OQS_AES128_ECB_load_schedule: 18| 147|void OQS_AES128_ECB_load_schedule(const uint8_t *key, void **schedule) { 19| 147| callbacks->AES128_ECB_load_schedule(key, schedule); 20| 147|} OQS_AES128_free_schedule: 34| 147|void OQS_AES128_free_schedule(void *schedule) { 35| 147| callbacks->AES128_free_schedule(schedule); 36| 147|} OQS_AES128_ECB_enc_sch: 62| 25.8k|void OQS_AES128_ECB_enc_sch(const uint8_t *plaintext, const size_t plaintext_len, const void *schedule, uint8_t *ciphertext) { 63| 25.8k| callbacks->AES128_ECB_enc_sch(plaintext, plaintext_len, schedule, ciphertext); 64| 25.8k|} oqs_aes128_load_schedule_ni: 51| 147|void oqs_aes128_load_schedule_ni(const uint8_t *key, void **_schedule) { 52| 147| *_schedule = OQS_MEM_malloc(sizeof(aes128ctx)); 53| 147| OQS_EXIT_IF_NULLPTR(*_schedule, "AES"); ------------------ | | 82| 147| do { \ | | 83| 147| if ((x) == (void *)0) { \ | | ------------------ | | | Branch (83:9): [True: 0, False: 147] | | ------------------ | | 84| 0| fprintf(stderr, "Unexpected NULL returned from %s API. Exiting.\n", \ | | 85| 0| loc); \ | | 86| 0| exit(EXIT_FAILURE); \ | | 87| 0| } \ | | 88| 147| } while (0) | | ------------------ | | | Branch (88:12): [Folded, False: 147] | | ------------------ ------------------ 54| 147| assert(*_schedule != NULL); 55| 147| __m128i *schedule = ((aes128ctx *) *_schedule)->sk_exp; 56| 147| aes128ni_setkey_encrypt(key, schedule); 57| 147|} oqs_aes128_free_schedule_ni: 77| 147|void oqs_aes128_free_schedule_ni(void *schedule) { 78| 147| if (schedule != NULL) { ------------------ | Branch (78:6): [True: 147, False: 0] ------------------ 79| 147| OQS_MEM_secure_free(schedule, sizeof(aes128ctx)); 80| 147| } 81| 147|} oqs_aes128_enc_sch_block_ni: 135| 21.4M|void oqs_aes128_enc_sch_block_ni(const uint8_t *plaintext, const void *_schedule, uint8_t *ciphertext) { 136| 21.4M| const __m128i *schedule = ((const aes128ctx *) _schedule)->sk_exp; 137| 21.4M| aes128ni_encrypt(schedule, _mm_loadu_si128((const __m128i *)plaintext), ciphertext); 138| 21.4M|} oqs_aes128_ecb_enc_sch_ni: 140| 25.8k|void oqs_aes128_ecb_enc_sch_ni(const uint8_t *plaintext, const size_t plaintext_len, const void *schedule, uint8_t *ciphertext) { 141| 25.8k| assert(plaintext_len % 16 == 0); 142| 21.4M| for (size_t block = 0; block < plaintext_len / 16; block++) { ------------------ | Branch (142:25): [True: 21.4M, False: 25.8k] ------------------ 143| 21.4M| oqs_aes128_enc_sch_block_ni(plaintext + (16 * block), schedule, ciphertext + (16 * block)); 144| 21.4M| } 145| 25.8k|} aes128_ni.c:aes128ni_setkey_encrypt: 20| 147|static inline void aes128ni_setkey_encrypt(const unsigned char *key, __m128i rkeys[11]) { 21| 147| __m128i key0 = _mm_loadu_si128((const __m128i *)(key + 0)); 22| 147| __m128i temp0, temp1, temp4; 23| 147| int idx = 0; 24| | 25| 147| temp0 = key0; 26| | 27| | /* blockshift-based block by Cedric Bourrasset */ 28| 147|#define BLOCK1(IMM) \ 29| 147| temp1 = _mm_aeskeygenassist_si128(temp0, IMM); \ 30| 147| rkeys[idx++] = temp0; \ 31| 147| temp4 = _mm_slli_si128(temp0,4); \ 32| 147| temp0 = _mm_xor_si128(temp0,temp4); \ 33| 147| temp4 = _mm_slli_si128(temp0,8); \ 34| 147| temp0 = _mm_xor_si128(temp0,temp4); \ 35| 147| temp1 = _mm_shuffle_epi32(temp1,0xff); \ 36| 147| temp0 = _mm_xor_si128(temp0,temp1) 37| | 38| 147| BLOCK1(0x01); ------------------ | | 29| 147| temp1 = _mm_aeskeygenassist_si128(temp0, IMM); \ | | 30| 147| rkeys[idx++] = temp0; \ | | 31| 147| temp4 = _mm_slli_si128(temp0,4); \ | | 32| 147| temp0 = _mm_xor_si128(temp0,temp4); \ | | 33| 147| temp4 = _mm_slli_si128(temp0,8); \ | | 34| 147| temp0 = _mm_xor_si128(temp0,temp4); \ | | 35| 147| temp1 = _mm_shuffle_epi32(temp1,0xff); \ | | 36| 147| temp0 = _mm_xor_si128(temp0,temp1) ------------------ 39| 147| BLOCK1(0x02); ------------------ | | 29| 147| temp1 = _mm_aeskeygenassist_si128(temp0, IMM); \ | | 30| 147| rkeys[idx++] = temp0; \ | | 31| 147| temp4 = _mm_slli_si128(temp0,4); \ | | 32| 147| temp0 = _mm_xor_si128(temp0,temp4); \ | | 33| 147| temp4 = _mm_slli_si128(temp0,8); \ | | 34| 147| temp0 = _mm_xor_si128(temp0,temp4); \ | | 35| 147| temp1 = _mm_shuffle_epi32(temp1,0xff); \ | | 36| 147| temp0 = _mm_xor_si128(temp0,temp1) ------------------ 40| 147| BLOCK1(0x04); ------------------ | | 29| 147| temp1 = _mm_aeskeygenassist_si128(temp0, IMM); \ | | 30| 147| rkeys[idx++] = temp0; \ | | 31| 147| temp4 = _mm_slli_si128(temp0,4); \ | | 32| 147| temp0 = _mm_xor_si128(temp0,temp4); \ | | 33| 147| temp4 = _mm_slli_si128(temp0,8); \ | | 34| 147| temp0 = _mm_xor_si128(temp0,temp4); \ | | 35| 147| temp1 = _mm_shuffle_epi32(temp1,0xff); \ | | 36| 147| temp0 = _mm_xor_si128(temp0,temp1) ------------------ 41| 147| BLOCK1(0x08); ------------------ | | 29| 147| temp1 = _mm_aeskeygenassist_si128(temp0, IMM); \ | | 30| 147| rkeys[idx++] = temp0; \ | | 31| 147| temp4 = _mm_slli_si128(temp0,4); \ | | 32| 147| temp0 = _mm_xor_si128(temp0,temp4); \ | | 33| 147| temp4 = _mm_slli_si128(temp0,8); \ | | 34| 147| temp0 = _mm_xor_si128(temp0,temp4); \ | | 35| 147| temp1 = _mm_shuffle_epi32(temp1,0xff); \ | | 36| 147| temp0 = _mm_xor_si128(temp0,temp1) ------------------ 42| 147| BLOCK1(0x10); ------------------ | | 29| 147| temp1 = _mm_aeskeygenassist_si128(temp0, IMM); \ | | 30| 147| rkeys[idx++] = temp0; \ | | 31| 147| temp4 = _mm_slli_si128(temp0,4); \ | | 32| 147| temp0 = _mm_xor_si128(temp0,temp4); \ | | 33| 147| temp4 = _mm_slli_si128(temp0,8); \ | | 34| 147| temp0 = _mm_xor_si128(temp0,temp4); \ | | 35| 147| temp1 = _mm_shuffle_epi32(temp1,0xff); \ | | 36| 147| temp0 = _mm_xor_si128(temp0,temp1) ------------------ 43| 147| BLOCK1(0x20); ------------------ | | 29| 147| temp1 = _mm_aeskeygenassist_si128(temp0, IMM); \ | | 30| 147| rkeys[idx++] = temp0; \ | | 31| 147| temp4 = _mm_slli_si128(temp0,4); \ | | 32| 147| temp0 = _mm_xor_si128(temp0,temp4); \ | | 33| 147| temp4 = _mm_slli_si128(temp0,8); \ | | 34| 147| temp0 = _mm_xor_si128(temp0,temp4); \ | | 35| 147| temp1 = _mm_shuffle_epi32(temp1,0xff); \ | | 36| 147| temp0 = _mm_xor_si128(temp0,temp1) ------------------ 44| 147| BLOCK1(0x40); ------------------ | | 29| 147| temp1 = _mm_aeskeygenassist_si128(temp0, IMM); \ | | 30| 147| rkeys[idx++] = temp0; \ | | 31| 147| temp4 = _mm_slli_si128(temp0,4); \ | | 32| 147| temp0 = _mm_xor_si128(temp0,temp4); \ | | 33| 147| temp4 = _mm_slli_si128(temp0,8); \ | | 34| 147| temp0 = _mm_xor_si128(temp0,temp4); \ | | 35| 147| temp1 = _mm_shuffle_epi32(temp1,0xff); \ | | 36| 147| temp0 = _mm_xor_si128(temp0,temp1) ------------------ 45| 147| BLOCK1(0x80); ------------------ | | 29| 147| temp1 = _mm_aeskeygenassist_si128(temp0, IMM); \ | | 30| 147| rkeys[idx++] = temp0; \ | | 31| 147| temp4 = _mm_slli_si128(temp0,4); \ | | 32| 147| temp0 = _mm_xor_si128(temp0,temp4); \ | | 33| 147| temp4 = _mm_slli_si128(temp0,8); \ | | 34| 147| temp0 = _mm_xor_si128(temp0,temp4); \ | | 35| 147| temp1 = _mm_shuffle_epi32(temp1,0xff); \ | | 36| 147| temp0 = _mm_xor_si128(temp0,temp1) ------------------ 46| 147| BLOCK1(0x1b); ------------------ | | 29| 147| temp1 = _mm_aeskeygenassist_si128(temp0, IMM); \ | | 30| 147| rkeys[idx++] = temp0; \ | | 31| 147| temp4 = _mm_slli_si128(temp0,4); \ | | 32| 147| temp0 = _mm_xor_si128(temp0,temp4); \ | | 33| 147| temp4 = _mm_slli_si128(temp0,8); \ | | 34| 147| temp0 = _mm_xor_si128(temp0,temp4); \ | | 35| 147| temp1 = _mm_shuffle_epi32(temp1,0xff); \ | | 36| 147| temp0 = _mm_xor_si128(temp0,temp1) ------------------ 47| | BLOCK1(0x36); ------------------ | | 29| 147| temp1 = _mm_aeskeygenassist_si128(temp0, IMM); \ | | 30| 147| rkeys[idx++] = temp0; \ | | 31| 147| temp4 = _mm_slli_si128(temp0,4); \ | | 32| 147| temp0 = _mm_xor_si128(temp0,temp4); \ | | 33| 147| temp4 = _mm_slli_si128(temp0,8); \ | | 34| 147| temp0 = _mm_xor_si128(temp0,temp4); \ | | 35| 147| temp1 = _mm_shuffle_epi32(temp1,0xff); \ | | 36| 147| temp0 = _mm_xor_si128(temp0,temp1) ------------------ 48| 147| rkeys[idx++] = temp0; 49| 147|} aes128_ni.c:aes128ni_encrypt: 84| 21.4M|static inline void aes128ni_encrypt(const __m128i rkeys[11], __m128i nv, unsigned char *out) { 85| 21.4M| __m128i temp = _mm_xor_si128(nv, rkeys[0]); 86| 21.4M| temp = _mm_aesenc_si128(temp, rkeys[1]); 87| 21.4M| temp = _mm_aesenc_si128(temp, rkeys[2]); 88| 21.4M| temp = _mm_aesenc_si128(temp, rkeys[3]); 89| 21.4M| temp = _mm_aesenc_si128(temp, rkeys[4]); 90| 21.4M| temp = _mm_aesenc_si128(temp, rkeys[5]); 91| 21.4M| temp = _mm_aesenc_si128(temp, rkeys[6]); 92| 21.4M| temp = _mm_aesenc_si128(temp, rkeys[7]); 93| 21.4M| temp = _mm_aesenc_si128(temp, rkeys[8]); 94| 21.4M| temp = _mm_aesenc_si128(temp, rkeys[9]); 95| 21.4M| temp = _mm_aesenclast_si128(temp, rkeys[10]); 96| 21.4M| _mm_storeu_si128((__m128i *)(out), temp); 97| 21.4M|} aes_impl.c:AES128_ECB_load_schedule: 41| 147|static void AES128_ECB_load_schedule(const uint8_t *key, void **_schedule) { 42| 147| C_OR_NI_OR_ARM( ------------------ | | 14| 147| do { \ | | 15| 147| if (OQS_CPU_has_extension(OQS_CPU_EXT_AES)) { \ | | ------------------ | | | Branch (15:11): [True: 147, False: 0] | | ------------------ | | 16| 147| stmt_ni; \ | | 17| 147| } else { \ | | 18| 0| stmt_c; \ | | 19| 0| } \ | | 20| 147| } while(0) | | ------------------ | | | Branch (20:12): [Folded, False: 147] | | ------------------ ------------------ 43| 147| oqs_aes128_load_schedule_c(key, _schedule), 44| 147| oqs_aes128_load_schedule_ni(key, _schedule), 45| 147| oqs_aes128_load_schedule_no_bitslice(key, _schedule) 46| 147| ); 47| 147|} aes_impl.c:AES128_free_schedule: 69| 147|static void AES128_free_schedule(void *schedule) { 70| 147| C_OR_NI_OR_ARM( ------------------ | | 14| 147| do { \ | | 15| 147| if (OQS_CPU_has_extension(OQS_CPU_EXT_AES)) { \ | | ------------------ | | | Branch (15:11): [True: 147, False: 0] | | ------------------ | | 16| 147| stmt_ni; \ | | 17| 147| } else { \ | | 18| 0| stmt_c; \ | | 19| 0| } \ | | 20| 147| } while(0) | | ------------------ | | | Branch (20:12): [Folded, False: 147] | | ------------------ ------------------ 71| 147| oqs_aes128_free_schedule_c(schedule), 72| 147| oqs_aes128_free_schedule_ni(schedule), 73| 147| oqs_aes128_free_schedule_no_bitslice(schedule) 74| 147| ); 75| 147|} aes_impl.c:AES128_ECB_enc_sch: 122| 25.8k|static void AES128_ECB_enc_sch(const uint8_t *plaintext, const size_t plaintext_len, const void *schedule, uint8_t *ciphertext) { 123| 25.8k| C_OR_NI_OR_ARM( ------------------ | | 14| 25.8k| do { \ | | 15| 25.8k| if (OQS_CPU_has_extension(OQS_CPU_EXT_AES)) { \ | | ------------------ | | | Branch (15:11): [True: 25.8k, False: 0] | | ------------------ | | 16| 25.8k| stmt_ni; \ | | 17| 25.8k| } else { \ | | 18| 0| stmt_c; \ | | 19| 0| } \ | | 20| 25.8k| } while(0) | | ------------------ | | | Branch (20:12): [Folded, False: 25.8k] | | ------------------ ------------------ 124| 25.8k| oqs_aes128_ecb_enc_sch_c(plaintext, plaintext_len, schedule, ciphertext), 125| 25.8k| oqs_aes128_ecb_enc_sch_ni(plaintext, plaintext_len, schedule, ciphertext), 126| 25.8k| oqs_aes128_ecb_enc_sch_armv8(plaintext, plaintext_len, schedule, ciphertext) 127| 25.8k| ); 128| 25.8k|} OQS_CPU_has_extension: 219| 40.7k|OQS_API int OQS_CPU_has_extension(OQS_CPU_EXT ext) { 220| 40.7k|#if defined(OQS_DIST_BUILD) 221| 40.7k|#if defined(OQS_USE_PTHREADS) 222| 40.7k| pthread_once(&once_control, &set_available_cpu_extensions); 223| |#else 224| | if (0 == cpu_ext_data[OQS_CPU_EXT_INIT]) { 225| | set_available_cpu_extensions(); 226| | } 227| |#endif 228| 40.7k| if (0 < ext && ext < OQS_CPU_EXT_COUNT) { ------------------ | Branch (228:6): [True: 38.8k, False: 1.87k] | Branch (228:17): [True: 38.8k, False: 0] ------------------ 229| 38.8k| return (int)cpu_ext_data[ext]; 230| 38.8k| } 231| |#else 232| | (void)ext; 233| |#endif 234| 1.87k| return 0; 235| 40.7k|} OQS_init: 237| 1.87k|OQS_API void OQS_init(void) { 238| 1.87k|#if defined(OQS_DIST_BUILD) 239| 1.87k| OQS_CPU_has_extension(OQS_CPU_EXT_INIT); 240| 1.87k|#endif 241| 1.87k|} OQS_destroy: 253| 1.87k|OQS_API void OQS_destroy(void) { 254| 1.87k|#if defined(OQS_USE_OPENSSL) 255| 1.87k| oqs_ossl_destroy(); 256| 1.87k|#endif 257| 1.87k|} OQS_MEM_cleanse: 271| 65.1k|OQS_API void OQS_MEM_cleanse(void *ptr, size_t len) { 272| 65.1k| if (ptr == NULL) { ------------------ | Branch (272:6): [True: 0, False: 65.1k] ------------------ 273| 0| return; 274| 0| } 275| 65.1k|#if defined(OQS_USE_OPENSSL) 276| 65.1k| OSSL_FUNC(OPENSSL_cleanse)(ptr, len); ------------------ | | 66| 65.1k|#define OSSL_FUNC(name) name ------------------ 277| |#elif defined(_WIN32) 278| | SecureZeroMemory(ptr, len); 279| |#elif defined(OQS_HAVE_EXPLICIT_BZERO) 280| | explicit_bzero(ptr, len); 281| |#elif defined(OQS_HAVE_EXPLICIT_MEMSET) 282| | explicit_memset(ptr, 0, len); 283| |#elif defined(__STDC_LIB_EXT1__) || defined(OQS_HAVE_MEMSET_S) 284| | if (0U < len && memset_s(ptr, (rsize_t)len, 0, (rsize_t)len) != 0) { 285| | abort(); 286| | } 287| |#else 288| | typedef void *(*memset_t)(void *, int, size_t); 289| | static volatile memset_t memset_func = memset; 290| | memset_func(ptr, 0, len); 291| |#endif 292| 65.1k|} OQS_MEM_secure_free: 294| 5.78k|OQS_API void OQS_MEM_secure_free(void *ptr, size_t len) { 295| 5.78k| if (ptr != NULL) { ------------------ | Branch (295:6): [True: 5.78k, False: 0] ------------------ 296| 5.78k| OQS_MEM_cleanse(ptr, len); 297| 5.78k| OQS_MEM_insecure_free(ptr); 298| 5.78k| } 299| 5.78k|} OQS_MEM_insecure_free: 301| 11.4k|OQS_API void OQS_MEM_insecure_free(void *ptr) { 302| 11.4k|#if defined(OQS_USE_OPENSSL) && defined(OPENSSL_VERSION_NUMBER) 303| 11.4k| OSSL_FUNC(CRYPTO_free)(ptr, OPENSSL_FILE, OPENSSL_LINE); ------------------ | | 66| 11.4k|#define OSSL_FUNC(name) name ------------------ 304| |#else 305| | free(ptr); // IGNORE memory-check 306| |#endif 307| 11.4k|} OQS_MEM_aligned_alloc: 309| 52.0k|void *OQS_MEM_aligned_alloc(size_t alignment, size_t size) { 310| 52.0k|#if defined(OQS_USE_OPENSSL) 311| | // Use OpenSSL's memory allocation functions 312| 52.0k| if (!size) { ------------------ | Branch (312:6): [True: 0, False: 52.0k] ------------------ 313| 0| return NULL; 314| 0| } 315| | // Check alignment (power of 2, and >= sizeof(void*)) and size (multiple of alignment) 316| 52.0k| if (alignment & (alignment - 1) || size & (alignment - 1) || alignment < sizeof(void *)) { ------------------ | Branch (316:6): [True: 0, False: 52.0k] | Branch (316:37): [True: 0, False: 52.0k] | Branch (316:63): [True: 0, False: 52.0k] ------------------ 317| 0| errno = EINVAL; 318| 0| return NULL; 319| 0| } 320| 52.0k| const size_t offset = alignment - 1 + sizeof(uint8_t); 321| 52.0k| if (offset > SIZE_MAX - size) { ------------------ | Branch (321:6): [True: 0, False: 52.0k] ------------------ 322| 0| return NULL; 323| 0| } 324| 52.0k| uint8_t *buffer = OSSL_FUNC(CRYPTO_malloc)(size + offset, OPENSSL_FILE, OPENSSL_LINE); ------------------ | | 66| 52.0k|#define OSSL_FUNC(name) name ------------------ 325| 52.0k| if (!buffer) { ------------------ | Branch (325:6): [True: 0, False: 52.0k] ------------------ 326| 0| return NULL; 327| 0| } 328| 52.0k| uint8_t *ptr = (uint8_t *)(((uintptr_t)(buffer) + offset) & ~(alignment - 1)); 329| 52.0k| ptrdiff_t diff = ptr - buffer; 330| 52.0k| if (diff > UINT8_MAX) { ------------------ | Branch (330:6): [True: 0, False: 52.0k] ------------------ 331| | // Free and return NULL if alignment is too large 332| 0| OSSL_FUNC(CRYPTO_free)(buffer, OPENSSL_FILE, OPENSSL_LINE); ------------------ | | 66| 0|#define OSSL_FUNC(name) name ------------------ 333| 0| errno = EINVAL; 334| 0| return NULL; 335| 0| } 336| | // Store the difference so that the free function can use it 337| 52.0k| ptr[-1] = (uint8_t)diff; 338| 52.0k| return ptr; 339| |#elif defined(OQS_HAVE_ALIGNED_ALLOC) // glibc and other implementations providing aligned_alloc 340| | return aligned_alloc(alignment, size); 341| |#else 342| | // Check alignment (power of 2, and >= sizeof(void*)) and size (multiple of alignment) 343| | if (alignment & (alignment - 1) || size & (alignment - 1) || alignment < sizeof(void *)) { 344| | errno = EINVAL; 345| | return NULL; 346| | } 347| | 348| |#if defined(OQS_HAVE_POSIX_MEMALIGN) 349| | void *ptr = NULL; 350| | const int err = posix_memalign(&ptr, alignment, size); 351| | if (err) { 352| | errno = err; 353| | ptr = NULL; 354| | } 355| | return ptr; 356| |#elif defined(OQS_HAVE_MEMALIGN) 357| | return memalign(alignment, size); 358| |#elif defined(__MINGW32__) || defined(__MINGW64__) 359| | return __mingw_aligned_malloc(size, alignment); 360| |#elif defined(_MSC_VER) 361| | return _aligned_malloc(size, alignment); 362| |#else 363| | if (!size) { 364| | return NULL; 365| | } 366| | // Overallocate to be able to align the pointer (alignment -1) and to store 367| | // the difference between the pointer returned to the user (ptr) and the 368| | // pointer returned by malloc (buffer). The difference is caped to 255 and 369| | // can be made larger if necessary, but this should be enough for all users 370| | // in liboqs. 371| | // 372| | // buffer ptr 373| | // ↓ ↓ 374| | // ...........|................... 375| | // | 376| | // diff = ptr - buffer 377| | const size_t offset = alignment - 1 + sizeof(uint8_t); 378| | if (offset > SIZE_MAX - size) { 379| | return NULL; 380| | } 381| | uint8_t *buffer = malloc(size + offset); // IGNORE memory-check 382| | if (!buffer) { 383| | return NULL; 384| | } 385| | 386| | // Align the pointer returned to the user. 387| | uint8_t *ptr = (uint8_t *)(((uintptr_t)(buffer) + offset) & ~(alignment - 1)); 388| | ptrdiff_t diff = ptr - buffer; 389| | if (diff > UINT8_MAX) { 390| | // This should never happen in our code, but just to be safe 391| | free(buffer); // IGNORE memory-check 392| | errno = EINVAL; 393| | return NULL; 394| | } 395| | // Store the difference one byte ahead the returned poitner so that free 396| | // can reconstruct buffer. 397| | ptr[-1] = diff; 398| | return ptr; 399| |#endif 400| |#endif 401| 52.0k|} OQS_MEM_aligned_free: 403| 52.0k|void OQS_MEM_aligned_free(void *ptr) { 404| 52.0k| if (ptr == NULL) { ------------------ | Branch (404:6): [True: 0, False: 52.0k] ------------------ 405| 0| return; 406| 0| } 407| 52.0k|#if defined(OQS_USE_OPENSSL) 408| | // Use OpenSSL's free function 409| 52.0k| uint8_t *u8ptr = ptr; 410| 52.0k| OSSL_FUNC(CRYPTO_free)(u8ptr - u8ptr[-1], OPENSSL_FILE, OPENSSL_LINE); ------------------ | | 66| 52.0k|#define OSSL_FUNC(name) name ------------------ 411| |#elif defined(OQS_HAVE_ALIGNED_ALLOC) || defined(OQS_HAVE_POSIX_MEMALIGN) || defined(OQS_HAVE_MEMALIGN) 412| | free(ptr); // IGNORE memory-check 413| |#elif defined(__MINGW32__) || defined(__MINGW64__) 414| | __mingw_aligned_free(ptr); 415| |#elif defined(_MSC_VER) 416| | _aligned_free(ptr); 417| |#else 418| | // Reconstruct the pointer returned from malloc using the difference 419| | // stored one byte ahead of ptr. 420| | uint8_t *u8ptr = ptr; 421| | free(u8ptr - u8ptr[-1]); // IGNORE memory-check 422| |#endif 423| 52.0k|} OQS_MEM_aligned_secure_free: 425| 52.0k|void OQS_MEM_aligned_secure_free(void *ptr, size_t len) { 426| 52.0k| OQS_MEM_cleanse(ptr, len); 427| 52.0k| OQS_MEM_aligned_free(ptr); 428| 52.0k|} OQS_MEM_malloc: 430| 9.54k|OQS_API void *OQS_MEM_malloc(size_t size) { 431| 9.54k|#if defined(OQS_USE_OPENSSL) 432| 9.54k| return OSSL_FUNC(CRYPTO_malloc)(size, OPENSSL_FILE, OPENSSL_LINE); ------------------ | | 66| 9.54k|#define OSSL_FUNC(name) name ------------------ 433| |#else 434| | return malloc(size); // IGNORE memory-check 435| |#endif 436| 9.54k|} OQS_MEM_calloc: 438| 1.87k|OQS_API void *OQS_MEM_calloc(size_t num_elements, size_t element_size) { 439| 1.87k|#if defined(OQS_USE_OPENSSL) 440| 1.87k| if (element_size != 0 && num_elements > SIZE_MAX / element_size) { ------------------ | Branch (440:6): [True: 1.87k, False: 0] | Branch (440:27): [True: 0, False: 1.87k] ------------------ 441| 0| return NULL; 442| 0| } 443| 1.87k| return OSSL_FUNC(CRYPTO_zalloc)(num_elements * element_size, ------------------ | | 66| 1.87k|#define OSSL_FUNC(name) name ------------------ 444| 1.87k| OPENSSL_FILE, OPENSSL_LINE); 445| |#else 446| | return calloc(num_elements, element_size); // IGNORE memory-check 447| |#endif 448| 1.87k|} common.c:set_available_cpu_extensions: 47| 1|static void set_available_cpu_extensions(void) { 48| | /* mark that this function has been called */ 49| 1| cpu_ext_data[OQS_CPU_EXT_INIT] = 1; 50| | 51| 1| cpuid_out leaf_1; 52| 1| cpuid(&leaf_1, 1); 53| 1| if (leaf_1.eax == 0) { ------------------ | Branch (53:6): [True: 0, False: 1] ------------------ 54| 0| return; 55| 0| } 56| | 57| 1| cpuid_out leaf_7; 58| 1| cpuid(&leaf_7, 7); 59| | 60| 1| const unsigned int has_xsave = is_bit_set(leaf_1.ecx, 26); 61| 1| const unsigned int has_osxsave = is_bit_set(leaf_1.ecx, 27); 62| 1| const uint32_t xcr0_eax = (has_xsave && has_osxsave) ? xgetbv_eax(0) : 0; ------------------ | Branch (62:29): [True: 1, False: 0] | Branch (62:42): [True: 1, False: 0] ------------------ 63| | 64| 1| cpu_ext_data[OQS_CPU_EXT_AES] = is_bit_set(leaf_1.ecx, 25); 65| 1| if (has_mask(xcr0_eax, MASK_XMM | MASK_YMM)) { ------------------ | | 14| 1|#define MASK_XMM 0x2 ------------------ if (has_mask(xcr0_eax, MASK_XMM | MASK_YMM)) { ------------------ | | 15| 1|#define MASK_YMM 0x4 ------------------ | Branch (65:6): [True: 1, False: 0] ------------------ 66| 1| cpu_ext_data[OQS_CPU_EXT_AVX] = is_bit_set(leaf_1.ecx, 28); 67| 1| cpu_ext_data[OQS_CPU_EXT_AVX2] = is_bit_set(leaf_7.ebx, 5); 68| 1| } 69| 1| cpu_ext_data[OQS_CPU_EXT_PCLMULQDQ] = is_bit_set(leaf_1.ecx, 1); 70| 1| cpu_ext_data[OQS_CPU_EXT_POPCNT] = is_bit_set(leaf_1.ecx, 23); 71| 1| cpu_ext_data[OQS_CPU_EXT_BMI1] = is_bit_set(leaf_7.ebx, 3); 72| 1| cpu_ext_data[OQS_CPU_EXT_BMI2] = is_bit_set(leaf_7.ebx, 8); 73| 1| cpu_ext_data[OQS_CPU_EXT_ADX] = is_bit_set(leaf_7.ebx, 19); 74| | 75| 1| if (has_mask(xcr0_eax, MASK_XMM)) { ------------------ | | 14| 1|#define MASK_XMM 0x2 ------------------ | Branch (75:6): [True: 1, False: 0] ------------------ 76| 1| cpu_ext_data[OQS_CPU_EXT_SSE] = is_bit_set(leaf_1.edx, 25); 77| 1| cpu_ext_data[OQS_CPU_EXT_SSE2] = is_bit_set(leaf_1.edx, 26); 78| 1| cpu_ext_data[OQS_CPU_EXT_SSE3] = is_bit_set(leaf_1.ecx, 0); 79| 1| } 80| | 81| 1| if (has_mask(xcr0_eax, MASK_XMM | MASK_YMM | MASK_MASKREG | MASK_ZMM0_15 | MASK_ZMM16_31)) { ------------------ | | 14| 1|#define MASK_XMM 0x2 ------------------ if (has_mask(xcr0_eax, MASK_XMM | MASK_YMM | MASK_MASKREG | MASK_ZMM0_15 | MASK_ZMM16_31)) { ------------------ | | 15| 1|#define MASK_YMM 0x4 ------------------ if (has_mask(xcr0_eax, MASK_XMM | MASK_YMM | MASK_MASKREG | MASK_ZMM0_15 | MASK_ZMM16_31)) { ------------------ | | 16| 1|#define MASK_MASKREG 0x20 ------------------ if (has_mask(xcr0_eax, MASK_XMM | MASK_YMM | MASK_MASKREG | MASK_ZMM0_15 | MASK_ZMM16_31)) { ------------------ | | 17| 1|#define MASK_ZMM0_15 0x40 ------------------ if (has_mask(xcr0_eax, MASK_XMM | MASK_YMM | MASK_MASKREG | MASK_ZMM0_15 | MASK_ZMM16_31)) { ------------------ | | 18| 1|#define MASK_ZMM16_31 0x80 ------------------ | Branch (81:6): [True: 0, False: 1] ------------------ 82| 0| unsigned int avx512f = is_bit_set(leaf_7.ebx, 16); 83| 0| unsigned int avx512bw = is_bit_set(leaf_7.ebx, 30); 84| 0| unsigned int avx512dq = is_bit_set(leaf_7.ebx, 17); 85| 0| if (avx512f && avx512bw && avx512dq) { ------------------ | Branch (85:7): [True: 0, False: 0] | Branch (85:18): [True: 0, False: 0] | Branch (85:30): [True: 0, False: 0] ------------------ 86| 0| cpu_ext_data[OQS_CPU_EXT_AVX512] = 1; 87| 0| } 88| 0| cpu_ext_data[OQS_CPU_EXT_VPCLMULQDQ] = is_bit_set(leaf_7.ecx, 10); 89| 0| } 90| 1|} oqs_ossl_destroy: 89| 1.87k|void oqs_ossl_destroy(void) { 90| 1.87k|#if OPENSSL_VERSION_NUMBER >= 0x30000000L 91| 1.87k|#if defined(OQS_USE_PTHREADS) 92| 1.87k| pthread_once(&free_once_control, free_ossl_objects); 93| |#else 94| | if (sha256_ptr || sha384_ptr || sha512_ptr || sha3_256_ptr || 95| | sha3_384_ptr || sha3_512_ptr || shake128_ptr || shake256_ptr || 96| | aes128_ecb_ptr || aes128_ctr_ptr || aes256_ecb_ptr || aes256_ctr_ptr) { 97| | free_ossl_objects(); 98| | } 99| |#endif 100| 1.87k|#endif 101| 1.87k|} oqs_sha512: 182| 100|const EVP_MD *oqs_sha512(void) { 183| 100|#if OPENSSL_VERSION_NUMBER >= 0x30000000L 184| 100|#if defined(OQS_USE_PTHREADS) 185| 100| if (pthread_once(&init_once_control, fetch_ossl_objects)) { ------------------ | Branch (185:6): [True: 0, False: 100] ------------------ 186| 0| return NULL; 187| 0| } 188| |#else 189| | if (!sha512_ptr) { 190| | fetch_ossl_objects(); 191| | } 192| |#endif 193| 100| return sha512_ptr; 194| |#else 195| | return OSSL_FUNC(EVP_sha512)(); 196| |#endif 197| 100|} ossl_helpers.c:free_ossl_objects: 73| 1|static void free_ossl_objects(void) { 74| 1| cleanup_evp_md(&sha256_ptr); 75| 1| cleanup_evp_md(&sha384_ptr); 76| 1| cleanup_evp_md(&sha512_ptr); 77| 1| cleanup_evp_md(&sha3_256_ptr); 78| 1| cleanup_evp_md(&sha3_384_ptr); 79| 1| cleanup_evp_md(&sha3_512_ptr); 80| 1| cleanup_evp_md(&shake128_ptr); 81| 1| cleanup_evp_md(&shake256_ptr); 82| 1| cleanup_evp_cipher(&aes128_ecb_ptr); 83| 1| cleanup_evp_cipher(&aes128_ctr_ptr); 84| 1| cleanup_evp_cipher(&aes256_ecb_ptr); 85| 1| cleanup_evp_cipher(&aes256_ctr_ptr); 86| 1|} ossl_helpers.c:cleanup_evp_md: 51| 8|static inline void cleanup_evp_md(EVP_MD **mdp) { 52| | /* Always check argument is non-NULL before calling EVP_MD_free 53| | * to avoid OpenSSL functions being used when they are 54| | * overridden with OQS_*_set_callbacks. 55| | */ 56| 8| if (*mdp) { ------------------ | Branch (56:6): [True: 0, False: 8] ------------------ 57| 0| OSSL_FUNC(EVP_MD_free)(*mdp); ------------------ | | 66| 0|#define OSSL_FUNC(name) name ------------------ 58| | *mdp = NULL; 59| 0| } 60| 8|} ossl_helpers.c:cleanup_evp_cipher: 62| 4|static inline void cleanup_evp_cipher(EVP_CIPHER **cipherp) { 63| | /* Always check argument is non-NULL before calling EVP_CIPHER_free 64| | * to avoid OpenSSL functions being used when they are 65| | * overridden with OQS_*_set_callbacks. 66| | */ 67| 4| if (*cipherp) { ------------------ | Branch (67:6): [True: 0, False: 4] ------------------ 68| 0| OSSL_FUNC(EVP_CIPHER_free)(*cipherp); ------------------ | | 66| 0|#define OSSL_FUNC(name) name ------------------ 69| | *cipherp = NULL; 70| 0| } 71| 4|} ossl_helpers.c:fetch_ossl_objects: 28| 1|static void fetch_ossl_objects(void) { 29| 1| sha256_ptr = OSSL_FUNC(EVP_MD_fetch)(NULL, "SHA256", NULL); ------------------ | | 66| 1|#define OSSL_FUNC(name) name ------------------ 30| 1| sha384_ptr = OSSL_FUNC(EVP_MD_fetch)(NULL, "SHA384", NULL); ------------------ | | 66| 1|#define OSSL_FUNC(name) name ------------------ 31| 1| sha512_ptr = OSSL_FUNC(EVP_MD_fetch)(NULL, "SHA512", NULL); ------------------ | | 66| 1|#define OSSL_FUNC(name) name ------------------ 32| | 33| 1| sha3_256_ptr = OSSL_FUNC(EVP_MD_fetch)(NULL, "SHA3-256", NULL); ------------------ | | 66| 1|#define OSSL_FUNC(name) name ------------------ 34| 1| sha3_384_ptr = OSSL_FUNC(EVP_MD_fetch)(NULL, "SHA3-384", NULL); ------------------ | | 66| 1|#define OSSL_FUNC(name) name ------------------ 35| 1| sha3_512_ptr = OSSL_FUNC(EVP_MD_fetch)(NULL, "SHA3-512", NULL); ------------------ | | 66| 1|#define OSSL_FUNC(name) name ------------------ 36| 1| shake128_ptr = OSSL_FUNC(EVP_MD_fetch)(NULL, "SHAKE128", NULL); ------------------ | | 66| 1|#define OSSL_FUNC(name) name ------------------ 37| 1| shake256_ptr = OSSL_FUNC(EVP_MD_fetch)(NULL, "SHAKE256", NULL); ------------------ | | 66| 1|#define OSSL_FUNC(name) name ------------------ 38| | 39| 1| aes128_ecb_ptr = OSSL_FUNC(EVP_CIPHER_fetch)(NULL, "AES-128-ECB", NULL); ------------------ | | 66| 1|#define OSSL_FUNC(name) name ------------------ 40| 1| aes128_ctr_ptr = OSSL_FUNC(EVP_CIPHER_fetch)(NULL, "AES-128-CTR", NULL); ------------------ | | 66| 1|#define OSSL_FUNC(name) name ------------------ 41| 1| aes256_ecb_ptr = OSSL_FUNC(EVP_CIPHER_fetch)(NULL, "AES-256-ECB", NULL); ------------------ | | 66| 1|#define OSSL_FUNC(name) name ------------------ 42| 1| aes256_ctr_ptr = OSSL_FUNC(EVP_CIPHER_fetch)(NULL, "AES-256-CTR", NULL); ------------------ | | 66| 1|#define OSSL_FUNC(name) name ------------------ 43| | 44| 1| if (!sha256_ptr || !sha384_ptr || !sha512_ptr || !sha3_256_ptr || ------------------ | Branch (44:6): [True: 0, False: 1] | Branch (44:21): [True: 0, False: 1] | Branch (44:36): [True: 0, False: 1] | Branch (44:51): [True: 0, False: 1] ------------------ 45| 1| !sha3_384_ptr || !sha3_512_ptr || !shake128_ptr || !shake256_ptr || ------------------ | Branch (45:10): [True: 0, False: 1] | Branch (45:27): [True: 0, False: 1] | Branch (45:44): [True: 0, False: 1] | Branch (45:61): [True: 0, False: 1] ------------------ 46| 1| !aes128_ecb_ptr || !aes128_ctr_ptr || !aes256_ecb_ptr || !aes256_ctr_ptr) { ------------------ | Branch (46:10): [True: 0, False: 1] | Branch (46:29): [True: 0, False: 1] | Branch (46:48): [True: 0, False: 1] | Branch (46:67): [True: 0, False: 1] ------------------ 47| | fprintf(stderr, "liboqs warning: OpenSSL initialization failure. Is provider for SHA, SHAKE, AES enabled?\n"); 48| 0| } 49| 1|} OQS_SHA3_shake128_absorb_once: 5| 486|void shake128_absorb_once(shake128incctx *state, const uint8_t *in, size_t inlen) { 6| 486| shake128_inc_ctx_reset(state); ------------------ | | 45| 486|#define shake128_inc_ctx_reset OQS_SHA3_shake128_inc_ctx_reset ------------------ 7| 486| shake128_inc_absorb(state, in, inlen); ------------------ | | 40| 486|#define shake128_inc_absorb OQS_SHA3_shake128_inc_absorb ------------------ 8| 486| shake128_inc_finalize(state); ------------------ | | 41| 486|#define shake128_inc_finalize OQS_SHA3_shake128_inc_finalize ------------------ 9| 486|} OQS_SHA3_shake128_x4_absorb_once: 5| 2.57k|void shake128x4_absorb_once(shake128x4incctx *state, const uint8_t *in0, const uint8_t *in1, const uint8_t *in2, const uint8_t *in3, size_t inlen) { 6| 2.57k| shake128x4_inc_ctx_reset(state); ------------------ | | 25| 2.57k|#define shake128x4_inc_ctx_reset OQS_SHA3_shake128_x4_inc_ctx_reset ------------------ 7| 2.57k| shake128x4_inc_absorb(state, in0, in1, in2, in3, inlen); ------------------ | | 20| 2.57k|#define shake128x4_inc_absorb OQS_SHA3_shake128_x4_inc_absorb ------------------ 8| 2.57k| shake128x4_inc_finalize(state); ------------------ | | 21| 2.57k|#define shake128x4_inc_finalize OQS_SHA3_shake128_x4_inc_finalize ------------------ 9| 2.57k|} OQS_SHA3_shake256_x4_absorb_once: 11| 1.46k|void shake256x4_absorb_once(shake256x4incctx *state, const uint8_t *in0, const uint8_t *in1, const uint8_t *in2, const uint8_t *in3, size_t inlen) { 12| 1.46k| shake256x4_inc_ctx_reset(state); ------------------ | | 34| 1.46k|#define shake256x4_inc_ctx_reset OQS_SHA3_shake256_x4_inc_ctx_reset ------------------ 13| 1.46k| shake256x4_inc_absorb(state, in0, in1, in2, in3, inlen); ------------------ | | 29| 1.46k|#define shake256x4_inc_absorb OQS_SHA3_shake256_x4_inc_absorb ------------------ 14| 1.46k| shake256x4_inc_finalize(state); ------------------ | | 30| 1.46k|#define shake256x4_inc_finalize OQS_SHA3_shake256_x4_inc_finalize ------------------ 15| 1.46k|} OQS_randombytes_custom_algorithm: 58| 1.87k|OQS_API void OQS_randombytes_custom_algorithm(void (*algorithm_ptr)(uint8_t *, size_t)) { 59| 1.87k| oqs_randombytes_algorithm = algorithm_ptr; 60| 1.87k|} OQS_randombytes: 62| 8.44k|OQS_API void OQS_randombytes(uint8_t *random_array, size_t bytes_to_read) { 63| 8.44k| oqs_randombytes_algorithm(random_array, bytes_to_read); 64| 8.44k|} OQS_SHA2_sha512: 85| 100|void OQS_SHA2_sha512(uint8_t *out, const uint8_t *in, size_t inlen) { 86| 100| callbacks->SHA2_sha512(out, in, inlen); 87| 100|} sha2_ossl.c:do_hash: 16| 100|static void do_hash(uint8_t *output, const uint8_t *input, size_t inplen, const EVP_MD *md) { 17| 100| EVP_MD_CTX *mdctx; 18| 100| unsigned int outlen; 19| 100| mdctx = OSSL_FUNC(EVP_MD_CTX_new)(); ------------------ | | 66| 100|#define OSSL_FUNC(name) name ------------------ 20| 100| OQS_EXIT_IF_NULLPTR(mdctx, "OpenSSL"); ------------------ | | 82| 100| do { \ | | 83| 100| if ((x) == (void *)0) { \ | | ------------------ | | | Branch (83:9): [True: 0, False: 100] | | ------------------ | | 84| 0| fprintf(stderr, "Unexpected NULL returned from %s API. Exiting.\n", \ | | 85| 0| loc); \ | | 86| 0| exit(EXIT_FAILURE); \ | | 87| 0| } \ | | 88| 100| } while (0) | | ------------------ | | | Branch (88:12): [Folded, False: 100] | | ------------------ ------------------ 21| 100| OQS_OPENSSL_GUARD(OSSL_FUNC(EVP_DigestInit_ex)(mdctx, md, NULL)); ------------------ | | 113| 100| do { \ | | 114| 100| if (1 != (x)) { \ | | ------------------ | | | Branch (114:9): [True: 0, False: 100] | | ------------------ | | 115| 0| fprintf(stderr, "Error return value from OpenSSL API: %d. Exiting.\n", \ | | 116| 0| x); \ | | 117| 0| OSSL_FUNC(ERR_print_errors_fp)(stderr); \ | | ------------------ | | | | 66| 0|#define OSSL_FUNC(name) name | | ------------------ | | 118| 0| exit(EXIT_FAILURE); \ | | 119| 0| } \ | | 120| 100| } while (0) | | ------------------ | | | Branch (120:12): [Folded, False: 100] | | ------------------ ------------------ 22| 100| OQS_OPENSSL_GUARD(OSSL_FUNC(EVP_DigestUpdate)(mdctx, input, inplen)); ------------------ | | 113| 100| do { \ | | 114| 100| if (1 != (x)) { \ | | ------------------ | | | Branch (114:9): [True: 0, False: 100] | | ------------------ | | 115| 0| fprintf(stderr, "Error return value from OpenSSL API: %d. Exiting.\n", \ | | 116| 0| x); \ | | 117| 0| OSSL_FUNC(ERR_print_errors_fp)(stderr); \ | | ------------------ | | | | 66| 0|#define OSSL_FUNC(name) name | | ------------------ | | 118| 0| exit(EXIT_FAILURE); \ | | 119| 0| } \ | | 120| 100| } while (0) | | ------------------ | | | Branch (120:12): [Folded, False: 100] | | ------------------ ------------------ 23| 100| OQS_OPENSSL_GUARD(OSSL_FUNC(EVP_DigestFinal_ex)(mdctx, output, &outlen)); ------------------ | | 113| 100| do { \ | | 114| 100| if (1 != (x)) { \ | | ------------------ | | | Branch (114:9): [True: 0, False: 100] | | ------------------ | | 115| 0| fprintf(stderr, "Error return value from OpenSSL API: %d. Exiting.\n", \ | | 116| 0| x); \ | | 117| 0| OSSL_FUNC(ERR_print_errors_fp)(stderr); \ | | ------------------ | | | | 66| 0|#define OSSL_FUNC(name) name | | ------------------ | | 118| 0| exit(EXIT_FAILURE); \ | | 119| 0| } \ | | 120| 100| } while (0) | | ------------------ | | | Branch (120:12): [Folded, False: 100] | | ------------------ ------------------ 24| 100| OSSL_FUNC(EVP_MD_CTX_free)(mdctx); ------------------ | | 66| 100|#define OSSL_FUNC(name) name ------------------ 25| 100|} sha2_ossl.c:SHA2_sha512: 41| 100|static void SHA2_sha512(uint8_t *output, const uint8_t *input, size_t inplen) { 42| 100| const EVP_MD *md; 43| 100| md = oqs_sha512(); 44| 100| OQS_EXIT_IF_NULLPTR(md, "OpenSSL"); ------------------ | | 82| 100| do { \ | | 83| 100| if ((x) == (void *)0) { \ | | ------------------ | | | Branch (83:9): [True: 0, False: 100] | | ------------------ | | 84| 0| fprintf(stderr, "Unexpected NULL returned from %s API. Exiting.\n", \ | | 85| 0| loc); \ | | 86| 0| exit(EXIT_FAILURE); \ | | 87| 0| } \ | | 88| 100| } while (0) | | ------------------ | | | Branch (88:12): [Folded, False: 100] | | ------------------ ------------------ 45| 100| do_hash(output, input, inplen, md); 46| 100|} OQS_SHA3_sha3_256: 15| 2.64k|void OQS_SHA3_sha3_256(uint8_t *output, const uint8_t *input, size_t inplen) { 16| 2.64k| callbacks->SHA3_sha3_256(output, input, inplen); 17| 2.64k|} OQS_SHA3_sha3_256_inc_init: 19| 3.00k|void OQS_SHA3_sha3_256_inc_init(OQS_SHA3_sha3_256_inc_ctx *state) { 20| 3.00k| callbacks->SHA3_sha3_256_inc_init(state); 21| 3.00k|} OQS_SHA3_sha3_256_inc_absorb: 23| 3.86k|void OQS_SHA3_sha3_256_inc_absorb(OQS_SHA3_sha3_256_inc_ctx *state, const uint8_t *input, size_t inlen) { 24| 3.86k| callbacks->SHA3_sha3_256_inc_absorb(state, input, inlen); 25| 3.86k|} OQS_SHA3_sha3_256_inc_finalize: 27| 3.00k|void OQS_SHA3_sha3_256_inc_finalize(uint8_t *output, OQS_SHA3_sha3_256_inc_ctx *state) { 28| 3.00k| callbacks->SHA3_sha3_256_inc_finalize(output, state); 29| 3.00k|} OQS_SHA3_sha3_256_inc_ctx_release: 31| 3.00k|void OQS_SHA3_sha3_256_inc_ctx_release(OQS_SHA3_sha3_256_inc_ctx *state) { 32| 3.00k| callbacks->SHA3_sha3_256_inc_ctx_release(state); 33| 3.00k|} OQS_SHA3_sha3_384: 43| 28|void OQS_SHA3_sha3_384(uint8_t *output, const uint8_t *input, size_t inplen) { 44| 28| callbacks->SHA3_sha3_384(output, input, inplen); 45| 28|} OQS_SHA3_sha3_384_inc_init: 47| 28|void OQS_SHA3_sha3_384_inc_init(OQS_SHA3_sha3_384_inc_ctx *state) { 48| 28| callbacks->SHA3_sha3_384_inc_init(state); 49| 28|} OQS_SHA3_sha3_384_inc_absorb: 51| 28|void OQS_SHA3_sha3_384_inc_absorb(OQS_SHA3_sha3_384_inc_ctx *state, const uint8_t *input, size_t inlen) { 52| 28| callbacks->SHA3_sha3_384_inc_absorb(state, input, inlen); 53| 28|} OQS_SHA3_sha3_384_inc_finalize: 55| 28|void OQS_SHA3_sha3_384_inc_finalize(uint8_t *output, OQS_SHA3_sha3_384_inc_ctx *state) { 56| 28| callbacks->SHA3_sha3_384_inc_finalize(output, state); 57| 28|} OQS_SHA3_sha3_384_inc_ctx_release: 59| 28|void OQS_SHA3_sha3_384_inc_ctx_release(OQS_SHA3_sha3_384_inc_ctx *state) { 60| 28| callbacks->SHA3_sha3_384_inc_ctx_release(state); 61| 28|} OQS_SHA3_sha3_512: 71| 1.08k|void OQS_SHA3_sha3_512(uint8_t *output, const uint8_t *input, size_t inplen) { 72| 1.08k| callbacks->SHA3_sha3_512(output, input, inplen); 73| 1.08k|} OQS_SHA3_sha3_512_inc_init: 75| 1.45k|void OQS_SHA3_sha3_512_inc_init(OQS_SHA3_sha3_512_inc_ctx *state) { 76| 1.45k| callbacks->SHA3_sha3_512_inc_init(state); 77| 1.45k|} OQS_SHA3_sha3_512_inc_absorb: 79| 2.30k|void OQS_SHA3_sha3_512_inc_absorb(OQS_SHA3_sha3_512_inc_ctx *state, const uint8_t *input, size_t inlen) { 80| 2.30k| callbacks->SHA3_sha3_512_inc_absorb(state, input, inlen); 81| 2.30k|} OQS_SHA3_sha3_512_inc_finalize: 83| 1.45k|void OQS_SHA3_sha3_512_inc_finalize(uint8_t *output, OQS_SHA3_sha3_512_inc_ctx *state) { 84| 1.45k| callbacks->SHA3_sha3_512_inc_finalize(output, state); 85| 1.45k|} OQS_SHA3_sha3_512_inc_ctx_release: 87| 1.45k|void OQS_SHA3_sha3_512_inc_ctx_release(OQS_SHA3_sha3_512_inc_ctx *state) { 88| 1.45k| callbacks->SHA3_sha3_512_inc_ctx_release(state); 89| 1.45k|} OQS_SHA3_shake128: 99| 110|void OQS_SHA3_shake128(uint8_t *output, size_t outlen, const uint8_t *input, size_t inplen) { 100| 110| callbacks->SHA3_shake128(output, outlen, input, inplen); 101| 110|} OQS_SHA3_shake128_inc_init: 103| 596|void OQS_SHA3_shake128_inc_init(OQS_SHA3_shake128_inc_ctx *state) { 104| 596| callbacks->SHA3_shake128_inc_init(state); 105| 596|} OQS_SHA3_shake128_inc_absorb: 107| 596|void OQS_SHA3_shake128_inc_absorb(OQS_SHA3_shake128_inc_ctx *state, const uint8_t *input, size_t inlen) { 108| 596| callbacks->SHA3_shake128_inc_absorb(state, input, inlen); 109| 596|} OQS_SHA3_shake128_inc_finalize: 111| 596|void OQS_SHA3_shake128_inc_finalize(OQS_SHA3_shake128_inc_ctx *state) { 112| 596| callbacks->SHA3_shake128_inc_finalize(state); 113| 596|} OQS_SHA3_shake128_inc_squeeze: 115| 671|void OQS_SHA3_shake128_inc_squeeze(uint8_t *output, size_t outlen, OQS_SHA3_shake128_inc_ctx *state) { 116| 671| callbacks->SHA3_shake128_inc_squeeze(output, outlen, state); 117| 671|} OQS_SHA3_shake128_inc_ctx_release: 119| 596|void OQS_SHA3_shake128_inc_ctx_release(OQS_SHA3_shake128_inc_ctx *state) { 120| 596| callbacks->SHA3_shake128_inc_ctx_release(state); 121| 596|} OQS_SHA3_shake128_inc_ctx_reset: 127| 486|void OQS_SHA3_shake128_inc_ctx_reset(OQS_SHA3_shake128_inc_ctx *state) { 128| 486| callbacks->SHA3_shake128_inc_ctx_reset(state); 129| 486|} OQS_SHA3_shake256: 131| 9.29k|void OQS_SHA3_shake256(uint8_t *output, size_t outlen, const uint8_t *input, size_t inplen) { 132| 9.29k| callbacks->SHA3_shake256(output, outlen, input, inplen); 133| 9.29k|} OQS_SHA3_shake256_inc_init: 135| 10.2k|void OQS_SHA3_shake256_inc_init(OQS_SHA3_shake256_inc_ctx *state) { 136| 10.2k| callbacks->SHA3_shake256_inc_init(state); 137| 10.2k|} OQS_SHA3_shake256_inc_absorb: 139| 11.2k|void OQS_SHA3_shake256_inc_absorb(OQS_SHA3_shake256_inc_ctx *state, const uint8_t *input, size_t inlen) { 140| 11.2k| callbacks->SHA3_shake256_inc_absorb(state, input, inlen); 141| 11.2k|} OQS_SHA3_shake256_inc_finalize: 143| 10.2k|void OQS_SHA3_shake256_inc_finalize(OQS_SHA3_shake256_inc_ctx *state) { 144| 10.2k| callbacks->SHA3_shake256_inc_finalize(state); 145| 10.2k|} OQS_SHA3_shake256_inc_squeeze: 147| 47.3k|void OQS_SHA3_shake256_inc_squeeze(uint8_t *output, size_t outlen, OQS_SHA3_shake256_inc_ctx *state) { 148| 47.3k| callbacks->SHA3_shake256_inc_squeeze(output, outlen, state); 149| 47.3k|} OQS_SHA3_shake256_inc_ctx_release: 151| 10.2k|void OQS_SHA3_shake256_inc_ctx_release(OQS_SHA3_shake256_inc_ctx *state) { 152| 10.2k| callbacks->SHA3_shake256_inc_ctx_release(state); 153| 10.2k|} OQS_SHA3_shake128_x4: 15| 33.3k|void OQS_SHA3_shake128_x4(uint8_t *out0, uint8_t *out1, uint8_t *out2, uint8_t *out3, size_t outlen, const uint8_t *in0, const uint8_t *in1, const uint8_t *in2, const uint8_t *in3, size_t inlen) { 16| 33.3k| callbacks->SHA3_shake128_x4(out0, out1, out2, out3, outlen, in0, in1, in2, in3, inlen); 17| 33.3k|} OQS_SHA3_shake128_x4_inc_init: 19| 34.7k|void OQS_SHA3_shake128_x4_inc_init(OQS_SHA3_shake128_x4_inc_ctx *state) { 20| 34.7k| callbacks->SHA3_shake128_x4_inc_init(state); 21| 34.7k|} OQS_SHA3_shake128_x4_inc_absorb: 23| 35.9k|void OQS_SHA3_shake128_x4_inc_absorb(OQS_SHA3_shake128_x4_inc_ctx *state, const uint8_t *in0, const uint8_t *in1, const uint8_t *in2, const uint8_t *in3, size_t inlen) { 24| 35.9k| callbacks->SHA3_shake128_x4_inc_absorb(state, in0, in1, in2, in3, inlen); 25| 35.9k|} OQS_SHA3_shake128_x4_inc_finalize: 27| 35.9k|void OQS_SHA3_shake128_x4_inc_finalize(OQS_SHA3_shake128_x4_inc_ctx *state) { 28| 35.9k| callbacks->SHA3_shake128_x4_inc_finalize(state); 29| 35.9k|} OQS_SHA3_shake128_x4_inc_squeeze: 31| 37.0k|void OQS_SHA3_shake128_x4_inc_squeeze(uint8_t *out0, uint8_t *out1, uint8_t *out2, uint8_t *out3, size_t outlen, OQS_SHA3_shake128_x4_inc_ctx *state) { 32| 37.0k| callbacks->SHA3_shake128_x4_inc_squeeze(out0, out1, out2, out3, outlen, state); 33| 37.0k|} OQS_SHA3_shake128_x4_inc_ctx_release: 35| 34.7k|void OQS_SHA3_shake128_x4_inc_ctx_release(OQS_SHA3_shake128_x4_inc_ctx *state) { 36| 34.7k| callbacks->SHA3_shake128_x4_inc_ctx_release(state); 37| 34.7k|} OQS_SHA3_shake128_x4_inc_ctx_reset: 43| 2.57k|void OQS_SHA3_shake128_x4_inc_ctx_reset(OQS_SHA3_shake128_x4_inc_ctx *state) { 44| 2.57k| callbacks->SHA3_shake128_x4_inc_ctx_reset(state); 45| 2.57k|} OQS_SHA3_shake256_x4: 47| 438|void OQS_SHA3_shake256_x4(uint8_t *out0, uint8_t *out1, uint8_t *out2, uint8_t *out3, size_t outlen, const uint8_t *in0, const uint8_t *in1, const uint8_t *in2, const uint8_t *in3, size_t inlen) { 48| 438| callbacks->SHA3_shake256_x4(out0, out1, out2, out3, outlen, in0, in1, in2, in3, inlen); 49| 438|} OQS_SHA3_shake256_x4_inc_init: 51| 1.90k|void OQS_SHA3_shake256_x4_inc_init(OQS_SHA3_shake256_x4_inc_ctx *state) { 52| 1.90k| callbacks->SHA3_shake256_x4_inc_init(state); 53| 1.90k|} OQS_SHA3_shake256_x4_inc_absorb: 55| 1.90k|void OQS_SHA3_shake256_x4_inc_absorb(OQS_SHA3_shake256_x4_inc_ctx *state, const uint8_t *in0, const uint8_t *in1, const uint8_t *in2, const uint8_t *in3, size_t inlen) { 56| 1.90k| callbacks->SHA3_shake256_x4_inc_absorb(state, in0, in1, in2, in3, inlen); 57| 1.90k|} OQS_SHA3_shake256_x4_inc_finalize: 59| 1.90k|void OQS_SHA3_shake256_x4_inc_finalize(OQS_SHA3_shake256_x4_inc_ctx *state) { 60| 1.90k| callbacks->SHA3_shake256_x4_inc_finalize(state); 61| 1.90k|} OQS_SHA3_shake256_x4_inc_squeeze: 63| 1.90k|void OQS_SHA3_shake256_x4_inc_squeeze(uint8_t *out0, uint8_t *out1, uint8_t *out2, uint8_t *out3, size_t outlen, OQS_SHA3_shake256_x4_inc_ctx *state) { 64| 1.90k| callbacks->SHA3_shake256_x4_inc_squeeze(out0, out1, out2, out3, outlen, state); 65| 1.90k|} OQS_SHA3_shake256_x4_inc_ctx_release: 67| 1.90k|void OQS_SHA3_shake256_x4_inc_ctx_release(OQS_SHA3_shake256_x4_inc_ctx *state) { 68| 1.90k| callbacks->SHA3_shake256_x4_inc_ctx_release(state); 69| 1.90k|} OQS_SHA3_shake256_x4_inc_ctx_reset: 75| 1.46k|void OQS_SHA3_shake256_x4_inc_ctx_reset(OQS_SHA3_shake256_x4_inc_ctx *state) { 76| 1.46k| callbacks->SHA3_shake256_x4_inc_ctx_reset(state); 77| 1.46k|} KeccakP1600times4_InitializeAll_avx2: 108| 40.6k|void KeccakP1600times4_InitializeAll(void *states) { 109| 40.6k| memset(states, 0, KeccakP1600times4_statesSizeInBytes_avx2); ------------------ | | 27| 40.6k|#define KeccakP1600times4_statesSizeInBytes_avx2 800 ------------------ 110| 40.6k|} KeccakP1600times4_AddByte_avx2: 112| 302k|void KeccakP1600times4_AddByte(void *states, unsigned int instanceIndex, unsigned char byte, unsigned int offset) { 113| 302k| ((unsigned char *)states)[instanceIndex * 8 + (offset / 8) * 4 * 8 + offset % 8] ^= byte; 114| 302k|} KeccakP1600times4_AddBytes_avx2: 116| 151k|void KeccakP1600times4_AddBytes(void *states, unsigned int instanceIndex, const unsigned char *data, unsigned int offset, unsigned int length) { 117| 151k| unsigned int sizeLeft = length; 118| 151k| unsigned int lanePosition = offset / SnP_laneLengthInBytes; ------------------ | | 91| 151k|#define SnP_laneLengthInBytes 8 ------------------ 119| 151k| unsigned int offsetInLane = offset % SnP_laneLengthInBytes; ------------------ | | 91| 151k|#define SnP_laneLengthInBytes 8 ------------------ 120| 151k| unsigned int bytesInLane; 121| 151k| const unsigned char *curData = data; 122| 151k| uint64_t *statesAsLanes = (uint64_t *)states; 123| 151k| uint64_t lane; 124| | 125| 151k| if ((sizeLeft > 0) && (offsetInLane != 0)) { ------------------ | Branch (125:6): [True: 151k, False: 0] | Branch (125:24): [True: 0, False: 151k] ------------------ 126| 0| bytesInLane = SnP_laneLengthInBytes - offsetInLane; ------------------ | | 91| 0|#define SnP_laneLengthInBytes 8 ------------------ 127| 0| if (bytesInLane > sizeLeft) { ------------------ | Branch (127:7): [True: 0, False: 0] ------------------ 128| 0| bytesInLane = sizeLeft; 129| 0| } 130| 0| lane = 0; 131| 0| memcpy((unsigned char *)&lane + offsetInLane, curData, bytesInLane); 132| 0| statesAsLanes[laneIndex(instanceIndex, lanePosition)] ^= lane; ------------------ | | 44| 0|#define laneIndex(instanceIndex, lanePosition) ((lanePosition)*4 + instanceIndex) ------------------ 133| 0| sizeLeft -= bytesInLane; 134| 0| lanePosition++; 135| 0| curData += bytesInLane; 136| 0| } 137| | 138| 489k| while (sizeLeft >= SnP_laneLengthInBytes) { ------------------ | | 91| 489k|#define SnP_laneLengthInBytes 8 ------------------ | Branch (138:9): [True: 338k, False: 151k] ------------------ 139| 338k| lane = load64(curData); 140| 338k| statesAsLanes[laneIndex(instanceIndex, lanePosition)] ^= lane; ------------------ | | 44| 338k|#define laneIndex(instanceIndex, lanePosition) ((lanePosition)*4 + instanceIndex) ------------------ 141| 338k| sizeLeft -= SnP_laneLengthInBytes; ------------------ | | 91| 338k|#define SnP_laneLengthInBytes 8 ------------------ 142| 338k| lanePosition++; 143| 338k| curData += SnP_laneLengthInBytes; ------------------ | | 91| 338k|#define SnP_laneLengthInBytes 8 ------------------ 144| 338k| } 145| | 146| 151k| if (sizeLeft > 0) { ------------------ | Branch (146:6): [True: 151k, False: 0] ------------------ 147| 151k| lane = 0; 148| 151k| memcpy(&lane, curData, sizeLeft); 149| 151k| statesAsLanes[laneIndex(instanceIndex, lanePosition)] ^= lane; ------------------ | | 44| 151k|#define laneIndex(instanceIndex, lanePosition) ((lanePosition)*4 + instanceIndex) ------------------ 150| 151k| } 151| 151k|} KeccakP1600times4_ExtractBytes_avx2: 296| 1.98M|void KeccakP1600times4_ExtractBytes(const void *states, unsigned int instanceIndex, unsigned char *data, unsigned int offset, unsigned int length) { 297| 1.98M| unsigned int sizeLeft = length; 298| 1.98M| unsigned int lanePosition = offset / SnP_laneLengthInBytes; ------------------ | | 91| 1.98M|#define SnP_laneLengthInBytes 8 ------------------ 299| 1.98M| unsigned int offsetInLane = offset % SnP_laneLengthInBytes; ------------------ | | 91| 1.98M|#define SnP_laneLengthInBytes 8 ------------------ 300| 1.98M| unsigned char *curData = data; 301| 1.98M| const uint64_t *statesAsLanes = (const uint64_t *)states; 302| | 303| 1.98M| if ((sizeLeft > 0) && (offsetInLane != 0)) { ------------------ | Branch (303:6): [True: 1.83M, False: 155k] | Branch (303:24): [True: 0, False: 1.83M] ------------------ 304| 0| unsigned int bytesInLane = SnP_laneLengthInBytes - offsetInLane; ------------------ | | 91| 0|#define SnP_laneLengthInBytes 8 ------------------ 305| 0| if (bytesInLane > sizeLeft) { ------------------ | Branch (305:7): [True: 0, False: 0] ------------------ 306| 0| bytesInLane = sizeLeft; 307| 0| } 308| 0| memcpy( curData, ((const unsigned char *)&statesAsLanes[laneIndex(instanceIndex, lanePosition)]) + offsetInLane, bytesInLane); ------------------ | | 44| 0|#define laneIndex(instanceIndex, lanePosition) ((lanePosition)*4 + instanceIndex) ------------------ 309| 0| sizeLeft -= bytesInLane; 310| 0| lanePosition++; 311| 0| curData += bytesInLane; 312| 0| } 313| | 314| 39.8M| while (sizeLeft >= SnP_laneLengthInBytes) { ------------------ | | 91| 39.8M|#define SnP_laneLengthInBytes 8 ------------------ | Branch (314:9): [True: 37.8M, False: 1.98M] ------------------ 315| 37.8M| store64(curData, statesAsLanes[laneIndex(instanceIndex, lanePosition)]); ------------------ | | 44| 37.8M|#define laneIndex(instanceIndex, lanePosition) ((lanePosition)*4 + instanceIndex) ------------------ 316| 37.8M| sizeLeft -= SnP_laneLengthInBytes; ------------------ | | 91| 37.8M|#define SnP_laneLengthInBytes 8 ------------------ 317| 37.8M| lanePosition++; 318| 37.8M| curData += SnP_laneLengthInBytes; ------------------ | | 91| 37.8M|#define SnP_laneLengthInBytes 8 ------------------ 319| 37.8M| } 320| | 321| 1.98M| if (sizeLeft > 0) { ------------------ | Branch (321:6): [True: 0, False: 1.98M] ------------------ 322| 0| memcpy( curData, &statesAsLanes[laneIndex(instanceIndex, lanePosition)], sizeLeft); ------------------ | | 44| 0|#define laneIndex(instanceIndex, lanePosition) ((lanePosition)*4 + instanceIndex) ------------------ 323| 0| } 324| 1.98M|} KeccakP1600times4_PermuteAll_24rounds_avx2: 833| 457k|void KeccakP1600times4_PermuteAll_24rounds(void *states) { 834| 457k| V256 *statesAsLanes = (V256 *)states; 835| 457k| declareABCDE ------------------ | | 479| 457k| V256 Aba, Abe, Abi, Abo, Abu; \ | | 480| 457k| V256 Aga, Age, Agi, Ago, Agu; \ | | 481| 457k| V256 Aka, Ake, Aki, Ako, Aku; \ | | 482| 457k| V256 Ama, Ame, Ami, Amo, Amu; \ | | 483| 457k| V256 Asa, Ase, Asi, Aso, Asu; \ | | 484| 457k| V256 Bba, Bbe, Bbi, Bbo, Bbu; \ | | 485| 457k| V256 Bga, Bge, Bgi, Bgo, Bgu; \ | | 486| 457k| V256 Bka, Bke, Bki, Bko, Bku; \ | | 487| 457k| V256 Bma, Bme, Bmi, Bmo, Bmu; \ | | 488| 457k| V256 Bsa, Bse, Bsi, Bso, Bsu; \ | | 489| 457k| V256 Ca, Ce, Ci, Co, Cu; \ | | 490| 457k| V256 Ca1, Ce1, Ci1, Co1, Cu1; \ | | 491| 457k| V256 Da, De, Di, Do, Du; \ | | 492| 457k| V256 Eba, Ebe, Ebi, Ebo, Ebu; \ | | 493| 457k| V256 Ega, Ege, Egi, Ego, Egu; \ | | 494| 457k| V256 Eka, Eke, Eki, Eko, Eku; \ | | 495| 457k| V256 Ema, Eme, Emi, Emo, Emu; \ | | 496| 457k| V256 Esa, Ese, Esi, Eso, Esu; \ ------------------ 836| | 837| 457k| copyFromState(A, statesAsLanes) ------------------ | | 750| 457k| X##ba = LOAD256(state[ 0]); \ | | ------------------ | | | | 48| 457k|#define LOAD256(a) _mm256_load_si256((const V256 *)&(a)) | | ------------------ | | 751| 457k| X##be = LOAD256(state[ 1]); \ | | ------------------ | | | | 48| 457k|#define LOAD256(a) _mm256_load_si256((const V256 *)&(a)) | | ------------------ | | 752| 457k| X##bi = LOAD256(state[ 2]); \ | | ------------------ | | | | 48| 457k|#define LOAD256(a) _mm256_load_si256((const V256 *)&(a)) | | ------------------ | | 753| 457k| X##bo = LOAD256(state[ 3]); \ | | ------------------ | | | | 48| 457k|#define LOAD256(a) _mm256_load_si256((const V256 *)&(a)) | | ------------------ | | 754| 457k| X##bu = LOAD256(state[ 4]); \ | | ------------------ | | | | 48| 457k|#define LOAD256(a) _mm256_load_si256((const V256 *)&(a)) | | ------------------ | | 755| 457k| X##ga = LOAD256(state[ 5]); \ | | ------------------ | | | | 48| 457k|#define LOAD256(a) _mm256_load_si256((const V256 *)&(a)) | | ------------------ | | 756| 457k| X##ge = LOAD256(state[ 6]); \ | | ------------------ | | | | 48| 457k|#define LOAD256(a) _mm256_load_si256((const V256 *)&(a)) | | ------------------ | | 757| 457k| X##gi = LOAD256(state[ 7]); \ | | ------------------ | | | | 48| 457k|#define LOAD256(a) _mm256_load_si256((const V256 *)&(a)) | | ------------------ | | 758| 457k| X##go = LOAD256(state[ 8]); \ | | ------------------ | | | | 48| 457k|#define LOAD256(a) _mm256_load_si256((const V256 *)&(a)) | | ------------------ | | 759| 457k| X##gu = LOAD256(state[ 9]); \ | | ------------------ | | | | 48| 457k|#define LOAD256(a) _mm256_load_si256((const V256 *)&(a)) | | ------------------ | | 760| 457k| X##ka = LOAD256(state[10]); \ | | ------------------ | | | | 48| 457k|#define LOAD256(a) _mm256_load_si256((const V256 *)&(a)) | | ------------------ | | 761| 457k| X##ke = LOAD256(state[11]); \ | | ------------------ | | | | 48| 457k|#define LOAD256(a) _mm256_load_si256((const V256 *)&(a)) | | ------------------ | | 762| 457k| X##ki = LOAD256(state[12]); \ | | ------------------ | | | | 48| 457k|#define LOAD256(a) _mm256_load_si256((const V256 *)&(a)) | | ------------------ | | 763| 457k| X##ko = LOAD256(state[13]); \ | | ------------------ | | | | 48| 457k|#define LOAD256(a) _mm256_load_si256((const V256 *)&(a)) | | ------------------ | | 764| 457k| X##ku = LOAD256(state[14]); \ | | ------------------ | | | | 48| 457k|#define LOAD256(a) _mm256_load_si256((const V256 *)&(a)) | | ------------------ | | 765| 457k| X##ma = LOAD256(state[15]); \ | | ------------------ | | | | 48| 457k|#define LOAD256(a) _mm256_load_si256((const V256 *)&(a)) | | ------------------ | | 766| 457k| X##me = LOAD256(state[16]); \ | | ------------------ | | | | 48| 457k|#define LOAD256(a) _mm256_load_si256((const V256 *)&(a)) | | ------------------ | | 767| 457k| X##mi = LOAD256(state[17]); \ | | ------------------ | | | | 48| 457k|#define LOAD256(a) _mm256_load_si256((const V256 *)&(a)) | | ------------------ | | 768| 457k| X##mo = LOAD256(state[18]); \ | | ------------------ | | | | 48| 457k|#define LOAD256(a) _mm256_load_si256((const V256 *)&(a)) | | ------------------ | | 769| 457k| X##mu = LOAD256(state[19]); \ | | ------------------ | | | | 48| 457k|#define LOAD256(a) _mm256_load_si256((const V256 *)&(a)) | | ------------------ | | 770| 457k| X##sa = LOAD256(state[20]); \ | | ------------------ | | | | 48| 457k|#define LOAD256(a) _mm256_load_si256((const V256 *)&(a)) | | ------------------ | | 771| 457k| X##se = LOAD256(state[21]); \ | | ------------------ | | | | 48| 457k|#define LOAD256(a) _mm256_load_si256((const V256 *)&(a)) | | ------------------ | | 772| 457k| X##si = LOAD256(state[22]); \ | | ------------------ | | | | 48| 457k|#define LOAD256(a) _mm256_load_si256((const V256 *)&(a)) | | ------------------ | | 773| 457k| X##so = LOAD256(state[23]); \ | | ------------------ | | | | 48| 457k|#define LOAD256(a) _mm256_load_si256((const V256 *)&(a)) | | ------------------ | | 774| 457k| X##su = LOAD256(state[24]); \ | | ------------------ | | | | 48| 457k|#define LOAD256(a) _mm256_load_si256((const V256 *)&(a)) | | ------------------ ------------------ 838| 457k| rounds24 ------------------ | | 19| 457k| prepareTheta \ | | ------------------ | | | | 499| 457k| Ca = XOR256(Aba, XOR256(Aga, XOR256(Aka, XOR256(Ama, Asa)))); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 500| 457k| Ce = XOR256(Abe, XOR256(Age, XOR256(Ake, XOR256(Ame, Ase)))); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 501| 457k| Ci = XOR256(Abi, XOR256(Agi, XOR256(Aki, XOR256(Ami, Asi)))); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 502| 457k| Co = XOR256(Abo, XOR256(Ago, XOR256(Ako, XOR256(Amo, Aso)))); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 503| 457k| Cu = XOR256(Abu, XOR256(Agu, XOR256(Aku, XOR256(Amu, Asu)))); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | ------------------ | | 20| 457k| thetaRhoPiChiIotaPrepareTheta( 0, A, E) \ | | ------------------ | | | | 508| 457k| ROL64in256(Ce1, Ce, 1); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 509| 457k| Da = XOR256(Cu, Ce1); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 510| 457k| ROL64in256(Ci1, Ci, 1); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 511| 457k| De = XOR256(Ca, Ci1); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 512| 457k| ROL64in256(Co1, Co, 1); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 513| 457k| Di = XOR256(Ce, Co1); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 514| 457k| ROL64in256(Cu1, Cu, 1); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 515| 457k| Do = XOR256(Ci, Cu1); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 516| 457k| ROL64in256(Ca1, Ca, 1); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 517| 457k| Du = XOR256(Co, Ca1); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 518| 457k|\ | | | | 519| 457k| XOReq256(A##ba, Da); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 520| 457k| Bba = A##ba; \ | | | | 521| 457k| XOReq256(A##ge, De); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 522| 457k| ROL64in256(Bbe, A##ge, 44); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 523| 457k| XOReq256(A##ki, Di); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 524| 457k| ROL64in256(Bbi, A##ki, 43); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 525| 457k| E##ba = XOR256(Bba, ANDnu256(Bbe, Bbi)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 526| 457k| XOReq256(E##ba, CONST256_64(KeccakF1600RoundConstants[i])); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 527| 457k| Ca = E##ba; \ | | | | 528| 457k| XOReq256(A##mo, Do); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 529| 457k| ROL64in256(Bbo, A##mo, 21); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 530| 457k| E##be = XOR256(Bbe, ANDnu256(Bbi, Bbo)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 531| 457k| Ce = E##be; \ | | | | 532| 457k| XOReq256(A##su, Du); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 533| 457k| ROL64in256(Bbu, A##su, 14); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 534| 457k| E##bi = XOR256(Bbi, ANDnu256(Bbo, Bbu)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 535| 457k| Ci = E##bi; \ | | | | 536| 457k| E##bo = XOR256(Bbo, ANDnu256(Bbu, Bba)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 537| 457k| Co = E##bo; \ | | | | 538| 457k| E##bu = XOR256(Bbu, ANDnu256(Bba, Bbe)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 539| 457k| Cu = E##bu; \ | | | | 540| 457k|\ | | | | 541| 457k| XOReq256(A##bo, Do); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 542| 457k| ROL64in256(Bga, A##bo, 28); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 543| 457k| XOReq256(A##gu, Du); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 544| 457k| ROL64in256(Bge, A##gu, 20); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 545| 457k| XOReq256(A##ka, Da); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 546| 457k| ROL64in256(Bgi, A##ka, 3); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 547| 457k| E##ga = XOR256(Bga, ANDnu256(Bge, Bgi)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 548| 457k| XOReq256(Ca, E##ga); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 549| 457k| XOReq256(A##me, De); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 550| 457k| ROL64in256(Bgo, A##me, 45); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 551| 457k| E##ge = XOR256(Bge, ANDnu256(Bgi, Bgo)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 552| 457k| XOReq256(Ce, E##ge); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 553| 457k| XOReq256(A##si, Di); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 554| 457k| ROL64in256(Bgu, A##si, 61); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 555| 457k| E##gi = XOR256(Bgi, ANDnu256(Bgo, Bgu)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 556| 457k| XOReq256(Ci, E##gi); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 557| 457k| E##go = XOR256(Bgo, ANDnu256(Bgu, Bga)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 558| 457k| XOReq256(Co, E##go); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 559| 457k| E##gu = XOR256(Bgu, ANDnu256(Bga, Bge)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 560| 457k| XOReq256(Cu, E##gu); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 561| 457k|\ | | | | 562| 457k| XOReq256(A##be, De); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 563| 457k| ROL64in256(Bka, A##be, 1); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 564| 457k| XOReq256(A##gi, Di); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 565| 457k| ROL64in256(Bke, A##gi, 6); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 566| 457k| XOReq256(A##ko, Do); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 567| 457k| ROL64in256(Bki, A##ko, 25); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 568| 457k| E##ka = XOR256(Bka, ANDnu256(Bke, Bki)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 569| 457k| XOReq256(Ca, E##ka); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 570| 457k| XOReq256(A##mu, Du); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 571| 457k| ROL64in256_8(Bko, A##mu); \ | | | | ------------------ | | | | | | 52| 457k|#define ROL64in256_8(d, a) d = _mm256_shuffle_epi8(a, rho8.v) | | | | ------------------ | | | | 572| 457k| E##ke = XOR256(Bke, ANDnu256(Bki, Bko)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 573| 457k| XOReq256(Ce, E##ke); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 574| 457k| XOReq256(A##sa, Da); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 575| 457k| ROL64in256(Bku, A##sa, 18); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 576| 457k| E##ki = XOR256(Bki, ANDnu256(Bko, Bku)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 577| 457k| XOReq256(Ci, E##ki); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 578| 457k| E##ko = XOR256(Bko, ANDnu256(Bku, Bka)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 579| 457k| XOReq256(Co, E##ko); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 580| 457k| E##ku = XOR256(Bku, ANDnu256(Bka, Bke)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 581| 457k| XOReq256(Cu, E##ku); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 582| 457k|\ | | | | 583| 457k| XOReq256(A##bu, Du); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 584| 457k| ROL64in256(Bma, A##bu, 27); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 585| 457k| XOReq256(A##ga, Da); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 586| 457k| ROL64in256(Bme, A##ga, 36); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 587| 457k| XOReq256(A##ke, De); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 588| 457k| ROL64in256(Bmi, A##ke, 10); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 589| 457k| E##ma = XOR256(Bma, ANDnu256(Bme, Bmi)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 590| 457k| XOReq256(Ca, E##ma); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 591| 457k| XOReq256(A##mi, Di); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 592| 457k| ROL64in256(Bmo, A##mi, 15); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 593| 457k| E##me = XOR256(Bme, ANDnu256(Bmi, Bmo)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 594| 457k| XOReq256(Ce, E##me); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 595| 457k| XOReq256(A##so, Do); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 596| 457k| ROL64in256_56(Bmu, A##so); \ | | | | ------------------ | | | | | | 53| 457k|#define ROL64in256_56(d, a) d = _mm256_shuffle_epi8(a, rho56.v) | | | | ------------------ | | | | 597| 457k| E##mi = XOR256(Bmi, ANDnu256(Bmo, Bmu)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 598| 457k| XOReq256(Ci, E##mi); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 599| 457k| E##mo = XOR256(Bmo, ANDnu256(Bmu, Bma)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 600| 457k| XOReq256(Co, E##mo); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 601| 457k| E##mu = XOR256(Bmu, ANDnu256(Bma, Bme)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 602| 457k| XOReq256(Cu, E##mu); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 603| 457k|\ | | | | 604| 457k| XOReq256(A##bi, Di); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 605| 457k| ROL64in256(Bsa, A##bi, 62); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 606| 457k| XOReq256(A##go, Do); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 607| 457k| ROL64in256(Bse, A##go, 55); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 608| 457k| XOReq256(A##ku, Du); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 609| 457k| ROL64in256(Bsi, A##ku, 39); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 610| 457k| E##sa = XOR256(Bsa, ANDnu256(Bse, Bsi)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 611| 457k| XOReq256(Ca, E##sa); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 612| 457k| XOReq256(A##ma, Da); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 613| 457k| ROL64in256(Bso, A##ma, 41); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 614| 457k| E##se = XOR256(Bse, ANDnu256(Bsi, Bso)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 615| 457k| XOReq256(Ce, E##se); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 616| 457k| XOReq256(A##se, De); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 617| 457k| ROL64in256(Bsu, A##se, 2); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 618| 457k| E##si = XOR256(Bsi, ANDnu256(Bso, Bsu)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 619| 457k| XOReq256(Ci, E##si); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 620| 457k| E##so = XOR256(Bso, ANDnu256(Bsu, Bsa)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 621| 457k| XOReq256(Co, E##so); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 622| 457k| E##su = XOR256(Bsu, ANDnu256(Bsa, Bse)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 623| 457k| XOReq256(Cu, E##su); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | ------------------ | | 21| 457k| thetaRhoPiChiIotaPrepareTheta( 1, E, A) \ | | ------------------ | | | | 508| 457k| ROL64in256(Ce1, Ce, 1); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 509| 457k| Da = XOR256(Cu, Ce1); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 510| 457k| ROL64in256(Ci1, Ci, 1); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 511| 457k| De = XOR256(Ca, Ci1); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 512| 457k| ROL64in256(Co1, Co, 1); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 513| 457k| Di = XOR256(Ce, Co1); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 514| 457k| ROL64in256(Cu1, Cu, 1); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 515| 457k| Do = XOR256(Ci, Cu1); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 516| 457k| ROL64in256(Ca1, Ca, 1); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 517| 457k| Du = XOR256(Co, Ca1); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 518| 457k|\ | | | | 519| 457k| XOReq256(A##ba, Da); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 520| 457k| Bba = A##ba; \ | | | | 521| 457k| XOReq256(A##ge, De); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 522| 457k| ROL64in256(Bbe, A##ge, 44); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 523| 457k| XOReq256(A##ki, Di); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 524| 457k| ROL64in256(Bbi, A##ki, 43); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 525| 457k| E##ba = XOR256(Bba, ANDnu256(Bbe, Bbi)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 526| 457k| XOReq256(E##ba, CONST256_64(KeccakF1600RoundConstants[i])); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 527| 457k| Ca = E##ba; \ | | | | 528| 457k| XOReq256(A##mo, Do); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 529| 457k| ROL64in256(Bbo, A##mo, 21); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 530| 457k| E##be = XOR256(Bbe, ANDnu256(Bbi, Bbo)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 531| 457k| Ce = E##be; \ | | | | 532| 457k| XOReq256(A##su, Du); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 533| 457k| ROL64in256(Bbu, A##su, 14); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 534| 457k| E##bi = XOR256(Bbi, ANDnu256(Bbo, Bbu)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 535| 457k| Ci = E##bi; \ | | | | 536| 457k| E##bo = XOR256(Bbo, ANDnu256(Bbu, Bba)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 537| 457k| Co = E##bo; \ | | | | 538| 457k| E##bu = XOR256(Bbu, ANDnu256(Bba, Bbe)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 539| 457k| Cu = E##bu; \ | | | | 540| 457k|\ | | | | 541| 457k| XOReq256(A##bo, Do); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 542| 457k| ROL64in256(Bga, A##bo, 28); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 543| 457k| XOReq256(A##gu, Du); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 544| 457k| ROL64in256(Bge, A##gu, 20); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 545| 457k| XOReq256(A##ka, Da); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 546| 457k| ROL64in256(Bgi, A##ka, 3); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 547| 457k| E##ga = XOR256(Bga, ANDnu256(Bge, Bgi)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 548| 457k| XOReq256(Ca, E##ga); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 549| 457k| XOReq256(A##me, De); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 550| 457k| ROL64in256(Bgo, A##me, 45); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 551| 457k| E##ge = XOR256(Bge, ANDnu256(Bgi, Bgo)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 552| 457k| XOReq256(Ce, E##ge); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 553| 457k| XOReq256(A##si, Di); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 554| 457k| ROL64in256(Bgu, A##si, 61); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 555| 457k| E##gi = XOR256(Bgi, ANDnu256(Bgo, Bgu)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 556| 457k| XOReq256(Ci, E##gi); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 557| 457k| E##go = XOR256(Bgo, ANDnu256(Bgu, Bga)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 558| 457k| XOReq256(Co, E##go); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 559| 457k| E##gu = XOR256(Bgu, ANDnu256(Bga, Bge)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 560| 457k| XOReq256(Cu, E##gu); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 561| 457k|\ | | | | 562| 457k| XOReq256(A##be, De); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 563| 457k| ROL64in256(Bka, A##be, 1); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 564| 457k| XOReq256(A##gi, Di); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 565| 457k| ROL64in256(Bke, A##gi, 6); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 566| 457k| XOReq256(A##ko, Do); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 567| 457k| ROL64in256(Bki, A##ko, 25); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 568| 457k| E##ka = XOR256(Bka, ANDnu256(Bke, Bki)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 569| 457k| XOReq256(Ca, E##ka); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 570| 457k| XOReq256(A##mu, Du); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 571| 457k| ROL64in256_8(Bko, A##mu); \ | | | | ------------------ | | | | | | 52| 457k|#define ROL64in256_8(d, a) d = _mm256_shuffle_epi8(a, rho8.v) | | | | ------------------ | | | | 572| 457k| E##ke = XOR256(Bke, ANDnu256(Bki, Bko)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 573| 457k| XOReq256(Ce, E##ke); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 574| 457k| XOReq256(A##sa, Da); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 575| 457k| ROL64in256(Bku, A##sa, 18); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 576| 457k| E##ki = XOR256(Bki, ANDnu256(Bko, Bku)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 577| 457k| XOReq256(Ci, E##ki); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 578| 457k| E##ko = XOR256(Bko, ANDnu256(Bku, Bka)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 579| 457k| XOReq256(Co, E##ko); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 580| 457k| E##ku = XOR256(Bku, ANDnu256(Bka, Bke)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 581| 457k| XOReq256(Cu, E##ku); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 582| 457k|\ | | | | 583| 457k| XOReq256(A##bu, Du); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 584| 457k| ROL64in256(Bma, A##bu, 27); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 585| 457k| XOReq256(A##ga, Da); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 586| 457k| ROL64in256(Bme, A##ga, 36); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 587| 457k| XOReq256(A##ke, De); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 588| 457k| ROL64in256(Bmi, A##ke, 10); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 589| 457k| E##ma = XOR256(Bma, ANDnu256(Bme, Bmi)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 590| 457k| XOReq256(Ca, E##ma); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 591| 457k| XOReq256(A##mi, Di); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 592| 457k| ROL64in256(Bmo, A##mi, 15); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 593| 457k| E##me = XOR256(Bme, ANDnu256(Bmi, Bmo)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 594| 457k| XOReq256(Ce, E##me); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 595| 457k| XOReq256(A##so, Do); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 596| 457k| ROL64in256_56(Bmu, A##so); \ | | | | ------------------ | | | | | | 53| 457k|#define ROL64in256_56(d, a) d = _mm256_shuffle_epi8(a, rho56.v) | | | | ------------------ | | | | 597| 457k| E##mi = XOR256(Bmi, ANDnu256(Bmo, Bmu)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 598| 457k| XOReq256(Ci, E##mi); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 599| 457k| E##mo = XOR256(Bmo, ANDnu256(Bmu, Bma)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 600| 457k| XOReq256(Co, E##mo); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 601| 457k| E##mu = XOR256(Bmu, ANDnu256(Bma, Bme)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 602| 457k| XOReq256(Cu, E##mu); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 603| 457k|\ | | | | 604| 457k| XOReq256(A##bi, Di); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 605| 457k| ROL64in256(Bsa, A##bi, 62); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 606| 457k| XOReq256(A##go, Do); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 607| 457k| ROL64in256(Bse, A##go, 55); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 608| 457k| XOReq256(A##ku, Du); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 609| 457k| ROL64in256(Bsi, A##ku, 39); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 610| 457k| E##sa = XOR256(Bsa, ANDnu256(Bse, Bsi)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 611| 457k| XOReq256(Ca, E##sa); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 612| 457k| XOReq256(A##ma, Da); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 613| 457k| ROL64in256(Bso, A##ma, 41); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 614| 457k| E##se = XOR256(Bse, ANDnu256(Bsi, Bso)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 615| 457k| XOReq256(Ce, E##se); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 616| 457k| XOReq256(A##se, De); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 617| 457k| ROL64in256(Bsu, A##se, 2); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 618| 457k| E##si = XOR256(Bsi, ANDnu256(Bso, Bsu)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 619| 457k| XOReq256(Ci, E##si); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 620| 457k| E##so = XOR256(Bso, ANDnu256(Bsu, Bsa)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 621| 457k| XOReq256(Co, E##so); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 622| 457k| E##su = XOR256(Bsu, ANDnu256(Bsa, Bse)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 623| 457k| XOReq256(Cu, E##su); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | ------------------ | | 22| 457k| thetaRhoPiChiIotaPrepareTheta( 2, A, E) \ | | ------------------ | | | | 508| 457k| ROL64in256(Ce1, Ce, 1); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 509| 457k| Da = XOR256(Cu, Ce1); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 510| 457k| ROL64in256(Ci1, Ci, 1); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 511| 457k| De = XOR256(Ca, Ci1); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 512| 457k| ROL64in256(Co1, Co, 1); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 513| 457k| Di = XOR256(Ce, Co1); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 514| 457k| ROL64in256(Cu1, Cu, 1); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 515| 457k| Do = XOR256(Ci, Cu1); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 516| 457k| ROL64in256(Ca1, Ca, 1); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 517| 457k| Du = XOR256(Co, Ca1); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 518| 457k|\ | | | | 519| 457k| XOReq256(A##ba, Da); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 520| 457k| Bba = A##ba; \ | | | | 521| 457k| XOReq256(A##ge, De); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 522| 457k| ROL64in256(Bbe, A##ge, 44); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 523| 457k| XOReq256(A##ki, Di); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 524| 457k| ROL64in256(Bbi, A##ki, 43); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 525| 457k| E##ba = XOR256(Bba, ANDnu256(Bbe, Bbi)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 526| 457k| XOReq256(E##ba, CONST256_64(KeccakF1600RoundConstants[i])); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 527| 457k| Ca = E##ba; \ | | | | 528| 457k| XOReq256(A##mo, Do); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 529| 457k| ROL64in256(Bbo, A##mo, 21); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 530| 457k| E##be = XOR256(Bbe, ANDnu256(Bbi, Bbo)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 531| 457k| Ce = E##be; \ | | | | 532| 457k| XOReq256(A##su, Du); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 533| 457k| ROL64in256(Bbu, A##su, 14); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 534| 457k| E##bi = XOR256(Bbi, ANDnu256(Bbo, Bbu)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 535| 457k| Ci = E##bi; \ | | | | 536| 457k| E##bo = XOR256(Bbo, ANDnu256(Bbu, Bba)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 537| 457k| Co = E##bo; \ | | | | 538| 457k| E##bu = XOR256(Bbu, ANDnu256(Bba, Bbe)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 539| 457k| Cu = E##bu; \ | | | | 540| 457k|\ | | | | 541| 457k| XOReq256(A##bo, Do); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 542| 457k| ROL64in256(Bga, A##bo, 28); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 543| 457k| XOReq256(A##gu, Du); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 544| 457k| ROL64in256(Bge, A##gu, 20); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 545| 457k| XOReq256(A##ka, Da); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 546| 457k| ROL64in256(Bgi, A##ka, 3); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 547| 457k| E##ga = XOR256(Bga, ANDnu256(Bge, Bgi)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 548| 457k| XOReq256(Ca, E##ga); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 549| 457k| XOReq256(A##me, De); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 550| 457k| ROL64in256(Bgo, A##me, 45); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 551| 457k| E##ge = XOR256(Bge, ANDnu256(Bgi, Bgo)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 552| 457k| XOReq256(Ce, E##ge); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 553| 457k| XOReq256(A##si, Di); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 554| 457k| ROL64in256(Bgu, A##si, 61); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 555| 457k| E##gi = XOR256(Bgi, ANDnu256(Bgo, Bgu)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 556| 457k| XOReq256(Ci, E##gi); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 557| 457k| E##go = XOR256(Bgo, ANDnu256(Bgu, Bga)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 558| 457k| XOReq256(Co, E##go); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 559| 457k| E##gu = XOR256(Bgu, ANDnu256(Bga, Bge)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 560| 457k| XOReq256(Cu, E##gu); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 561| 457k|\ | | | | 562| 457k| XOReq256(A##be, De); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 563| 457k| ROL64in256(Bka, A##be, 1); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 564| 457k| XOReq256(A##gi, Di); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 565| 457k| ROL64in256(Bke, A##gi, 6); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 566| 457k| XOReq256(A##ko, Do); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 567| 457k| ROL64in256(Bki, A##ko, 25); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 568| 457k| E##ka = XOR256(Bka, ANDnu256(Bke, Bki)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 569| 457k| XOReq256(Ca, E##ka); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 570| 457k| XOReq256(A##mu, Du); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 571| 457k| ROL64in256_8(Bko, A##mu); \ | | | | ------------------ | | | | | | 52| 457k|#define ROL64in256_8(d, a) d = _mm256_shuffle_epi8(a, rho8.v) | | | | ------------------ | | | | 572| 457k| E##ke = XOR256(Bke, ANDnu256(Bki, Bko)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 573| 457k| XOReq256(Ce, E##ke); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 574| 457k| XOReq256(A##sa, Da); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 575| 457k| ROL64in256(Bku, A##sa, 18); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 576| 457k| E##ki = XOR256(Bki, ANDnu256(Bko, Bku)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 577| 457k| XOReq256(Ci, E##ki); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 578| 457k| E##ko = XOR256(Bko, ANDnu256(Bku, Bka)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 579| 457k| XOReq256(Co, E##ko); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 580| 457k| E##ku = XOR256(Bku, ANDnu256(Bka, Bke)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 581| 457k| XOReq256(Cu, E##ku); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 582| 457k|\ | | | | 583| 457k| XOReq256(A##bu, Du); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 584| 457k| ROL64in256(Bma, A##bu, 27); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 585| 457k| XOReq256(A##ga, Da); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 586| 457k| ROL64in256(Bme, A##ga, 36); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 587| 457k| XOReq256(A##ke, De); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 588| 457k| ROL64in256(Bmi, A##ke, 10); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 589| 457k| E##ma = XOR256(Bma, ANDnu256(Bme, Bmi)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 590| 457k| XOReq256(Ca, E##ma); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 591| 457k| XOReq256(A##mi, Di); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 592| 457k| ROL64in256(Bmo, A##mi, 15); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 593| 457k| E##me = XOR256(Bme, ANDnu256(Bmi, Bmo)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 594| 457k| XOReq256(Ce, E##me); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 595| 457k| XOReq256(A##so, Do); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 596| 457k| ROL64in256_56(Bmu, A##so); \ | | | | ------------------ | | | | | | 53| 457k|#define ROL64in256_56(d, a) d = _mm256_shuffle_epi8(a, rho56.v) | | | | ------------------ | | | | 597| 457k| E##mi = XOR256(Bmi, ANDnu256(Bmo, Bmu)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 598| 457k| XOReq256(Ci, E##mi); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 599| 457k| E##mo = XOR256(Bmo, ANDnu256(Bmu, Bma)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 600| 457k| XOReq256(Co, E##mo); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 601| 457k| E##mu = XOR256(Bmu, ANDnu256(Bma, Bme)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 602| 457k| XOReq256(Cu, E##mu); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 603| 457k|\ | | | | 604| 457k| XOReq256(A##bi, Di); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 605| 457k| ROL64in256(Bsa, A##bi, 62); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 606| 457k| XOReq256(A##go, Do); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 607| 457k| ROL64in256(Bse, A##go, 55); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 608| 457k| XOReq256(A##ku, Du); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 609| 457k| ROL64in256(Bsi, A##ku, 39); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 610| 457k| E##sa = XOR256(Bsa, ANDnu256(Bse, Bsi)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 611| 457k| XOReq256(Ca, E##sa); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 612| 457k| XOReq256(A##ma, Da); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 613| 457k| ROL64in256(Bso, A##ma, 41); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 614| 457k| E##se = XOR256(Bse, ANDnu256(Bsi, Bso)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 615| 457k| XOReq256(Ce, E##se); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 616| 457k| XOReq256(A##se, De); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 617| 457k| ROL64in256(Bsu, A##se, 2); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 618| 457k| E##si = XOR256(Bsi, ANDnu256(Bso, Bsu)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 619| 457k| XOReq256(Ci, E##si); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 620| 457k| E##so = XOR256(Bso, ANDnu256(Bsu, Bsa)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 621| 457k| XOReq256(Co, E##so); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 622| 457k| E##su = XOR256(Bsu, ANDnu256(Bsa, Bse)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 623| 457k| XOReq256(Cu, E##su); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | ------------------ | | 23| 457k| thetaRhoPiChiIotaPrepareTheta( 3, E, A) \ | | ------------------ | | | | 508| 457k| ROL64in256(Ce1, Ce, 1); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 509| 457k| Da = XOR256(Cu, Ce1); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 510| 457k| ROL64in256(Ci1, Ci, 1); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 511| 457k| De = XOR256(Ca, Ci1); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 512| 457k| ROL64in256(Co1, Co, 1); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 513| 457k| Di = XOR256(Ce, Co1); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 514| 457k| ROL64in256(Cu1, Cu, 1); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 515| 457k| Do = XOR256(Ci, Cu1); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 516| 457k| ROL64in256(Ca1, Ca, 1); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 517| 457k| Du = XOR256(Co, Ca1); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 518| 457k|\ | | | | 519| 457k| XOReq256(A##ba, Da); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 520| 457k| Bba = A##ba; \ | | | | 521| 457k| XOReq256(A##ge, De); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 522| 457k| ROL64in256(Bbe, A##ge, 44); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 523| 457k| XOReq256(A##ki, Di); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 524| 457k| ROL64in256(Bbi, A##ki, 43); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 525| 457k| E##ba = XOR256(Bba, ANDnu256(Bbe, Bbi)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 526| 457k| XOReq256(E##ba, CONST256_64(KeccakF1600RoundConstants[i])); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 527| 457k| Ca = E##ba; \ | | | | 528| 457k| XOReq256(A##mo, Do); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 529| 457k| ROL64in256(Bbo, A##mo, 21); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 530| 457k| E##be = XOR256(Bbe, ANDnu256(Bbi, Bbo)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 531| 457k| Ce = E##be; \ | | | | 532| 457k| XOReq256(A##su, Du); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 533| 457k| ROL64in256(Bbu, A##su, 14); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 534| 457k| E##bi = XOR256(Bbi, ANDnu256(Bbo, Bbu)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 535| 457k| Ci = E##bi; \ | | | | 536| 457k| E##bo = XOR256(Bbo, ANDnu256(Bbu, Bba)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 537| 457k| Co = E##bo; \ | | | | 538| 457k| E##bu = XOR256(Bbu, ANDnu256(Bba, Bbe)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 539| 457k| Cu = E##bu; \ | | | | 540| 457k|\ | | | | 541| 457k| XOReq256(A##bo, Do); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 542| 457k| ROL64in256(Bga, A##bo, 28); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 543| 457k| XOReq256(A##gu, Du); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 544| 457k| ROL64in256(Bge, A##gu, 20); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 545| 457k| XOReq256(A##ka, Da); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 546| 457k| ROL64in256(Bgi, A##ka, 3); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 547| 457k| E##ga = XOR256(Bga, ANDnu256(Bge, Bgi)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 548| 457k| XOReq256(Ca, E##ga); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 549| 457k| XOReq256(A##me, De); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 550| 457k| ROL64in256(Bgo, A##me, 45); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 551| 457k| E##ge = XOR256(Bge, ANDnu256(Bgi, Bgo)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 552| 457k| XOReq256(Ce, E##ge); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 553| 457k| XOReq256(A##si, Di); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 554| 457k| ROL64in256(Bgu, A##si, 61); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 555| 457k| E##gi = XOR256(Bgi, ANDnu256(Bgo, Bgu)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 556| 457k| XOReq256(Ci, E##gi); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 557| 457k| E##go = XOR256(Bgo, ANDnu256(Bgu, Bga)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 558| 457k| XOReq256(Co, E##go); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 559| 457k| E##gu = XOR256(Bgu, ANDnu256(Bga, Bge)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 560| 457k| XOReq256(Cu, E##gu); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 561| 457k|\ | | | | 562| 457k| XOReq256(A##be, De); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 563| 457k| ROL64in256(Bka, A##be, 1); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 564| 457k| XOReq256(A##gi, Di); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 565| 457k| ROL64in256(Bke, A##gi, 6); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 566| 457k| XOReq256(A##ko, Do); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 567| 457k| ROL64in256(Bki, A##ko, 25); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 568| 457k| E##ka = XOR256(Bka, ANDnu256(Bke, Bki)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 569| 457k| XOReq256(Ca, E##ka); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 570| 457k| XOReq256(A##mu, Du); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 571| 457k| ROL64in256_8(Bko, A##mu); \ | | | | ------------------ | | | | | | 52| 457k|#define ROL64in256_8(d, a) d = _mm256_shuffle_epi8(a, rho8.v) | | | | ------------------ | | | | 572| 457k| E##ke = XOR256(Bke, ANDnu256(Bki, Bko)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 573| 457k| XOReq256(Ce, E##ke); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 574| 457k| XOReq256(A##sa, Da); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 575| 457k| ROL64in256(Bku, A##sa, 18); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 576| 457k| E##ki = XOR256(Bki, ANDnu256(Bko, Bku)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 577| 457k| XOReq256(Ci, E##ki); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 578| 457k| E##ko = XOR256(Bko, ANDnu256(Bku, Bka)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 579| 457k| XOReq256(Co, E##ko); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 580| 457k| E##ku = XOR256(Bku, ANDnu256(Bka, Bke)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 581| 457k| XOReq256(Cu, E##ku); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 582| 457k|\ | | | | 583| 457k| XOReq256(A##bu, Du); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 584| 457k| ROL64in256(Bma, A##bu, 27); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 585| 457k| XOReq256(A##ga, Da); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 586| 457k| ROL64in256(Bme, A##ga, 36); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 587| 457k| XOReq256(A##ke, De); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 588| 457k| ROL64in256(Bmi, A##ke, 10); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 589| 457k| E##ma = XOR256(Bma, ANDnu256(Bme, Bmi)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 590| 457k| XOReq256(Ca, E##ma); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 591| 457k| XOReq256(A##mi, Di); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 592| 457k| ROL64in256(Bmo, A##mi, 15); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 593| 457k| E##me = XOR256(Bme, ANDnu256(Bmi, Bmo)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 594| 457k| XOReq256(Ce, E##me); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 595| 457k| XOReq256(A##so, Do); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 596| 457k| ROL64in256_56(Bmu, A##so); \ | | | | ------------------ | | | | | | 53| 457k|#define ROL64in256_56(d, a) d = _mm256_shuffle_epi8(a, rho56.v) | | | | ------------------ | | | | 597| 457k| E##mi = XOR256(Bmi, ANDnu256(Bmo, Bmu)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 598| 457k| XOReq256(Ci, E##mi); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 599| 457k| E##mo = XOR256(Bmo, ANDnu256(Bmu, Bma)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 600| 457k| XOReq256(Co, E##mo); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 601| 457k| E##mu = XOR256(Bmu, ANDnu256(Bma, Bme)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 602| 457k| XOReq256(Cu, E##mu); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 603| 457k|\ | | | | 604| 457k| XOReq256(A##bi, Di); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 605| 457k| ROL64in256(Bsa, A##bi, 62); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 606| 457k| XOReq256(A##go, Do); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 607| 457k| ROL64in256(Bse, A##go, 55); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 608| 457k| XOReq256(A##ku, Du); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 609| 457k| ROL64in256(Bsi, A##ku, 39); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 610| 457k| E##sa = XOR256(Bsa, ANDnu256(Bse, Bsi)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 611| 457k| XOReq256(Ca, E##sa); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 612| 457k| XOReq256(A##ma, Da); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 613| 457k| ROL64in256(Bso, A##ma, 41); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 614| 457k| E##se = XOR256(Bse, ANDnu256(Bsi, Bso)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 615| 457k| XOReq256(Ce, E##se); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 616| 457k| XOReq256(A##se, De); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 617| 457k| ROL64in256(Bsu, A##se, 2); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 618| 457k| E##si = XOR256(Bsi, ANDnu256(Bso, Bsu)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 619| 457k| XOReq256(Ci, E##si); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 620| 457k| E##so = XOR256(Bso, ANDnu256(Bsu, Bsa)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 621| 457k| XOReq256(Co, E##so); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 622| 457k| E##su = XOR256(Bsu, ANDnu256(Bsa, Bse)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 623| 457k| XOReq256(Cu, E##su); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | ------------------ | | 24| 457k| thetaRhoPiChiIotaPrepareTheta( 4, A, E) \ | | ------------------ | | | | 508| 457k| ROL64in256(Ce1, Ce, 1); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 509| 457k| Da = XOR256(Cu, Ce1); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 510| 457k| ROL64in256(Ci1, Ci, 1); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 511| 457k| De = XOR256(Ca, Ci1); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 512| 457k| ROL64in256(Co1, Co, 1); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 513| 457k| Di = XOR256(Ce, Co1); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 514| 457k| ROL64in256(Cu1, Cu, 1); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 515| 457k| Do = XOR256(Ci, Cu1); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 516| 457k| ROL64in256(Ca1, Ca, 1); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 517| 457k| Du = XOR256(Co, Ca1); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 518| 457k|\ | | | | 519| 457k| XOReq256(A##ba, Da); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 520| 457k| Bba = A##ba; \ | | | | 521| 457k| XOReq256(A##ge, De); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 522| 457k| ROL64in256(Bbe, A##ge, 44); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 523| 457k| XOReq256(A##ki, Di); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 524| 457k| ROL64in256(Bbi, A##ki, 43); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 525| 457k| E##ba = XOR256(Bba, ANDnu256(Bbe, Bbi)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 526| 457k| XOReq256(E##ba, CONST256_64(KeccakF1600RoundConstants[i])); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 527| 457k| Ca = E##ba; \ | | | | 528| 457k| XOReq256(A##mo, Do); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 529| 457k| ROL64in256(Bbo, A##mo, 21); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 530| 457k| E##be = XOR256(Bbe, ANDnu256(Bbi, Bbo)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 531| 457k| Ce = E##be; \ | | | | 532| 457k| XOReq256(A##su, Du); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 533| 457k| ROL64in256(Bbu, A##su, 14); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 534| 457k| E##bi = XOR256(Bbi, ANDnu256(Bbo, Bbu)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 535| 457k| Ci = E##bi; \ | | | | 536| 457k| E##bo = XOR256(Bbo, ANDnu256(Bbu, Bba)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 537| 457k| Co = E##bo; \ | | | | 538| 457k| E##bu = XOR256(Bbu, ANDnu256(Bba, Bbe)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 539| 457k| Cu = E##bu; \ | | | | 540| 457k|\ | | | | 541| 457k| XOReq256(A##bo, Do); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 542| 457k| ROL64in256(Bga, A##bo, 28); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 543| 457k| XOReq256(A##gu, Du); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 544| 457k| ROL64in256(Bge, A##gu, 20); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 545| 457k| XOReq256(A##ka, Da); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 546| 457k| ROL64in256(Bgi, A##ka, 3); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 547| 457k| E##ga = XOR256(Bga, ANDnu256(Bge, Bgi)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 548| 457k| XOReq256(Ca, E##ga); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 549| 457k| XOReq256(A##me, De); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 550| 457k| ROL64in256(Bgo, A##me, 45); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 551| 457k| E##ge = XOR256(Bge, ANDnu256(Bgi, Bgo)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 552| 457k| XOReq256(Ce, E##ge); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 553| 457k| XOReq256(A##si, Di); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 554| 457k| ROL64in256(Bgu, A##si, 61); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 555| 457k| E##gi = XOR256(Bgi, ANDnu256(Bgo, Bgu)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 556| 457k| XOReq256(Ci, E##gi); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 557| 457k| E##go = XOR256(Bgo, ANDnu256(Bgu, Bga)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 558| 457k| XOReq256(Co, E##go); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 559| 457k| E##gu = XOR256(Bgu, ANDnu256(Bga, Bge)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 560| 457k| XOReq256(Cu, E##gu); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 561| 457k|\ | | | | 562| 457k| XOReq256(A##be, De); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 563| 457k| ROL64in256(Bka, A##be, 1); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 564| 457k| XOReq256(A##gi, Di); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 565| 457k| ROL64in256(Bke, A##gi, 6); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 566| 457k| XOReq256(A##ko, Do); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 567| 457k| ROL64in256(Bki, A##ko, 25); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 568| 457k| E##ka = XOR256(Bka, ANDnu256(Bke, Bki)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 569| 457k| XOReq256(Ca, E##ka); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 570| 457k| XOReq256(A##mu, Du); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 571| 457k| ROL64in256_8(Bko, A##mu); \ | | | | ------------------ | | | | | | 52| 457k|#define ROL64in256_8(d, a) d = _mm256_shuffle_epi8(a, rho8.v) | | | | ------------------ | | | | 572| 457k| E##ke = XOR256(Bke, ANDnu256(Bki, Bko)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 573| 457k| XOReq256(Ce, E##ke); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 574| 457k| XOReq256(A##sa, Da); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 575| 457k| ROL64in256(Bku, A##sa, 18); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 576| 457k| E##ki = XOR256(Bki, ANDnu256(Bko, Bku)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 577| 457k| XOReq256(Ci, E##ki); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 578| 457k| E##ko = XOR256(Bko, ANDnu256(Bku, Bka)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 579| 457k| XOReq256(Co, E##ko); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 580| 457k| E##ku = XOR256(Bku, ANDnu256(Bka, Bke)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 581| 457k| XOReq256(Cu, E##ku); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 582| 457k|\ | | | | 583| 457k| XOReq256(A##bu, Du); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 584| 457k| ROL64in256(Bma, A##bu, 27); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 585| 457k| XOReq256(A##ga, Da); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 586| 457k| ROL64in256(Bme, A##ga, 36); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 587| 457k| XOReq256(A##ke, De); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 588| 457k| ROL64in256(Bmi, A##ke, 10); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 589| 457k| E##ma = XOR256(Bma, ANDnu256(Bme, Bmi)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 590| 457k| XOReq256(Ca, E##ma); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 591| 457k| XOReq256(A##mi, Di); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 592| 457k| ROL64in256(Bmo, A##mi, 15); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 593| 457k| E##me = XOR256(Bme, ANDnu256(Bmi, Bmo)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 594| 457k| XOReq256(Ce, E##me); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 595| 457k| XOReq256(A##so, Do); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 596| 457k| ROL64in256_56(Bmu, A##so); \ | | | | ------------------ | | | | | | 53| 457k|#define ROL64in256_56(d, a) d = _mm256_shuffle_epi8(a, rho56.v) | | | | ------------------ | | | | 597| 457k| E##mi = XOR256(Bmi, ANDnu256(Bmo, Bmu)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 598| 457k| XOReq256(Ci, E##mi); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 599| 457k| E##mo = XOR256(Bmo, ANDnu256(Bmu, Bma)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 600| 457k| XOReq256(Co, E##mo); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 601| 457k| E##mu = XOR256(Bmu, ANDnu256(Bma, Bme)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 602| 457k| XOReq256(Cu, E##mu); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 603| 457k|\ | | | | 604| 457k| XOReq256(A##bi, Di); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 605| 457k| ROL64in256(Bsa, A##bi, 62); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 606| 457k| XOReq256(A##go, Do); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 607| 457k| ROL64in256(Bse, A##go, 55); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 608| 457k| XOReq256(A##ku, Du); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 609| 457k| ROL64in256(Bsi, A##ku, 39); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 610| 457k| E##sa = XOR256(Bsa, ANDnu256(Bse, Bsi)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 611| 457k| XOReq256(Ca, E##sa); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 612| 457k| XOReq256(A##ma, Da); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 613| 457k| ROL64in256(Bso, A##ma, 41); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 614| 457k| E##se = XOR256(Bse, ANDnu256(Bsi, Bso)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 615| 457k| XOReq256(Ce, E##se); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 616| 457k| XOReq256(A##se, De); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 617| 457k| ROL64in256(Bsu, A##se, 2); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 618| 457k| E##si = XOR256(Bsi, ANDnu256(Bso, Bsu)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 619| 457k| XOReq256(Ci, E##si); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 620| 457k| E##so = XOR256(Bso, ANDnu256(Bsu, Bsa)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 621| 457k| XOReq256(Co, E##so); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 622| 457k| E##su = XOR256(Bsu, ANDnu256(Bsa, Bse)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 623| 457k| XOReq256(Cu, E##su); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | ------------------ | | 25| 457k| thetaRhoPiChiIotaPrepareTheta( 5, E, A) \ | | ------------------ | | | | 508| 457k| ROL64in256(Ce1, Ce, 1); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 509| 457k| Da = XOR256(Cu, Ce1); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 510| 457k| ROL64in256(Ci1, Ci, 1); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 511| 457k| De = XOR256(Ca, Ci1); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 512| 457k| ROL64in256(Co1, Co, 1); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 513| 457k| Di = XOR256(Ce, Co1); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 514| 457k| ROL64in256(Cu1, Cu, 1); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 515| 457k| Do = XOR256(Ci, Cu1); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 516| 457k| ROL64in256(Ca1, Ca, 1); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 517| 457k| Du = XOR256(Co, Ca1); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 518| 457k|\ | | | | 519| 457k| XOReq256(A##ba, Da); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 520| 457k| Bba = A##ba; \ | | | | 521| 457k| XOReq256(A##ge, De); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 522| 457k| ROL64in256(Bbe, A##ge, 44); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 523| 457k| XOReq256(A##ki, Di); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 524| 457k| ROL64in256(Bbi, A##ki, 43); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 525| 457k| E##ba = XOR256(Bba, ANDnu256(Bbe, Bbi)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 526| 457k| XOReq256(E##ba, CONST256_64(KeccakF1600RoundConstants[i])); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 527| 457k| Ca = E##ba; \ | | | | 528| 457k| XOReq256(A##mo, Do); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 529| 457k| ROL64in256(Bbo, A##mo, 21); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 530| 457k| E##be = XOR256(Bbe, ANDnu256(Bbi, Bbo)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 531| 457k| Ce = E##be; \ | | | | 532| 457k| XOReq256(A##su, Du); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 533| 457k| ROL64in256(Bbu, A##su, 14); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 534| 457k| E##bi = XOR256(Bbi, ANDnu256(Bbo, Bbu)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 535| 457k| Ci = E##bi; \ | | | | 536| 457k| E##bo = XOR256(Bbo, ANDnu256(Bbu, Bba)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 537| 457k| Co = E##bo; \ | | | | 538| 457k| E##bu = XOR256(Bbu, ANDnu256(Bba, Bbe)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 539| 457k| Cu = E##bu; \ | | | | 540| 457k|\ | | | | 541| 457k| XOReq256(A##bo, Do); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 542| 457k| ROL64in256(Bga, A##bo, 28); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 543| 457k| XOReq256(A##gu, Du); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 544| 457k| ROL64in256(Bge, A##gu, 20); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 545| 457k| XOReq256(A##ka, Da); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 546| 457k| ROL64in256(Bgi, A##ka, 3); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 547| 457k| E##ga = XOR256(Bga, ANDnu256(Bge, Bgi)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 548| 457k| XOReq256(Ca, E##ga); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 549| 457k| XOReq256(A##me, De); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 550| 457k| ROL64in256(Bgo, A##me, 45); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 551| 457k| E##ge = XOR256(Bge, ANDnu256(Bgi, Bgo)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 552| 457k| XOReq256(Ce, E##ge); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 553| 457k| XOReq256(A##si, Di); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 554| 457k| ROL64in256(Bgu, A##si, 61); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 555| 457k| E##gi = XOR256(Bgi, ANDnu256(Bgo, Bgu)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 556| 457k| XOReq256(Ci, E##gi); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 557| 457k| E##go = XOR256(Bgo, ANDnu256(Bgu, Bga)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 558| 457k| XOReq256(Co, E##go); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 559| 457k| E##gu = XOR256(Bgu, ANDnu256(Bga, Bge)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 560| 457k| XOReq256(Cu, E##gu); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 561| 457k|\ | | | | 562| 457k| XOReq256(A##be, De); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 563| 457k| ROL64in256(Bka, A##be, 1); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 564| 457k| XOReq256(A##gi, Di); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 565| 457k| ROL64in256(Bke, A##gi, 6); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 566| 457k| XOReq256(A##ko, Do); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 567| 457k| ROL64in256(Bki, A##ko, 25); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 568| 457k| E##ka = XOR256(Bka, ANDnu256(Bke, Bki)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 569| 457k| XOReq256(Ca, E##ka); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 570| 457k| XOReq256(A##mu, Du); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 571| 457k| ROL64in256_8(Bko, A##mu); \ | | | | ------------------ | | | | | | 52| 457k|#define ROL64in256_8(d, a) d = _mm256_shuffle_epi8(a, rho8.v) | | | | ------------------ | | | | 572| 457k| E##ke = XOR256(Bke, ANDnu256(Bki, Bko)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 573| 457k| XOReq256(Ce, E##ke); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 574| 457k| XOReq256(A##sa, Da); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 575| 457k| ROL64in256(Bku, A##sa, 18); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 576| 457k| E##ki = XOR256(Bki, ANDnu256(Bko, Bku)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 577| 457k| XOReq256(Ci, E##ki); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 578| 457k| E##ko = XOR256(Bko, ANDnu256(Bku, Bka)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 579| 457k| XOReq256(Co, E##ko); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 580| 457k| E##ku = XOR256(Bku, ANDnu256(Bka, Bke)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 581| 457k| XOReq256(Cu, E##ku); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 582| 457k|\ | | | | 583| 457k| XOReq256(A##bu, Du); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 584| 457k| ROL64in256(Bma, A##bu, 27); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 585| 457k| XOReq256(A##ga, Da); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 586| 457k| ROL64in256(Bme, A##ga, 36); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 587| 457k| XOReq256(A##ke, De); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 588| 457k| ROL64in256(Bmi, A##ke, 10); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 589| 457k| E##ma = XOR256(Bma, ANDnu256(Bme, Bmi)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 590| 457k| XOReq256(Ca, E##ma); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 591| 457k| XOReq256(A##mi, Di); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 592| 457k| ROL64in256(Bmo, A##mi, 15); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 593| 457k| E##me = XOR256(Bme, ANDnu256(Bmi, Bmo)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 594| 457k| XOReq256(Ce, E##me); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 595| 457k| XOReq256(A##so, Do); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 596| 457k| ROL64in256_56(Bmu, A##so); \ | | | | ------------------ | | | | | | 53| 457k|#define ROL64in256_56(d, a) d = _mm256_shuffle_epi8(a, rho56.v) | | | | ------------------ | | | | 597| 457k| E##mi = XOR256(Bmi, ANDnu256(Bmo, Bmu)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 598| 457k| XOReq256(Ci, E##mi); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 599| 457k| E##mo = XOR256(Bmo, ANDnu256(Bmu, Bma)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 600| 457k| XOReq256(Co, E##mo); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 601| 457k| E##mu = XOR256(Bmu, ANDnu256(Bma, Bme)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 602| 457k| XOReq256(Cu, E##mu); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 603| 457k|\ | | | | 604| 457k| XOReq256(A##bi, Di); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 605| 457k| ROL64in256(Bsa, A##bi, 62); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 606| 457k| XOReq256(A##go, Do); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 607| 457k| ROL64in256(Bse, A##go, 55); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 608| 457k| XOReq256(A##ku, Du); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 609| 457k| ROL64in256(Bsi, A##ku, 39); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 610| 457k| E##sa = XOR256(Bsa, ANDnu256(Bse, Bsi)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 611| 457k| XOReq256(Ca, E##sa); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 612| 457k| XOReq256(A##ma, Da); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 613| 457k| ROL64in256(Bso, A##ma, 41); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 614| 457k| E##se = XOR256(Bse, ANDnu256(Bsi, Bso)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 615| 457k| XOReq256(Ce, E##se); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 616| 457k| XOReq256(A##se, De); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 617| 457k| ROL64in256(Bsu, A##se, 2); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 618| 457k| E##si = XOR256(Bsi, ANDnu256(Bso, Bsu)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 619| 457k| XOReq256(Ci, E##si); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 620| 457k| E##so = XOR256(Bso, ANDnu256(Bsu, Bsa)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 621| 457k| XOReq256(Co, E##so); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 622| 457k| E##su = XOR256(Bsu, ANDnu256(Bsa, Bse)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 623| 457k| XOReq256(Cu, E##su); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | ------------------ | | 26| 457k| thetaRhoPiChiIotaPrepareTheta( 6, A, E) \ | | ------------------ | | | | 508| 457k| ROL64in256(Ce1, Ce, 1); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 509| 457k| Da = XOR256(Cu, Ce1); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 510| 457k| ROL64in256(Ci1, Ci, 1); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 511| 457k| De = XOR256(Ca, Ci1); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 512| 457k| ROL64in256(Co1, Co, 1); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 513| 457k| Di = XOR256(Ce, Co1); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 514| 457k| ROL64in256(Cu1, Cu, 1); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 515| 457k| Do = XOR256(Ci, Cu1); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 516| 457k| ROL64in256(Ca1, Ca, 1); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 517| 457k| Du = XOR256(Co, Ca1); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 518| 457k|\ | | | | 519| 457k| XOReq256(A##ba, Da); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 520| 457k| Bba = A##ba; \ | | | | 521| 457k| XOReq256(A##ge, De); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 522| 457k| ROL64in256(Bbe, A##ge, 44); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 523| 457k| XOReq256(A##ki, Di); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 524| 457k| ROL64in256(Bbi, A##ki, 43); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 525| 457k| E##ba = XOR256(Bba, ANDnu256(Bbe, Bbi)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 526| 457k| XOReq256(E##ba, CONST256_64(KeccakF1600RoundConstants[i])); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 527| 457k| Ca = E##ba; \ | | | | 528| 457k| XOReq256(A##mo, Do); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 529| 457k| ROL64in256(Bbo, A##mo, 21); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 530| 457k| E##be = XOR256(Bbe, ANDnu256(Bbi, Bbo)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 531| 457k| Ce = E##be; \ | | | | 532| 457k| XOReq256(A##su, Du); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 533| 457k| ROL64in256(Bbu, A##su, 14); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 534| 457k| E##bi = XOR256(Bbi, ANDnu256(Bbo, Bbu)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 535| 457k| Ci = E##bi; \ | | | | 536| 457k| E##bo = XOR256(Bbo, ANDnu256(Bbu, Bba)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 537| 457k| Co = E##bo; \ | | | | 538| 457k| E##bu = XOR256(Bbu, ANDnu256(Bba, Bbe)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 539| 457k| Cu = E##bu; \ | | | | 540| 457k|\ | | | | 541| 457k| XOReq256(A##bo, Do); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 542| 457k| ROL64in256(Bga, A##bo, 28); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 543| 457k| XOReq256(A##gu, Du); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 544| 457k| ROL64in256(Bge, A##gu, 20); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 545| 457k| XOReq256(A##ka, Da); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 546| 457k| ROL64in256(Bgi, A##ka, 3); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 547| 457k| E##ga = XOR256(Bga, ANDnu256(Bge, Bgi)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 548| 457k| XOReq256(Ca, E##ga); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 549| 457k| XOReq256(A##me, De); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 550| 457k| ROL64in256(Bgo, A##me, 45); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 551| 457k| E##ge = XOR256(Bge, ANDnu256(Bgi, Bgo)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 552| 457k| XOReq256(Ce, E##ge); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 553| 457k| XOReq256(A##si, Di); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 554| 457k| ROL64in256(Bgu, A##si, 61); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 555| 457k| E##gi = XOR256(Bgi, ANDnu256(Bgo, Bgu)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 556| 457k| XOReq256(Ci, E##gi); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 557| 457k| E##go = XOR256(Bgo, ANDnu256(Bgu, Bga)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 558| 457k| XOReq256(Co, E##go); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 559| 457k| E##gu = XOR256(Bgu, ANDnu256(Bga, Bge)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 560| 457k| XOReq256(Cu, E##gu); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 561| 457k|\ | | | | 562| 457k| XOReq256(A##be, De); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 563| 457k| ROL64in256(Bka, A##be, 1); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 564| 457k| XOReq256(A##gi, Di); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 565| 457k| ROL64in256(Bke, A##gi, 6); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 566| 457k| XOReq256(A##ko, Do); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 567| 457k| ROL64in256(Bki, A##ko, 25); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 568| 457k| E##ka = XOR256(Bka, ANDnu256(Bke, Bki)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 569| 457k| XOReq256(Ca, E##ka); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 570| 457k| XOReq256(A##mu, Du); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 571| 457k| ROL64in256_8(Bko, A##mu); \ | | | | ------------------ | | | | | | 52| 457k|#define ROL64in256_8(d, a) d = _mm256_shuffle_epi8(a, rho8.v) | | | | ------------------ | | | | 572| 457k| E##ke = XOR256(Bke, ANDnu256(Bki, Bko)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 573| 457k| XOReq256(Ce, E##ke); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 574| 457k| XOReq256(A##sa, Da); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 575| 457k| ROL64in256(Bku, A##sa, 18); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 576| 457k| E##ki = XOR256(Bki, ANDnu256(Bko, Bku)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 577| 457k| XOReq256(Ci, E##ki); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 578| 457k| E##ko = XOR256(Bko, ANDnu256(Bku, Bka)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 579| 457k| XOReq256(Co, E##ko); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 580| 457k| E##ku = XOR256(Bku, ANDnu256(Bka, Bke)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 581| 457k| XOReq256(Cu, E##ku); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 582| 457k|\ | | | | 583| 457k| XOReq256(A##bu, Du); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 584| 457k| ROL64in256(Bma, A##bu, 27); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 585| 457k| XOReq256(A##ga, Da); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 586| 457k| ROL64in256(Bme, A##ga, 36); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 587| 457k| XOReq256(A##ke, De); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 588| 457k| ROL64in256(Bmi, A##ke, 10); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 589| 457k| E##ma = XOR256(Bma, ANDnu256(Bme, Bmi)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 590| 457k| XOReq256(Ca, E##ma); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 591| 457k| XOReq256(A##mi, Di); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 592| 457k| ROL64in256(Bmo, A##mi, 15); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 593| 457k| E##me = XOR256(Bme, ANDnu256(Bmi, Bmo)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 594| 457k| XOReq256(Ce, E##me); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 595| 457k| XOReq256(A##so, Do); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 596| 457k| ROL64in256_56(Bmu, A##so); \ | | | | ------------------ | | | | | | 53| 457k|#define ROL64in256_56(d, a) d = _mm256_shuffle_epi8(a, rho56.v) | | | | ------------------ | | | | 597| 457k| E##mi = XOR256(Bmi, ANDnu256(Bmo, Bmu)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 598| 457k| XOReq256(Ci, E##mi); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 599| 457k| E##mo = XOR256(Bmo, ANDnu256(Bmu, Bma)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 600| 457k| XOReq256(Co, E##mo); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 601| 457k| E##mu = XOR256(Bmu, ANDnu256(Bma, Bme)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 602| 457k| XOReq256(Cu, E##mu); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 603| 457k|\ | | | | 604| 457k| XOReq256(A##bi, Di); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 605| 457k| ROL64in256(Bsa, A##bi, 62); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 606| 457k| XOReq256(A##go, Do); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 607| 457k| ROL64in256(Bse, A##go, 55); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 608| 457k| XOReq256(A##ku, Du); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 609| 457k| ROL64in256(Bsi, A##ku, 39); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 610| 457k| E##sa = XOR256(Bsa, ANDnu256(Bse, Bsi)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 611| 457k| XOReq256(Ca, E##sa); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 612| 457k| XOReq256(A##ma, Da); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 613| 457k| ROL64in256(Bso, A##ma, 41); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 614| 457k| E##se = XOR256(Bse, ANDnu256(Bsi, Bso)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 615| 457k| XOReq256(Ce, E##se); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 616| 457k| XOReq256(A##se, De); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 617| 457k| ROL64in256(Bsu, A##se, 2); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 618| 457k| E##si = XOR256(Bsi, ANDnu256(Bso, Bsu)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 619| 457k| XOReq256(Ci, E##si); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 620| 457k| E##so = XOR256(Bso, ANDnu256(Bsu, Bsa)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 621| 457k| XOReq256(Co, E##so); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 622| 457k| E##su = XOR256(Bsu, ANDnu256(Bsa, Bse)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 623| 457k| XOReq256(Cu, E##su); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | ------------------ | | 27| 457k| thetaRhoPiChiIotaPrepareTheta( 7, E, A) \ | | ------------------ | | | | 508| 457k| ROL64in256(Ce1, Ce, 1); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 509| 457k| Da = XOR256(Cu, Ce1); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 510| 457k| ROL64in256(Ci1, Ci, 1); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 511| 457k| De = XOR256(Ca, Ci1); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 512| 457k| ROL64in256(Co1, Co, 1); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 513| 457k| Di = XOR256(Ce, Co1); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 514| 457k| ROL64in256(Cu1, Cu, 1); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 515| 457k| Do = XOR256(Ci, Cu1); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 516| 457k| ROL64in256(Ca1, Ca, 1); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 517| 457k| Du = XOR256(Co, Ca1); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 518| 457k|\ | | | | 519| 457k| XOReq256(A##ba, Da); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 520| 457k| Bba = A##ba; \ | | | | 521| 457k| XOReq256(A##ge, De); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 522| 457k| ROL64in256(Bbe, A##ge, 44); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 523| 457k| XOReq256(A##ki, Di); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 524| 457k| ROL64in256(Bbi, A##ki, 43); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 525| 457k| E##ba = XOR256(Bba, ANDnu256(Bbe, Bbi)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 526| 457k| XOReq256(E##ba, CONST256_64(KeccakF1600RoundConstants[i])); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 527| 457k| Ca = E##ba; \ | | | | 528| 457k| XOReq256(A##mo, Do); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 529| 457k| ROL64in256(Bbo, A##mo, 21); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 530| 457k| E##be = XOR256(Bbe, ANDnu256(Bbi, Bbo)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 531| 457k| Ce = E##be; \ | | | | 532| 457k| XOReq256(A##su, Du); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 533| 457k| ROL64in256(Bbu, A##su, 14); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 534| 457k| E##bi = XOR256(Bbi, ANDnu256(Bbo, Bbu)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 535| 457k| Ci = E##bi; \ | | | | 536| 457k| E##bo = XOR256(Bbo, ANDnu256(Bbu, Bba)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 537| 457k| Co = E##bo; \ | | | | 538| 457k| E##bu = XOR256(Bbu, ANDnu256(Bba, Bbe)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 539| 457k| Cu = E##bu; \ | | | | 540| 457k|\ | | | | 541| 457k| XOReq256(A##bo, Do); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 542| 457k| ROL64in256(Bga, A##bo, 28); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 543| 457k| XOReq256(A##gu, Du); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 544| 457k| ROL64in256(Bge, A##gu, 20); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 545| 457k| XOReq256(A##ka, Da); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 546| 457k| ROL64in256(Bgi, A##ka, 3); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 547| 457k| E##ga = XOR256(Bga, ANDnu256(Bge, Bgi)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 548| 457k| XOReq256(Ca, E##ga); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 549| 457k| XOReq256(A##me, De); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 550| 457k| ROL64in256(Bgo, A##me, 45); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 551| 457k| E##ge = XOR256(Bge, ANDnu256(Bgi, Bgo)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 552| 457k| XOReq256(Ce, E##ge); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 553| 457k| XOReq256(A##si, Di); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 554| 457k| ROL64in256(Bgu, A##si, 61); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 555| 457k| E##gi = XOR256(Bgi, ANDnu256(Bgo, Bgu)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 556| 457k| XOReq256(Ci, E##gi); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 557| 457k| E##go = XOR256(Bgo, ANDnu256(Bgu, Bga)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 558| 457k| XOReq256(Co, E##go); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 559| 457k| E##gu = XOR256(Bgu, ANDnu256(Bga, Bge)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 560| 457k| XOReq256(Cu, E##gu); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 561| 457k|\ | | | | 562| 457k| XOReq256(A##be, De); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 563| 457k| ROL64in256(Bka, A##be, 1); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 564| 457k| XOReq256(A##gi, Di); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 565| 457k| ROL64in256(Bke, A##gi, 6); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 566| 457k| XOReq256(A##ko, Do); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 567| 457k| ROL64in256(Bki, A##ko, 25); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 568| 457k| E##ka = XOR256(Bka, ANDnu256(Bke, Bki)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 569| 457k| XOReq256(Ca, E##ka); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 570| 457k| XOReq256(A##mu, Du); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 571| 457k| ROL64in256_8(Bko, A##mu); \ | | | | ------------------ | | | | | | 52| 457k|#define ROL64in256_8(d, a) d = _mm256_shuffle_epi8(a, rho8.v) | | | | ------------------ | | | | 572| 457k| E##ke = XOR256(Bke, ANDnu256(Bki, Bko)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 573| 457k| XOReq256(Ce, E##ke); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 574| 457k| XOReq256(A##sa, Da); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 575| 457k| ROL64in256(Bku, A##sa, 18); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 576| 457k| E##ki = XOR256(Bki, ANDnu256(Bko, Bku)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 577| 457k| XOReq256(Ci, E##ki); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 578| 457k| E##ko = XOR256(Bko, ANDnu256(Bku, Bka)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 579| 457k| XOReq256(Co, E##ko); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 580| 457k| E##ku = XOR256(Bku, ANDnu256(Bka, Bke)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 581| 457k| XOReq256(Cu, E##ku); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 582| 457k|\ | | | | 583| 457k| XOReq256(A##bu, Du); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 584| 457k| ROL64in256(Bma, A##bu, 27); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 585| 457k| XOReq256(A##ga, Da); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 586| 457k| ROL64in256(Bme, A##ga, 36); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 587| 457k| XOReq256(A##ke, De); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 588| 457k| ROL64in256(Bmi, A##ke, 10); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 589| 457k| E##ma = XOR256(Bma, ANDnu256(Bme, Bmi)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 590| 457k| XOReq256(Ca, E##ma); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 591| 457k| XOReq256(A##mi, Di); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 592| 457k| ROL64in256(Bmo, A##mi, 15); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 593| 457k| E##me = XOR256(Bme, ANDnu256(Bmi, Bmo)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 594| 457k| XOReq256(Ce, E##me); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 595| 457k| XOReq256(A##so, Do); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 596| 457k| ROL64in256_56(Bmu, A##so); \ | | | | ------------------ | | | | | | 53| 457k|#define ROL64in256_56(d, a) d = _mm256_shuffle_epi8(a, rho56.v) | | | | ------------------ | | | | 597| 457k| E##mi = XOR256(Bmi, ANDnu256(Bmo, Bmu)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 598| 457k| XOReq256(Ci, E##mi); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 599| 457k| E##mo = XOR256(Bmo, ANDnu256(Bmu, Bma)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 600| 457k| XOReq256(Co, E##mo); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 601| 457k| E##mu = XOR256(Bmu, ANDnu256(Bma, Bme)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 602| 457k| XOReq256(Cu, E##mu); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 603| 457k|\ | | | | 604| 457k| XOReq256(A##bi, Di); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 605| 457k| ROL64in256(Bsa, A##bi, 62); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 606| 457k| XOReq256(A##go, Do); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 607| 457k| ROL64in256(Bse, A##go, 55); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 608| 457k| XOReq256(A##ku, Du); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 609| 457k| ROL64in256(Bsi, A##ku, 39); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 610| 457k| E##sa = XOR256(Bsa, ANDnu256(Bse, Bsi)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 611| 457k| XOReq256(Ca, E##sa); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 612| 457k| XOReq256(A##ma, Da); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 613| 457k| ROL64in256(Bso, A##ma, 41); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 614| 457k| E##se = XOR256(Bse, ANDnu256(Bsi, Bso)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 615| 457k| XOReq256(Ce, E##se); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 616| 457k| XOReq256(A##se, De); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 617| 457k| ROL64in256(Bsu, A##se, 2); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 618| 457k| E##si = XOR256(Bsi, ANDnu256(Bso, Bsu)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 619| 457k| XOReq256(Ci, E##si); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 620| 457k| E##so = XOR256(Bso, ANDnu256(Bsu, Bsa)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 621| 457k| XOReq256(Co, E##so); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 622| 457k| E##su = XOR256(Bsu, ANDnu256(Bsa, Bse)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 623| 457k| XOReq256(Cu, E##su); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | ------------------ | | 28| 457k| thetaRhoPiChiIotaPrepareTheta( 8, A, E) \ | | ------------------ | | | | 508| 457k| ROL64in256(Ce1, Ce, 1); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 509| 457k| Da = XOR256(Cu, Ce1); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 510| 457k| ROL64in256(Ci1, Ci, 1); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 511| 457k| De = XOR256(Ca, Ci1); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 512| 457k| ROL64in256(Co1, Co, 1); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 513| 457k| Di = XOR256(Ce, Co1); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 514| 457k| ROL64in256(Cu1, Cu, 1); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 515| 457k| Do = XOR256(Ci, Cu1); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 516| 457k| ROL64in256(Ca1, Ca, 1); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 517| 457k| Du = XOR256(Co, Ca1); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 518| 457k|\ | | | | 519| 457k| XOReq256(A##ba, Da); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 520| 457k| Bba = A##ba; \ | | | | 521| 457k| XOReq256(A##ge, De); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 522| 457k| ROL64in256(Bbe, A##ge, 44); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 523| 457k| XOReq256(A##ki, Di); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 524| 457k| ROL64in256(Bbi, A##ki, 43); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 525| 457k| E##ba = XOR256(Bba, ANDnu256(Bbe, Bbi)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 526| 457k| XOReq256(E##ba, CONST256_64(KeccakF1600RoundConstants[i])); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 527| 457k| Ca = E##ba; \ | | | | 528| 457k| XOReq256(A##mo, Do); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 529| 457k| ROL64in256(Bbo, A##mo, 21); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 530| 457k| E##be = XOR256(Bbe, ANDnu256(Bbi, Bbo)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 531| 457k| Ce = E##be; \ | | | | 532| 457k| XOReq256(A##su, Du); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 533| 457k| ROL64in256(Bbu, A##su, 14); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 534| 457k| E##bi = XOR256(Bbi, ANDnu256(Bbo, Bbu)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 535| 457k| Ci = E##bi; \ | | | | 536| 457k| E##bo = XOR256(Bbo, ANDnu256(Bbu, Bba)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 537| 457k| Co = E##bo; \ | | | | 538| 457k| E##bu = XOR256(Bbu, ANDnu256(Bba, Bbe)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 539| 457k| Cu = E##bu; \ | | | | 540| 457k|\ | | | | 541| 457k| XOReq256(A##bo, Do); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 542| 457k| ROL64in256(Bga, A##bo, 28); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 543| 457k| XOReq256(A##gu, Du); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 544| 457k| ROL64in256(Bge, A##gu, 20); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 545| 457k| XOReq256(A##ka, Da); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 546| 457k| ROL64in256(Bgi, A##ka, 3); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 547| 457k| E##ga = XOR256(Bga, ANDnu256(Bge, Bgi)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 548| 457k| XOReq256(Ca, E##ga); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 549| 457k| XOReq256(A##me, De); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 550| 457k| ROL64in256(Bgo, A##me, 45); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 551| 457k| E##ge = XOR256(Bge, ANDnu256(Bgi, Bgo)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 552| 457k| XOReq256(Ce, E##ge); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 553| 457k| XOReq256(A##si, Di); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 554| 457k| ROL64in256(Bgu, A##si, 61); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 555| 457k| E##gi = XOR256(Bgi, ANDnu256(Bgo, Bgu)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 556| 457k| XOReq256(Ci, E##gi); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 557| 457k| E##go = XOR256(Bgo, ANDnu256(Bgu, Bga)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 558| 457k| XOReq256(Co, E##go); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 559| 457k| E##gu = XOR256(Bgu, ANDnu256(Bga, Bge)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 560| 457k| XOReq256(Cu, E##gu); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 561| 457k|\ | | | | 562| 457k| XOReq256(A##be, De); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 563| 457k| ROL64in256(Bka, A##be, 1); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 564| 457k| XOReq256(A##gi, Di); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 565| 457k| ROL64in256(Bke, A##gi, 6); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 566| 457k| XOReq256(A##ko, Do); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 567| 457k| ROL64in256(Bki, A##ko, 25); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 568| 457k| E##ka = XOR256(Bka, ANDnu256(Bke, Bki)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 569| 457k| XOReq256(Ca, E##ka); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 570| 457k| XOReq256(A##mu, Du); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 571| 457k| ROL64in256_8(Bko, A##mu); \ | | | | ------------------ | | | | | | 52| 457k|#define ROL64in256_8(d, a) d = _mm256_shuffle_epi8(a, rho8.v) | | | | ------------------ | | | | 572| 457k| E##ke = XOR256(Bke, ANDnu256(Bki, Bko)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 573| 457k| XOReq256(Ce, E##ke); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 574| 457k| XOReq256(A##sa, Da); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 575| 457k| ROL64in256(Bku, A##sa, 18); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 576| 457k| E##ki = XOR256(Bki, ANDnu256(Bko, Bku)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 577| 457k| XOReq256(Ci, E##ki); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 578| 457k| E##ko = XOR256(Bko, ANDnu256(Bku, Bka)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 579| 457k| XOReq256(Co, E##ko); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 580| 457k| E##ku = XOR256(Bku, ANDnu256(Bka, Bke)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 581| 457k| XOReq256(Cu, E##ku); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 582| 457k|\ | | | | 583| 457k| XOReq256(A##bu, Du); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 584| 457k| ROL64in256(Bma, A##bu, 27); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 585| 457k| XOReq256(A##ga, Da); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 586| 457k| ROL64in256(Bme, A##ga, 36); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 587| 457k| XOReq256(A##ke, De); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 588| 457k| ROL64in256(Bmi, A##ke, 10); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 589| 457k| E##ma = XOR256(Bma, ANDnu256(Bme, Bmi)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 590| 457k| XOReq256(Ca, E##ma); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 591| 457k| XOReq256(A##mi, Di); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 592| 457k| ROL64in256(Bmo, A##mi, 15); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 593| 457k| E##me = XOR256(Bme, ANDnu256(Bmi, Bmo)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 594| 457k| XOReq256(Ce, E##me); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 595| 457k| XOReq256(A##so, Do); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 596| 457k| ROL64in256_56(Bmu, A##so); \ | | | | ------------------ | | | | | | 53| 457k|#define ROL64in256_56(d, a) d = _mm256_shuffle_epi8(a, rho56.v) | | | | ------------------ | | | | 597| 457k| E##mi = XOR256(Bmi, ANDnu256(Bmo, Bmu)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 598| 457k| XOReq256(Ci, E##mi); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 599| 457k| E##mo = XOR256(Bmo, ANDnu256(Bmu, Bma)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 600| 457k| XOReq256(Co, E##mo); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 601| 457k| E##mu = XOR256(Bmu, ANDnu256(Bma, Bme)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 602| 457k| XOReq256(Cu, E##mu); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 603| 457k|\ | | | | 604| 457k| XOReq256(A##bi, Di); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 605| 457k| ROL64in256(Bsa, A##bi, 62); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 606| 457k| XOReq256(A##go, Do); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 607| 457k| ROL64in256(Bse, A##go, 55); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 608| 457k| XOReq256(A##ku, Du); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 609| 457k| ROL64in256(Bsi, A##ku, 39); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 610| 457k| E##sa = XOR256(Bsa, ANDnu256(Bse, Bsi)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 611| 457k| XOReq256(Ca, E##sa); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 612| 457k| XOReq256(A##ma, Da); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 613| 457k| ROL64in256(Bso, A##ma, 41); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 614| 457k| E##se = XOR256(Bse, ANDnu256(Bsi, Bso)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 615| 457k| XOReq256(Ce, E##se); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 616| 457k| XOReq256(A##se, De); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 617| 457k| ROL64in256(Bsu, A##se, 2); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 618| 457k| E##si = XOR256(Bsi, ANDnu256(Bso, Bsu)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 619| 457k| XOReq256(Ci, E##si); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 620| 457k| E##so = XOR256(Bso, ANDnu256(Bsu, Bsa)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 621| 457k| XOReq256(Co, E##so); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 622| 457k| E##su = XOR256(Bsu, ANDnu256(Bsa, Bse)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 623| 457k| XOReq256(Cu, E##su); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | ------------------ | | 29| 457k| thetaRhoPiChiIotaPrepareTheta( 9, E, A) \ | | ------------------ | | | | 508| 457k| ROL64in256(Ce1, Ce, 1); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 509| 457k| Da = XOR256(Cu, Ce1); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 510| 457k| ROL64in256(Ci1, Ci, 1); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 511| 457k| De = XOR256(Ca, Ci1); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 512| 457k| ROL64in256(Co1, Co, 1); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 513| 457k| Di = XOR256(Ce, Co1); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 514| 457k| ROL64in256(Cu1, Cu, 1); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 515| 457k| Do = XOR256(Ci, Cu1); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 516| 457k| ROL64in256(Ca1, Ca, 1); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 517| 457k| Du = XOR256(Co, Ca1); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 518| 457k|\ | | | | 519| 457k| XOReq256(A##ba, Da); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 520| 457k| Bba = A##ba; \ | | | | 521| 457k| XOReq256(A##ge, De); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 522| 457k| ROL64in256(Bbe, A##ge, 44); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 523| 457k| XOReq256(A##ki, Di); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 524| 457k| ROL64in256(Bbi, A##ki, 43); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 525| 457k| E##ba = XOR256(Bba, ANDnu256(Bbe, Bbi)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 526| 457k| XOReq256(E##ba, CONST256_64(KeccakF1600RoundConstants[i])); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 527| 457k| Ca = E##ba; \ | | | | 528| 457k| XOReq256(A##mo, Do); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 529| 457k| ROL64in256(Bbo, A##mo, 21); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 530| 457k| E##be = XOR256(Bbe, ANDnu256(Bbi, Bbo)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 531| 457k| Ce = E##be; \ | | | | 532| 457k| XOReq256(A##su, Du); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 533| 457k| ROL64in256(Bbu, A##su, 14); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 534| 457k| E##bi = XOR256(Bbi, ANDnu256(Bbo, Bbu)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 535| 457k| Ci = E##bi; \ | | | | 536| 457k| E##bo = XOR256(Bbo, ANDnu256(Bbu, Bba)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 537| 457k| Co = E##bo; \ | | | | 538| 457k| E##bu = XOR256(Bbu, ANDnu256(Bba, Bbe)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 539| 457k| Cu = E##bu; \ | | | | 540| 457k|\ | | | | 541| 457k| XOReq256(A##bo, Do); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 542| 457k| ROL64in256(Bga, A##bo, 28); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 543| 457k| XOReq256(A##gu, Du); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 544| 457k| ROL64in256(Bge, A##gu, 20); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 545| 457k| XOReq256(A##ka, Da); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 546| 457k| ROL64in256(Bgi, A##ka, 3); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 547| 457k| E##ga = XOR256(Bga, ANDnu256(Bge, Bgi)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 548| 457k| XOReq256(Ca, E##ga); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 549| 457k| XOReq256(A##me, De); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 550| 457k| ROL64in256(Bgo, A##me, 45); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 551| 457k| E##ge = XOR256(Bge, ANDnu256(Bgi, Bgo)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 552| 457k| XOReq256(Ce, E##ge); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 553| 457k| XOReq256(A##si, Di); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 554| 457k| ROL64in256(Bgu, A##si, 61); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 555| 457k| E##gi = XOR256(Bgi, ANDnu256(Bgo, Bgu)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 556| 457k| XOReq256(Ci, E##gi); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 557| 457k| E##go = XOR256(Bgo, ANDnu256(Bgu, Bga)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 558| 457k| XOReq256(Co, E##go); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 559| 457k| E##gu = XOR256(Bgu, ANDnu256(Bga, Bge)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 560| 457k| XOReq256(Cu, E##gu); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 561| 457k|\ | | | | 562| 457k| XOReq256(A##be, De); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 563| 457k| ROL64in256(Bka, A##be, 1); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 564| 457k| XOReq256(A##gi, Di); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 565| 457k| ROL64in256(Bke, A##gi, 6); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 566| 457k| XOReq256(A##ko, Do); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 567| 457k| ROL64in256(Bki, A##ko, 25); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 568| 457k| E##ka = XOR256(Bka, ANDnu256(Bke, Bki)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 569| 457k| XOReq256(Ca, E##ka); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 570| 457k| XOReq256(A##mu, Du); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 571| 457k| ROL64in256_8(Bko, A##mu); \ | | | | ------------------ | | | | | | 52| 457k|#define ROL64in256_8(d, a) d = _mm256_shuffle_epi8(a, rho8.v) | | | | ------------------ | | | | 572| 457k| E##ke = XOR256(Bke, ANDnu256(Bki, Bko)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 573| 457k| XOReq256(Ce, E##ke); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 574| 457k| XOReq256(A##sa, Da); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 575| 457k| ROL64in256(Bku, A##sa, 18); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 576| 457k| E##ki = XOR256(Bki, ANDnu256(Bko, Bku)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 577| 457k| XOReq256(Ci, E##ki); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 578| 457k| E##ko = XOR256(Bko, ANDnu256(Bku, Bka)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 579| 457k| XOReq256(Co, E##ko); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 580| 457k| E##ku = XOR256(Bku, ANDnu256(Bka, Bke)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 581| 457k| XOReq256(Cu, E##ku); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 582| 457k|\ | | | | 583| 457k| XOReq256(A##bu, Du); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 584| 457k| ROL64in256(Bma, A##bu, 27); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 585| 457k| XOReq256(A##ga, Da); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 586| 457k| ROL64in256(Bme, A##ga, 36); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 587| 457k| XOReq256(A##ke, De); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 588| 457k| ROL64in256(Bmi, A##ke, 10); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 589| 457k| E##ma = XOR256(Bma, ANDnu256(Bme, Bmi)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 590| 457k| XOReq256(Ca, E##ma); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 591| 457k| XOReq256(A##mi, Di); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 592| 457k| ROL64in256(Bmo, A##mi, 15); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 593| 457k| E##me = XOR256(Bme, ANDnu256(Bmi, Bmo)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 594| 457k| XOReq256(Ce, E##me); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 595| 457k| XOReq256(A##so, Do); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 596| 457k| ROL64in256_56(Bmu, A##so); \ | | | | ------------------ | | | | | | 53| 457k|#define ROL64in256_56(d, a) d = _mm256_shuffle_epi8(a, rho56.v) | | | | ------------------ | | | | 597| 457k| E##mi = XOR256(Bmi, ANDnu256(Bmo, Bmu)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 598| 457k| XOReq256(Ci, E##mi); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 599| 457k| E##mo = XOR256(Bmo, ANDnu256(Bmu, Bma)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 600| 457k| XOReq256(Co, E##mo); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 601| 457k| E##mu = XOR256(Bmu, ANDnu256(Bma, Bme)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 602| 457k| XOReq256(Cu, E##mu); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 603| 457k|\ | | | | 604| 457k| XOReq256(A##bi, Di); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 605| 457k| ROL64in256(Bsa, A##bi, 62); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 606| 457k| XOReq256(A##go, Do); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 607| 457k| ROL64in256(Bse, A##go, 55); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 608| 457k| XOReq256(A##ku, Du); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 609| 457k| ROL64in256(Bsi, A##ku, 39); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 610| 457k| E##sa = XOR256(Bsa, ANDnu256(Bse, Bsi)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 611| 457k| XOReq256(Ca, E##sa); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 612| 457k| XOReq256(A##ma, Da); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 613| 457k| ROL64in256(Bso, A##ma, 41); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 614| 457k| E##se = XOR256(Bse, ANDnu256(Bsi, Bso)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 615| 457k| XOReq256(Ce, E##se); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 616| 457k| XOReq256(A##se, De); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 617| 457k| ROL64in256(Bsu, A##se, 2); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 618| 457k| E##si = XOR256(Bsi, ANDnu256(Bso, Bsu)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 619| 457k| XOReq256(Ci, E##si); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 620| 457k| E##so = XOR256(Bso, ANDnu256(Bsu, Bsa)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 621| 457k| XOReq256(Co, E##so); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 622| 457k| E##su = XOR256(Bsu, ANDnu256(Bsa, Bse)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 623| 457k| XOReq256(Cu, E##su); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | ------------------ | | 30| 457k| thetaRhoPiChiIotaPrepareTheta(10, A, E) \ | | ------------------ | | | | 508| 457k| ROL64in256(Ce1, Ce, 1); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 509| 457k| Da = XOR256(Cu, Ce1); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 510| 457k| ROL64in256(Ci1, Ci, 1); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 511| 457k| De = XOR256(Ca, Ci1); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 512| 457k| ROL64in256(Co1, Co, 1); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 513| 457k| Di = XOR256(Ce, Co1); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 514| 457k| ROL64in256(Cu1, Cu, 1); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 515| 457k| Do = XOR256(Ci, Cu1); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 516| 457k| ROL64in256(Ca1, Ca, 1); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 517| 457k| Du = XOR256(Co, Ca1); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 518| 457k|\ | | | | 519| 457k| XOReq256(A##ba, Da); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 520| 457k| Bba = A##ba; \ | | | | 521| 457k| XOReq256(A##ge, De); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 522| 457k| ROL64in256(Bbe, A##ge, 44); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 523| 457k| XOReq256(A##ki, Di); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 524| 457k| ROL64in256(Bbi, A##ki, 43); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 525| 457k| E##ba = XOR256(Bba, ANDnu256(Bbe, Bbi)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 526| 457k| XOReq256(E##ba, CONST256_64(KeccakF1600RoundConstants[i])); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 527| 457k| Ca = E##ba; \ | | | | 528| 457k| XOReq256(A##mo, Do); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 529| 457k| ROL64in256(Bbo, A##mo, 21); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 530| 457k| E##be = XOR256(Bbe, ANDnu256(Bbi, Bbo)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 531| 457k| Ce = E##be; \ | | | | 532| 457k| XOReq256(A##su, Du); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 533| 457k| ROL64in256(Bbu, A##su, 14); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 534| 457k| E##bi = XOR256(Bbi, ANDnu256(Bbo, Bbu)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 535| 457k| Ci = E##bi; \ | | | | 536| 457k| E##bo = XOR256(Bbo, ANDnu256(Bbu, Bba)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 537| 457k| Co = E##bo; \ | | | | 538| 457k| E##bu = XOR256(Bbu, ANDnu256(Bba, Bbe)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 539| 457k| Cu = E##bu; \ | | | | 540| 457k|\ | | | | 541| 457k| XOReq256(A##bo, Do); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 542| 457k| ROL64in256(Bga, A##bo, 28); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 543| 457k| XOReq256(A##gu, Du); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 544| 457k| ROL64in256(Bge, A##gu, 20); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 545| 457k| XOReq256(A##ka, Da); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 546| 457k| ROL64in256(Bgi, A##ka, 3); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 547| 457k| E##ga = XOR256(Bga, ANDnu256(Bge, Bgi)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 548| 457k| XOReq256(Ca, E##ga); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 549| 457k| XOReq256(A##me, De); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 550| 457k| ROL64in256(Bgo, A##me, 45); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 551| 457k| E##ge = XOR256(Bge, ANDnu256(Bgi, Bgo)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 552| 457k| XOReq256(Ce, E##ge); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 553| 457k| XOReq256(A##si, Di); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 554| 457k| ROL64in256(Bgu, A##si, 61); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 555| 457k| E##gi = XOR256(Bgi, ANDnu256(Bgo, Bgu)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 556| 457k| XOReq256(Ci, E##gi); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 557| 457k| E##go = XOR256(Bgo, ANDnu256(Bgu, Bga)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 558| 457k| XOReq256(Co, E##go); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 559| 457k| E##gu = XOR256(Bgu, ANDnu256(Bga, Bge)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 560| 457k| XOReq256(Cu, E##gu); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 561| 457k|\ | | | | 562| 457k| XOReq256(A##be, De); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 563| 457k| ROL64in256(Bka, A##be, 1); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 564| 457k| XOReq256(A##gi, Di); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 565| 457k| ROL64in256(Bke, A##gi, 6); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 566| 457k| XOReq256(A##ko, Do); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 567| 457k| ROL64in256(Bki, A##ko, 25); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 568| 457k| E##ka = XOR256(Bka, ANDnu256(Bke, Bki)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 569| 457k| XOReq256(Ca, E##ka); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 570| 457k| XOReq256(A##mu, Du); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 571| 457k| ROL64in256_8(Bko, A##mu); \ | | | | ------------------ | | | | | | 52| 457k|#define ROL64in256_8(d, a) d = _mm256_shuffle_epi8(a, rho8.v) | | | | ------------------ | | | | 572| 457k| E##ke = XOR256(Bke, ANDnu256(Bki, Bko)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 573| 457k| XOReq256(Ce, E##ke); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 574| 457k| XOReq256(A##sa, Da); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 575| 457k| ROL64in256(Bku, A##sa, 18); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 576| 457k| E##ki = XOR256(Bki, ANDnu256(Bko, Bku)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 577| 457k| XOReq256(Ci, E##ki); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 578| 457k| E##ko = XOR256(Bko, ANDnu256(Bku, Bka)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 579| 457k| XOReq256(Co, E##ko); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 580| 457k| E##ku = XOR256(Bku, ANDnu256(Bka, Bke)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 581| 457k| XOReq256(Cu, E##ku); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 582| 457k|\ | | | | 583| 457k| XOReq256(A##bu, Du); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 584| 457k| ROL64in256(Bma, A##bu, 27); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 585| 457k| XOReq256(A##ga, Da); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 586| 457k| ROL64in256(Bme, A##ga, 36); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 587| 457k| XOReq256(A##ke, De); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 588| 457k| ROL64in256(Bmi, A##ke, 10); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 589| 457k| E##ma = XOR256(Bma, ANDnu256(Bme, Bmi)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 590| 457k| XOReq256(Ca, E##ma); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 591| 457k| XOReq256(A##mi, Di); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 592| 457k| ROL64in256(Bmo, A##mi, 15); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 593| 457k| E##me = XOR256(Bme, ANDnu256(Bmi, Bmo)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 594| 457k| XOReq256(Ce, E##me); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 595| 457k| XOReq256(A##so, Do); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 596| 457k| ROL64in256_56(Bmu, A##so); \ | | | | ------------------ | | | | | | 53| 457k|#define ROL64in256_56(d, a) d = _mm256_shuffle_epi8(a, rho56.v) | | | | ------------------ | | | | 597| 457k| E##mi = XOR256(Bmi, ANDnu256(Bmo, Bmu)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 598| 457k| XOReq256(Ci, E##mi); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 599| 457k| E##mo = XOR256(Bmo, ANDnu256(Bmu, Bma)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 600| 457k| XOReq256(Co, E##mo); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 601| 457k| E##mu = XOR256(Bmu, ANDnu256(Bma, Bme)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 602| 457k| XOReq256(Cu, E##mu); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 603| 457k|\ | | | | 604| 457k| XOReq256(A##bi, Di); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 605| 457k| ROL64in256(Bsa, A##bi, 62); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 606| 457k| XOReq256(A##go, Do); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 607| 457k| ROL64in256(Bse, A##go, 55); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 608| 457k| XOReq256(A##ku, Du); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 609| 457k| ROL64in256(Bsi, A##ku, 39); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 610| 457k| E##sa = XOR256(Bsa, ANDnu256(Bse, Bsi)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 611| 457k| XOReq256(Ca, E##sa); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 612| 457k| XOReq256(A##ma, Da); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 613| 457k| ROL64in256(Bso, A##ma, 41); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 614| 457k| E##se = XOR256(Bse, ANDnu256(Bsi, Bso)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 615| 457k| XOReq256(Ce, E##se); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 616| 457k| XOReq256(A##se, De); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 617| 457k| ROL64in256(Bsu, A##se, 2); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 618| 457k| E##si = XOR256(Bsi, ANDnu256(Bso, Bsu)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 619| 457k| XOReq256(Ci, E##si); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 620| 457k| E##so = XOR256(Bso, ANDnu256(Bsu, Bsa)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 621| 457k| XOReq256(Co, E##so); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 622| 457k| E##su = XOR256(Bsu, ANDnu256(Bsa, Bse)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 623| 457k| XOReq256(Cu, E##su); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | ------------------ | | 31| 457k| thetaRhoPiChiIotaPrepareTheta(11, E, A) \ | | ------------------ | | | | 508| 457k| ROL64in256(Ce1, Ce, 1); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 509| 457k| Da = XOR256(Cu, Ce1); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 510| 457k| ROL64in256(Ci1, Ci, 1); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 511| 457k| De = XOR256(Ca, Ci1); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 512| 457k| ROL64in256(Co1, Co, 1); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 513| 457k| Di = XOR256(Ce, Co1); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 514| 457k| ROL64in256(Cu1, Cu, 1); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 515| 457k| Do = XOR256(Ci, Cu1); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 516| 457k| ROL64in256(Ca1, Ca, 1); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 517| 457k| Du = XOR256(Co, Ca1); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 518| 457k|\ | | | | 519| 457k| XOReq256(A##ba, Da); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 520| 457k| Bba = A##ba; \ | | | | 521| 457k| XOReq256(A##ge, De); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 522| 457k| ROL64in256(Bbe, A##ge, 44); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 523| 457k| XOReq256(A##ki, Di); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 524| 457k| ROL64in256(Bbi, A##ki, 43); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 525| 457k| E##ba = XOR256(Bba, ANDnu256(Bbe, Bbi)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 526| 457k| XOReq256(E##ba, CONST256_64(KeccakF1600RoundConstants[i])); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 527| 457k| Ca = E##ba; \ | | | | 528| 457k| XOReq256(A##mo, Do); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 529| 457k| ROL64in256(Bbo, A##mo, 21); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 530| 457k| E##be = XOR256(Bbe, ANDnu256(Bbi, Bbo)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 531| 457k| Ce = E##be; \ | | | | 532| 457k| XOReq256(A##su, Du); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 533| 457k| ROL64in256(Bbu, A##su, 14); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 534| 457k| E##bi = XOR256(Bbi, ANDnu256(Bbo, Bbu)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 535| 457k| Ci = E##bi; \ | | | | 536| 457k| E##bo = XOR256(Bbo, ANDnu256(Bbu, Bba)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 537| 457k| Co = E##bo; \ | | | | 538| 457k| E##bu = XOR256(Bbu, ANDnu256(Bba, Bbe)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 539| 457k| Cu = E##bu; \ | | | | 540| 457k|\ | | | | 541| 457k| XOReq256(A##bo, Do); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 542| 457k| ROL64in256(Bga, A##bo, 28); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 543| 457k| XOReq256(A##gu, Du); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 544| 457k| ROL64in256(Bge, A##gu, 20); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 545| 457k| XOReq256(A##ka, Da); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 546| 457k| ROL64in256(Bgi, A##ka, 3); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 547| 457k| E##ga = XOR256(Bga, ANDnu256(Bge, Bgi)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 548| 457k| XOReq256(Ca, E##ga); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 549| 457k| XOReq256(A##me, De); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 550| 457k| ROL64in256(Bgo, A##me, 45); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 551| 457k| E##ge = XOR256(Bge, ANDnu256(Bgi, Bgo)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 552| 457k| XOReq256(Ce, E##ge); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 553| 457k| XOReq256(A##si, Di); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 554| 457k| ROL64in256(Bgu, A##si, 61); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 555| 457k| E##gi = XOR256(Bgi, ANDnu256(Bgo, Bgu)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 556| 457k| XOReq256(Ci, E##gi); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 557| 457k| E##go = XOR256(Bgo, ANDnu256(Bgu, Bga)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 558| 457k| XOReq256(Co, E##go); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 559| 457k| E##gu = XOR256(Bgu, ANDnu256(Bga, Bge)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 560| 457k| XOReq256(Cu, E##gu); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 561| 457k|\ | | | | 562| 457k| XOReq256(A##be, De); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 563| 457k| ROL64in256(Bka, A##be, 1); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 564| 457k| XOReq256(A##gi, Di); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 565| 457k| ROL64in256(Bke, A##gi, 6); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 566| 457k| XOReq256(A##ko, Do); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 567| 457k| ROL64in256(Bki, A##ko, 25); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 568| 457k| E##ka = XOR256(Bka, ANDnu256(Bke, Bki)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 569| 457k| XOReq256(Ca, E##ka); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 570| 457k| XOReq256(A##mu, Du); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 571| 457k| ROL64in256_8(Bko, A##mu); \ | | | | ------------------ | | | | | | 52| 457k|#define ROL64in256_8(d, a) d = _mm256_shuffle_epi8(a, rho8.v) | | | | ------------------ | | | | 572| 457k| E##ke = XOR256(Bke, ANDnu256(Bki, Bko)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 573| 457k| XOReq256(Ce, E##ke); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 574| 457k| XOReq256(A##sa, Da); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 575| 457k| ROL64in256(Bku, A##sa, 18); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 576| 457k| E##ki = XOR256(Bki, ANDnu256(Bko, Bku)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 577| 457k| XOReq256(Ci, E##ki); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 578| 457k| E##ko = XOR256(Bko, ANDnu256(Bku, Bka)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 579| 457k| XOReq256(Co, E##ko); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 580| 457k| E##ku = XOR256(Bku, ANDnu256(Bka, Bke)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 581| 457k| XOReq256(Cu, E##ku); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 582| 457k|\ | | | | 583| 457k| XOReq256(A##bu, Du); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 584| 457k| ROL64in256(Bma, A##bu, 27); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 585| 457k| XOReq256(A##ga, Da); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 586| 457k| ROL64in256(Bme, A##ga, 36); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 587| 457k| XOReq256(A##ke, De); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 588| 457k| ROL64in256(Bmi, A##ke, 10); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 589| 457k| E##ma = XOR256(Bma, ANDnu256(Bme, Bmi)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 590| 457k| XOReq256(Ca, E##ma); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 591| 457k| XOReq256(A##mi, Di); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 592| 457k| ROL64in256(Bmo, A##mi, 15); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 593| 457k| E##me = XOR256(Bme, ANDnu256(Bmi, Bmo)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 594| 457k| XOReq256(Ce, E##me); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 595| 457k| XOReq256(A##so, Do); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 596| 457k| ROL64in256_56(Bmu, A##so); \ | | | | ------------------ | | | | | | 53| 457k|#define ROL64in256_56(d, a) d = _mm256_shuffle_epi8(a, rho56.v) | | | | ------------------ | | | | 597| 457k| E##mi = XOR256(Bmi, ANDnu256(Bmo, Bmu)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 598| 457k| XOReq256(Ci, E##mi); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 599| 457k| E##mo = XOR256(Bmo, ANDnu256(Bmu, Bma)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 600| 457k| XOReq256(Co, E##mo); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 601| 457k| E##mu = XOR256(Bmu, ANDnu256(Bma, Bme)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 602| 457k| XOReq256(Cu, E##mu); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 603| 457k|\ | | | | 604| 457k| XOReq256(A##bi, Di); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 605| 457k| ROL64in256(Bsa, A##bi, 62); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 606| 457k| XOReq256(A##go, Do); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 607| 457k| ROL64in256(Bse, A##go, 55); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 608| 457k| XOReq256(A##ku, Du); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 609| 457k| ROL64in256(Bsi, A##ku, 39); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 610| 457k| E##sa = XOR256(Bsa, ANDnu256(Bse, Bsi)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 611| 457k| XOReq256(Ca, E##sa); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 612| 457k| XOReq256(A##ma, Da); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 613| 457k| ROL64in256(Bso, A##ma, 41); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 614| 457k| E##se = XOR256(Bse, ANDnu256(Bsi, Bso)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 615| 457k| XOReq256(Ce, E##se); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 616| 457k| XOReq256(A##se, De); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 617| 457k| ROL64in256(Bsu, A##se, 2); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 618| 457k| E##si = XOR256(Bsi, ANDnu256(Bso, Bsu)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 619| 457k| XOReq256(Ci, E##si); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 620| 457k| E##so = XOR256(Bso, ANDnu256(Bsu, Bsa)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 621| 457k| XOReq256(Co, E##so); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 622| 457k| E##su = XOR256(Bsu, ANDnu256(Bsa, Bse)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 623| 457k| XOReq256(Cu, E##su); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | ------------------ | | 32| 457k| thetaRhoPiChiIotaPrepareTheta(12, A, E) \ | | ------------------ | | | | 508| 457k| ROL64in256(Ce1, Ce, 1); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 509| 457k| Da = XOR256(Cu, Ce1); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 510| 457k| ROL64in256(Ci1, Ci, 1); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 511| 457k| De = XOR256(Ca, Ci1); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 512| 457k| ROL64in256(Co1, Co, 1); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 513| 457k| Di = XOR256(Ce, Co1); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 514| 457k| ROL64in256(Cu1, Cu, 1); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 515| 457k| Do = XOR256(Ci, Cu1); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 516| 457k| ROL64in256(Ca1, Ca, 1); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 517| 457k| Du = XOR256(Co, Ca1); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 518| 457k|\ | | | | 519| 457k| XOReq256(A##ba, Da); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 520| 457k| Bba = A##ba; \ | | | | 521| 457k| XOReq256(A##ge, De); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 522| 457k| ROL64in256(Bbe, A##ge, 44); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 523| 457k| XOReq256(A##ki, Di); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 524| 457k| ROL64in256(Bbi, A##ki, 43); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 525| 457k| E##ba = XOR256(Bba, ANDnu256(Bbe, Bbi)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 526| 457k| XOReq256(E##ba, CONST256_64(KeccakF1600RoundConstants[i])); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 527| 457k| Ca = E##ba; \ | | | | 528| 457k| XOReq256(A##mo, Do); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 529| 457k| ROL64in256(Bbo, A##mo, 21); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 530| 457k| E##be = XOR256(Bbe, ANDnu256(Bbi, Bbo)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 531| 457k| Ce = E##be; \ | | | | 532| 457k| XOReq256(A##su, Du); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 533| 457k| ROL64in256(Bbu, A##su, 14); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 534| 457k| E##bi = XOR256(Bbi, ANDnu256(Bbo, Bbu)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 535| 457k| Ci = E##bi; \ | | | | 536| 457k| E##bo = XOR256(Bbo, ANDnu256(Bbu, Bba)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 537| 457k| Co = E##bo; \ | | | | 538| 457k| E##bu = XOR256(Bbu, ANDnu256(Bba, Bbe)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 539| 457k| Cu = E##bu; \ | | | | 540| 457k|\ | | | | 541| 457k| XOReq256(A##bo, Do); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 542| 457k| ROL64in256(Bga, A##bo, 28); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 543| 457k| XOReq256(A##gu, Du); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 544| 457k| ROL64in256(Bge, A##gu, 20); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 545| 457k| XOReq256(A##ka, Da); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 546| 457k| ROL64in256(Bgi, A##ka, 3); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 547| 457k| E##ga = XOR256(Bga, ANDnu256(Bge, Bgi)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 548| 457k| XOReq256(Ca, E##ga); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 549| 457k| XOReq256(A##me, De); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 550| 457k| ROL64in256(Bgo, A##me, 45); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 551| 457k| E##ge = XOR256(Bge, ANDnu256(Bgi, Bgo)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 552| 457k| XOReq256(Ce, E##ge); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 553| 457k| XOReq256(A##si, Di); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 554| 457k| ROL64in256(Bgu, A##si, 61); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 555| 457k| E##gi = XOR256(Bgi, ANDnu256(Bgo, Bgu)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 556| 457k| XOReq256(Ci, E##gi); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 557| 457k| E##go = XOR256(Bgo, ANDnu256(Bgu, Bga)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 558| 457k| XOReq256(Co, E##go); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 559| 457k| E##gu = XOR256(Bgu, ANDnu256(Bga, Bge)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 560| 457k| XOReq256(Cu, E##gu); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 561| 457k|\ | | | | 562| 457k| XOReq256(A##be, De); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 563| 457k| ROL64in256(Bka, A##be, 1); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 564| 457k| XOReq256(A##gi, Di); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 565| 457k| ROL64in256(Bke, A##gi, 6); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 566| 457k| XOReq256(A##ko, Do); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 567| 457k| ROL64in256(Bki, A##ko, 25); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 568| 457k| E##ka = XOR256(Bka, ANDnu256(Bke, Bki)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 569| 457k| XOReq256(Ca, E##ka); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 570| 457k| XOReq256(A##mu, Du); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 571| 457k| ROL64in256_8(Bko, A##mu); \ | | | | ------------------ | | | | | | 52| 457k|#define ROL64in256_8(d, a) d = _mm256_shuffle_epi8(a, rho8.v) | | | | ------------------ | | | | 572| 457k| E##ke = XOR256(Bke, ANDnu256(Bki, Bko)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 573| 457k| XOReq256(Ce, E##ke); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 574| 457k| XOReq256(A##sa, Da); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 575| 457k| ROL64in256(Bku, A##sa, 18); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 576| 457k| E##ki = XOR256(Bki, ANDnu256(Bko, Bku)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 577| 457k| XOReq256(Ci, E##ki); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 578| 457k| E##ko = XOR256(Bko, ANDnu256(Bku, Bka)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 579| 457k| XOReq256(Co, E##ko); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 580| 457k| E##ku = XOR256(Bku, ANDnu256(Bka, Bke)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 581| 457k| XOReq256(Cu, E##ku); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 582| 457k|\ | | | | 583| 457k| XOReq256(A##bu, Du); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 584| 457k| ROL64in256(Bma, A##bu, 27); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 585| 457k| XOReq256(A##ga, Da); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 586| 457k| ROL64in256(Bme, A##ga, 36); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 587| 457k| XOReq256(A##ke, De); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 588| 457k| ROL64in256(Bmi, A##ke, 10); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 589| 457k| E##ma = XOR256(Bma, ANDnu256(Bme, Bmi)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 590| 457k| XOReq256(Ca, E##ma); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 591| 457k| XOReq256(A##mi, Di); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 592| 457k| ROL64in256(Bmo, A##mi, 15); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 593| 457k| E##me = XOR256(Bme, ANDnu256(Bmi, Bmo)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 594| 457k| XOReq256(Ce, E##me); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 595| 457k| XOReq256(A##so, Do); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 596| 457k| ROL64in256_56(Bmu, A##so); \ | | | | ------------------ | | | | | | 53| 457k|#define ROL64in256_56(d, a) d = _mm256_shuffle_epi8(a, rho56.v) | | | | ------------------ | | | | 597| 457k| E##mi = XOR256(Bmi, ANDnu256(Bmo, Bmu)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 598| 457k| XOReq256(Ci, E##mi); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 599| 457k| E##mo = XOR256(Bmo, ANDnu256(Bmu, Bma)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 600| 457k| XOReq256(Co, E##mo); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 601| 457k| E##mu = XOR256(Bmu, ANDnu256(Bma, Bme)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 602| 457k| XOReq256(Cu, E##mu); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 603| 457k|\ | | | | 604| 457k| XOReq256(A##bi, Di); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 605| 457k| ROL64in256(Bsa, A##bi, 62); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 606| 457k| XOReq256(A##go, Do); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 607| 457k| ROL64in256(Bse, A##go, 55); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 608| 457k| XOReq256(A##ku, Du); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 609| 457k| ROL64in256(Bsi, A##ku, 39); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 610| 457k| E##sa = XOR256(Bsa, ANDnu256(Bse, Bsi)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 611| 457k| XOReq256(Ca, E##sa); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 612| 457k| XOReq256(A##ma, Da); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 613| 457k| ROL64in256(Bso, A##ma, 41); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 614| 457k| E##se = XOR256(Bse, ANDnu256(Bsi, Bso)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 615| 457k| XOReq256(Ce, E##se); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 616| 457k| XOReq256(A##se, De); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 617| 457k| ROL64in256(Bsu, A##se, 2); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 618| 457k| E##si = XOR256(Bsi, ANDnu256(Bso, Bsu)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 619| 457k| XOReq256(Ci, E##si); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 620| 457k| E##so = XOR256(Bso, ANDnu256(Bsu, Bsa)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 621| 457k| XOReq256(Co, E##so); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 622| 457k| E##su = XOR256(Bsu, ANDnu256(Bsa, Bse)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 623| 457k| XOReq256(Cu, E##su); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | ------------------ | | 33| 457k| thetaRhoPiChiIotaPrepareTheta(13, E, A) \ | | ------------------ | | | | 508| 457k| ROL64in256(Ce1, Ce, 1); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 509| 457k| Da = XOR256(Cu, Ce1); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 510| 457k| ROL64in256(Ci1, Ci, 1); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 511| 457k| De = XOR256(Ca, Ci1); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 512| 457k| ROL64in256(Co1, Co, 1); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 513| 457k| Di = XOR256(Ce, Co1); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 514| 457k| ROL64in256(Cu1, Cu, 1); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 515| 457k| Do = XOR256(Ci, Cu1); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 516| 457k| ROL64in256(Ca1, Ca, 1); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 517| 457k| Du = XOR256(Co, Ca1); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 518| 457k|\ | | | | 519| 457k| XOReq256(A##ba, Da); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 520| 457k| Bba = A##ba; \ | | | | 521| 457k| XOReq256(A##ge, De); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 522| 457k| ROL64in256(Bbe, A##ge, 44); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 523| 457k| XOReq256(A##ki, Di); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 524| 457k| ROL64in256(Bbi, A##ki, 43); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 525| 457k| E##ba = XOR256(Bba, ANDnu256(Bbe, Bbi)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 526| 457k| XOReq256(E##ba, CONST256_64(KeccakF1600RoundConstants[i])); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 527| 457k| Ca = E##ba; \ | | | | 528| 457k| XOReq256(A##mo, Do); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 529| 457k| ROL64in256(Bbo, A##mo, 21); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 530| 457k| E##be = XOR256(Bbe, ANDnu256(Bbi, Bbo)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 531| 457k| Ce = E##be; \ | | | | 532| 457k| XOReq256(A##su, Du); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 533| 457k| ROL64in256(Bbu, A##su, 14); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 534| 457k| E##bi = XOR256(Bbi, ANDnu256(Bbo, Bbu)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 535| 457k| Ci = E##bi; \ | | | | 536| 457k| E##bo = XOR256(Bbo, ANDnu256(Bbu, Bba)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 537| 457k| Co = E##bo; \ | | | | 538| 457k| E##bu = XOR256(Bbu, ANDnu256(Bba, Bbe)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 539| 457k| Cu = E##bu; \ | | | | 540| 457k|\ | | | | 541| 457k| XOReq256(A##bo, Do); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 542| 457k| ROL64in256(Bga, A##bo, 28); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 543| 457k| XOReq256(A##gu, Du); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 544| 457k| ROL64in256(Bge, A##gu, 20); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 545| 457k| XOReq256(A##ka, Da); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 546| 457k| ROL64in256(Bgi, A##ka, 3); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 547| 457k| E##ga = XOR256(Bga, ANDnu256(Bge, Bgi)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 548| 457k| XOReq256(Ca, E##ga); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 549| 457k| XOReq256(A##me, De); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 550| 457k| ROL64in256(Bgo, A##me, 45); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 551| 457k| E##ge = XOR256(Bge, ANDnu256(Bgi, Bgo)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 552| 457k| XOReq256(Ce, E##ge); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 553| 457k| XOReq256(A##si, Di); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 554| 457k| ROL64in256(Bgu, A##si, 61); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 555| 457k| E##gi = XOR256(Bgi, ANDnu256(Bgo, Bgu)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 556| 457k| XOReq256(Ci, E##gi); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 557| 457k| E##go = XOR256(Bgo, ANDnu256(Bgu, Bga)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 558| 457k| XOReq256(Co, E##go); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 559| 457k| E##gu = XOR256(Bgu, ANDnu256(Bga, Bge)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 560| 457k| XOReq256(Cu, E##gu); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 561| 457k|\ | | | | 562| 457k| XOReq256(A##be, De); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 563| 457k| ROL64in256(Bka, A##be, 1); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 564| 457k| XOReq256(A##gi, Di); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 565| 457k| ROL64in256(Bke, A##gi, 6); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 566| 457k| XOReq256(A##ko, Do); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 567| 457k| ROL64in256(Bki, A##ko, 25); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 568| 457k| E##ka = XOR256(Bka, ANDnu256(Bke, Bki)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 569| 457k| XOReq256(Ca, E##ka); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 570| 457k| XOReq256(A##mu, Du); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 571| 457k| ROL64in256_8(Bko, A##mu); \ | | | | ------------------ | | | | | | 52| 457k|#define ROL64in256_8(d, a) d = _mm256_shuffle_epi8(a, rho8.v) | | | | ------------------ | | | | 572| 457k| E##ke = XOR256(Bke, ANDnu256(Bki, Bko)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 573| 457k| XOReq256(Ce, E##ke); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 574| 457k| XOReq256(A##sa, Da); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 575| 457k| ROL64in256(Bku, A##sa, 18); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 576| 457k| E##ki = XOR256(Bki, ANDnu256(Bko, Bku)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 577| 457k| XOReq256(Ci, E##ki); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 578| 457k| E##ko = XOR256(Bko, ANDnu256(Bku, Bka)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 579| 457k| XOReq256(Co, E##ko); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 580| 457k| E##ku = XOR256(Bku, ANDnu256(Bka, Bke)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 581| 457k| XOReq256(Cu, E##ku); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 582| 457k|\ | | | | 583| 457k| XOReq256(A##bu, Du); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 584| 457k| ROL64in256(Bma, A##bu, 27); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 585| 457k| XOReq256(A##ga, Da); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 586| 457k| ROL64in256(Bme, A##ga, 36); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 587| 457k| XOReq256(A##ke, De); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 588| 457k| ROL64in256(Bmi, A##ke, 10); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 589| 457k| E##ma = XOR256(Bma, ANDnu256(Bme, Bmi)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 590| 457k| XOReq256(Ca, E##ma); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 591| 457k| XOReq256(A##mi, Di); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 592| 457k| ROL64in256(Bmo, A##mi, 15); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 593| 457k| E##me = XOR256(Bme, ANDnu256(Bmi, Bmo)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 594| 457k| XOReq256(Ce, E##me); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 595| 457k| XOReq256(A##so, Do); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 596| 457k| ROL64in256_56(Bmu, A##so); \ | | | | ------------------ | | | | | | 53| 457k|#define ROL64in256_56(d, a) d = _mm256_shuffle_epi8(a, rho56.v) | | | | ------------------ | | | | 597| 457k| E##mi = XOR256(Bmi, ANDnu256(Bmo, Bmu)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 598| 457k| XOReq256(Ci, E##mi); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 599| 457k| E##mo = XOR256(Bmo, ANDnu256(Bmu, Bma)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 600| 457k| XOReq256(Co, E##mo); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 601| 457k| E##mu = XOR256(Bmu, ANDnu256(Bma, Bme)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 602| 457k| XOReq256(Cu, E##mu); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 603| 457k|\ | | | | 604| 457k| XOReq256(A##bi, Di); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 605| 457k| ROL64in256(Bsa, A##bi, 62); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 606| 457k| XOReq256(A##go, Do); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 607| 457k| ROL64in256(Bse, A##go, 55); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 608| 457k| XOReq256(A##ku, Du); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 609| 457k| ROL64in256(Bsi, A##ku, 39); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 610| 457k| E##sa = XOR256(Bsa, ANDnu256(Bse, Bsi)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 611| 457k| XOReq256(Ca, E##sa); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 612| 457k| XOReq256(A##ma, Da); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 613| 457k| ROL64in256(Bso, A##ma, 41); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 614| 457k| E##se = XOR256(Bse, ANDnu256(Bsi, Bso)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 615| 457k| XOReq256(Ce, E##se); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 616| 457k| XOReq256(A##se, De); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 617| 457k| ROL64in256(Bsu, A##se, 2); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 618| 457k| E##si = XOR256(Bsi, ANDnu256(Bso, Bsu)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 619| 457k| XOReq256(Ci, E##si); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 620| 457k| E##so = XOR256(Bso, ANDnu256(Bsu, Bsa)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 621| 457k| XOReq256(Co, E##so); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 622| 457k| E##su = XOR256(Bsu, ANDnu256(Bsa, Bse)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 623| 457k| XOReq256(Cu, E##su); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | ------------------ | | 34| 457k| thetaRhoPiChiIotaPrepareTheta(14, A, E) \ | | ------------------ | | | | 508| 457k| ROL64in256(Ce1, Ce, 1); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 509| 457k| Da = XOR256(Cu, Ce1); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 510| 457k| ROL64in256(Ci1, Ci, 1); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 511| 457k| De = XOR256(Ca, Ci1); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 512| 457k| ROL64in256(Co1, Co, 1); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 513| 457k| Di = XOR256(Ce, Co1); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 514| 457k| ROL64in256(Cu1, Cu, 1); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 515| 457k| Do = XOR256(Ci, Cu1); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 516| 457k| ROL64in256(Ca1, Ca, 1); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 517| 457k| Du = XOR256(Co, Ca1); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 518| 457k|\ | | | | 519| 457k| XOReq256(A##ba, Da); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 520| 457k| Bba = A##ba; \ | | | | 521| 457k| XOReq256(A##ge, De); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 522| 457k| ROL64in256(Bbe, A##ge, 44); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 523| 457k| XOReq256(A##ki, Di); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 524| 457k| ROL64in256(Bbi, A##ki, 43); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 525| 457k| E##ba = XOR256(Bba, ANDnu256(Bbe, Bbi)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 526| 457k| XOReq256(E##ba, CONST256_64(KeccakF1600RoundConstants[i])); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 527| 457k| Ca = E##ba; \ | | | | 528| 457k| XOReq256(A##mo, Do); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 529| 457k| ROL64in256(Bbo, A##mo, 21); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 530| 457k| E##be = XOR256(Bbe, ANDnu256(Bbi, Bbo)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 531| 457k| Ce = E##be; \ | | | | 532| 457k| XOReq256(A##su, Du); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 533| 457k| ROL64in256(Bbu, A##su, 14); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 534| 457k| E##bi = XOR256(Bbi, ANDnu256(Bbo, Bbu)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 535| 457k| Ci = E##bi; \ | | | | 536| 457k| E##bo = XOR256(Bbo, ANDnu256(Bbu, Bba)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 537| 457k| Co = E##bo; \ | | | | 538| 457k| E##bu = XOR256(Bbu, ANDnu256(Bba, Bbe)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 539| 457k| Cu = E##bu; \ | | | | 540| 457k|\ | | | | 541| 457k| XOReq256(A##bo, Do); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 542| 457k| ROL64in256(Bga, A##bo, 28); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 543| 457k| XOReq256(A##gu, Du); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 544| 457k| ROL64in256(Bge, A##gu, 20); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 545| 457k| XOReq256(A##ka, Da); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 546| 457k| ROL64in256(Bgi, A##ka, 3); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 547| 457k| E##ga = XOR256(Bga, ANDnu256(Bge, Bgi)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 548| 457k| XOReq256(Ca, E##ga); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 549| 457k| XOReq256(A##me, De); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 550| 457k| ROL64in256(Bgo, A##me, 45); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 551| 457k| E##ge = XOR256(Bge, ANDnu256(Bgi, Bgo)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 552| 457k| XOReq256(Ce, E##ge); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 553| 457k| XOReq256(A##si, Di); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 554| 457k| ROL64in256(Bgu, A##si, 61); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 555| 457k| E##gi = XOR256(Bgi, ANDnu256(Bgo, Bgu)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 556| 457k| XOReq256(Ci, E##gi); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 557| 457k| E##go = XOR256(Bgo, ANDnu256(Bgu, Bga)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 558| 457k| XOReq256(Co, E##go); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 559| 457k| E##gu = XOR256(Bgu, ANDnu256(Bga, Bge)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 560| 457k| XOReq256(Cu, E##gu); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 561| 457k|\ | | | | 562| 457k| XOReq256(A##be, De); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 563| 457k| ROL64in256(Bka, A##be, 1); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 564| 457k| XOReq256(A##gi, Di); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 565| 457k| ROL64in256(Bke, A##gi, 6); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 566| 457k| XOReq256(A##ko, Do); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 567| 457k| ROL64in256(Bki, A##ko, 25); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 568| 457k| E##ka = XOR256(Bka, ANDnu256(Bke, Bki)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 569| 457k| XOReq256(Ca, E##ka); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 570| 457k| XOReq256(A##mu, Du); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 571| 457k| ROL64in256_8(Bko, A##mu); \ | | | | ------------------ | | | | | | 52| 457k|#define ROL64in256_8(d, a) d = _mm256_shuffle_epi8(a, rho8.v) | | | | ------------------ | | | | 572| 457k| E##ke = XOR256(Bke, ANDnu256(Bki, Bko)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 573| 457k| XOReq256(Ce, E##ke); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 574| 457k| XOReq256(A##sa, Da); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 575| 457k| ROL64in256(Bku, A##sa, 18); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 576| 457k| E##ki = XOR256(Bki, ANDnu256(Bko, Bku)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 577| 457k| XOReq256(Ci, E##ki); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 578| 457k| E##ko = XOR256(Bko, ANDnu256(Bku, Bka)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 579| 457k| XOReq256(Co, E##ko); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 580| 457k| E##ku = XOR256(Bku, ANDnu256(Bka, Bke)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 581| 457k| XOReq256(Cu, E##ku); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 582| 457k|\ | | | | 583| 457k| XOReq256(A##bu, Du); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 584| 457k| ROL64in256(Bma, A##bu, 27); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 585| 457k| XOReq256(A##ga, Da); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 586| 457k| ROL64in256(Bme, A##ga, 36); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 587| 457k| XOReq256(A##ke, De); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 588| 457k| ROL64in256(Bmi, A##ke, 10); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 589| 457k| E##ma = XOR256(Bma, ANDnu256(Bme, Bmi)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 590| 457k| XOReq256(Ca, E##ma); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 591| 457k| XOReq256(A##mi, Di); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 592| 457k| ROL64in256(Bmo, A##mi, 15); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 593| 457k| E##me = XOR256(Bme, ANDnu256(Bmi, Bmo)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 594| 457k| XOReq256(Ce, E##me); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 595| 457k| XOReq256(A##so, Do); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 596| 457k| ROL64in256_56(Bmu, A##so); \ | | | | ------------------ | | | | | | 53| 457k|#define ROL64in256_56(d, a) d = _mm256_shuffle_epi8(a, rho56.v) | | | | ------------------ | | | | 597| 457k| E##mi = XOR256(Bmi, ANDnu256(Bmo, Bmu)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 598| 457k| XOReq256(Ci, E##mi); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 599| 457k| E##mo = XOR256(Bmo, ANDnu256(Bmu, Bma)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 600| 457k| XOReq256(Co, E##mo); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 601| 457k| E##mu = XOR256(Bmu, ANDnu256(Bma, Bme)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 602| 457k| XOReq256(Cu, E##mu); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 603| 457k|\ | | | | 604| 457k| XOReq256(A##bi, Di); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 605| 457k| ROL64in256(Bsa, A##bi, 62); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 606| 457k| XOReq256(A##go, Do); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 607| 457k| ROL64in256(Bse, A##go, 55); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 608| 457k| XOReq256(A##ku, Du); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 609| 457k| ROL64in256(Bsi, A##ku, 39); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 610| 457k| E##sa = XOR256(Bsa, ANDnu256(Bse, Bsi)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 611| 457k| XOReq256(Ca, E##sa); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 612| 457k| XOReq256(A##ma, Da); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 613| 457k| ROL64in256(Bso, A##ma, 41); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 614| 457k| E##se = XOR256(Bse, ANDnu256(Bsi, Bso)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 615| 457k| XOReq256(Ce, E##se); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 616| 457k| XOReq256(A##se, De); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 617| 457k| ROL64in256(Bsu, A##se, 2); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 618| 457k| E##si = XOR256(Bsi, ANDnu256(Bso, Bsu)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 619| 457k| XOReq256(Ci, E##si); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 620| 457k| E##so = XOR256(Bso, ANDnu256(Bsu, Bsa)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 621| 457k| XOReq256(Co, E##so); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 622| 457k| E##su = XOR256(Bsu, ANDnu256(Bsa, Bse)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 623| 457k| XOReq256(Cu, E##su); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | ------------------ | | 35| 457k| thetaRhoPiChiIotaPrepareTheta(15, E, A) \ | | ------------------ | | | | 508| 457k| ROL64in256(Ce1, Ce, 1); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 509| 457k| Da = XOR256(Cu, Ce1); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 510| 457k| ROL64in256(Ci1, Ci, 1); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 511| 457k| De = XOR256(Ca, Ci1); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 512| 457k| ROL64in256(Co1, Co, 1); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 513| 457k| Di = XOR256(Ce, Co1); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 514| 457k| ROL64in256(Cu1, Cu, 1); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 515| 457k| Do = XOR256(Ci, Cu1); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 516| 457k| ROL64in256(Ca1, Ca, 1); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 517| 457k| Du = XOR256(Co, Ca1); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 518| 457k|\ | | | | 519| 457k| XOReq256(A##ba, Da); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 520| 457k| Bba = A##ba; \ | | | | 521| 457k| XOReq256(A##ge, De); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 522| 457k| ROL64in256(Bbe, A##ge, 44); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 523| 457k| XOReq256(A##ki, Di); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 524| 457k| ROL64in256(Bbi, A##ki, 43); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 525| 457k| E##ba = XOR256(Bba, ANDnu256(Bbe, Bbi)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 526| 457k| XOReq256(E##ba, CONST256_64(KeccakF1600RoundConstants[i])); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 527| 457k| Ca = E##ba; \ | | | | 528| 457k| XOReq256(A##mo, Do); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 529| 457k| ROL64in256(Bbo, A##mo, 21); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 530| 457k| E##be = XOR256(Bbe, ANDnu256(Bbi, Bbo)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 531| 457k| Ce = E##be; \ | | | | 532| 457k| XOReq256(A##su, Du); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 533| 457k| ROL64in256(Bbu, A##su, 14); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 534| 457k| E##bi = XOR256(Bbi, ANDnu256(Bbo, Bbu)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 535| 457k| Ci = E##bi; \ | | | | 536| 457k| E##bo = XOR256(Bbo, ANDnu256(Bbu, Bba)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 537| 457k| Co = E##bo; \ | | | | 538| 457k| E##bu = XOR256(Bbu, ANDnu256(Bba, Bbe)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 539| 457k| Cu = E##bu; \ | | | | 540| 457k|\ | | | | 541| 457k| XOReq256(A##bo, Do); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 542| 457k| ROL64in256(Bga, A##bo, 28); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 543| 457k| XOReq256(A##gu, Du); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 544| 457k| ROL64in256(Bge, A##gu, 20); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 545| 457k| XOReq256(A##ka, Da); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 546| 457k| ROL64in256(Bgi, A##ka, 3); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 547| 457k| E##ga = XOR256(Bga, ANDnu256(Bge, Bgi)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 548| 457k| XOReq256(Ca, E##ga); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 549| 457k| XOReq256(A##me, De); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 550| 457k| ROL64in256(Bgo, A##me, 45); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 551| 457k| E##ge = XOR256(Bge, ANDnu256(Bgi, Bgo)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 552| 457k| XOReq256(Ce, E##ge); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 553| 457k| XOReq256(A##si, Di); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 554| 457k| ROL64in256(Bgu, A##si, 61); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 555| 457k| E##gi = XOR256(Bgi, ANDnu256(Bgo, Bgu)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 556| 457k| XOReq256(Ci, E##gi); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 557| 457k| E##go = XOR256(Bgo, ANDnu256(Bgu, Bga)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 558| 457k| XOReq256(Co, E##go); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 559| 457k| E##gu = XOR256(Bgu, ANDnu256(Bga, Bge)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 560| 457k| XOReq256(Cu, E##gu); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 561| 457k|\ | | | | 562| 457k| XOReq256(A##be, De); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 563| 457k| ROL64in256(Bka, A##be, 1); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 564| 457k| XOReq256(A##gi, Di); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 565| 457k| ROL64in256(Bke, A##gi, 6); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 566| 457k| XOReq256(A##ko, Do); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 567| 457k| ROL64in256(Bki, A##ko, 25); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 568| 457k| E##ka = XOR256(Bka, ANDnu256(Bke, Bki)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 569| 457k| XOReq256(Ca, E##ka); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 570| 457k| XOReq256(A##mu, Du); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 571| 457k| ROL64in256_8(Bko, A##mu); \ | | | | ------------------ | | | | | | 52| 457k|#define ROL64in256_8(d, a) d = _mm256_shuffle_epi8(a, rho8.v) | | | | ------------------ | | | | 572| 457k| E##ke = XOR256(Bke, ANDnu256(Bki, Bko)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 573| 457k| XOReq256(Ce, E##ke); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 574| 457k| XOReq256(A##sa, Da); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 575| 457k| ROL64in256(Bku, A##sa, 18); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 576| 457k| E##ki = XOR256(Bki, ANDnu256(Bko, Bku)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 577| 457k| XOReq256(Ci, E##ki); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 578| 457k| E##ko = XOR256(Bko, ANDnu256(Bku, Bka)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 579| 457k| XOReq256(Co, E##ko); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 580| 457k| E##ku = XOR256(Bku, ANDnu256(Bka, Bke)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 581| 457k| XOReq256(Cu, E##ku); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 582| 457k|\ | | | | 583| 457k| XOReq256(A##bu, Du); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 584| 457k| ROL64in256(Bma, A##bu, 27); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 585| 457k| XOReq256(A##ga, Da); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 586| 457k| ROL64in256(Bme, A##ga, 36); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 587| 457k| XOReq256(A##ke, De); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 588| 457k| ROL64in256(Bmi, A##ke, 10); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 589| 457k| E##ma = XOR256(Bma, ANDnu256(Bme, Bmi)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 590| 457k| XOReq256(Ca, E##ma); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 591| 457k| XOReq256(A##mi, Di); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 592| 457k| ROL64in256(Bmo, A##mi, 15); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 593| 457k| E##me = XOR256(Bme, ANDnu256(Bmi, Bmo)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 594| 457k| XOReq256(Ce, E##me); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 595| 457k| XOReq256(A##so, Do); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 596| 457k| ROL64in256_56(Bmu, A##so); \ | | | | ------------------ | | | | | | 53| 457k|#define ROL64in256_56(d, a) d = _mm256_shuffle_epi8(a, rho56.v) | | | | ------------------ | | | | 597| 457k| E##mi = XOR256(Bmi, ANDnu256(Bmo, Bmu)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 598| 457k| XOReq256(Ci, E##mi); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 599| 457k| E##mo = XOR256(Bmo, ANDnu256(Bmu, Bma)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 600| 457k| XOReq256(Co, E##mo); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 601| 457k| E##mu = XOR256(Bmu, ANDnu256(Bma, Bme)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 602| 457k| XOReq256(Cu, E##mu); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 603| 457k|\ | | | | 604| 457k| XOReq256(A##bi, Di); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 605| 457k| ROL64in256(Bsa, A##bi, 62); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 606| 457k| XOReq256(A##go, Do); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 607| 457k| ROL64in256(Bse, A##go, 55); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 608| 457k| XOReq256(A##ku, Du); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 609| 457k| ROL64in256(Bsi, A##ku, 39); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 610| 457k| E##sa = XOR256(Bsa, ANDnu256(Bse, Bsi)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 611| 457k| XOReq256(Ca, E##sa); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 612| 457k| XOReq256(A##ma, Da); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 613| 457k| ROL64in256(Bso, A##ma, 41); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 614| 457k| E##se = XOR256(Bse, ANDnu256(Bsi, Bso)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 615| 457k| XOReq256(Ce, E##se); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 616| 457k| XOReq256(A##se, De); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 617| 457k| ROL64in256(Bsu, A##se, 2); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 618| 457k| E##si = XOR256(Bsi, ANDnu256(Bso, Bsu)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 619| 457k| XOReq256(Ci, E##si); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 620| 457k| E##so = XOR256(Bso, ANDnu256(Bsu, Bsa)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 621| 457k| XOReq256(Co, E##so); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 622| 457k| E##su = XOR256(Bsu, ANDnu256(Bsa, Bse)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 623| 457k| XOReq256(Cu, E##su); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | ------------------ | | 36| 457k| thetaRhoPiChiIotaPrepareTheta(16, A, E) \ | | ------------------ | | | | 508| 457k| ROL64in256(Ce1, Ce, 1); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 509| 457k| Da = XOR256(Cu, Ce1); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 510| 457k| ROL64in256(Ci1, Ci, 1); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 511| 457k| De = XOR256(Ca, Ci1); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 512| 457k| ROL64in256(Co1, Co, 1); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 513| 457k| Di = XOR256(Ce, Co1); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 514| 457k| ROL64in256(Cu1, Cu, 1); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 515| 457k| Do = XOR256(Ci, Cu1); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 516| 457k| ROL64in256(Ca1, Ca, 1); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 517| 457k| Du = XOR256(Co, Ca1); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 518| 457k|\ | | | | 519| 457k| XOReq256(A##ba, Da); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 520| 457k| Bba = A##ba; \ | | | | 521| 457k| XOReq256(A##ge, De); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 522| 457k| ROL64in256(Bbe, A##ge, 44); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 523| 457k| XOReq256(A##ki, Di); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 524| 457k| ROL64in256(Bbi, A##ki, 43); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 525| 457k| E##ba = XOR256(Bba, ANDnu256(Bbe, Bbi)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 526| 457k| XOReq256(E##ba, CONST256_64(KeccakF1600RoundConstants[i])); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 527| 457k| Ca = E##ba; \ | | | | 528| 457k| XOReq256(A##mo, Do); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 529| 457k| ROL64in256(Bbo, A##mo, 21); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 530| 457k| E##be = XOR256(Bbe, ANDnu256(Bbi, Bbo)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 531| 457k| Ce = E##be; \ | | | | 532| 457k| XOReq256(A##su, Du); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 533| 457k| ROL64in256(Bbu, A##su, 14); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 534| 457k| E##bi = XOR256(Bbi, ANDnu256(Bbo, Bbu)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 535| 457k| Ci = E##bi; \ | | | | 536| 457k| E##bo = XOR256(Bbo, ANDnu256(Bbu, Bba)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 537| 457k| Co = E##bo; \ | | | | 538| 457k| E##bu = XOR256(Bbu, ANDnu256(Bba, Bbe)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 539| 457k| Cu = E##bu; \ | | | | 540| 457k|\ | | | | 541| 457k| XOReq256(A##bo, Do); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 542| 457k| ROL64in256(Bga, A##bo, 28); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 543| 457k| XOReq256(A##gu, Du); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 544| 457k| ROL64in256(Bge, A##gu, 20); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 545| 457k| XOReq256(A##ka, Da); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 546| 457k| ROL64in256(Bgi, A##ka, 3); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 547| 457k| E##ga = XOR256(Bga, ANDnu256(Bge, Bgi)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 548| 457k| XOReq256(Ca, E##ga); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 549| 457k| XOReq256(A##me, De); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 550| 457k| ROL64in256(Bgo, A##me, 45); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 551| 457k| E##ge = XOR256(Bge, ANDnu256(Bgi, Bgo)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 552| 457k| XOReq256(Ce, E##ge); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 553| 457k| XOReq256(A##si, Di); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 554| 457k| ROL64in256(Bgu, A##si, 61); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 555| 457k| E##gi = XOR256(Bgi, ANDnu256(Bgo, Bgu)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 556| 457k| XOReq256(Ci, E##gi); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 557| 457k| E##go = XOR256(Bgo, ANDnu256(Bgu, Bga)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 558| 457k| XOReq256(Co, E##go); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 559| 457k| E##gu = XOR256(Bgu, ANDnu256(Bga, Bge)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 560| 457k| XOReq256(Cu, E##gu); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 561| 457k|\ | | | | 562| 457k| XOReq256(A##be, De); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 563| 457k| ROL64in256(Bka, A##be, 1); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 564| 457k| XOReq256(A##gi, Di); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 565| 457k| ROL64in256(Bke, A##gi, 6); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 566| 457k| XOReq256(A##ko, Do); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 567| 457k| ROL64in256(Bki, A##ko, 25); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 568| 457k| E##ka = XOR256(Bka, ANDnu256(Bke, Bki)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 569| 457k| XOReq256(Ca, E##ka); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 570| 457k| XOReq256(A##mu, Du); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 571| 457k| ROL64in256_8(Bko, A##mu); \ | | | | ------------------ | | | | | | 52| 457k|#define ROL64in256_8(d, a) d = _mm256_shuffle_epi8(a, rho8.v) | | | | ------------------ | | | | 572| 457k| E##ke = XOR256(Bke, ANDnu256(Bki, Bko)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 573| 457k| XOReq256(Ce, E##ke); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 574| 457k| XOReq256(A##sa, Da); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 575| 457k| ROL64in256(Bku, A##sa, 18); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 576| 457k| E##ki = XOR256(Bki, ANDnu256(Bko, Bku)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 577| 457k| XOReq256(Ci, E##ki); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 578| 457k| E##ko = XOR256(Bko, ANDnu256(Bku, Bka)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 579| 457k| XOReq256(Co, E##ko); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 580| 457k| E##ku = XOR256(Bku, ANDnu256(Bka, Bke)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 581| 457k| XOReq256(Cu, E##ku); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 582| 457k|\ | | | | 583| 457k| XOReq256(A##bu, Du); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 584| 457k| ROL64in256(Bma, A##bu, 27); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 585| 457k| XOReq256(A##ga, Da); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 586| 457k| ROL64in256(Bme, A##ga, 36); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 587| 457k| XOReq256(A##ke, De); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 588| 457k| ROL64in256(Bmi, A##ke, 10); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 589| 457k| E##ma = XOR256(Bma, ANDnu256(Bme, Bmi)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 590| 457k| XOReq256(Ca, E##ma); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 591| 457k| XOReq256(A##mi, Di); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 592| 457k| ROL64in256(Bmo, A##mi, 15); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 593| 457k| E##me = XOR256(Bme, ANDnu256(Bmi, Bmo)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 594| 457k| XOReq256(Ce, E##me); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 595| 457k| XOReq256(A##so, Do); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 596| 457k| ROL64in256_56(Bmu, A##so); \ | | | | ------------------ | | | | | | 53| 457k|#define ROL64in256_56(d, a) d = _mm256_shuffle_epi8(a, rho56.v) | | | | ------------------ | | | | 597| 457k| E##mi = XOR256(Bmi, ANDnu256(Bmo, Bmu)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 598| 457k| XOReq256(Ci, E##mi); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 599| 457k| E##mo = XOR256(Bmo, ANDnu256(Bmu, Bma)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 600| 457k| XOReq256(Co, E##mo); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 601| 457k| E##mu = XOR256(Bmu, ANDnu256(Bma, Bme)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 602| 457k| XOReq256(Cu, E##mu); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 603| 457k|\ | | | | 604| 457k| XOReq256(A##bi, Di); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 605| 457k| ROL64in256(Bsa, A##bi, 62); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 606| 457k| XOReq256(A##go, Do); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 607| 457k| ROL64in256(Bse, A##go, 55); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 608| 457k| XOReq256(A##ku, Du); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 609| 457k| ROL64in256(Bsi, A##ku, 39); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 610| 457k| E##sa = XOR256(Bsa, ANDnu256(Bse, Bsi)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 611| 457k| XOReq256(Ca, E##sa); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 612| 457k| XOReq256(A##ma, Da); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 613| 457k| ROL64in256(Bso, A##ma, 41); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 614| 457k| E##se = XOR256(Bse, ANDnu256(Bsi, Bso)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 615| 457k| XOReq256(Ce, E##se); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 616| 457k| XOReq256(A##se, De); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 617| 457k| ROL64in256(Bsu, A##se, 2); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 618| 457k| E##si = XOR256(Bsi, ANDnu256(Bso, Bsu)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 619| 457k| XOReq256(Ci, E##si); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 620| 457k| E##so = XOR256(Bso, ANDnu256(Bsu, Bsa)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 621| 457k| XOReq256(Co, E##so); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 622| 457k| E##su = XOR256(Bsu, ANDnu256(Bsa, Bse)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 623| 457k| XOReq256(Cu, E##su); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | ------------------ | | 37| 457k| thetaRhoPiChiIotaPrepareTheta(17, E, A) \ | | ------------------ | | | | 508| 457k| ROL64in256(Ce1, Ce, 1); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 509| 457k| Da = XOR256(Cu, Ce1); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 510| 457k| ROL64in256(Ci1, Ci, 1); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 511| 457k| De = XOR256(Ca, Ci1); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 512| 457k| ROL64in256(Co1, Co, 1); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 513| 457k| Di = XOR256(Ce, Co1); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 514| 457k| ROL64in256(Cu1, Cu, 1); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 515| 457k| Do = XOR256(Ci, Cu1); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 516| 457k| ROL64in256(Ca1, Ca, 1); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 517| 457k| Du = XOR256(Co, Ca1); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 518| 457k|\ | | | | 519| 457k| XOReq256(A##ba, Da); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 520| 457k| Bba = A##ba; \ | | | | 521| 457k| XOReq256(A##ge, De); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 522| 457k| ROL64in256(Bbe, A##ge, 44); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 523| 457k| XOReq256(A##ki, Di); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 524| 457k| ROL64in256(Bbi, A##ki, 43); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 525| 457k| E##ba = XOR256(Bba, ANDnu256(Bbe, Bbi)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 526| 457k| XOReq256(E##ba, CONST256_64(KeccakF1600RoundConstants[i])); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 527| 457k| Ca = E##ba; \ | | | | 528| 457k| XOReq256(A##mo, Do); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 529| 457k| ROL64in256(Bbo, A##mo, 21); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 530| 457k| E##be = XOR256(Bbe, ANDnu256(Bbi, Bbo)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 531| 457k| Ce = E##be; \ | | | | 532| 457k| XOReq256(A##su, Du); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 533| 457k| ROL64in256(Bbu, A##su, 14); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 534| 457k| E##bi = XOR256(Bbi, ANDnu256(Bbo, Bbu)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 535| 457k| Ci = E##bi; \ | | | | 536| 457k| E##bo = XOR256(Bbo, ANDnu256(Bbu, Bba)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 537| 457k| Co = E##bo; \ | | | | 538| 457k| E##bu = XOR256(Bbu, ANDnu256(Bba, Bbe)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 539| 457k| Cu = E##bu; \ | | | | 540| 457k|\ | | | | 541| 457k| XOReq256(A##bo, Do); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 542| 457k| ROL64in256(Bga, A##bo, 28); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 543| 457k| XOReq256(A##gu, Du); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 544| 457k| ROL64in256(Bge, A##gu, 20); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 545| 457k| XOReq256(A##ka, Da); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 546| 457k| ROL64in256(Bgi, A##ka, 3); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 547| 457k| E##ga = XOR256(Bga, ANDnu256(Bge, Bgi)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 548| 457k| XOReq256(Ca, E##ga); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 549| 457k| XOReq256(A##me, De); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 550| 457k| ROL64in256(Bgo, A##me, 45); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 551| 457k| E##ge = XOR256(Bge, ANDnu256(Bgi, Bgo)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 552| 457k| XOReq256(Ce, E##ge); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 553| 457k| XOReq256(A##si, Di); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 554| 457k| ROL64in256(Bgu, A##si, 61); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 555| 457k| E##gi = XOR256(Bgi, ANDnu256(Bgo, Bgu)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 556| 457k| XOReq256(Ci, E##gi); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 557| 457k| E##go = XOR256(Bgo, ANDnu256(Bgu, Bga)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 558| 457k| XOReq256(Co, E##go); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 559| 457k| E##gu = XOR256(Bgu, ANDnu256(Bga, Bge)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 560| 457k| XOReq256(Cu, E##gu); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 561| 457k|\ | | | | 562| 457k| XOReq256(A##be, De); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 563| 457k| ROL64in256(Bka, A##be, 1); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 564| 457k| XOReq256(A##gi, Di); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 565| 457k| ROL64in256(Bke, A##gi, 6); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 566| 457k| XOReq256(A##ko, Do); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 567| 457k| ROL64in256(Bki, A##ko, 25); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 568| 457k| E##ka = XOR256(Bka, ANDnu256(Bke, Bki)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 569| 457k| XOReq256(Ca, E##ka); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 570| 457k| XOReq256(A##mu, Du); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 571| 457k| ROL64in256_8(Bko, A##mu); \ | | | | ------------------ | | | | | | 52| 457k|#define ROL64in256_8(d, a) d = _mm256_shuffle_epi8(a, rho8.v) | | | | ------------------ | | | | 572| 457k| E##ke = XOR256(Bke, ANDnu256(Bki, Bko)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 573| 457k| XOReq256(Ce, E##ke); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 574| 457k| XOReq256(A##sa, Da); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 575| 457k| ROL64in256(Bku, A##sa, 18); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 576| 457k| E##ki = XOR256(Bki, ANDnu256(Bko, Bku)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 577| 457k| XOReq256(Ci, E##ki); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 578| 457k| E##ko = XOR256(Bko, ANDnu256(Bku, Bka)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 579| 457k| XOReq256(Co, E##ko); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 580| 457k| E##ku = XOR256(Bku, ANDnu256(Bka, Bke)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 581| 457k| XOReq256(Cu, E##ku); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 582| 457k|\ | | | | 583| 457k| XOReq256(A##bu, Du); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 584| 457k| ROL64in256(Bma, A##bu, 27); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 585| 457k| XOReq256(A##ga, Da); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 586| 457k| ROL64in256(Bme, A##ga, 36); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 587| 457k| XOReq256(A##ke, De); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 588| 457k| ROL64in256(Bmi, A##ke, 10); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 589| 457k| E##ma = XOR256(Bma, ANDnu256(Bme, Bmi)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 590| 457k| XOReq256(Ca, E##ma); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 591| 457k| XOReq256(A##mi, Di); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 592| 457k| ROL64in256(Bmo, A##mi, 15); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 593| 457k| E##me = XOR256(Bme, ANDnu256(Bmi, Bmo)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 594| 457k| XOReq256(Ce, E##me); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 595| 457k| XOReq256(A##so, Do); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 596| 457k| ROL64in256_56(Bmu, A##so); \ | | | | ------------------ | | | | | | 53| 457k|#define ROL64in256_56(d, a) d = _mm256_shuffle_epi8(a, rho56.v) | | | | ------------------ | | | | 597| 457k| E##mi = XOR256(Bmi, ANDnu256(Bmo, Bmu)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 598| 457k| XOReq256(Ci, E##mi); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 599| 457k| E##mo = XOR256(Bmo, ANDnu256(Bmu, Bma)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 600| 457k| XOReq256(Co, E##mo); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 601| 457k| E##mu = XOR256(Bmu, ANDnu256(Bma, Bme)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 602| 457k| XOReq256(Cu, E##mu); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 603| 457k|\ | | | | 604| 457k| XOReq256(A##bi, Di); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 605| 457k| ROL64in256(Bsa, A##bi, 62); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 606| 457k| XOReq256(A##go, Do); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 607| 457k| ROL64in256(Bse, A##go, 55); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 608| 457k| XOReq256(A##ku, Du); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 609| 457k| ROL64in256(Bsi, A##ku, 39); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 610| 457k| E##sa = XOR256(Bsa, ANDnu256(Bse, Bsi)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 611| 457k| XOReq256(Ca, E##sa); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 612| 457k| XOReq256(A##ma, Da); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 613| 457k| ROL64in256(Bso, A##ma, 41); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 614| 457k| E##se = XOR256(Bse, ANDnu256(Bsi, Bso)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 615| 457k| XOReq256(Ce, E##se); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 616| 457k| XOReq256(A##se, De); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 617| 457k| ROL64in256(Bsu, A##se, 2); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 618| 457k| E##si = XOR256(Bsi, ANDnu256(Bso, Bsu)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 619| 457k| XOReq256(Ci, E##si); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 620| 457k| E##so = XOR256(Bso, ANDnu256(Bsu, Bsa)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 621| 457k| XOReq256(Co, E##so); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 622| 457k| E##su = XOR256(Bsu, ANDnu256(Bsa, Bse)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 623| 457k| XOReq256(Cu, E##su); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | ------------------ | | 38| 457k| thetaRhoPiChiIotaPrepareTheta(18, A, E) \ | | ------------------ | | | | 508| 457k| ROL64in256(Ce1, Ce, 1); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 509| 457k| Da = XOR256(Cu, Ce1); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 510| 457k| ROL64in256(Ci1, Ci, 1); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 511| 457k| De = XOR256(Ca, Ci1); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 512| 457k| ROL64in256(Co1, Co, 1); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 513| 457k| Di = XOR256(Ce, Co1); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 514| 457k| ROL64in256(Cu1, Cu, 1); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 515| 457k| Do = XOR256(Ci, Cu1); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 516| 457k| ROL64in256(Ca1, Ca, 1); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 517| 457k| Du = XOR256(Co, Ca1); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 518| 457k|\ | | | | 519| 457k| XOReq256(A##ba, Da); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 520| 457k| Bba = A##ba; \ | | | | 521| 457k| XOReq256(A##ge, De); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 522| 457k| ROL64in256(Bbe, A##ge, 44); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 523| 457k| XOReq256(A##ki, Di); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 524| 457k| ROL64in256(Bbi, A##ki, 43); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 525| 457k| E##ba = XOR256(Bba, ANDnu256(Bbe, Bbi)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 526| 457k| XOReq256(E##ba, CONST256_64(KeccakF1600RoundConstants[i])); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 527| 457k| Ca = E##ba; \ | | | | 528| 457k| XOReq256(A##mo, Do); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 529| 457k| ROL64in256(Bbo, A##mo, 21); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 530| 457k| E##be = XOR256(Bbe, ANDnu256(Bbi, Bbo)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 531| 457k| Ce = E##be; \ | | | | 532| 457k| XOReq256(A##su, Du); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 533| 457k| ROL64in256(Bbu, A##su, 14); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 534| 457k| E##bi = XOR256(Bbi, ANDnu256(Bbo, Bbu)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 535| 457k| Ci = E##bi; \ | | | | 536| 457k| E##bo = XOR256(Bbo, ANDnu256(Bbu, Bba)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 537| 457k| Co = E##bo; \ | | | | 538| 457k| E##bu = XOR256(Bbu, ANDnu256(Bba, Bbe)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 539| 457k| Cu = E##bu; \ | | | | 540| 457k|\ | | | | 541| 457k| XOReq256(A##bo, Do); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 542| 457k| ROL64in256(Bga, A##bo, 28); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 543| 457k| XOReq256(A##gu, Du); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 544| 457k| ROL64in256(Bge, A##gu, 20); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 545| 457k| XOReq256(A##ka, Da); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 546| 457k| ROL64in256(Bgi, A##ka, 3); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 547| 457k| E##ga = XOR256(Bga, ANDnu256(Bge, Bgi)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 548| 457k| XOReq256(Ca, E##ga); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 549| 457k| XOReq256(A##me, De); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 550| 457k| ROL64in256(Bgo, A##me, 45); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 551| 457k| E##ge = XOR256(Bge, ANDnu256(Bgi, Bgo)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 552| 457k| XOReq256(Ce, E##ge); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 553| 457k| XOReq256(A##si, Di); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 554| 457k| ROL64in256(Bgu, A##si, 61); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 555| 457k| E##gi = XOR256(Bgi, ANDnu256(Bgo, Bgu)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 556| 457k| XOReq256(Ci, E##gi); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 557| 457k| E##go = XOR256(Bgo, ANDnu256(Bgu, Bga)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 558| 457k| XOReq256(Co, E##go); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 559| 457k| E##gu = XOR256(Bgu, ANDnu256(Bga, Bge)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 560| 457k| XOReq256(Cu, E##gu); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 561| 457k|\ | | | | 562| 457k| XOReq256(A##be, De); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 563| 457k| ROL64in256(Bka, A##be, 1); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 564| 457k| XOReq256(A##gi, Di); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 565| 457k| ROL64in256(Bke, A##gi, 6); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 566| 457k| XOReq256(A##ko, Do); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 567| 457k| ROL64in256(Bki, A##ko, 25); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 568| 457k| E##ka = XOR256(Bka, ANDnu256(Bke, Bki)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 569| 457k| XOReq256(Ca, E##ka); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 570| 457k| XOReq256(A##mu, Du); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 571| 457k| ROL64in256_8(Bko, A##mu); \ | | | | ------------------ | | | | | | 52| 457k|#define ROL64in256_8(d, a) d = _mm256_shuffle_epi8(a, rho8.v) | | | | ------------------ | | | | 572| 457k| E##ke = XOR256(Bke, ANDnu256(Bki, Bko)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 573| 457k| XOReq256(Ce, E##ke); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 574| 457k| XOReq256(A##sa, Da); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 575| 457k| ROL64in256(Bku, A##sa, 18); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 576| 457k| E##ki = XOR256(Bki, ANDnu256(Bko, Bku)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 577| 457k| XOReq256(Ci, E##ki); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 578| 457k| E##ko = XOR256(Bko, ANDnu256(Bku, Bka)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 579| 457k| XOReq256(Co, E##ko); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 580| 457k| E##ku = XOR256(Bku, ANDnu256(Bka, Bke)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 581| 457k| XOReq256(Cu, E##ku); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 582| 457k|\ | | | | 583| 457k| XOReq256(A##bu, Du); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 584| 457k| ROL64in256(Bma, A##bu, 27); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 585| 457k| XOReq256(A##ga, Da); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 586| 457k| ROL64in256(Bme, A##ga, 36); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 587| 457k| XOReq256(A##ke, De); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 588| 457k| ROL64in256(Bmi, A##ke, 10); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 589| 457k| E##ma = XOR256(Bma, ANDnu256(Bme, Bmi)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 590| 457k| XOReq256(Ca, E##ma); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 591| 457k| XOReq256(A##mi, Di); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 592| 457k| ROL64in256(Bmo, A##mi, 15); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 593| 457k| E##me = XOR256(Bme, ANDnu256(Bmi, Bmo)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 594| 457k| XOReq256(Ce, E##me); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 595| 457k| XOReq256(A##so, Do); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 596| 457k| ROL64in256_56(Bmu, A##so); \ | | | | ------------------ | | | | | | 53| 457k|#define ROL64in256_56(d, a) d = _mm256_shuffle_epi8(a, rho56.v) | | | | ------------------ | | | | 597| 457k| E##mi = XOR256(Bmi, ANDnu256(Bmo, Bmu)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 598| 457k| XOReq256(Ci, E##mi); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 599| 457k| E##mo = XOR256(Bmo, ANDnu256(Bmu, Bma)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 600| 457k| XOReq256(Co, E##mo); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 601| 457k| E##mu = XOR256(Bmu, ANDnu256(Bma, Bme)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 602| 457k| XOReq256(Cu, E##mu); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 603| 457k|\ | | | | 604| 457k| XOReq256(A##bi, Di); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 605| 457k| ROL64in256(Bsa, A##bi, 62); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 606| 457k| XOReq256(A##go, Do); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 607| 457k| ROL64in256(Bse, A##go, 55); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 608| 457k| XOReq256(A##ku, Du); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 609| 457k| ROL64in256(Bsi, A##ku, 39); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 610| 457k| E##sa = XOR256(Bsa, ANDnu256(Bse, Bsi)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 611| 457k| XOReq256(Ca, E##sa); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 612| 457k| XOReq256(A##ma, Da); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 613| 457k| ROL64in256(Bso, A##ma, 41); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 614| 457k| E##se = XOR256(Bse, ANDnu256(Bsi, Bso)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 615| 457k| XOReq256(Ce, E##se); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 616| 457k| XOReq256(A##se, De); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 617| 457k| ROL64in256(Bsu, A##se, 2); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 618| 457k| E##si = XOR256(Bsi, ANDnu256(Bso, Bsu)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 619| 457k| XOReq256(Ci, E##si); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 620| 457k| E##so = XOR256(Bso, ANDnu256(Bsu, Bsa)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 621| 457k| XOReq256(Co, E##so); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 622| 457k| E##su = XOR256(Bsu, ANDnu256(Bsa, Bse)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 623| 457k| XOReq256(Cu, E##su); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | ------------------ | | 39| 457k| thetaRhoPiChiIotaPrepareTheta(19, E, A) \ | | ------------------ | | | | 508| 457k| ROL64in256(Ce1, Ce, 1); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 509| 457k| Da = XOR256(Cu, Ce1); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 510| 457k| ROL64in256(Ci1, Ci, 1); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 511| 457k| De = XOR256(Ca, Ci1); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 512| 457k| ROL64in256(Co1, Co, 1); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 513| 457k| Di = XOR256(Ce, Co1); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 514| 457k| ROL64in256(Cu1, Cu, 1); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 515| 457k| Do = XOR256(Ci, Cu1); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 516| 457k| ROL64in256(Ca1, Ca, 1); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 517| 457k| Du = XOR256(Co, Ca1); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 518| 457k|\ | | | | 519| 457k| XOReq256(A##ba, Da); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 520| 457k| Bba = A##ba; \ | | | | 521| 457k| XOReq256(A##ge, De); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 522| 457k| ROL64in256(Bbe, A##ge, 44); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 523| 457k| XOReq256(A##ki, Di); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 524| 457k| ROL64in256(Bbi, A##ki, 43); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 525| 457k| E##ba = XOR256(Bba, ANDnu256(Bbe, Bbi)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 526| 457k| XOReq256(E##ba, CONST256_64(KeccakF1600RoundConstants[i])); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 527| 457k| Ca = E##ba; \ | | | | 528| 457k| XOReq256(A##mo, Do); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 529| 457k| ROL64in256(Bbo, A##mo, 21); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 530| 457k| E##be = XOR256(Bbe, ANDnu256(Bbi, Bbo)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 531| 457k| Ce = E##be; \ | | | | 532| 457k| XOReq256(A##su, Du); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 533| 457k| ROL64in256(Bbu, A##su, 14); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 534| 457k| E##bi = XOR256(Bbi, ANDnu256(Bbo, Bbu)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 535| 457k| Ci = E##bi; \ | | | | 536| 457k| E##bo = XOR256(Bbo, ANDnu256(Bbu, Bba)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 537| 457k| Co = E##bo; \ | | | | 538| 457k| E##bu = XOR256(Bbu, ANDnu256(Bba, Bbe)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 539| 457k| Cu = E##bu; \ | | | | 540| 457k|\ | | | | 541| 457k| XOReq256(A##bo, Do); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 542| 457k| ROL64in256(Bga, A##bo, 28); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 543| 457k| XOReq256(A##gu, Du); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 544| 457k| ROL64in256(Bge, A##gu, 20); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 545| 457k| XOReq256(A##ka, Da); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 546| 457k| ROL64in256(Bgi, A##ka, 3); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 547| 457k| E##ga = XOR256(Bga, ANDnu256(Bge, Bgi)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 548| 457k| XOReq256(Ca, E##ga); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 549| 457k| XOReq256(A##me, De); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 550| 457k| ROL64in256(Bgo, A##me, 45); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 551| 457k| E##ge = XOR256(Bge, ANDnu256(Bgi, Bgo)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 552| 457k| XOReq256(Ce, E##ge); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 553| 457k| XOReq256(A##si, Di); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 554| 457k| ROL64in256(Bgu, A##si, 61); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 555| 457k| E##gi = XOR256(Bgi, ANDnu256(Bgo, Bgu)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 556| 457k| XOReq256(Ci, E##gi); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 557| 457k| E##go = XOR256(Bgo, ANDnu256(Bgu, Bga)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 558| 457k| XOReq256(Co, E##go); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 559| 457k| E##gu = XOR256(Bgu, ANDnu256(Bga, Bge)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 560| 457k| XOReq256(Cu, E##gu); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 561| 457k|\ | | | | 562| 457k| XOReq256(A##be, De); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 563| 457k| ROL64in256(Bka, A##be, 1); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 564| 457k| XOReq256(A##gi, Di); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 565| 457k| ROL64in256(Bke, A##gi, 6); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 566| 457k| XOReq256(A##ko, Do); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 567| 457k| ROL64in256(Bki, A##ko, 25); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 568| 457k| E##ka = XOR256(Bka, ANDnu256(Bke, Bki)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 569| 457k| XOReq256(Ca, E##ka); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 570| 457k| XOReq256(A##mu, Du); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 571| 457k| ROL64in256_8(Bko, A##mu); \ | | | | ------------------ | | | | | | 52| 457k|#define ROL64in256_8(d, a) d = _mm256_shuffle_epi8(a, rho8.v) | | | | ------------------ | | | | 572| 457k| E##ke = XOR256(Bke, ANDnu256(Bki, Bko)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 573| 457k| XOReq256(Ce, E##ke); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 574| 457k| XOReq256(A##sa, Da); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 575| 457k| ROL64in256(Bku, A##sa, 18); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 576| 457k| E##ki = XOR256(Bki, ANDnu256(Bko, Bku)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 577| 457k| XOReq256(Ci, E##ki); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 578| 457k| E##ko = XOR256(Bko, ANDnu256(Bku, Bka)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 579| 457k| XOReq256(Co, E##ko); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 580| 457k| E##ku = XOR256(Bku, ANDnu256(Bka, Bke)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 581| 457k| XOReq256(Cu, E##ku); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 582| 457k|\ | | | | 583| 457k| XOReq256(A##bu, Du); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 584| 457k| ROL64in256(Bma, A##bu, 27); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 585| 457k| XOReq256(A##ga, Da); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 586| 457k| ROL64in256(Bme, A##ga, 36); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 587| 457k| XOReq256(A##ke, De); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 588| 457k| ROL64in256(Bmi, A##ke, 10); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 589| 457k| E##ma = XOR256(Bma, ANDnu256(Bme, Bmi)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 590| 457k| XOReq256(Ca, E##ma); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 591| 457k| XOReq256(A##mi, Di); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 592| 457k| ROL64in256(Bmo, A##mi, 15); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 593| 457k| E##me = XOR256(Bme, ANDnu256(Bmi, Bmo)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 594| 457k| XOReq256(Ce, E##me); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 595| 457k| XOReq256(A##so, Do); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 596| 457k| ROL64in256_56(Bmu, A##so); \ | | | | ------------------ | | | | | | 53| 457k|#define ROL64in256_56(d, a) d = _mm256_shuffle_epi8(a, rho56.v) | | | | ------------------ | | | | 597| 457k| E##mi = XOR256(Bmi, ANDnu256(Bmo, Bmu)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 598| 457k| XOReq256(Ci, E##mi); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 599| 457k| E##mo = XOR256(Bmo, ANDnu256(Bmu, Bma)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 600| 457k| XOReq256(Co, E##mo); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 601| 457k| E##mu = XOR256(Bmu, ANDnu256(Bma, Bme)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 602| 457k| XOReq256(Cu, E##mu); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 603| 457k|\ | | | | 604| 457k| XOReq256(A##bi, Di); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 605| 457k| ROL64in256(Bsa, A##bi, 62); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 606| 457k| XOReq256(A##go, Do); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 607| 457k| ROL64in256(Bse, A##go, 55); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 608| 457k| XOReq256(A##ku, Du); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 609| 457k| ROL64in256(Bsi, A##ku, 39); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 610| 457k| E##sa = XOR256(Bsa, ANDnu256(Bse, Bsi)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 611| 457k| XOReq256(Ca, E##sa); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 612| 457k| XOReq256(A##ma, Da); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 613| 457k| ROL64in256(Bso, A##ma, 41); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 614| 457k| E##se = XOR256(Bse, ANDnu256(Bsi, Bso)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 615| 457k| XOReq256(Ce, E##se); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 616| 457k| XOReq256(A##se, De); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 617| 457k| ROL64in256(Bsu, A##se, 2); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 618| 457k| E##si = XOR256(Bsi, ANDnu256(Bso, Bsu)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 619| 457k| XOReq256(Ci, E##si); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 620| 457k| E##so = XOR256(Bso, ANDnu256(Bsu, Bsa)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 621| 457k| XOReq256(Co, E##so); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 622| 457k| E##su = XOR256(Bsu, ANDnu256(Bsa, Bse)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 623| 457k| XOReq256(Cu, E##su); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | ------------------ | | 40| 457k| thetaRhoPiChiIotaPrepareTheta(20, A, E) \ | | ------------------ | | | | 508| 457k| ROL64in256(Ce1, Ce, 1); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 509| 457k| Da = XOR256(Cu, Ce1); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 510| 457k| ROL64in256(Ci1, Ci, 1); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 511| 457k| De = XOR256(Ca, Ci1); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 512| 457k| ROL64in256(Co1, Co, 1); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 513| 457k| Di = XOR256(Ce, Co1); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 514| 457k| ROL64in256(Cu1, Cu, 1); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 515| 457k| Do = XOR256(Ci, Cu1); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 516| 457k| ROL64in256(Ca1, Ca, 1); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 517| 457k| Du = XOR256(Co, Ca1); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 518| 457k|\ | | | | 519| 457k| XOReq256(A##ba, Da); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 520| 457k| Bba = A##ba; \ | | | | 521| 457k| XOReq256(A##ge, De); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 522| 457k| ROL64in256(Bbe, A##ge, 44); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 523| 457k| XOReq256(A##ki, Di); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 524| 457k| ROL64in256(Bbi, A##ki, 43); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 525| 457k| E##ba = XOR256(Bba, ANDnu256(Bbe, Bbi)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 526| 457k| XOReq256(E##ba, CONST256_64(KeccakF1600RoundConstants[i])); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 527| 457k| Ca = E##ba; \ | | | | 528| 457k| XOReq256(A##mo, Do); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 529| 457k| ROL64in256(Bbo, A##mo, 21); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 530| 457k| E##be = XOR256(Bbe, ANDnu256(Bbi, Bbo)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 531| 457k| Ce = E##be; \ | | | | 532| 457k| XOReq256(A##su, Du); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 533| 457k| ROL64in256(Bbu, A##su, 14); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 534| 457k| E##bi = XOR256(Bbi, ANDnu256(Bbo, Bbu)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 535| 457k| Ci = E##bi; \ | | | | 536| 457k| E##bo = XOR256(Bbo, ANDnu256(Bbu, Bba)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 537| 457k| Co = E##bo; \ | | | | 538| 457k| E##bu = XOR256(Bbu, ANDnu256(Bba, Bbe)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 539| 457k| Cu = E##bu; \ | | | | 540| 457k|\ | | | | 541| 457k| XOReq256(A##bo, Do); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 542| 457k| ROL64in256(Bga, A##bo, 28); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 543| 457k| XOReq256(A##gu, Du); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 544| 457k| ROL64in256(Bge, A##gu, 20); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 545| 457k| XOReq256(A##ka, Da); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 546| 457k| ROL64in256(Bgi, A##ka, 3); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 547| 457k| E##ga = XOR256(Bga, ANDnu256(Bge, Bgi)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 548| 457k| XOReq256(Ca, E##ga); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 549| 457k| XOReq256(A##me, De); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 550| 457k| ROL64in256(Bgo, A##me, 45); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 551| 457k| E##ge = XOR256(Bge, ANDnu256(Bgi, Bgo)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 552| 457k| XOReq256(Ce, E##ge); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 553| 457k| XOReq256(A##si, Di); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 554| 457k| ROL64in256(Bgu, A##si, 61); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 555| 457k| E##gi = XOR256(Bgi, ANDnu256(Bgo, Bgu)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 556| 457k| XOReq256(Ci, E##gi); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 557| 457k| E##go = XOR256(Bgo, ANDnu256(Bgu, Bga)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 558| 457k| XOReq256(Co, E##go); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 559| 457k| E##gu = XOR256(Bgu, ANDnu256(Bga, Bge)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 560| 457k| XOReq256(Cu, E##gu); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 561| 457k|\ | | | | 562| 457k| XOReq256(A##be, De); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 563| 457k| ROL64in256(Bka, A##be, 1); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 564| 457k| XOReq256(A##gi, Di); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 565| 457k| ROL64in256(Bke, A##gi, 6); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 566| 457k| XOReq256(A##ko, Do); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 567| 457k| ROL64in256(Bki, A##ko, 25); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 568| 457k| E##ka = XOR256(Bka, ANDnu256(Bke, Bki)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 569| 457k| XOReq256(Ca, E##ka); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 570| 457k| XOReq256(A##mu, Du); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 571| 457k| ROL64in256_8(Bko, A##mu); \ | | | | ------------------ | | | | | | 52| 457k|#define ROL64in256_8(d, a) d = _mm256_shuffle_epi8(a, rho8.v) | | | | ------------------ | | | | 572| 457k| E##ke = XOR256(Bke, ANDnu256(Bki, Bko)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 573| 457k| XOReq256(Ce, E##ke); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 574| 457k| XOReq256(A##sa, Da); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 575| 457k| ROL64in256(Bku, A##sa, 18); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 576| 457k| E##ki = XOR256(Bki, ANDnu256(Bko, Bku)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 577| 457k| XOReq256(Ci, E##ki); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 578| 457k| E##ko = XOR256(Bko, ANDnu256(Bku, Bka)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 579| 457k| XOReq256(Co, E##ko); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 580| 457k| E##ku = XOR256(Bku, ANDnu256(Bka, Bke)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 581| 457k| XOReq256(Cu, E##ku); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 582| 457k|\ | | | | 583| 457k| XOReq256(A##bu, Du); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 584| 457k| ROL64in256(Bma, A##bu, 27); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 585| 457k| XOReq256(A##ga, Da); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 586| 457k| ROL64in256(Bme, A##ga, 36); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 587| 457k| XOReq256(A##ke, De); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 588| 457k| ROL64in256(Bmi, A##ke, 10); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 589| 457k| E##ma = XOR256(Bma, ANDnu256(Bme, Bmi)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 590| 457k| XOReq256(Ca, E##ma); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 591| 457k| XOReq256(A##mi, Di); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 592| 457k| ROL64in256(Bmo, A##mi, 15); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 593| 457k| E##me = XOR256(Bme, ANDnu256(Bmi, Bmo)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 594| 457k| XOReq256(Ce, E##me); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 595| 457k| XOReq256(A##so, Do); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 596| 457k| ROL64in256_56(Bmu, A##so); \ | | | | ------------------ | | | | | | 53| 457k|#define ROL64in256_56(d, a) d = _mm256_shuffle_epi8(a, rho56.v) | | | | ------------------ | | | | 597| 457k| E##mi = XOR256(Bmi, ANDnu256(Bmo, Bmu)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 598| 457k| XOReq256(Ci, E##mi); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 599| 457k| E##mo = XOR256(Bmo, ANDnu256(Bmu, Bma)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 600| 457k| XOReq256(Co, E##mo); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 601| 457k| E##mu = XOR256(Bmu, ANDnu256(Bma, Bme)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 602| 457k| XOReq256(Cu, E##mu); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 603| 457k|\ | | | | 604| 457k| XOReq256(A##bi, Di); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 605| 457k| ROL64in256(Bsa, A##bi, 62); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 606| 457k| XOReq256(A##go, Do); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 607| 457k| ROL64in256(Bse, A##go, 55); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 608| 457k| XOReq256(A##ku, Du); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 609| 457k| ROL64in256(Bsi, A##ku, 39); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 610| 457k| E##sa = XOR256(Bsa, ANDnu256(Bse, Bsi)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 611| 457k| XOReq256(Ca, E##sa); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 612| 457k| XOReq256(A##ma, Da); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 613| 457k| ROL64in256(Bso, A##ma, 41); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 614| 457k| E##se = XOR256(Bse, ANDnu256(Bsi, Bso)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 615| 457k| XOReq256(Ce, E##se); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 616| 457k| XOReq256(A##se, De); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 617| 457k| ROL64in256(Bsu, A##se, 2); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 618| 457k| E##si = XOR256(Bsi, ANDnu256(Bso, Bsu)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 619| 457k| XOReq256(Ci, E##si); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 620| 457k| E##so = XOR256(Bso, ANDnu256(Bsu, Bsa)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 621| 457k| XOReq256(Co, E##so); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 622| 457k| E##su = XOR256(Bsu, ANDnu256(Bsa, Bse)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 623| 457k| XOReq256(Cu, E##su); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | ------------------ | | 41| 457k| thetaRhoPiChiIotaPrepareTheta(21, E, A) \ | | ------------------ | | | | 508| 457k| ROL64in256(Ce1, Ce, 1); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 509| 457k| Da = XOR256(Cu, Ce1); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 510| 457k| ROL64in256(Ci1, Ci, 1); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 511| 457k| De = XOR256(Ca, Ci1); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 512| 457k| ROL64in256(Co1, Co, 1); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 513| 457k| Di = XOR256(Ce, Co1); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 514| 457k| ROL64in256(Cu1, Cu, 1); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 515| 457k| Do = XOR256(Ci, Cu1); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 516| 457k| ROL64in256(Ca1, Ca, 1); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 517| 457k| Du = XOR256(Co, Ca1); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 518| 457k|\ | | | | 519| 457k| XOReq256(A##ba, Da); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 520| 457k| Bba = A##ba; \ | | | | 521| 457k| XOReq256(A##ge, De); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 522| 457k| ROL64in256(Bbe, A##ge, 44); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 523| 457k| XOReq256(A##ki, Di); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 524| 457k| ROL64in256(Bbi, A##ki, 43); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 525| 457k| E##ba = XOR256(Bba, ANDnu256(Bbe, Bbi)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 526| 457k| XOReq256(E##ba, CONST256_64(KeccakF1600RoundConstants[i])); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 527| 457k| Ca = E##ba; \ | | | | 528| 457k| XOReq256(A##mo, Do); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 529| 457k| ROL64in256(Bbo, A##mo, 21); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 530| 457k| E##be = XOR256(Bbe, ANDnu256(Bbi, Bbo)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 531| 457k| Ce = E##be; \ | | | | 532| 457k| XOReq256(A##su, Du); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 533| 457k| ROL64in256(Bbu, A##su, 14); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 534| 457k| E##bi = XOR256(Bbi, ANDnu256(Bbo, Bbu)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 535| 457k| Ci = E##bi; \ | | | | 536| 457k| E##bo = XOR256(Bbo, ANDnu256(Bbu, Bba)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 537| 457k| Co = E##bo; \ | | | | 538| 457k| E##bu = XOR256(Bbu, ANDnu256(Bba, Bbe)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 539| 457k| Cu = E##bu; \ | | | | 540| 457k|\ | | | | 541| 457k| XOReq256(A##bo, Do); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 542| 457k| ROL64in256(Bga, A##bo, 28); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 543| 457k| XOReq256(A##gu, Du); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 544| 457k| ROL64in256(Bge, A##gu, 20); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 545| 457k| XOReq256(A##ka, Da); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 546| 457k| ROL64in256(Bgi, A##ka, 3); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 547| 457k| E##ga = XOR256(Bga, ANDnu256(Bge, Bgi)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 548| 457k| XOReq256(Ca, E##ga); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 549| 457k| XOReq256(A##me, De); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 550| 457k| ROL64in256(Bgo, A##me, 45); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 551| 457k| E##ge = XOR256(Bge, ANDnu256(Bgi, Bgo)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 552| 457k| XOReq256(Ce, E##ge); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 553| 457k| XOReq256(A##si, Di); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 554| 457k| ROL64in256(Bgu, A##si, 61); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 555| 457k| E##gi = XOR256(Bgi, ANDnu256(Bgo, Bgu)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 556| 457k| XOReq256(Ci, E##gi); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 557| 457k| E##go = XOR256(Bgo, ANDnu256(Bgu, Bga)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 558| 457k| XOReq256(Co, E##go); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 559| 457k| E##gu = XOR256(Bgu, ANDnu256(Bga, Bge)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 560| 457k| XOReq256(Cu, E##gu); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 561| 457k|\ | | | | 562| 457k| XOReq256(A##be, De); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 563| 457k| ROL64in256(Bka, A##be, 1); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 564| 457k| XOReq256(A##gi, Di); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 565| 457k| ROL64in256(Bke, A##gi, 6); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 566| 457k| XOReq256(A##ko, Do); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 567| 457k| ROL64in256(Bki, A##ko, 25); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 568| 457k| E##ka = XOR256(Bka, ANDnu256(Bke, Bki)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 569| 457k| XOReq256(Ca, E##ka); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 570| 457k| XOReq256(A##mu, Du); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 571| 457k| ROL64in256_8(Bko, A##mu); \ | | | | ------------------ | | | | | | 52| 457k|#define ROL64in256_8(d, a) d = _mm256_shuffle_epi8(a, rho8.v) | | | | ------------------ | | | | 572| 457k| E##ke = XOR256(Bke, ANDnu256(Bki, Bko)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 573| 457k| XOReq256(Ce, E##ke); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 574| 457k| XOReq256(A##sa, Da); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 575| 457k| ROL64in256(Bku, A##sa, 18); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 576| 457k| E##ki = XOR256(Bki, ANDnu256(Bko, Bku)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 577| 457k| XOReq256(Ci, E##ki); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 578| 457k| E##ko = XOR256(Bko, ANDnu256(Bku, Bka)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 579| 457k| XOReq256(Co, E##ko); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 580| 457k| E##ku = XOR256(Bku, ANDnu256(Bka, Bke)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 581| 457k| XOReq256(Cu, E##ku); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 582| 457k|\ | | | | 583| 457k| XOReq256(A##bu, Du); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 584| 457k| ROL64in256(Bma, A##bu, 27); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 585| 457k| XOReq256(A##ga, Da); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 586| 457k| ROL64in256(Bme, A##ga, 36); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 587| 457k| XOReq256(A##ke, De); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 588| 457k| ROL64in256(Bmi, A##ke, 10); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 589| 457k| E##ma = XOR256(Bma, ANDnu256(Bme, Bmi)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 590| 457k| XOReq256(Ca, E##ma); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 591| 457k| XOReq256(A##mi, Di); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 592| 457k| ROL64in256(Bmo, A##mi, 15); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 593| 457k| E##me = XOR256(Bme, ANDnu256(Bmi, Bmo)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 594| 457k| XOReq256(Ce, E##me); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 595| 457k| XOReq256(A##so, Do); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 596| 457k| ROL64in256_56(Bmu, A##so); \ | | | | ------------------ | | | | | | 53| 457k|#define ROL64in256_56(d, a) d = _mm256_shuffle_epi8(a, rho56.v) | | | | ------------------ | | | | 597| 457k| E##mi = XOR256(Bmi, ANDnu256(Bmo, Bmu)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 598| 457k| XOReq256(Ci, E##mi); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 599| 457k| E##mo = XOR256(Bmo, ANDnu256(Bmu, Bma)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 600| 457k| XOReq256(Co, E##mo); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 601| 457k| E##mu = XOR256(Bmu, ANDnu256(Bma, Bme)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 602| 457k| XOReq256(Cu, E##mu); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 603| 457k|\ | | | | 604| 457k| XOReq256(A##bi, Di); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 605| 457k| ROL64in256(Bsa, A##bi, 62); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 606| 457k| XOReq256(A##go, Do); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 607| 457k| ROL64in256(Bse, A##go, 55); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 608| 457k| XOReq256(A##ku, Du); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 609| 457k| ROL64in256(Bsi, A##ku, 39); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 610| 457k| E##sa = XOR256(Bsa, ANDnu256(Bse, Bsi)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 611| 457k| XOReq256(Ca, E##sa); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 612| 457k| XOReq256(A##ma, Da); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 613| 457k| ROL64in256(Bso, A##ma, 41); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 614| 457k| E##se = XOR256(Bse, ANDnu256(Bsi, Bso)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 615| 457k| XOReq256(Ce, E##se); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 616| 457k| XOReq256(A##se, De); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 617| 457k| ROL64in256(Bsu, A##se, 2); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 618| 457k| E##si = XOR256(Bsi, ANDnu256(Bso, Bsu)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 619| 457k| XOReq256(Ci, E##si); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 620| 457k| E##so = XOR256(Bso, ANDnu256(Bsu, Bsa)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 621| 457k| XOReq256(Co, E##so); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 622| 457k| E##su = XOR256(Bsu, ANDnu256(Bsa, Bse)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 623| 457k| XOReq256(Cu, E##su); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | ------------------ | | 42| 457k| thetaRhoPiChiIotaPrepareTheta(22, A, E) \ | | ------------------ | | | | 508| 457k| ROL64in256(Ce1, Ce, 1); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 509| 457k| Da = XOR256(Cu, Ce1); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 510| 457k| ROL64in256(Ci1, Ci, 1); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 511| 457k| De = XOR256(Ca, Ci1); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 512| 457k| ROL64in256(Co1, Co, 1); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 513| 457k| Di = XOR256(Ce, Co1); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 514| 457k| ROL64in256(Cu1, Cu, 1); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 515| 457k| Do = XOR256(Ci, Cu1); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 516| 457k| ROL64in256(Ca1, Ca, 1); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 517| 457k| Du = XOR256(Co, Ca1); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 518| 457k|\ | | | | 519| 457k| XOReq256(A##ba, Da); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 520| 457k| Bba = A##ba; \ | | | | 521| 457k| XOReq256(A##ge, De); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 522| 457k| ROL64in256(Bbe, A##ge, 44); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 523| 457k| XOReq256(A##ki, Di); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 524| 457k| ROL64in256(Bbi, A##ki, 43); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 525| 457k| E##ba = XOR256(Bba, ANDnu256(Bbe, Bbi)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 526| 457k| XOReq256(E##ba, CONST256_64(KeccakF1600RoundConstants[i])); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 527| 457k| Ca = E##ba; \ | | | | 528| 457k| XOReq256(A##mo, Do); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 529| 457k| ROL64in256(Bbo, A##mo, 21); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 530| 457k| E##be = XOR256(Bbe, ANDnu256(Bbi, Bbo)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 531| 457k| Ce = E##be; \ | | | | 532| 457k| XOReq256(A##su, Du); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 533| 457k| ROL64in256(Bbu, A##su, 14); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 534| 457k| E##bi = XOR256(Bbi, ANDnu256(Bbo, Bbu)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 535| 457k| Ci = E##bi; \ | | | | 536| 457k| E##bo = XOR256(Bbo, ANDnu256(Bbu, Bba)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 537| 457k| Co = E##bo; \ | | | | 538| 457k| E##bu = XOR256(Bbu, ANDnu256(Bba, Bbe)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 539| 457k| Cu = E##bu; \ | | | | 540| 457k|\ | | | | 541| 457k| XOReq256(A##bo, Do); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 542| 457k| ROL64in256(Bga, A##bo, 28); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 543| 457k| XOReq256(A##gu, Du); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 544| 457k| ROL64in256(Bge, A##gu, 20); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 545| 457k| XOReq256(A##ka, Da); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 546| 457k| ROL64in256(Bgi, A##ka, 3); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 547| 457k| E##ga = XOR256(Bga, ANDnu256(Bge, Bgi)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 548| 457k| XOReq256(Ca, E##ga); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 549| 457k| XOReq256(A##me, De); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 550| 457k| ROL64in256(Bgo, A##me, 45); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 551| 457k| E##ge = XOR256(Bge, ANDnu256(Bgi, Bgo)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 552| 457k| XOReq256(Ce, E##ge); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 553| 457k| XOReq256(A##si, Di); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 554| 457k| ROL64in256(Bgu, A##si, 61); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 555| 457k| E##gi = XOR256(Bgi, ANDnu256(Bgo, Bgu)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 556| 457k| XOReq256(Ci, E##gi); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 557| 457k| E##go = XOR256(Bgo, ANDnu256(Bgu, Bga)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 558| 457k| XOReq256(Co, E##go); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 559| 457k| E##gu = XOR256(Bgu, ANDnu256(Bga, Bge)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 560| 457k| XOReq256(Cu, E##gu); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 561| 457k|\ | | | | 562| 457k| XOReq256(A##be, De); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 563| 457k| ROL64in256(Bka, A##be, 1); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 564| 457k| XOReq256(A##gi, Di); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 565| 457k| ROL64in256(Bke, A##gi, 6); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 566| 457k| XOReq256(A##ko, Do); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 567| 457k| ROL64in256(Bki, A##ko, 25); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 568| 457k| E##ka = XOR256(Bka, ANDnu256(Bke, Bki)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 569| 457k| XOReq256(Ca, E##ka); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 570| 457k| XOReq256(A##mu, Du); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 571| 457k| ROL64in256_8(Bko, A##mu); \ | | | | ------------------ | | | | | | 52| 457k|#define ROL64in256_8(d, a) d = _mm256_shuffle_epi8(a, rho8.v) | | | | ------------------ | | | | 572| 457k| E##ke = XOR256(Bke, ANDnu256(Bki, Bko)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 573| 457k| XOReq256(Ce, E##ke); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 574| 457k| XOReq256(A##sa, Da); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 575| 457k| ROL64in256(Bku, A##sa, 18); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 576| 457k| E##ki = XOR256(Bki, ANDnu256(Bko, Bku)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 577| 457k| XOReq256(Ci, E##ki); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 578| 457k| E##ko = XOR256(Bko, ANDnu256(Bku, Bka)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 579| 457k| XOReq256(Co, E##ko); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 580| 457k| E##ku = XOR256(Bku, ANDnu256(Bka, Bke)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 581| 457k| XOReq256(Cu, E##ku); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 582| 457k|\ | | | | 583| 457k| XOReq256(A##bu, Du); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 584| 457k| ROL64in256(Bma, A##bu, 27); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 585| 457k| XOReq256(A##ga, Da); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 586| 457k| ROL64in256(Bme, A##ga, 36); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 587| 457k| XOReq256(A##ke, De); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 588| 457k| ROL64in256(Bmi, A##ke, 10); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 589| 457k| E##ma = XOR256(Bma, ANDnu256(Bme, Bmi)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 590| 457k| XOReq256(Ca, E##ma); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 591| 457k| XOReq256(A##mi, Di); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 592| 457k| ROL64in256(Bmo, A##mi, 15); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 593| 457k| E##me = XOR256(Bme, ANDnu256(Bmi, Bmo)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 594| 457k| XOReq256(Ce, E##me); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 595| 457k| XOReq256(A##so, Do); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 596| 457k| ROL64in256_56(Bmu, A##so); \ | | | | ------------------ | | | | | | 53| 457k|#define ROL64in256_56(d, a) d = _mm256_shuffle_epi8(a, rho56.v) | | | | ------------------ | | | | 597| 457k| E##mi = XOR256(Bmi, ANDnu256(Bmo, Bmu)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 598| 457k| XOReq256(Ci, E##mi); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 599| 457k| E##mo = XOR256(Bmo, ANDnu256(Bmu, Bma)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 600| 457k| XOReq256(Co, E##mo); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 601| 457k| E##mu = XOR256(Bmu, ANDnu256(Bma, Bme)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 602| 457k| XOReq256(Cu, E##mu); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 603| 457k|\ | | | | 604| 457k| XOReq256(A##bi, Di); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 605| 457k| ROL64in256(Bsa, A##bi, 62); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 606| 457k| XOReq256(A##go, Do); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 607| 457k| ROL64in256(Bse, A##go, 55); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 608| 457k| XOReq256(A##ku, Du); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 609| 457k| ROL64in256(Bsi, A##ku, 39); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 610| 457k| E##sa = XOR256(Bsa, ANDnu256(Bse, Bsi)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 611| 457k| XOReq256(Ca, E##sa); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 612| 457k| XOReq256(A##ma, Da); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 613| 457k| ROL64in256(Bso, A##ma, 41); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 614| 457k| E##se = XOR256(Bse, ANDnu256(Bsi, Bso)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 615| 457k| XOReq256(Ce, E##se); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 616| 457k| XOReq256(A##se, De); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 617| 457k| ROL64in256(Bsu, A##se, 2); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 618| 457k| E##si = XOR256(Bsi, ANDnu256(Bso, Bsu)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 619| 457k| XOReq256(Ci, E##si); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 620| 457k| E##so = XOR256(Bso, ANDnu256(Bsu, Bsa)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 621| 457k| XOReq256(Co, E##so); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 622| 457k| E##su = XOR256(Bsu, ANDnu256(Bsa, Bse)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 623| 457k| XOReq256(Cu, E##su); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | ------------------ | | 43| 457k| thetaRhoPiChiIota(23, E, A) \ | | ------------------ | | | | 629| 457k| ROL64in256(Ce1, Ce, 1); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 630| 457k| Da = XOR256(Cu, Ce1); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 631| 457k| ROL64in256(Ci1, Ci, 1); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 632| 457k| De = XOR256(Ca, Ci1); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 633| 457k| ROL64in256(Co1, Co, 1); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 634| 457k| Di = XOR256(Ce, Co1); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 635| 457k| ROL64in256(Cu1, Cu, 1); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 636| 457k| Do = XOR256(Ci, Cu1); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 637| 457k| ROL64in256(Ca1, Ca, 1); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 638| 457k| Du = XOR256(Co, Ca1); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 639| 457k|\ | | | | 640| 457k| XOReq256(A##ba, Da); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 641| 457k| Bba = A##ba; \ | | | | 642| 457k| XOReq256(A##ge, De); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 643| 457k| ROL64in256(Bbe, A##ge, 44); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 644| 457k| XOReq256(A##ki, Di); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 645| 457k| ROL64in256(Bbi, A##ki, 43); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 646| 457k| E##ba = XOR256(Bba, ANDnu256(Bbe, Bbi)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 647| 457k| XOReq256(E##ba, CONST256_64(KeccakF1600RoundConstants[i])); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 648| 457k| XOReq256(A##mo, Do); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 649| 457k| ROL64in256(Bbo, A##mo, 21); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 650| 457k| E##be = XOR256(Bbe, ANDnu256(Bbi, Bbo)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 651| 457k| XOReq256(A##su, Du); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 652| 457k| ROL64in256(Bbu, A##su, 14); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 653| 457k| E##bi = XOR256(Bbi, ANDnu256(Bbo, Bbu)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 654| 457k| E##bo = XOR256(Bbo, ANDnu256(Bbu, Bba)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 655| 457k| E##bu = XOR256(Bbu, ANDnu256(Bba, Bbe)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 656| 457k|\ | | | | 657| 457k| XOReq256(A##bo, Do); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 658| 457k| ROL64in256(Bga, A##bo, 28); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 659| 457k| XOReq256(A##gu, Du); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 660| 457k| ROL64in256(Bge, A##gu, 20); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 661| 457k| XOReq256(A##ka, Da); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 662| 457k| ROL64in256(Bgi, A##ka, 3); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 663| 457k| E##ga = XOR256(Bga, ANDnu256(Bge, Bgi)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 664| 457k| XOReq256(A##me, De); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 665| 457k| ROL64in256(Bgo, A##me, 45); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 666| 457k| E##ge = XOR256(Bge, ANDnu256(Bgi, Bgo)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 667| 457k| XOReq256(A##si, Di); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 668| 457k| ROL64in256(Bgu, A##si, 61); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 669| 457k| E##gi = XOR256(Bgi, ANDnu256(Bgo, Bgu)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 670| 457k| E##go = XOR256(Bgo, ANDnu256(Bgu, Bga)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 671| 457k| E##gu = XOR256(Bgu, ANDnu256(Bga, Bge)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 672| 457k|\ | | | | 673| 457k| XOReq256(A##be, De); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 674| 457k| ROL64in256(Bka, A##be, 1); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 675| 457k| XOReq256(A##gi, Di); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 676| 457k| ROL64in256(Bke, A##gi, 6); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 677| 457k| XOReq256(A##ko, Do); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 678| 457k| ROL64in256(Bki, A##ko, 25); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 679| 457k| E##ka = XOR256(Bka, ANDnu256(Bke, Bki)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 680| 457k| XOReq256(A##mu, Du); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 681| 457k| ROL64in256_8(Bko, A##mu); \ | | | | ------------------ | | | | | | 52| 457k|#define ROL64in256_8(d, a) d = _mm256_shuffle_epi8(a, rho8.v) | | | | ------------------ | | | | 682| 457k| E##ke = XOR256(Bke, ANDnu256(Bki, Bko)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 683| 457k| XOReq256(A##sa, Da); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 684| 457k| ROL64in256(Bku, A##sa, 18); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 685| 457k| E##ki = XOR256(Bki, ANDnu256(Bko, Bku)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 686| 457k| E##ko = XOR256(Bko, ANDnu256(Bku, Bka)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 687| 457k| E##ku = XOR256(Bku, ANDnu256(Bka, Bke)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 688| 457k|\ | | | | 689| 457k| XOReq256(A##bu, Du); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 690| 457k| ROL64in256(Bma, A##bu, 27); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 691| 457k| XOReq256(A##ga, Da); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 692| 457k| ROL64in256(Bme, A##ga, 36); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 693| 457k| XOReq256(A##ke, De); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 694| 457k| ROL64in256(Bmi, A##ke, 10); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 695| 457k| E##ma = XOR256(Bma, ANDnu256(Bme, Bmi)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 696| 457k| XOReq256(A##mi, Di); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 697| 457k| ROL64in256(Bmo, A##mi, 15); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 698| 457k| E##me = XOR256(Bme, ANDnu256(Bmi, Bmo)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 699| 457k| XOReq256(A##so, Do); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 700| 457k| ROL64in256_56(Bmu, A##so); \ | | | | ------------------ | | | | | | 53| 457k|#define ROL64in256_56(d, a) d = _mm256_shuffle_epi8(a, rho56.v) | | | | ------------------ | | | | 701| 457k| E##mi = XOR256(Bmi, ANDnu256(Bmo, Bmu)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 702| 457k| E##mo = XOR256(Bmo, ANDnu256(Bmu, Bma)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 703| 457k| E##mu = XOR256(Bmu, ANDnu256(Bma, Bme)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 704| 457k|\ | | | | 705| 457k| XOReq256(A##bi, Di); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 706| 457k| ROL64in256(Bsa, A##bi, 62); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 707| 457k| XOReq256(A##go, Do); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 708| 457k| ROL64in256(Bse, A##go, 55); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 709| 457k| XOReq256(A##ku, Du); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 710| 457k| ROL64in256(Bsi, A##ku, 39); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 711| 457k| E##sa = XOR256(Bsa, ANDnu256(Bse, Bsi)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 712| 457k| XOReq256(A##ma, Da); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 713| 457k| ROL64in256(Bso, A##ma, 41); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 714| 457k| E##se = XOR256(Bse, ANDnu256(Bsi, Bso)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 715| 457k| XOReq256(A##se, De); \ | | | | ------------------ | | | | | | 66| 457k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 716| 457k| ROL64in256(Bsu, A##se, 2); \ | | | | ------------------ | | | | | | 51| 457k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 717| 457k| E##si = XOR256(Bsi, ANDnu256(Bso, Bsu)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 718| 457k| E##so = XOR256(Bso, ANDnu256(Bsu, Bsa)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 719| 457k| E##su = XOR256(Bsu, ANDnu256(Bsa, Bse)); \ | | | | ------------------ | | | | | | 65| 457k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | ------------------ ------------------ 839| 457k| copyToState(statesAsLanes, A) ------------------ | | 777| 457k| STORE256(state[ 0], X##ba); \ | | ------------------ | | | | 62| 457k|#define STORE256(a, b) _mm256_store_si256((V256 *)&(a), b) | | ------------------ | | 778| 457k| STORE256(state[ 1], X##be); \ | | ------------------ | | | | 62| 457k|#define STORE256(a, b) _mm256_store_si256((V256 *)&(a), b) | | ------------------ | | 779| 457k| STORE256(state[ 2], X##bi); \ | | ------------------ | | | | 62| 457k|#define STORE256(a, b) _mm256_store_si256((V256 *)&(a), b) | | ------------------ | | 780| 457k| STORE256(state[ 3], X##bo); \ | | ------------------ | | | | 62| 457k|#define STORE256(a, b) _mm256_store_si256((V256 *)&(a), b) | | ------------------ | | 781| 457k| STORE256(state[ 4], X##bu); \ | | ------------------ | | | | 62| 457k|#define STORE256(a, b) _mm256_store_si256((V256 *)&(a), b) | | ------------------ | | 782| 457k| STORE256(state[ 5], X##ga); \ | | ------------------ | | | | 62| 457k|#define STORE256(a, b) _mm256_store_si256((V256 *)&(a), b) | | ------------------ | | 783| 457k| STORE256(state[ 6], X##ge); \ | | ------------------ | | | | 62| 457k|#define STORE256(a, b) _mm256_store_si256((V256 *)&(a), b) | | ------------------ | | 784| 457k| STORE256(state[ 7], X##gi); \ | | ------------------ | | | | 62| 457k|#define STORE256(a, b) _mm256_store_si256((V256 *)&(a), b) | | ------------------ | | 785| 457k| STORE256(state[ 8], X##go); \ | | ------------------ | | | | 62| 457k|#define STORE256(a, b) _mm256_store_si256((V256 *)&(a), b) | | ------------------ | | 786| 457k| STORE256(state[ 9], X##gu); \ | | ------------------ | | | | 62| 457k|#define STORE256(a, b) _mm256_store_si256((V256 *)&(a), b) | | ------------------ | | 787| 457k| STORE256(state[10], X##ka); \ | | ------------------ | | | | 62| 457k|#define STORE256(a, b) _mm256_store_si256((V256 *)&(a), b) | | ------------------ | | 788| 457k| STORE256(state[11], X##ke); \ | | ------------------ | | | | 62| 457k|#define STORE256(a, b) _mm256_store_si256((V256 *)&(a), b) | | ------------------ | | 789| 457k| STORE256(state[12], X##ki); \ | | ------------------ | | | | 62| 457k|#define STORE256(a, b) _mm256_store_si256((V256 *)&(a), b) | | ------------------ | | 790| 457k| STORE256(state[13], X##ko); \ | | ------------------ | | | | 62| 457k|#define STORE256(a, b) _mm256_store_si256((V256 *)&(a), b) | | ------------------ | | 791| 457k| STORE256(state[14], X##ku); \ | | ------------------ | | | | 62| 457k|#define STORE256(a, b) _mm256_store_si256((V256 *)&(a), b) | | ------------------ | | 792| 457k| STORE256(state[15], X##ma); \ | | ------------------ | | | | 62| 457k|#define STORE256(a, b) _mm256_store_si256((V256 *)&(a), b) | | ------------------ | | 793| 457k| STORE256(state[16], X##me); \ | | ------------------ | | | | 62| 457k|#define STORE256(a, b) _mm256_store_si256((V256 *)&(a), b) | | ------------------ | | 794| 457k| STORE256(state[17], X##mi); \ | | ------------------ | | | | 62| 457k|#define STORE256(a, b) _mm256_store_si256((V256 *)&(a), b) | | ------------------ | | 795| 457k| STORE256(state[18], X##mo); \ | | ------------------ | | | | 62| 457k|#define STORE256(a, b) _mm256_store_si256((V256 *)&(a), b) | | ------------------ | | 796| 457k| STORE256(state[19], X##mu); \ | | ------------------ | | | | 62| 457k|#define STORE256(a, b) _mm256_store_si256((V256 *)&(a), b) | | ------------------ | | 797| 457k| STORE256(state[20], X##sa); \ | | ------------------ | | | | 62| 457k|#define STORE256(a, b) _mm256_store_si256((V256 *)&(a), b) | | ------------------ | | 798| 457k| STORE256(state[21], X##se); \ | | ------------------ | | | | 62| 457k|#define STORE256(a, b) _mm256_store_si256((V256 *)&(a), b) | | ------------------ | | 799| 457k| STORE256(state[22], X##si); \ | | ------------------ | | | | 62| 457k|#define STORE256(a, b) _mm256_store_si256((V256 *)&(a), b) | | ------------------ | | 800| 457k| STORE256(state[23], X##so); \ | | ------------------ | | | | 62| 457k|#define STORE256(a, b) _mm256_store_si256((V256 *)&(a), b) | | ------------------ | | 801| 457k| STORE256(state[24], X##su); \ | | ------------------ | | | | 62| 457k|#define STORE256(a, b) _mm256_store_si256((V256 *)&(a), b) | | ------------------ ------------------ 840| 457k|} KeccakP-1600-times4-SIMD256.c:load64: 93| 338k|static inline uint64_t load64(const unsigned char *x) { 94| 338k| return (uint64_t) x[0] \ 95| 338k| | (uint64_t) x[1] << 0x08 \ 96| 338k| | (uint64_t) x[2] << 0x10 \ 97| 338k| | (uint64_t) x[3] << 0x18 \ 98| 338k| | (uint64_t) x[4] << 0x20 \ 99| 338k| | (uint64_t) x[5] << 0x28 \ 100| 338k| | (uint64_t) x[6] << 0x30 \ 101| 338k| | (uint64_t) x[7] << 0x38; 102| 338k|} KeccakP-1600-times4-SIMD256.c:store64: 104| 37.8M|static void store64(unsigned char *out, uint64_t in) { 105| 37.8M| memcpy(out, &in, sizeof(uint64_t)); 106| 37.8M|} xkcp_sha3.c:SHA3_sha3_256: 202| 2.64k|static void SHA3_sha3_256(uint8_t *output, const uint8_t *input, size_t inlen) { 203| 2.64k| OQS_SHA3_sha3_256_inc_ctx s; 204| 2.64k| OQS_SHA3_sha3_256_inc_init(&s); 205| 2.64k| OQS_SHA3_sha3_256_inc_absorb(&s, input, inlen); 206| 2.64k| OQS_SHA3_sha3_256_inc_finalize(output, &s); 207| 2.64k| OQS_SHA3_sha3_256_inc_ctx_release(&s); 208| 2.64k|} xkcp_sha3.c:SHA3_sha3_256_inc_init: 210| 3.00k|static void SHA3_sha3_256_inc_init(OQS_SHA3_sha3_256_inc_ctx *state) { 211| 3.00k| state->ctx = OQS_MEM_aligned_alloc(KECCAK_CTX_ALIGNMENT, KECCAK_CTX_BYTES); ------------------ | | 24| 3.00k|#define KECCAK_CTX_ALIGNMENT 32 ------------------ state->ctx = OQS_MEM_aligned_alloc(KECCAK_CTX_ALIGNMENT, KECCAK_CTX_BYTES); ------------------ | | 26| 3.00k|#define KECCAK_CTX_BYTES (KECCAK_CTX_ALIGNMENT * \ | | ------------------ | | | | 24| 3.00k|#define KECCAK_CTX_ALIGNMENT 32 | | ------------------ | | 27| 3.00k| ((_KECCAK_CTX_BYTES + KECCAK_CTX_ALIGNMENT - 1)/KECCAK_CTX_ALIGNMENT)) | | ------------------ | | | | 25| 3.00k|#define _KECCAK_CTX_BYTES (200+sizeof(uint64_t)) | | ------------------ | | ((_KECCAK_CTX_BYTES + KECCAK_CTX_ALIGNMENT - 1)/KECCAK_CTX_ALIGNMENT)) | | ------------------ | | | | 24| 3.00k|#define KECCAK_CTX_ALIGNMENT 32 | | ------------------ | | ((_KECCAK_CTX_BYTES + KECCAK_CTX_ALIGNMENT - 1)/KECCAK_CTX_ALIGNMENT)) | | ------------------ | | | | 24| 3.00k|#define KECCAK_CTX_ALIGNMENT 32 | | ------------------ ------------------ 212| | 213| 3.00k| OQS_EXIT_IF_NULLPTR(state->ctx, "SHA3"); ------------------ | | 82| 3.00k| do { \ | | 83| 3.00k| if ((x) == (void *)0) { \ | | ------------------ | | | Branch (83:9): [True: 0, False: 3.00k] | | ------------------ | | 84| 0| fprintf(stderr, "Unexpected NULL returned from %s API. Exiting.\n", \ | | 85| 0| loc); \ | | 86| 0| exit(EXIT_FAILURE); \ | | 87| 0| } \ | | 88| 3.00k| } while (0) | | ------------------ | | | Branch (88:12): [Folded, False: 3.00k] | | ------------------ ------------------ 214| 3.00k| keccak_inc_reset((uint64_t *)state->ctx); 215| 3.00k|} xkcp_sha3.c:keccak_inc_reset: 96| 15.8k|static void keccak_inc_reset(uint64_t *s) { 97| 15.8k|#if OQS_USE_PTHREADS 98| 15.8k| pthread_once(&dispatch_once_control, Keccak_Dispatch); 99| |#else 100| | if (Keccak_Initialize_ptr == NULL) { 101| | Keccak_Dispatch(); 102| | } 103| |#endif 104| 15.8k| (*Keccak_Initialize_ptr)(s); 105| 15.8k| s[25] = 0; 106| 15.8k|} xkcp_sha3.c:Keccak_Dispatch: 42| 1|static void Keccak_Dispatch(void) { 43| |// TODO: Simplify this when we have a Windows-compatible AVX2 implementation of SHA3 44| 1|#if defined(OQS_DIST_X86_64_BUILD) 45| 1|#if defined(OQS_ENABLE_SHA3_xkcp_low_avx2) 46| 1|#if defined(OQS_USE_SHA3_AVX512VL) 47| 1| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX512)) { ------------------ | Branch (47:6): [True: 0, False: 1] ------------------ 48| 0| extern const struct OQS_SHA3_callbacks sha3_avx512vl_callbacks; 49| | 50| 0| sha3_default_callbacks = sha3_avx512vl_callbacks; 51| 0| } 52| 1|#endif 53| 1| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2)) { ------------------ | Branch (53:6): [True: 1, False: 0] ------------------ 54| 1| Keccak_Initialize_ptr = &KeccakP1600_Initialize_avx2; 55| 1| Keccak_AddByte_ptr = &KeccakP1600_AddByte_avx2; 56| 1| Keccak_AddBytes_ptr = &KeccakP1600_AddBytes_avx2; 57| 1| Keccak_Permute_ptr = &KeccakP1600_Permute_24rounds_avx2; 58| 1| Keccak_ExtractBytes_ptr = &KeccakP1600_ExtractBytes_avx2; 59| 1| Keccak_FastLoopAbsorb_ptr = &KeccakF1600_FastLoop_Absorb_avx2; 60| 1| } else { 61| 0| Keccak_Initialize_ptr = &KeccakP1600_Initialize_plain64; 62| 0| Keccak_AddByte_ptr = &KeccakP1600_AddByte_plain64; 63| 0| Keccak_AddBytes_ptr = &KeccakP1600_AddBytes_plain64; 64| 0| Keccak_Permute_ptr = &KeccakP1600_Permute_24rounds_plain64; 65| 0| Keccak_ExtractBytes_ptr = &KeccakP1600_ExtractBytes_plain64; 66| 0| Keccak_FastLoopAbsorb_ptr = &KeccakF1600_FastLoop_Absorb_plain64; 67| 0| } 68| |#else // Windows 69| | Keccak_Initialize_ptr = &KeccakP1600_Initialize_plain64; 70| | Keccak_AddByte_ptr = &KeccakP1600_AddByte_plain64; 71| | Keccak_AddBytes_ptr = &KeccakP1600_AddBytes_plain64; 72| | Keccak_Permute_ptr = &KeccakP1600_Permute_24rounds_plain64; 73| | Keccak_ExtractBytes_ptr = &KeccakP1600_ExtractBytes_plain64; 74| | Keccak_FastLoopAbsorb_ptr = &KeccakF1600_FastLoop_Absorb_plain64; 75| |#endif 76| |#else 77| | Keccak_Initialize_ptr = &KeccakP1600_Initialize; 78| | Keccak_AddByte_ptr = &KeccakP1600_AddByte; 79| | Keccak_AddBytes_ptr = &KeccakP1600_AddBytes; 80| | Keccak_Permute_ptr = &KeccakP1600_Permute_24rounds; 81| | Keccak_ExtractBytes_ptr = &KeccakP1600_ExtractBytes; 82| | Keccak_FastLoopAbsorb_ptr = &KeccakF1600_FastLoop_Absorb; 83| |#endif 84| 1|} xkcp_sha3.c:SHA3_sha3_256_inc_absorb: 217| 3.86k|static void SHA3_sha3_256_inc_absorb(OQS_SHA3_sha3_256_inc_ctx *state, const uint8_t *input, size_t inlen) { 218| 3.86k| keccak_inc_absorb((uint64_t *)state->ctx, OQS_SHA3_SHA3_256_RATE, input, inlen); ------------------ | | 30| 3.86k|#define OQS_SHA3_SHA3_256_RATE 136 ------------------ 219| 3.86k|} xkcp_sha3.c:keccak_inc_absorb: 123| 18.0k| size_t mlen) { 124| 18.0k| uint64_t c = r - s[25]; 125| | 126| 18.0k| if (s[25] && mlen >= c) { ------------------ | Branch (126:6): [True: 2.59k, False: 15.4k] | Branch (126:15): [True: 412, False: 2.18k] ------------------ 127| 412| (*Keccak_AddBytes_ptr)(s, m, (unsigned int)s[25], (unsigned int)c); 128| 412| (*Keccak_Permute_ptr)(s); 129| 412| mlen -= c; 130| 412| m += c; 131| 412| s[25] = 0; 132| 412| } 133| | 134| |#ifdef KeccakF1600_FastLoop_supported 135| | if (mlen >= r) { 136| | c = (*Keccak_FastLoop_Absorb_ptr)(s, r / 8, m, mlen); 137| | mlen -= c; 138| | m += c; 139| | } 140| |#else 141| 107k| while (mlen >= r) { ------------------ | Branch (141:9): [True: 88.9k, False: 18.0k] ------------------ 142| 88.9k| (*Keccak_AddBytes_ptr)(s, m, 0, r); 143| 88.9k| (*Keccak_Permute_ptr)(s); 144| 88.9k| mlen -= r; 145| 88.9k| m += r; 146| 88.9k| } 147| 18.0k|#endif 148| | 149| 18.0k| (*Keccak_AddBytes_ptr)(s, m, (unsigned int)s[25], (unsigned int)mlen); 150| 18.0k| s[25] += mlen; 151| 18.0k|} xkcp_sha3.c:SHA3_sha3_256_inc_finalize: 221| 3.00k|static void SHA3_sha3_256_inc_finalize(uint8_t *output, OQS_SHA3_sha3_256_inc_ctx *state) { 222| 3.00k| keccak_inc_finalize((uint64_t *)state->ctx, OQS_SHA3_SHA3_256_RATE, 0x06); ------------------ | | 30| 3.00k|#define OQS_SHA3_SHA3_256_RATE 136 ------------------ 223| 3.00k| keccak_inc_squeeze(output, 32, (uint64_t *)state->ctx, OQS_SHA3_SHA3_256_RATE); ------------------ | | 30| 3.00k|#define OQS_SHA3_SHA3_256_RATE 136 ------------------ 224| 3.00k|} xkcp_sha3.c:keccak_inc_finalize: 166| 15.3k|static void keccak_inc_finalize(uint64_t *s, uint32_t r, uint8_t p) { 167| | /* After keccak_inc_absorb, we are guaranteed that s[25] < r, 168| | so we can always use one more byte for p in the current state. */ 169| 15.3k| (*Keccak_AddByte_ptr)(s, p, (unsigned int)s[25]); 170| 15.3k| (*Keccak_AddByte_ptr)(s, 0x80, (unsigned int)(r - 1)); 171| 15.3k| s[25] = 0; 172| 15.3k|} xkcp_sha3.c:keccak_inc_squeeze: 188| 52.5k| uint64_t *s, uint32_t r) { 189| 1.38M| while (outlen > s[25]) { ------------------ | Branch (189:9): [True: 1.33M, False: 52.5k] ------------------ 190| 1.33M| (*Keccak_ExtractBytes_ptr)(s, h, (unsigned int)(r - s[25]), (unsigned int)s[25]); 191| 1.33M| (*Keccak_Permute_ptr)(s); 192| 1.33M| h += s[25]; 193| 1.33M| outlen -= s[25]; 194| 1.33M| s[25] = r; 195| 1.33M| } 196| 52.5k| (*Keccak_ExtractBytes_ptr)(s, h, (unsigned int)(r - s[25]), (unsigned int)outlen); 197| 52.5k| s[25] -= outlen; 198| 52.5k|} xkcp_sha3.c:SHA3_sha3_256_inc_ctx_release: 226| 3.00k|static void SHA3_sha3_256_inc_ctx_release(OQS_SHA3_sha3_256_inc_ctx *state) { 227| 3.00k| OQS_MEM_aligned_secure_free(state->ctx, KECCAK_CTX_BYTES); ------------------ | | 26| 3.00k|#define KECCAK_CTX_BYTES (KECCAK_CTX_ALIGNMENT * \ | | ------------------ | | | | 24| 3.00k|#define KECCAK_CTX_ALIGNMENT 32 | | ------------------ | | 27| 3.00k| ((_KECCAK_CTX_BYTES + KECCAK_CTX_ALIGNMENT - 1)/KECCAK_CTX_ALIGNMENT)) | | ------------------ | | | | 25| 3.00k|#define _KECCAK_CTX_BYTES (200+sizeof(uint64_t)) | | ------------------ | | ((_KECCAK_CTX_BYTES + KECCAK_CTX_ALIGNMENT - 1)/KECCAK_CTX_ALIGNMENT)) | | ------------------ | | | | 24| 3.00k|#define KECCAK_CTX_ALIGNMENT 32 | | ------------------ | | ((_KECCAK_CTX_BYTES + KECCAK_CTX_ALIGNMENT - 1)/KECCAK_CTX_ALIGNMENT)) | | ------------------ | | | | 24| 3.00k|#define KECCAK_CTX_ALIGNMENT 32 | | ------------------ ------------------ 228| 3.00k|} xkcp_sha3.c:SHA3_sha3_384: 240| 28|static void SHA3_sha3_384(uint8_t *output, const uint8_t *input, size_t inlen) { 241| 28| OQS_SHA3_sha3_384_inc_ctx s; 242| 28| OQS_SHA3_sha3_384_inc_init(&s); 243| 28| OQS_SHA3_sha3_384_inc_absorb(&s, input, inlen); 244| 28| OQS_SHA3_sha3_384_inc_finalize(output, &s); 245| 28| OQS_SHA3_sha3_384_inc_ctx_release(&s); 246| 28|} xkcp_sha3.c:SHA3_sha3_384_inc_init: 248| 28|static void SHA3_sha3_384_inc_init(OQS_SHA3_sha3_384_inc_ctx *state) { 249| 28| state->ctx = OQS_MEM_aligned_alloc(KECCAK_CTX_ALIGNMENT, KECCAK_CTX_BYTES); ------------------ | | 24| 28|#define KECCAK_CTX_ALIGNMENT 32 ------------------ state->ctx = OQS_MEM_aligned_alloc(KECCAK_CTX_ALIGNMENT, KECCAK_CTX_BYTES); ------------------ | | 26| 28|#define KECCAK_CTX_BYTES (KECCAK_CTX_ALIGNMENT * \ | | ------------------ | | | | 24| 28|#define KECCAK_CTX_ALIGNMENT 32 | | ------------------ | | 27| 28| ((_KECCAK_CTX_BYTES + KECCAK_CTX_ALIGNMENT - 1)/KECCAK_CTX_ALIGNMENT)) | | ------------------ | | | | 25| 28|#define _KECCAK_CTX_BYTES (200+sizeof(uint64_t)) | | ------------------ | | ((_KECCAK_CTX_BYTES + KECCAK_CTX_ALIGNMENT - 1)/KECCAK_CTX_ALIGNMENT)) | | ------------------ | | | | 24| 28|#define KECCAK_CTX_ALIGNMENT 32 | | ------------------ | | ((_KECCAK_CTX_BYTES + KECCAK_CTX_ALIGNMENT - 1)/KECCAK_CTX_ALIGNMENT)) | | ------------------ | | | | 24| 28|#define KECCAK_CTX_ALIGNMENT 32 | | ------------------ ------------------ 250| 28| OQS_EXIT_IF_NULLPTR(state->ctx, "SHA3"); ------------------ | | 82| 28| do { \ | | 83| 28| if ((x) == (void *)0) { \ | | ------------------ | | | Branch (83:9): [True: 0, False: 28] | | ------------------ | | 84| 0| fprintf(stderr, "Unexpected NULL returned from %s API. Exiting.\n", \ | | 85| 0| loc); \ | | 86| 0| exit(EXIT_FAILURE); \ | | 87| 0| } \ | | 88| 28| } while (0) | | ------------------ | | | Branch (88:12): [Folded, False: 28] | | ------------------ ------------------ 251| 28| keccak_inc_reset((uint64_t *)state->ctx); 252| 28|} xkcp_sha3.c:SHA3_sha3_384_inc_absorb: 253| 28|static void SHA3_sha3_384_inc_absorb(OQS_SHA3_sha3_384_inc_ctx *state, const uint8_t *input, size_t inlen) { 254| 28| keccak_inc_absorb((uint64_t *)state->ctx, OQS_SHA3_SHA3_384_RATE, input, inlen); ------------------ | | 99| 28|#define OQS_SHA3_SHA3_384_RATE 104 ------------------ 255| 28|} xkcp_sha3.c:SHA3_sha3_384_inc_finalize: 257| 28|static void SHA3_sha3_384_inc_finalize(uint8_t *output, OQS_SHA3_sha3_384_inc_ctx *state) { 258| 28| keccak_inc_finalize((uint64_t *)state->ctx, OQS_SHA3_SHA3_384_RATE, 0x06); ------------------ | | 99| 28|#define OQS_SHA3_SHA3_384_RATE 104 ------------------ 259| 28| keccak_inc_squeeze(output, 48, (uint64_t *)state->ctx, OQS_SHA3_SHA3_384_RATE); ------------------ | | 99| 28|#define OQS_SHA3_SHA3_384_RATE 104 ------------------ 260| 28|} xkcp_sha3.c:SHA3_sha3_384_inc_ctx_release: 262| 28|static void SHA3_sha3_384_inc_ctx_release(OQS_SHA3_sha3_384_inc_ctx *state) { 263| 28| OQS_MEM_aligned_secure_free(state->ctx, KECCAK_CTX_BYTES); ------------------ | | 26| 28|#define KECCAK_CTX_BYTES (KECCAK_CTX_ALIGNMENT * \ | | ------------------ | | | | 24| 28|#define KECCAK_CTX_ALIGNMENT 32 | | ------------------ | | 27| 28| ((_KECCAK_CTX_BYTES + KECCAK_CTX_ALIGNMENT - 1)/KECCAK_CTX_ALIGNMENT)) | | ------------------ | | | | 25| 28|#define _KECCAK_CTX_BYTES (200+sizeof(uint64_t)) | | ------------------ | | ((_KECCAK_CTX_BYTES + KECCAK_CTX_ALIGNMENT - 1)/KECCAK_CTX_ALIGNMENT)) | | ------------------ | | | | 24| 28|#define KECCAK_CTX_ALIGNMENT 32 | | ------------------ | | ((_KECCAK_CTX_BYTES + KECCAK_CTX_ALIGNMENT - 1)/KECCAK_CTX_ALIGNMENT)) | | ------------------ | | | | 24| 28|#define KECCAK_CTX_ALIGNMENT 32 | | ------------------ ------------------ 264| 28|} xkcp_sha3.c:SHA3_sha3_512: 276| 1.08k|static void SHA3_sha3_512(uint8_t *output, const uint8_t *input, size_t inlen) { 277| 1.08k| OQS_SHA3_sha3_512_inc_ctx s; 278| 1.08k| OQS_SHA3_sha3_512_inc_init(&s); 279| 1.08k| OQS_SHA3_sha3_512_inc_absorb(&s, input, inlen); 280| 1.08k| OQS_SHA3_sha3_512_inc_finalize(output, &s); 281| 1.08k| OQS_SHA3_sha3_512_inc_ctx_release(&s); 282| 1.08k|} xkcp_sha3.c:SHA3_sha3_512_inc_init: 284| 1.45k|static void SHA3_sha3_512_inc_init(OQS_SHA3_sha3_512_inc_ctx *state) { 285| 1.45k| state->ctx = OQS_MEM_aligned_alloc(KECCAK_CTX_ALIGNMENT, KECCAK_CTX_BYTES); ------------------ | | 24| 1.45k|#define KECCAK_CTX_ALIGNMENT 32 ------------------ state->ctx = OQS_MEM_aligned_alloc(KECCAK_CTX_ALIGNMENT, KECCAK_CTX_BYTES); ------------------ | | 26| 1.45k|#define KECCAK_CTX_BYTES (KECCAK_CTX_ALIGNMENT * \ | | ------------------ | | | | 24| 1.45k|#define KECCAK_CTX_ALIGNMENT 32 | | ------------------ | | 27| 1.45k| ((_KECCAK_CTX_BYTES + KECCAK_CTX_ALIGNMENT - 1)/KECCAK_CTX_ALIGNMENT)) | | ------------------ | | | | 25| 1.45k|#define _KECCAK_CTX_BYTES (200+sizeof(uint64_t)) | | ------------------ | | ((_KECCAK_CTX_BYTES + KECCAK_CTX_ALIGNMENT - 1)/KECCAK_CTX_ALIGNMENT)) | | ------------------ | | | | 24| 1.45k|#define KECCAK_CTX_ALIGNMENT 32 | | ------------------ | | ((_KECCAK_CTX_BYTES + KECCAK_CTX_ALIGNMENT - 1)/KECCAK_CTX_ALIGNMENT)) | | ------------------ | | | | 24| 1.45k|#define KECCAK_CTX_ALIGNMENT 32 | | ------------------ ------------------ 286| 1.45k| OQS_EXIT_IF_NULLPTR(state->ctx, "SHA3"); ------------------ | | 82| 1.45k| do { \ | | 83| 1.45k| if ((x) == (void *)0) { \ | | ------------------ | | | Branch (83:9): [True: 0, False: 1.45k] | | ------------------ | | 84| 0| fprintf(stderr, "Unexpected NULL returned from %s API. Exiting.\n", \ | | 85| 0| loc); \ | | 86| 0| exit(EXIT_FAILURE); \ | | 87| 0| } \ | | 88| 1.45k| } while (0) | | ------------------ | | | Branch (88:12): [Folded, False: 1.45k] | | ------------------ ------------------ 287| 1.45k| keccak_inc_reset((uint64_t *)state->ctx); 288| 1.45k|} xkcp_sha3.c:SHA3_sha3_512_inc_absorb: 290| 2.30k|static void SHA3_sha3_512_inc_absorb(OQS_SHA3_sha3_512_inc_ctx *state, const uint8_t *input, size_t inlen) { 291| 2.30k| keccak_inc_absorb((uint64_t *)state->ctx, OQS_SHA3_SHA3_512_RATE, input, inlen); ------------------ | | 168| 2.30k|#define OQS_SHA3_SHA3_512_RATE 72 ------------------ 292| 2.30k|} xkcp_sha3.c:SHA3_sha3_512_inc_finalize: 294| 1.45k|static void SHA3_sha3_512_inc_finalize(uint8_t *output, OQS_SHA3_sha3_512_inc_ctx *state) { 295| 1.45k| keccak_inc_finalize((uint64_t *)state->ctx, OQS_SHA3_SHA3_512_RATE, 0x06); ------------------ | | 168| 1.45k|#define OQS_SHA3_SHA3_512_RATE 72 ------------------ 296| 1.45k| keccak_inc_squeeze(output, 64, (uint64_t *)state->ctx, OQS_SHA3_SHA3_512_RATE); ------------------ | | 168| 1.45k|#define OQS_SHA3_SHA3_512_RATE 72 ------------------ 297| 1.45k|} xkcp_sha3.c:SHA3_sha3_512_inc_ctx_release: 299| 1.45k|static void SHA3_sha3_512_inc_ctx_release(OQS_SHA3_sha3_512_inc_ctx *state) { 300| 1.45k| OQS_MEM_aligned_secure_free(state->ctx, KECCAK_CTX_BYTES); ------------------ | | 26| 1.45k|#define KECCAK_CTX_BYTES (KECCAK_CTX_ALIGNMENT * \ | | ------------------ | | | | 24| 1.45k|#define KECCAK_CTX_ALIGNMENT 32 | | ------------------ | | 27| 1.45k| ((_KECCAK_CTX_BYTES + KECCAK_CTX_ALIGNMENT - 1)/KECCAK_CTX_ALIGNMENT)) | | ------------------ | | | | 25| 1.45k|#define _KECCAK_CTX_BYTES (200+sizeof(uint64_t)) | | ------------------ | | ((_KECCAK_CTX_BYTES + KECCAK_CTX_ALIGNMENT - 1)/KECCAK_CTX_ALIGNMENT)) | | ------------------ | | | | 24| 1.45k|#define KECCAK_CTX_ALIGNMENT 32 | | ------------------ | | ((_KECCAK_CTX_BYTES + KECCAK_CTX_ALIGNMENT - 1)/KECCAK_CTX_ALIGNMENT)) | | ------------------ | | | | 24| 1.45k|#define KECCAK_CTX_ALIGNMENT 32 | | ------------------ ------------------ 301| 1.45k|} xkcp_sha3.c:SHA3_shake128: 313| 110|static void SHA3_shake128(uint8_t *output, size_t outlen, const uint8_t *input, size_t inlen) { 314| 110| OQS_SHA3_shake128_inc_ctx s; 315| 110| OQS_SHA3_shake128_inc_init(&s); 316| 110| OQS_SHA3_shake128_inc_absorb(&s, input, inlen); 317| 110| OQS_SHA3_shake128_inc_finalize(&s); 318| 110| OQS_SHA3_shake128_inc_squeeze(output, outlen, &s); 319| 110| OQS_SHA3_shake128_inc_ctx_release(&s); 320| 110|} xkcp_sha3.c:SHA3_shake128_inc_init: 324| 596|static void SHA3_shake128_inc_init(OQS_SHA3_shake128_inc_ctx *state) { 325| 596| state->ctx = OQS_MEM_aligned_alloc(KECCAK_CTX_ALIGNMENT, KECCAK_CTX_BYTES); ------------------ | | 24| 596|#define KECCAK_CTX_ALIGNMENT 32 ------------------ state->ctx = OQS_MEM_aligned_alloc(KECCAK_CTX_ALIGNMENT, KECCAK_CTX_BYTES); ------------------ | | 26| 596|#define KECCAK_CTX_BYTES (KECCAK_CTX_ALIGNMENT * \ | | ------------------ | | | | 24| 596|#define KECCAK_CTX_ALIGNMENT 32 | | ------------------ | | 27| 596| ((_KECCAK_CTX_BYTES + KECCAK_CTX_ALIGNMENT - 1)/KECCAK_CTX_ALIGNMENT)) | | ------------------ | | | | 25| 596|#define _KECCAK_CTX_BYTES (200+sizeof(uint64_t)) | | ------------------ | | ((_KECCAK_CTX_BYTES + KECCAK_CTX_ALIGNMENT - 1)/KECCAK_CTX_ALIGNMENT)) | | ------------------ | | | | 24| 596|#define KECCAK_CTX_ALIGNMENT 32 | | ------------------ | | ((_KECCAK_CTX_BYTES + KECCAK_CTX_ALIGNMENT - 1)/KECCAK_CTX_ALIGNMENT)) | | ------------------ | | | | 24| 596|#define KECCAK_CTX_ALIGNMENT 32 | | ------------------ ------------------ 326| 596| OQS_EXIT_IF_NULLPTR(state->ctx, "SHA3"); ------------------ | | 82| 596| do { \ | | 83| 596| if ((x) == (void *)0) { \ | | ------------------ | | | Branch (83:9): [True: 0, False: 596] | | ------------------ | | 84| 0| fprintf(stderr, "Unexpected NULL returned from %s API. Exiting.\n", \ | | 85| 0| loc); \ | | 86| 0| exit(EXIT_FAILURE); \ | | 87| 0| } \ | | 88| 596| } while (0) | | ------------------ | | | Branch (88:12): [Folded, False: 596] | | ------------------ ------------------ 327| 596| keccak_inc_reset((uint64_t *)state->ctx); 328| 596|} xkcp_sha3.c:SHA3_shake128_inc_absorb: 330| 596|static void SHA3_shake128_inc_absorb(OQS_SHA3_shake128_inc_ctx *state, const uint8_t *input, size_t inlen) { 331| 596| keccak_inc_absorb((uint64_t *)state->ctx, OQS_SHA3_SHAKE128_RATE, input, inlen); ------------------ | | 239| 596|#define OQS_SHA3_SHAKE128_RATE 168 ------------------ 332| 596|} xkcp_sha3.c:SHA3_shake128_inc_finalize: 334| 596|static void SHA3_shake128_inc_finalize(OQS_SHA3_shake128_inc_ctx *state) { 335| 596| keccak_inc_finalize((uint64_t *)state->ctx, OQS_SHA3_SHAKE128_RATE, 0x1F); ------------------ | | 239| 596|#define OQS_SHA3_SHAKE128_RATE 168 ------------------ 336| 596|} xkcp_sha3.c:SHA3_shake128_inc_squeeze: 338| 671|static void SHA3_shake128_inc_squeeze(uint8_t *output, size_t outlen, OQS_SHA3_shake128_inc_ctx *state) { 339| 671| keccak_inc_squeeze(output, outlen, (uint64_t *)state->ctx, OQS_SHA3_SHAKE128_RATE); ------------------ | | 239| 671|#define OQS_SHA3_SHAKE128_RATE 168 ------------------ 340| 671|} xkcp_sha3.c:SHA3_shake128_inc_ctx_release: 346| 596|static void SHA3_shake128_inc_ctx_release(OQS_SHA3_shake128_inc_ctx *state) { 347| 596| OQS_MEM_aligned_secure_free(state->ctx, KECCAK_CTX_BYTES); ------------------ | | 26| 596|#define KECCAK_CTX_BYTES (KECCAK_CTX_ALIGNMENT * \ | | ------------------ | | | | 24| 596|#define KECCAK_CTX_ALIGNMENT 32 | | ------------------ | | 27| 596| ((_KECCAK_CTX_BYTES + KECCAK_CTX_ALIGNMENT - 1)/KECCAK_CTX_ALIGNMENT)) | | ------------------ | | | | 25| 596|#define _KECCAK_CTX_BYTES (200+sizeof(uint64_t)) | | ------------------ | | ((_KECCAK_CTX_BYTES + KECCAK_CTX_ALIGNMENT - 1)/KECCAK_CTX_ALIGNMENT)) | | ------------------ | | | | 24| 596|#define KECCAK_CTX_ALIGNMENT 32 | | ------------------ | | ((_KECCAK_CTX_BYTES + KECCAK_CTX_ALIGNMENT - 1)/KECCAK_CTX_ALIGNMENT)) | | ------------------ | | | | 24| 596|#define KECCAK_CTX_ALIGNMENT 32 | | ------------------ ------------------ 348| 596|} xkcp_sha3.c:SHA3_shake128_inc_ctx_reset: 350| 486|static void SHA3_shake128_inc_ctx_reset(OQS_SHA3_shake128_inc_ctx *state) { 351| 486| keccak_inc_reset((uint64_t *)state->ctx); 352| 486|} xkcp_sha3.c:SHA3_shake256: 356| 9.29k|static void SHA3_shake256(uint8_t *output, size_t outlen, const uint8_t *input, size_t inlen) { 357| 9.29k| OQS_SHA3_shake256_inc_ctx s; 358| 9.29k| OQS_SHA3_shake256_inc_init(&s); 359| 9.29k| OQS_SHA3_shake256_inc_absorb(&s, input, inlen); 360| 9.29k| OQS_SHA3_shake256_inc_finalize(&s); 361| 9.29k| OQS_SHA3_shake256_inc_squeeze(output, outlen, &s); 362| 9.29k| OQS_SHA3_shake256_inc_ctx_release(&s); 363| 9.29k|} xkcp_sha3.c:SHA3_shake256_inc_init: 367| 10.2k|static void SHA3_shake256_inc_init(OQS_SHA3_shake256_inc_ctx *state) { 368| 10.2k| state->ctx = OQS_MEM_aligned_alloc(KECCAK_CTX_ALIGNMENT, KECCAK_CTX_BYTES); ------------------ | | 24| 10.2k|#define KECCAK_CTX_ALIGNMENT 32 ------------------ state->ctx = OQS_MEM_aligned_alloc(KECCAK_CTX_ALIGNMENT, KECCAK_CTX_BYTES); ------------------ | | 26| 10.2k|#define KECCAK_CTX_BYTES (KECCAK_CTX_ALIGNMENT * \ | | ------------------ | | | | 24| 10.2k|#define KECCAK_CTX_ALIGNMENT 32 | | ------------------ | | 27| 10.2k| ((_KECCAK_CTX_BYTES + KECCAK_CTX_ALIGNMENT - 1)/KECCAK_CTX_ALIGNMENT)) | | ------------------ | | | | 25| 10.2k|#define _KECCAK_CTX_BYTES (200+sizeof(uint64_t)) | | ------------------ | | ((_KECCAK_CTX_BYTES + KECCAK_CTX_ALIGNMENT - 1)/KECCAK_CTX_ALIGNMENT)) | | ------------------ | | | | 24| 10.2k|#define KECCAK_CTX_ALIGNMENT 32 | | ------------------ | | ((_KECCAK_CTX_BYTES + KECCAK_CTX_ALIGNMENT - 1)/KECCAK_CTX_ALIGNMENT)) | | ------------------ | | | | 24| 10.2k|#define KECCAK_CTX_ALIGNMENT 32 | | ------------------ ------------------ 369| 10.2k| OQS_EXIT_IF_NULLPTR(state->ctx, "SHA3"); ------------------ | | 82| 10.2k| do { \ | | 83| 10.2k| if ((x) == (void *)0) { \ | | ------------------ | | | Branch (83:9): [True: 0, False: 10.2k] | | ------------------ | | 84| 0| fprintf(stderr, "Unexpected NULL returned from %s API. Exiting.\n", \ | | 85| 0| loc); \ | | 86| 0| exit(EXIT_FAILURE); \ | | 87| 0| } \ | | 88| 10.2k| } while (0) | | ------------------ | | | Branch (88:12): [Folded, False: 10.2k] | | ------------------ ------------------ 370| 10.2k| keccak_inc_reset((uint64_t *)state->ctx); 371| 10.2k|} xkcp_sha3.c:SHA3_shake256_inc_absorb: 373| 11.2k|static void SHA3_shake256_inc_absorb(OQS_SHA3_shake256_inc_ctx *state, const uint8_t *input, size_t inlen) { 374| 11.2k| keccak_inc_absorb((uint64_t *)state->ctx, OQS_SHA3_SHAKE256_RATE, input, inlen); ------------------ | | 320| 11.2k|#define OQS_SHA3_SHAKE256_RATE 136 ------------------ 375| 11.2k|} xkcp_sha3.c:SHA3_shake256_inc_finalize: 377| 10.2k|static void SHA3_shake256_inc_finalize(OQS_SHA3_shake256_inc_ctx *state) { 378| 10.2k| keccak_inc_finalize((uint64_t *)state->ctx, OQS_SHA3_SHAKE256_RATE, 0x1F); ------------------ | | 320| 10.2k|#define OQS_SHA3_SHAKE256_RATE 136 ------------------ 379| 10.2k|} xkcp_sha3.c:SHA3_shake256_inc_squeeze: 381| 47.3k|static void SHA3_shake256_inc_squeeze(uint8_t *output, size_t outlen, OQS_SHA3_shake256_inc_ctx *state) { 382| 47.3k| keccak_inc_squeeze(output, outlen, state->ctx, OQS_SHA3_SHAKE256_RATE); ------------------ | | 320| 47.3k|#define OQS_SHA3_SHAKE256_RATE 136 ------------------ 383| 47.3k|} xkcp_sha3.c:SHA3_shake256_inc_ctx_release: 385| 10.2k|static void SHA3_shake256_inc_ctx_release(OQS_SHA3_shake256_inc_ctx *state) { 386| 10.2k| OQS_MEM_aligned_secure_free(state->ctx, KECCAK_CTX_BYTES); ------------------ | | 26| 10.2k|#define KECCAK_CTX_BYTES (KECCAK_CTX_ALIGNMENT * \ | | ------------------ | | | | 24| 10.2k|#define KECCAK_CTX_ALIGNMENT 32 | | ------------------ | | 27| 10.2k| ((_KECCAK_CTX_BYTES + KECCAK_CTX_ALIGNMENT - 1)/KECCAK_CTX_ALIGNMENT)) | | ------------------ | | | | 25| 10.2k|#define _KECCAK_CTX_BYTES (200+sizeof(uint64_t)) | | ------------------ | | ((_KECCAK_CTX_BYTES + KECCAK_CTX_ALIGNMENT - 1)/KECCAK_CTX_ALIGNMENT)) | | ------------------ | | | | 24| 10.2k|#define KECCAK_CTX_ALIGNMENT 32 | | ------------------ | | ((_KECCAK_CTX_BYTES + KECCAK_CTX_ALIGNMENT - 1)/KECCAK_CTX_ALIGNMENT)) | | ------------------ | | | | 24| 10.2k|#define KECCAK_CTX_ALIGNMENT 32 | | ------------------ ------------------ 387| 10.2k|} xkcp_sha3x4.c:SHA3_shake128_x4: 167| 33.3k|static void SHA3_shake128_x4(uint8_t *out0, uint8_t *out1, uint8_t *out2, uint8_t *out3, size_t outlen, const uint8_t *in0, const uint8_t *in1, const uint8_t *in2, const uint8_t *in3, size_t inlen) { 168| 33.3k| OQS_SHA3_shake128_x4_inc_ctx s; 169| 33.3k| OQS_SHA3_shake128_x4_inc_init(&s); 170| 33.3k| OQS_SHA3_shake128_x4_inc_absorb(&s, in0, in1, in2, in3, inlen); 171| 33.3k| OQS_SHA3_shake128_x4_inc_finalize(&s); 172| 33.3k| OQS_SHA3_shake128_x4_inc_squeeze(out0, out1, out2, out3, outlen, &s); 173| 33.3k| OQS_SHA3_shake128_x4_inc_ctx_release(&s); 174| 33.3k|} xkcp_sha3x4.c:SHA3_shake128_x4_inc_init: 178| 34.7k|static void SHA3_shake128_x4_inc_init(OQS_SHA3_shake128_x4_inc_ctx *state) { 179| 34.7k| state->ctx = OQS_MEM_aligned_alloc(KECCAK_X4_CTX_ALIGNMENT, KECCAK_X4_CTX_BYTES); ------------------ | | 19| 34.7k|#define KECCAK_X4_CTX_ALIGNMENT 32 ------------------ state->ctx = OQS_MEM_aligned_alloc(KECCAK_X4_CTX_ALIGNMENT, KECCAK_X4_CTX_BYTES); ------------------ | | 21| 34.7k|#define KECCAK_X4_CTX_BYTES (KECCAK_X4_CTX_ALIGNMENT * \ | | ------------------ | | | | 19| 34.7k|#define KECCAK_X4_CTX_ALIGNMENT 32 | | ------------------ | | 22| 34.7k| ((_KECCAK_X4_CTX_BYTES + KECCAK_X4_CTX_ALIGNMENT - 1)/KECCAK_X4_CTX_ALIGNMENT)) | | ------------------ | | | | 20| 34.7k|#define _KECCAK_X4_CTX_BYTES (800+sizeof(uint64_t)) | | ------------------ | | ((_KECCAK_X4_CTX_BYTES + KECCAK_X4_CTX_ALIGNMENT - 1)/KECCAK_X4_CTX_ALIGNMENT)) | | ------------------ | | | | 19| 34.7k|#define KECCAK_X4_CTX_ALIGNMENT 32 | | ------------------ | | ((_KECCAK_X4_CTX_BYTES + KECCAK_X4_CTX_ALIGNMENT - 1)/KECCAK_X4_CTX_ALIGNMENT)) | | ------------------ | | | | 19| 34.7k|#define KECCAK_X4_CTX_ALIGNMENT 32 | | ------------------ ------------------ 180| 34.7k| OQS_EXIT_IF_NULLPTR(state->ctx, "SHA3x4"); ------------------ | | 82| 34.7k| do { \ | | 83| 34.7k| if ((x) == (void *)0) { \ | | ------------------ | | | Branch (83:9): [True: 0, False: 34.7k] | | ------------------ | | 84| 0| fprintf(stderr, "Unexpected NULL returned from %s API. Exiting.\n", \ | | 85| 0| loc); \ | | 86| 0| exit(EXIT_FAILURE); \ | | 87| 0| } \ | | 88| 34.7k| } while (0) | | ------------------ | | | Branch (88:12): [Folded, False: 34.7k] | | ------------------ ------------------ 181| 34.7k| keccak_x4_inc_reset((uint64_t *)state->ctx); 182| 34.7k|} xkcp_sha3x4.c:keccak_x4_inc_reset: 76| 40.6k|static void keccak_x4_inc_reset(uint64_t *s) { 77| 40.6k|#if OQS_USE_PTHREADS 78| 40.6k| pthread_once(&dispatch_once_control, Keccak_X4_Dispatch); 79| |#else 80| | if (Keccak_X4_Initialize_ptr == NULL) { 81| | Keccak_X4_Dispatch(); 82| | } 83| |#endif 84| 40.6k| (*Keccak_X4_Initialize_ptr)(s); 85| 40.6k| s[100] = 0; 86| 40.6k|} xkcp_sha3x4.c:Keccak_X4_Dispatch: 36| 1|static void Keccak_X4_Dispatch(void) { 37| |// TODO: Simplify this when we have a Windows-compatible AVX2 implementation of SHA3 38| 1|#if defined(OQS_DIST_X86_64_BUILD) 39| 1|#if defined(OQS_ENABLE_SHA3_xkcp_low_avx2) 40| 1|#if defined(OQS_USE_SHA3_AVX512VL) 41| 1| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX512)) { ------------------ | Branch (41:6): [True: 0, False: 1] ------------------ 42| 0| extern const struct OQS_SHA3_x4_callbacks sha3_x4_avx512vl_callbacks; 43| | 44| 0| sha3_x4_default_callbacks = sha3_x4_avx512vl_callbacks; 45| 0| } 46| 1|#endif 47| 1| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2)) { ------------------ | Branch (47:6): [True: 1, False: 0] ------------------ 48| 1| Keccak_X4_Initialize_ptr = &KeccakP1600times4_InitializeAll_avx2; 49| 1| Keccak_X4_AddByte_ptr = &KeccakP1600times4_AddByte_avx2; 50| 1| Keccak_X4_AddBytes_ptr = &KeccakP1600times4_AddBytes_avx2; 51| 1| Keccak_X4_Permute_ptr = &KeccakP1600times4_PermuteAll_24rounds_avx2; 52| 1| Keccak_X4_ExtractBytes_ptr = &KeccakP1600times4_ExtractBytes_avx2; 53| 1| } else { 54| 0| Keccak_X4_Initialize_ptr = &KeccakP1600times4_InitializeAll_serial; 55| 0| Keccak_X4_AddByte_ptr = &KeccakP1600times4_AddByte_serial; 56| 0| Keccak_X4_AddBytes_ptr = &KeccakP1600times4_AddBytes_serial; 57| 0| Keccak_X4_Permute_ptr = &KeccakP1600times4_PermuteAll_24rounds_serial; 58| 0| Keccak_X4_ExtractBytes_ptr = &KeccakP1600times4_ExtractBytes_serial; 59| 0| } 60| |#else // Windows 61| | Keccak_X4_Initialize_ptr = &KeccakP1600times4_InitializeAll_serial; 62| | Keccak_X4_AddByte_ptr = &KeccakP1600times4_AddByte_serial; 63| | Keccak_X4_AddBytes_ptr = &KeccakP1600times4_AddBytes_serial; 64| | Keccak_X4_Permute_ptr = &KeccakP1600times4_PermuteAll_24rounds_serial; 65| | Keccak_X4_ExtractBytes_ptr = &KeccakP1600times4_ExtractBytes_serial; 66| |#endif 67| |#else 68| | Keccak_X4_Initialize_ptr = &KeccakP1600times4_InitializeAll; 69| | Keccak_X4_AddByte_ptr = &KeccakP1600times4_AddByte; 70| | Keccak_X4_AddBytes_ptr = &KeccakP1600times4_AddBytes; 71| | Keccak_X4_Permute_ptr = &KeccakP1600times4_PermuteAll_24rounds; 72| | Keccak_X4_ExtractBytes_ptr = &KeccakP1600times4_ExtractBytes; 73| |#endif 74| 1|} xkcp_sha3x4.c:SHA3_shake128_x4_inc_absorb: 183| 35.9k|static void SHA3_shake128_x4_inc_absorb(OQS_SHA3_shake128_x4_inc_ctx *state, const uint8_t *in0, const uint8_t *in1, const uint8_t *in2, const uint8_t *in3, size_t inlen) { 184| 35.9k| keccak_x4_inc_absorb((uint64_t *)state->ctx, OQS_SHA3_SHAKE128_RATE, in0, in1, in2, in3, inlen); ------------------ | | 239| 35.9k|#define OQS_SHA3_SHAKE128_RATE 168 ------------------ 185| 35.9k|} xkcp_sha3x4.c:keccak_x4_inc_absorb: 89| 37.8k| const uint8_t *in0, const uint8_t *in1, const uint8_t *in2, const uint8_t *in3, size_t inlen) { 90| 37.8k| uint64_t c = r - s[100]; 91| | 92| 37.8k| if (s[100] && inlen >= c) { ------------------ | Branch (92:6): [True: 0, False: 37.8k] | Branch (92:16): [True: 0, False: 0] ------------------ 93| 0| (*Keccak_X4_AddBytes_ptr)(s, 0, in0, (unsigned int)s[100], (unsigned int)c); 94| 0| (*Keccak_X4_AddBytes_ptr)(s, 1, in1, (unsigned int)s[100], (unsigned int)c); 95| 0| (*Keccak_X4_AddBytes_ptr)(s, 2, in2, (unsigned int)s[100], (unsigned int)c); 96| 0| (*Keccak_X4_AddBytes_ptr)(s, 3, in3, (unsigned int)s[100], (unsigned int)c); 97| 0| (*Keccak_X4_Permute_ptr)(s); 98| 0| inlen -= c; 99| 0| in0 += c; 100| 0| in1 += c; 101| 0| in2 += c; 102| 0| in3 += c; 103| 0| s[100] = 0; 104| 0| } 105| | 106| 37.8k| while (inlen >= r) { ------------------ | Branch (106:9): [True: 0, False: 37.8k] ------------------ 107| 0| (*Keccak_X4_AddBytes_ptr)(s, 0, in0, 0, (unsigned int)r); 108| 0| (*Keccak_X4_AddBytes_ptr)(s, 1, in1, 0, (unsigned int)r); 109| 0| (*Keccak_X4_AddBytes_ptr)(s, 2, in2, 0, (unsigned int)r); 110| 0| (*Keccak_X4_AddBytes_ptr)(s, 3, in3, 0, (unsigned int)r); 111| 0| (*Keccak_X4_Permute_ptr)(s); 112| 0| inlen -= r; 113| 0| in0 += r; 114| 0| in1 += r; 115| 0| in2 += r; 116| 0| in3 += r; 117| 0| } 118| | 119| 37.8k| (*Keccak_X4_AddBytes_ptr)(s, 0, in0, (unsigned int)s[100], (unsigned int)inlen); 120| 37.8k| (*Keccak_X4_AddBytes_ptr)(s, 1, in1, (unsigned int)s[100], (unsigned int)inlen); 121| 37.8k| (*Keccak_X4_AddBytes_ptr)(s, 2, in2, (unsigned int)s[100], (unsigned int)inlen); 122| 37.8k| (*Keccak_X4_AddBytes_ptr)(s, 3, in3, (unsigned int)s[100], (unsigned int)inlen); 123| 37.8k| s[100] += inlen; 124| 37.8k|} xkcp_sha3x4.c:SHA3_shake128_x4_inc_finalize: 187| 35.9k|static void SHA3_shake128_x4_inc_finalize(OQS_SHA3_shake128_x4_inc_ctx *state) { 188| 35.9k| keccak_x4_inc_finalize((uint64_t *)state->ctx, OQS_SHA3_SHAKE128_RATE, 0x1F); ------------------ | | 239| 35.9k|#define OQS_SHA3_SHAKE128_RATE 168 ------------------ 189| 35.9k|} xkcp_sha3x4.c:keccak_x4_inc_finalize: 126| 37.8k|static void keccak_x4_inc_finalize(uint64_t *s, uint32_t r, uint8_t p) { 127| 37.8k| (*Keccak_X4_AddByte_ptr)(s, 0, p, (unsigned int)s[100]); 128| 37.8k| (*Keccak_X4_AddByte_ptr)(s, 1, p, (unsigned int)s[100]); 129| 37.8k| (*Keccak_X4_AddByte_ptr)(s, 2, p, (unsigned int)s[100]); 130| 37.8k| (*Keccak_X4_AddByte_ptr)(s, 3, p, (unsigned int)s[100]); 131| | 132| 37.8k| (*Keccak_X4_AddByte_ptr)(s, 0, 0x80, (unsigned int)(r - 1)); 133| 37.8k| (*Keccak_X4_AddByte_ptr)(s, 1, 0x80, (unsigned int)(r - 1)); 134| 37.8k| (*Keccak_X4_AddByte_ptr)(s, 2, 0x80, (unsigned int)(r - 1)); 135| 37.8k| (*Keccak_X4_AddByte_ptr)(s, 3, 0x80, (unsigned int)(r - 1)); 136| | 137| 37.8k| s[100] = 0; 138| 37.8k|} xkcp_sha3x4.c:SHA3_shake128_x4_inc_squeeze: 191| 37.0k|static void SHA3_shake128_x4_inc_squeeze(uint8_t *out0, uint8_t *out1, uint8_t *out2, uint8_t *out3, size_t outlen, OQS_SHA3_shake128_x4_inc_ctx *state) { 192| 37.0k| keccak_x4_inc_squeeze(out0, out1, out2, out3, outlen, (uint64_t *)state->ctx, OQS_SHA3_SHAKE128_RATE); ------------------ | | 239| 37.0k|#define OQS_SHA3_SHAKE128_RATE 168 ------------------ 193| 37.0k|} xkcp_sha3x4.c:keccak_x4_inc_squeeze: 141| 38.9k| size_t outlen, uint64_t *s, uint32_t r) { 142| | 143| 496k| while (outlen > s[100]) { ------------------ | Branch (143:9): [True: 457k, False: 38.9k] ------------------ 144| 457k| (*Keccak_X4_ExtractBytes_ptr)(s, 0, out0, (unsigned int)(r - s[100]), (unsigned int)s[100]); 145| 457k| (*Keccak_X4_ExtractBytes_ptr)(s, 1, out1, (unsigned int)(r - s[100]), (unsigned int)s[100]); 146| 457k| (*Keccak_X4_ExtractBytes_ptr)(s, 2, out2, (unsigned int)(r - s[100]), (unsigned int)s[100]); 147| 457k| (*Keccak_X4_ExtractBytes_ptr)(s, 3, out3, (unsigned int)(r - s[100]), (unsigned int)s[100]); 148| 457k| (*Keccak_X4_Permute_ptr)(s); 149| 457k| out0 += s[100]; 150| 457k| out1 += s[100]; 151| 457k| out2 += s[100]; 152| 457k| out3 += s[100]; 153| 457k| outlen -= s[100]; 154| 457k| s[100] = r; 155| 457k| } 156| | 157| 38.9k| (*Keccak_X4_ExtractBytes_ptr)(s, 0, out0, (unsigned int)(r - s[100]), (unsigned int)outlen); 158| 38.9k| (*Keccak_X4_ExtractBytes_ptr)(s, 1, out1, (unsigned int)(r - s[100]), (unsigned int)outlen); 159| 38.9k| (*Keccak_X4_ExtractBytes_ptr)(s, 2, out2, (unsigned int)(r - s[100]), (unsigned int)outlen); 160| 38.9k| (*Keccak_X4_ExtractBytes_ptr)(s, 3, out3, (unsigned int)(r - s[100]), (unsigned int)outlen); 161| | 162| 38.9k| s[100] -= outlen; 163| 38.9k|} xkcp_sha3x4.c:SHA3_shake128_x4_inc_ctx_release: 199| 34.7k|static void SHA3_shake128_x4_inc_ctx_release(OQS_SHA3_shake128_x4_inc_ctx *state) { 200| 34.7k| OQS_MEM_aligned_secure_free(state->ctx, KECCAK_X4_CTX_BYTES); ------------------ | | 21| 34.7k|#define KECCAK_X4_CTX_BYTES (KECCAK_X4_CTX_ALIGNMENT * \ | | ------------------ | | | | 19| 34.7k|#define KECCAK_X4_CTX_ALIGNMENT 32 | | ------------------ | | 22| 34.7k| ((_KECCAK_X4_CTX_BYTES + KECCAK_X4_CTX_ALIGNMENT - 1)/KECCAK_X4_CTX_ALIGNMENT)) | | ------------------ | | | | 20| 34.7k|#define _KECCAK_X4_CTX_BYTES (800+sizeof(uint64_t)) | | ------------------ | | ((_KECCAK_X4_CTX_BYTES + KECCAK_X4_CTX_ALIGNMENT - 1)/KECCAK_X4_CTX_ALIGNMENT)) | | ------------------ | | | | 19| 34.7k|#define KECCAK_X4_CTX_ALIGNMENT 32 | | ------------------ | | ((_KECCAK_X4_CTX_BYTES + KECCAK_X4_CTX_ALIGNMENT - 1)/KECCAK_X4_CTX_ALIGNMENT)) | | ------------------ | | | | 19| 34.7k|#define KECCAK_X4_CTX_ALIGNMENT 32 | | ------------------ ------------------ 201| 34.7k|} xkcp_sha3x4.c:SHA3_shake128_x4_inc_ctx_reset: 203| 2.57k|static void SHA3_shake128_x4_inc_ctx_reset(OQS_SHA3_shake128_x4_inc_ctx *state) { 204| 2.57k| keccak_x4_inc_reset((uint64_t *)state->ctx); 205| 2.57k|} xkcp_sha3x4.c:SHA3_shake256_x4: 209| 438|static void SHA3_shake256_x4(uint8_t *out0, uint8_t *out1, uint8_t *out2, uint8_t *out3, size_t outlen, const uint8_t *in0, const uint8_t *in1, const uint8_t *in2, const uint8_t *in3, size_t inlen) { 210| 438| OQS_SHA3_shake256_x4_inc_ctx s; 211| 438| OQS_SHA3_shake256_x4_inc_init(&s); 212| 438| OQS_SHA3_shake256_x4_inc_absorb(&s, in0, in1, in2, in3, inlen); 213| 438| OQS_SHA3_shake256_x4_inc_finalize(&s); 214| 438| OQS_SHA3_shake256_x4_inc_squeeze(out0, out1, out2, out3, outlen, &s); 215| 438| OQS_SHA3_shake256_x4_inc_ctx_release(&s); 216| 438|} xkcp_sha3x4.c:SHA3_shake256_x4_inc_init: 220| 1.90k|static void SHA3_shake256_x4_inc_init(OQS_SHA3_shake256_x4_inc_ctx *state) { 221| 1.90k| state->ctx = OQS_MEM_aligned_alloc(KECCAK_X4_CTX_ALIGNMENT, KECCAK_X4_CTX_BYTES); ------------------ | | 19| 1.90k|#define KECCAK_X4_CTX_ALIGNMENT 32 ------------------ state->ctx = OQS_MEM_aligned_alloc(KECCAK_X4_CTX_ALIGNMENT, KECCAK_X4_CTX_BYTES); ------------------ | | 21| 1.90k|#define KECCAK_X4_CTX_BYTES (KECCAK_X4_CTX_ALIGNMENT * \ | | ------------------ | | | | 19| 1.90k|#define KECCAK_X4_CTX_ALIGNMENT 32 | | ------------------ | | 22| 1.90k| ((_KECCAK_X4_CTX_BYTES + KECCAK_X4_CTX_ALIGNMENT - 1)/KECCAK_X4_CTX_ALIGNMENT)) | | ------------------ | | | | 20| 1.90k|#define _KECCAK_X4_CTX_BYTES (800+sizeof(uint64_t)) | | ------------------ | | ((_KECCAK_X4_CTX_BYTES + KECCAK_X4_CTX_ALIGNMENT - 1)/KECCAK_X4_CTX_ALIGNMENT)) | | ------------------ | | | | 19| 1.90k|#define KECCAK_X4_CTX_ALIGNMENT 32 | | ------------------ | | ((_KECCAK_X4_CTX_BYTES + KECCAK_X4_CTX_ALIGNMENT - 1)/KECCAK_X4_CTX_ALIGNMENT)) | | ------------------ | | | | 19| 1.90k|#define KECCAK_X4_CTX_ALIGNMENT 32 | | ------------------ ------------------ 222| 1.90k| OQS_EXIT_IF_NULLPTR(state->ctx, "SHA3x4"); ------------------ | | 82| 1.90k| do { \ | | 83| 1.90k| if ((x) == (void *)0) { \ | | ------------------ | | | Branch (83:9): [True: 0, False: 1.90k] | | ------------------ | | 84| 0| fprintf(stderr, "Unexpected NULL returned from %s API. Exiting.\n", \ | | 85| 0| loc); \ | | 86| 0| exit(EXIT_FAILURE); \ | | 87| 0| } \ | | 88| 1.90k| } while (0) | | ------------------ | | | Branch (88:12): [Folded, False: 1.90k] | | ------------------ ------------------ 223| 1.90k| keccak_x4_inc_reset((uint64_t *)state->ctx); 224| 1.90k|} xkcp_sha3x4.c:SHA3_shake256_x4_inc_absorb: 226| 1.90k|static void SHA3_shake256_x4_inc_absorb(OQS_SHA3_shake256_x4_inc_ctx *state, const uint8_t *in0, const uint8_t *in1, const uint8_t *in2, const uint8_t *in3, size_t inlen) { 227| 1.90k| keccak_x4_inc_absorb((uint64_t *)state->ctx, OQS_SHA3_SHAKE256_RATE, in0, in1, in2, in3, inlen); ------------------ | | 320| 1.90k|#define OQS_SHA3_SHAKE256_RATE 136 ------------------ 228| 1.90k|} xkcp_sha3x4.c:SHA3_shake256_x4_inc_finalize: 230| 1.90k|static void SHA3_shake256_x4_inc_finalize(OQS_SHA3_shake256_x4_inc_ctx *state) { 231| 1.90k| keccak_x4_inc_finalize((uint64_t *)state->ctx, OQS_SHA3_SHAKE256_RATE, 0x1F); ------------------ | | 320| 1.90k|#define OQS_SHA3_SHAKE256_RATE 136 ------------------ 232| 1.90k|} xkcp_sha3x4.c:SHA3_shake256_x4_inc_squeeze: 234| 1.90k|static void SHA3_shake256_x4_inc_squeeze(uint8_t *out0, uint8_t *out1, uint8_t *out2, uint8_t *out3, size_t outlen, OQS_SHA3_shake256_x4_inc_ctx *state) { 235| 1.90k| keccak_x4_inc_squeeze(out0, out1, out2, out3, outlen, (uint64_t *)state->ctx, OQS_SHA3_SHAKE256_RATE); ------------------ | | 320| 1.90k|#define OQS_SHA3_SHAKE256_RATE 136 ------------------ 236| 1.90k|} xkcp_sha3x4.c:SHA3_shake256_x4_inc_ctx_release: 242| 1.90k|static void SHA3_shake256_x4_inc_ctx_release(OQS_SHA3_shake256_x4_inc_ctx *state) { 243| 1.90k| OQS_MEM_aligned_secure_free(state->ctx, KECCAK_X4_CTX_BYTES); ------------------ | | 21| 1.90k|#define KECCAK_X4_CTX_BYTES (KECCAK_X4_CTX_ALIGNMENT * \ | | ------------------ | | | | 19| 1.90k|#define KECCAK_X4_CTX_ALIGNMENT 32 | | ------------------ | | 22| 1.90k| ((_KECCAK_X4_CTX_BYTES + KECCAK_X4_CTX_ALIGNMENT - 1)/KECCAK_X4_CTX_ALIGNMENT)) | | ------------------ | | | | 20| 1.90k|#define _KECCAK_X4_CTX_BYTES (800+sizeof(uint64_t)) | | ------------------ | | ((_KECCAK_X4_CTX_BYTES + KECCAK_X4_CTX_ALIGNMENT - 1)/KECCAK_X4_CTX_ALIGNMENT)) | | ------------------ | | | | 19| 1.90k|#define KECCAK_X4_CTX_ALIGNMENT 32 | | ------------------ | | ((_KECCAK_X4_CTX_BYTES + KECCAK_X4_CTX_ALIGNMENT - 1)/KECCAK_X4_CTX_ALIGNMENT)) | | ------------------ | | | | 19| 1.90k|#define KECCAK_X4_CTX_ALIGNMENT 32 | | ------------------ ------------------ 244| 1.90k|} xkcp_sha3x4.c:SHA3_shake256_x4_inc_ctx_reset: 246| 1.46k|static void SHA3_shake256_x4_inc_ctx_reset(OQS_SHA3_shake256_x4_inc_ctx *state) { 247| 1.46k| keccak_x4_inc_reset((uint64_t *)state->ctx); 248| 1.46k|} common.c:cpuid: 47| 2|static inline void cpuid(cpuid_out *out, const uint32_t eax_leaf) { 48| 2| const uint32_t ecx_leaf = 0; 49| | 50| 2|#if defined(__GNUC__) || defined(__clang__) 51| 2| uint32_t eax, ebx, ecx, edx; 52| 2| __asm__("cpuid" : "=a"(eax), "=b"(ebx), "=c"(ecx), "=d"(edx) : "a"(eax_leaf), "c"(ecx_leaf) : ); 53| 2| out->eax = eax; 54| 2| out->ebx = ebx; 55| 2| out->ecx = ecx; 56| 2| out->edx = edx; 57| |#elif defined(_MSC_VER) 58| | uint32_t output[4]; 59| | __cpuidex(output, eax_leaf, ecx_leaf); 60| | out->eax = output[0]; 61| | out->ebx = output[1]; 62| | out->ecx = output[2]; 63| | out->edx = output[3]; 64| |#else 65| |#error "Only GCC, Clang, and MSVC are supported." 66| |#endif 67| 2|} common.c:is_bit_set: 43| 13|static inline unsigned int is_bit_set(const uint32_t val, const unsigned int bit_pos) { 44| 13| return val & (1 << bit_pos) ? 1 : 0; ------------------ | Branch (44:9): [True: 13, False: 0] ------------------ 45| 13|} common.c:xgetbv_eax: 27| 1|static inline uint32_t xgetbv_eax(uint32_t xcr) { 28| 1|#if defined(__GNUC__) || defined(__clang__) 29| 1| uint32_t eax; 30| 1| __asm__ ( ".byte 0x0f, 0x01, 0xd0" : "=a"(eax) : "c"(xcr) : "edx"); 31| 1| return eax; 32| |#elif defined(_MSC_VER) 33| | return _xgetbv(xcr) & 0xFFFF; 34| |#else 35| |#error "Only GCC, Clang, and MSVC are supported." 36| |#endif 37| 1|} common.c:has_mask: 39| 3|static unsigned int has_mask(const uint32_t value, const uint32_t mask) { 40| 3| return (value & mask) == mask; 41| 3|} kem.c:sk_cleanup: 37| 14| { \ 38| 14| secure_clean((uint8_t *)o, sizeof(*o)); \ ------------------ | | 33| 14|#define secure_clean OQS_MEM_cleanse ------------------ 39| 14| } kem.c:pad_r_cleanup: 37| 28| { \ 38| 28| secure_clean((uint8_t *)o, sizeof(*o)); \ ------------------ | | 33| 28|#define secure_clean OQS_MEM_cleanse ------------------ 39| 28| } kem.c:seeds_cleanup: 66| 14|{ 67| 42| for(int i = 0; i < NUM_OF_SEEDS; i++) { ------------------ | | 76| 42|#define NUM_OF_SEEDS 2 ------------------ | Branch (67:18): [True: 28, False: 14] ------------------ 68| 28| seed_cleanup(&(o->seed[i])); 69| 28| } 70| 14|} kem.c:seed_cleanup: 37| 42| { \ 38| 42| secure_clean((uint8_t *)o, sizeof(*o)); \ ------------------ | | 33| 42|#define secure_clean OQS_MEM_cleanse ------------------ 39| 42| } kem.c:m_cleanup: 37| 21| { \ 38| 21| secure_clean((uint8_t *)o, sizeof(*o)); \ ------------------ | | 33| 21|#define secure_clean OQS_MEM_cleanse ------------------ 39| 21| } kem.c:ss_cleanup: 37| 14| { \ 38| 14| secure_clean((uint8_t *)o, sizeof(*o)); \ ------------------ | | 33| 14|#define secure_clean OQS_MEM_cleanse ------------------ 39| 14| } kem.c:pad_e_cleanup: 37| 21| { \ 38| 21| secure_clean((uint8_t *)o, sizeof(*o)); \ ------------------ | | 33| 21|#define secure_clean OQS_MEM_cleanse ------------------ 39| 21| } kem.c:func_k_cleanup: 37| 14| { \ 38| 14| secure_clean((uint8_t *)o, sizeof(*o)); \ ------------------ | | 33| 14|#define secure_clean OQS_MEM_cleanse ------------------ 39| 14| } kem.c:e_cleanup: 37| 21| { \ 38| 21| secure_clean((uint8_t *)o, sizeof(*o)); \ ------------------ | | 33| 21|#define secure_clean OQS_MEM_cleanse ------------------ 39| 21| } decode.c:pad_r_cleanup: 37| 217| { \ 38| 217| secure_clean((uint8_t *)o, sizeof(*o)); \ ------------------ | | 33| 217|#define secure_clean OQS_MEM_cleanse ------------------ 39| 217| } decode.c:e_cleanup: 37| 14| { \ 38| 14| secure_clean((uint8_t *)o, sizeof(*o)); \ ------------------ | | 33| 14|#define secure_clean OQS_MEM_cleanse ------------------ 39| 14| } decode.c:syndrome_cleanup: 37| 56| { \ 38| 56| secure_clean((uint8_t *)o, sizeof(*o)); \ ------------------ | | 33| 56|#define secure_clean OQS_MEM_cleanse ------------------ 39| 56| } decode.c:upc_cleanup: 37| 49| { \ 38| 49| secure_clean((uint8_t *)o, sizeof(*o)); \ ------------------ | | 33| 49|#define secure_clean OQS_MEM_cleanse ------------------ 39| 49| } gf2x_inv.c:pad_r_cleanup: 37| 21| { \ 38| 21| secure_clean((uint8_t *)o, sizeof(*o)); \ ------------------ | | 33| 21|#define secure_clean OQS_MEM_cleanse ------------------ 39| 21| } gf2x_inv.c:dbl_pad_r_cleanup: 37| 7| { \ 38| 7| secure_clean((uint8_t *)o, sizeof(*o)); \ ------------------ | | 33| 7|#define secure_clean OQS_MEM_cleanse ------------------ 39| 7| } gf2x_mul.c:dbl_pad_r_cleanup: 37| 236| { \ 38| 236| secure_clean((uint8_t *)o, sizeof(*o)); \ ------------------ | | 33| 236|#define secure_clean OQS_MEM_cleanse ------------------ 39| 236| } sampling.c:OQS_KEM_bike_l1_is_avx512_enabled: 27| 15|{ 28| |// TODO: Determine minimal set of AVX512 features 29| 15|#if defined(OQS_DIST_X86_64_BUILD) 30| 15| return OQS_CPU_has_extension(OQS_CPU_EXT_AVX512); 31| |#elif defined(OQS_USE_AVX512_INSTRUCTIONS) 32| | return 1; 33| |#else 34| | return 0; 35| |#endif 36| 15|} sampling.c:OQS_KEM_bike_l1_is_avx2_enabled: 16| 15|{ 17| 15|#if defined(OQS_DIST_X86_64_BUILD) 18| 15| return OQS_CPU_has_extension(OQS_CPU_EXT_AVX2); 19| |#elif defined(OQS_USE_AVX2_INSTRUCTIONS) 20| | return 1; 21| |#else 22| | return 0; 23| |#endif 24| 15|} sampling.c:OQS_KEM_bike_l3_is_avx512_enabled: 27| 3|{ 28| |// TODO: Determine minimal set of AVX512 features 29| 3|#if defined(OQS_DIST_X86_64_BUILD) 30| 3| return OQS_CPU_has_extension(OQS_CPU_EXT_AVX512); 31| |#elif defined(OQS_USE_AVX512_INSTRUCTIONS) 32| | return 1; 33| |#else 34| | return 0; 35| |#endif 36| 3|} sampling.c:OQS_KEM_bike_l3_is_avx2_enabled: 16| 3|{ 17| 3|#if defined(OQS_DIST_X86_64_BUILD) 18| 3| return OQS_CPU_has_extension(OQS_CPU_EXT_AVX2); 19| |#elif defined(OQS_USE_AVX2_INSTRUCTIONS) 20| | return 1; 21| |#else 22| | return 0; 23| |#endif 24| 3|} sampling.c:OQS_KEM_bike_l5_is_avx512_enabled: 27| 3|{ 28| |// TODO: Determine minimal set of AVX512 features 29| 3|#if defined(OQS_DIST_X86_64_BUILD) 30| 3| return OQS_CPU_has_extension(OQS_CPU_EXT_AVX512); 31| |#elif defined(OQS_USE_AVX512_INSTRUCTIONS) 32| | return 1; 33| |#else 34| | return 0; 35| |#endif 36| 3|} sampling.c:OQS_KEM_bike_l5_is_avx2_enabled: 16| 3|{ 17| 3|#if defined(OQS_DIST_X86_64_BUILD) 18| 3| return OQS_CPU_has_extension(OQS_CPU_EXT_AVX2); 19| |#elif defined(OQS_USE_AVX2_INSTRUCTIONS) 20| | return 1; 21| |#else 22| | return 0; 23| |#endif 24| 3|} decode.c:OQS_KEM_bike_l1_is_avx512_enabled: 27| 5|{ 28| |// TODO: Determine minimal set of AVX512 features 29| 5|#if defined(OQS_DIST_X86_64_BUILD) 30| 5| return OQS_CPU_has_extension(OQS_CPU_EXT_AVX512); 31| |#elif defined(OQS_USE_AVX512_INSTRUCTIONS) 32| | return 1; 33| |#else 34| | return 0; 35| |#endif 36| 5|} decode.c:OQS_KEM_bike_l1_is_avx2_enabled: 16| 5|{ 17| 5|#if defined(OQS_DIST_X86_64_BUILD) 18| 5| return OQS_CPU_has_extension(OQS_CPU_EXT_AVX2); 19| |#elif defined(OQS_USE_AVX2_INSTRUCTIONS) 20| | return 1; 21| |#else 22| | return 0; 23| |#endif 24| 5|} gf2x_inv.c:OQS_KEM_bike_l1_is_avx512_enabled: 27| 5|{ 28| |// TODO: Determine minimal set of AVX512 features 29| 5|#if defined(OQS_DIST_X86_64_BUILD) 30| 5| return OQS_CPU_has_extension(OQS_CPU_EXT_AVX512); 31| |#elif defined(OQS_USE_AVX512_INSTRUCTIONS) 32| | return 1; 33| |#else 34| | return 0; 35| |#endif 36| 5|} gf2x_inv.c:OQS_KEM_bike_l1_is_avx2_enabled: 16| 5|{ 17| 5|#if defined(OQS_DIST_X86_64_BUILD) 18| 5| return OQS_CPU_has_extension(OQS_CPU_EXT_AVX2); 19| |#elif defined(OQS_USE_AVX2_INSTRUCTIONS) 20| | return 1; 21| |#else 22| | return 0; 23| |#endif 24| 5|} gf2x_inv.c:OQS_KEM_bike_l1_is_pclmul_enabled: 39| 5|{ 40| 5|#if defined(OQS_DIST_X86_64_BUILD) 41| 5| return OQS_CPU_has_extension(OQS_CPU_EXT_PCLMULQDQ); 42| |#elif defined(OQS_USE_PCLMULQDQ_INSTRUCTIONS) 43| | return 1; 44| |#else 45| | return 0; 46| |#endif 47| 5|} gf2x_mul.c:OQS_KEM_bike_l1_is_avx512_enabled: 27| 85|{ 28| |// TODO: Determine minimal set of AVX512 features 29| 85|#if defined(OQS_DIST_X86_64_BUILD) 30| 85| return OQS_CPU_has_extension(OQS_CPU_EXT_AVX512); 31| |#elif defined(OQS_USE_AVX512_INSTRUCTIONS) 32| | return 1; 33| |#else 34| | return 0; 35| |#endif 36| 85|} gf2x_mul.c:OQS_KEM_bike_l1_is_avx2_enabled: 16| 85|{ 17| 85|#if defined(OQS_DIST_X86_64_BUILD) 18| 85| return OQS_CPU_has_extension(OQS_CPU_EXT_AVX2); 19| |#elif defined(OQS_USE_AVX2_INSTRUCTIONS) 20| | return 1; 21| |#else 22| | return 0; 23| |#endif 24| 85|} gf2x_mul.c:OQS_KEM_bike_l1_is_pclmul_enabled: 39| 85|{ 40| 85|#if defined(OQS_DIST_X86_64_BUILD) 41| 85| return OQS_CPU_has_extension(OQS_CPU_EXT_PCLMULQDQ); 42| |#elif defined(OQS_USE_PCLMULQDQ_INSTRUCTIONS) 43| | return 1; 44| |#else 45| | return 0; 46| |#endif 47| 85|} decode.c:OQS_KEM_bike_l3_is_avx512_enabled: 27| 1|{ 28| |// TODO: Determine minimal set of AVX512 features 29| 1|#if defined(OQS_DIST_X86_64_BUILD) 30| 1| return OQS_CPU_has_extension(OQS_CPU_EXT_AVX512); 31| |#elif defined(OQS_USE_AVX512_INSTRUCTIONS) 32| | return 1; 33| |#else 34| | return 0; 35| |#endif 36| 1|} decode.c:OQS_KEM_bike_l3_is_avx2_enabled: 16| 1|{ 17| 1|#if defined(OQS_DIST_X86_64_BUILD) 18| 1| return OQS_CPU_has_extension(OQS_CPU_EXT_AVX2); 19| |#elif defined(OQS_USE_AVX2_INSTRUCTIONS) 20| | return 1; 21| |#else 22| | return 0; 23| |#endif 24| 1|} gf2x_inv.c:OQS_KEM_bike_l3_is_avx512_enabled: 27| 1|{ 28| |// TODO: Determine minimal set of AVX512 features 29| 1|#if defined(OQS_DIST_X86_64_BUILD) 30| 1| return OQS_CPU_has_extension(OQS_CPU_EXT_AVX512); 31| |#elif defined(OQS_USE_AVX512_INSTRUCTIONS) 32| | return 1; 33| |#else 34| | return 0; 35| |#endif 36| 1|} gf2x_inv.c:OQS_KEM_bike_l3_is_avx2_enabled: 16| 1|{ 17| 1|#if defined(OQS_DIST_X86_64_BUILD) 18| 1| return OQS_CPU_has_extension(OQS_CPU_EXT_AVX2); 19| |#elif defined(OQS_USE_AVX2_INSTRUCTIONS) 20| | return 1; 21| |#else 22| | return 0; 23| |#endif 24| 1|} gf2x_inv.c:OQS_KEM_bike_l3_is_pclmul_enabled: 39| 1|{ 40| 1|#if defined(OQS_DIST_X86_64_BUILD) 41| 1| return OQS_CPU_has_extension(OQS_CPU_EXT_PCLMULQDQ); 42| |#elif defined(OQS_USE_PCLMULQDQ_INSTRUCTIONS) 43| | return 1; 44| |#else 45| | return 0; 46| |#endif 47| 1|} gf2x_mul.c:OQS_KEM_bike_l3_is_avx512_enabled: 27| 17|{ 28| |// TODO: Determine minimal set of AVX512 features 29| 17|#if defined(OQS_DIST_X86_64_BUILD) 30| 17| return OQS_CPU_has_extension(OQS_CPU_EXT_AVX512); 31| |#elif defined(OQS_USE_AVX512_INSTRUCTIONS) 32| | return 1; 33| |#else 34| | return 0; 35| |#endif 36| 17|} gf2x_mul.c:OQS_KEM_bike_l3_is_avx2_enabled: 16| 17|{ 17| 17|#if defined(OQS_DIST_X86_64_BUILD) 18| 17| return OQS_CPU_has_extension(OQS_CPU_EXT_AVX2); 19| |#elif defined(OQS_USE_AVX2_INSTRUCTIONS) 20| | return 1; 21| |#else 22| | return 0; 23| |#endif 24| 17|} gf2x_mul.c:OQS_KEM_bike_l3_is_pclmul_enabled: 39| 17|{ 40| 17|#if defined(OQS_DIST_X86_64_BUILD) 41| 17| return OQS_CPU_has_extension(OQS_CPU_EXT_PCLMULQDQ); 42| |#elif defined(OQS_USE_PCLMULQDQ_INSTRUCTIONS) 43| | return 1; 44| |#else 45| | return 0; 46| |#endif 47| 17|} decode.c:OQS_KEM_bike_l5_is_avx512_enabled: 27| 1|{ 28| |// TODO: Determine minimal set of AVX512 features 29| 1|#if defined(OQS_DIST_X86_64_BUILD) 30| 1| return OQS_CPU_has_extension(OQS_CPU_EXT_AVX512); 31| |#elif defined(OQS_USE_AVX512_INSTRUCTIONS) 32| | return 1; 33| |#else 34| | return 0; 35| |#endif 36| 1|} decode.c:OQS_KEM_bike_l5_is_avx2_enabled: 16| 1|{ 17| 1|#if defined(OQS_DIST_X86_64_BUILD) 18| 1| return OQS_CPU_has_extension(OQS_CPU_EXT_AVX2); 19| |#elif defined(OQS_USE_AVX2_INSTRUCTIONS) 20| | return 1; 21| |#else 22| | return 0; 23| |#endif 24| 1|} gf2x_inv.c:OQS_KEM_bike_l5_is_avx512_enabled: 27| 1|{ 28| |// TODO: Determine minimal set of AVX512 features 29| 1|#if defined(OQS_DIST_X86_64_BUILD) 30| 1| return OQS_CPU_has_extension(OQS_CPU_EXT_AVX512); 31| |#elif defined(OQS_USE_AVX512_INSTRUCTIONS) 32| | return 1; 33| |#else 34| | return 0; 35| |#endif 36| 1|} gf2x_inv.c:OQS_KEM_bike_l5_is_avx2_enabled: 16| 1|{ 17| 1|#if defined(OQS_DIST_X86_64_BUILD) 18| 1| return OQS_CPU_has_extension(OQS_CPU_EXT_AVX2); 19| |#elif defined(OQS_USE_AVX2_INSTRUCTIONS) 20| | return 1; 21| |#else 22| | return 0; 23| |#endif 24| 1|} gf2x_inv.c:OQS_KEM_bike_l5_is_pclmul_enabled: 39| 1|{ 40| 1|#if defined(OQS_DIST_X86_64_BUILD) 41| 1| return OQS_CPU_has_extension(OQS_CPU_EXT_PCLMULQDQ); 42| |#elif defined(OQS_USE_PCLMULQDQ_INSTRUCTIONS) 43| | return 1; 44| |#else 45| | return 0; 46| |#endif 47| 1|} gf2x_mul.c:OQS_KEM_bike_l5_is_avx512_enabled: 27| 17|{ 28| |// TODO: Determine minimal set of AVX512 features 29| 17|#if defined(OQS_DIST_X86_64_BUILD) 30| 17| return OQS_CPU_has_extension(OQS_CPU_EXT_AVX512); 31| |#elif defined(OQS_USE_AVX512_INSTRUCTIONS) 32| | return 1; 33| |#else 34| | return 0; 35| |#endif 36| 17|} gf2x_mul.c:OQS_KEM_bike_l5_is_avx2_enabled: 16| 17|{ 17| 17|#if defined(OQS_DIST_X86_64_BUILD) 18| 17| return OQS_CPU_has_extension(OQS_CPU_EXT_AVX2); 19| |#elif defined(OQS_USE_AVX2_INSTRUCTIONS) 20| | return 1; 21| |#else 22| | return 0; 23| |#endif 24| 17|} gf2x_mul.c:OQS_KEM_bike_l5_is_pclmul_enabled: 39| 17|{ 40| 17|#if defined(OQS_DIST_X86_64_BUILD) 41| 17| return OQS_CPU_has_extension(OQS_CPU_EXT_PCLMULQDQ); 42| |#elif defined(OQS_USE_PCLMULQDQ_INSTRUCTIONS) 43| | return 1; 44| |#else 45| | return 0; 46| |#endif 47| 17|} OQS_KEM_bike_l1_compute_syndrome: 60| 40|{ 61| 40| DEFER_CLEANUP(pad_r_t pad_s, pad_r_cleanup); ------------------ | | 16| 40| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 62| | 63| 40| gf2x_mod_mul(&pad_s, c0, h0); ------------------ | | 60| 40|#define gf2x_mod_mul RENAME_FUNC_NAME(gf2x_mod_mul) | | ------------------ | | | | 44| 40|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 40|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 40|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 64| | 65| 40| bike_memcpy((uint8_t *)syndrome->qw, pad_s.val.raw, R_BYTES); ------------------ | | 81| 40|#define R_BYTES DIVIDE_AND_CEIL(R_BITS, 8) | | ------------------ | | | | 37| 40|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | ------------------ ------------------ 66| 40| ctx->dup(syndrome); 67| 40|} OQS_KEM_bike_l1_recompute_syndrome: 75| 35|{ 76| 35| DEFER_CLEANUP(pad_r_t tmp_c0, pad_r_cleanup); ------------------ | | 16| 35| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 77| 35| DEFER_CLEANUP(pad_r_t e0 = {0}, pad_r_cleanup); ------------------ | | 16| 35| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 78| 35| DEFER_CLEANUP(pad_r_t e1 = {0}, pad_r_cleanup); ------------------ | | 16| 35| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 79| | 80| 35| e0.val = e->val[0]; 81| 35| e1.val = e->val[1]; 82| | 83| | // tmp_c0 = pk * e1 + c0 + e0 84| 35| gf2x_mod_mul(&tmp_c0, &e1, pk); ------------------ | | 60| 35|#define gf2x_mod_mul RENAME_FUNC_NAME(gf2x_mod_mul) | | ------------------ | | | | 44| 35|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 35|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 35|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 85| 35| gf2x_mod_add(&tmp_c0, &tmp_c0, c0); ------------------ | | 123| 35|#define gf2x_mod_add RENAME_FUNC_NAME(gf2x_mod_add) | | ------------------ | | | | 44| 35|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 35|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 35|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 86| 35| gf2x_mod_add(&tmp_c0, &tmp_c0, &e0); ------------------ | | 123| 35|#define gf2x_mod_add RENAME_FUNC_NAME(gf2x_mod_add) | | ------------------ | | | | 44| 35|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 35|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 35|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 87| | 88| | // Recompute the syndrome using the updated ciphertext 89| 35| compute_syndrome(syndrome, &tmp_c0, h0, ctx); ------------------ | | 66| 35|#define compute_syndrome RENAME_FUNC_NAME(compute_syndrome) | | ------------------ | | | | 44| 35|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 35|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 35|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 90| 35|} OQS_KEM_bike_l1_decode: 237| 5|{ 238| | // Initialize the decode methods struct 239| 5| decode_ctx ctx; 240| 5| decode_ctx_init(&ctx); ------------------ | | 94| 5|#define decode_ctx_init RENAME_FUNC_NAME(decode_ctx_init) | | ------------------ | | | | 44| 5|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 5|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 5|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 241| | 242| 5| DEFER_CLEANUP(e_t black_e = {0}, e_cleanup); ------------------ | | 16| 5| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 243| 5| DEFER_CLEANUP(e_t gray_e = {0}, e_cleanup); ------------------ | | 16| 5| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 244| | 245| 5| DEFER_CLEANUP(pad_r_t c0 = {0}, pad_r_cleanup); ------------------ | | 16| 5| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 246| 5| DEFER_CLEANUP(pad_r_t h0 = {0}, pad_r_cleanup); ------------------ | | 16| 5| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 247| 5| pad_r_t pk = {0}; 248| | 249| | // Pad ciphertext (c0), secret key (h0), and public key (h) 250| 5| c0.val = ct->c0; 251| 5| h0.val = sk->bin[0]; 252| 5| pk.val = sk->pk; 253| | 254| 5| DEFER_CLEANUP(syndrome_t s = {0}, syndrome_cleanup); ------------------ | | 16| 5| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 255| 5| DMSG(" Computing s.\n"); 256| 5| compute_syndrome(&s, &c0, &h0, &ctx); ------------------ | | 66| 5|#define compute_syndrome RENAME_FUNC_NAME(compute_syndrome) | | ------------------ | | | | 44| 5|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 5|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 5|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 257| 5| ctx.dup(&s); 258| | 259| | // Reset (init) the error because it is xored in the find_err functions. 260| 5| bike_memset(e, 0, sizeof(*e)); 261| | 262| 30| for(uint32_t iter = 0; iter < MAX_IT; iter++) { ------------------ | | 53| 30|# define MAX_IT 5 ------------------ | Branch (262:26): [True: 25, False: 5] ------------------ 263| 25| const uint8_t threshold = get_threshold(&s); ------------------ | | 141| 25|#define get_threshold RENAME_FUNC_NAME(get_threshold) | | ------------------ | | | | 44| 25|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 25|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 25|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 264| | 265| 25| DMSG(" Iteration: %d\n", iter); 266| 25| DMSG(" Weight of e: %lu\n", 267| 25| r_bits_vector_weight(&e->val[0]) + r_bits_vector_weight(&e->val[1])); 268| 25| DMSG(" Weight of syndrome: %lu\n", r_bits_vector_weight((r_t *)s.qw)); 269| | 270| 25| find_err1(e, &black_e, &gray_e, &s, sk->wlist, threshold, &ctx); 271| 25| recompute_syndrome(&s, &c0, &h0, &pk, e, &ctx); ------------------ | | 67| 25|#define recompute_syndrome RENAME_FUNC_NAME(recompute_syndrome) | | ------------------ | | | | 44| 25|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 25|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 25|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 272| 25|#if defined(BGF_DECODER) 273| 25| if(iter >= 1) { ------------------ | Branch (273:8): [True: 20, False: 5] ------------------ 274| 20| continue; 275| 20| } 276| 5|#endif 277| 5| DMSG(" Weight of e: %lu\n", 278| 5| r_bits_vector_weight(&e->val[0]) + r_bits_vector_weight(&e->val[1])); 279| 5| DMSG(" Weight of syndrome: %lu\n", r_bits_vector_weight((r_t *)s.qw)); 280| | 281| 5| find_err2(e, &black_e, &s, sk->wlist, ((D + 1) / 2) + 1, &ctx); ------------------ | | 24| 5|# define D 71 ------------------ 282| 5| recompute_syndrome(&s, &c0, &h0, &pk, e, &ctx); ------------------ | | 67| 5|#define recompute_syndrome RENAME_FUNC_NAME(recompute_syndrome) | | ------------------ | | | | 44| 5|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 5|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 5|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 283| | 284| 5| DMSG(" Weight of e: %lu\n", 285| 5| r_bits_vector_weight(&e->val[0]) + r_bits_vector_weight(&e->val[1])); 286| 5| DMSG(" Weight of syndrome: %lu\n", r_bits_vector_weight((r_t *)s.qw)); 287| | 288| 5| find_err2(e, &gray_e, &s, sk->wlist, ((D + 1) / 2) + 1, &ctx); ------------------ | | 24| 5|# define D 71 ------------------ 289| 5| recompute_syndrome(&s, &c0, &h0, &pk, e, &ctx); ------------------ | | 67| 5|#define recompute_syndrome RENAME_FUNC_NAME(recompute_syndrome) | | ------------------ | | | | 44| 5|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 5|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 5|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 290| 5| } 291| 5|} decode.c:OQS_KEM_bike_l1_get_threshold: 103| 25|{ 104| 25| bike_static_assert(sizeof(*s) >= sizeof(r_t), syndrome_is_large_enough); ------------------ | | 33| 25| typedef char static_assertion_##MSG[(COND) ? 1 : -1] BIKE_UNUSED_ATT ------------------ 105| | 106| 25| const uint64_t syndrome_weight = r_bits_vector_weight((const r_t *)s->qw); ------------------ | | 78| 25|#define r_bits_vector_weight RENAME_FUNC_NAME(r_bits_vector_weight) | | ------------------ | | | | 44| 25|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 25|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 25|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 107| | 108| | // The threshold coefficients are defined in the spec as floating point values. 109| | // Since we want to avoid floating point operations for constant-timeness, 110| | // we use integer arithmetic to compute the threshold. 111| | // For example, in the case of Level-1 parameters, instead of having: 112| | // T0 = 13.530 and T1 = 0.0069722, 113| | // we multipy the values by 10^8 and work with integers: 114| | // T0' = 1353000000 and T1' = 697220. 115| | // Then, instead of computing the threshold by: 116| | // T0 + T1*S, 117| | // we compute: 118| | // (T0' + T1'*S)/10^8, 119| | // where S is the syndrome weight. Additionally, instead of dividing by 10^8, 120| | // we compute the result by a multiplication and a right shift (both 121| | // constant-time operations), as described in: 122| | // https://dl.acm.org/doi/pdf/10.1145/178243.178249 123| 25| uint64_t thr = THRESHOLD_COEFF0 + (THRESHOLD_COEFF1 * syndrome_weight); ------------------ | | 27| 25|# define THRESHOLD_COEFF0 1353000000ULL ------------------ uint64_t thr = THRESHOLD_COEFF0 + (THRESHOLD_COEFF1 * syndrome_weight); ------------------ | | 28| 25|# define THRESHOLD_COEFF1 697220ULL ------------------ 124| 25| MUL64HIGH(thr, thr, THRESHOLD_MUL_CONST); ------------------ | | 93| 25| do { \ | | 94| 25| uint64_t a_lo, a_hi, b_lo, b_hi; \ | | 95| 25| a_lo = a & 0xffffffff; \ | | 96| 25| b_lo = b & 0xffffffff; \ | | 97| 25| a_hi = a >> 32; \ | | 98| 25| b_hi = b >> 32; \ | | 99| 25| c = a_hi*b_hi + ((a_hi*b_lo + a_lo*b_hi) >> 32); \ | | 100| 25| } while(0) | | ------------------ | | | Branch (100:11): [Folded, False: 25] | | ------------------ ------------------ 125| 25| thr >>= THRESHOLD_SHR_CONST; ------------------ | | 30| 25|# define THRESHOLD_SHR_CONST 26 ------------------ 126| | 127| 25| const uint32_t mask = secure_l32_mask((uint32_t)thr, THRESHOLD_MIN); ------------------ | | 31| 25|# define THRESHOLD_MIN 36 ------------------ 128| 25| thr = (u32_barrier(mask) & thr) | (u32_barrier(~mask) & THRESHOLD_MIN); ------------------ | | 31| 25|# define THRESHOLD_MIN 36 ------------------ 129| | 130| 25| DMSG(" Threshold: %d\n", thr); 131| 25| return thr; 132| 25|} decode.c:find_err1: 144| 35|{ 145| | // This function uses the bit-slice-adder methodology of [5]: 146| 35| DEFER_CLEANUP(syndrome_t rotated_syndrome = {0}, syndrome_cleanup); ------------------ | | 16| 35| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 147| 35| DEFER_CLEANUP(upc_t upc, upc_cleanup); ------------------ | | 16| 35| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 148| | 149| 105| for(uint32_t i = 0; i < N0; i++) { ------------------ | | 15| 105|#define N0 2 ------------------ | Branch (149:23): [True: 70, False: 35] ------------------ 150| | // UPC must start from zero at every iteration 151| 70| bike_memset(&upc, 0, sizeof(upc)); 152| | 153| | // 1) Right-rotate the syndrome for every secret key set bit index 154| | // Then slice-add it to the UPC array. 155| 6.02k| for(size_t j = 0; j < D; j++) { ------------------ | | 24| 6.02k|# define D 71 ------------------ | Branch (155:23): [True: 5.95k, False: 70] ------------------ 156| 5.95k| ctx->rotate_right(&rotated_syndrome, syndrome, wlist[i].val[j]); ------------------ | | 77| 5.95k|#define rotate_right RENAME_FUNC_NAME(rotate_right) | | ------------------ | | | | 44| 5.95k|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 5.95k|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 5.95k|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 157| 5.95k| ctx->bit_sliced_adder(&upc, &rotated_syndrome, LOG2_MSB(j + 1)); ------------------ | | 77| 5.95k| ((v) == 0 \ | | ------------------ | | | Branch (77:4): [True: 0, False: 5.95k] | | ------------------ | | 78| 5.95k| ? 0 \ | | 79| 5.95k| : ((v) < 2 \ | | ------------------ | | | Branch (79:9): [True: 70, False: 5.88k] | | ------------------ | | 80| 5.95k| ? 1 \ | | 81| 5.95k| : ((v) < 4 \ | | ------------------ | | | Branch (81:14): [True: 140, False: 5.74k] | | ------------------ | | 82| 5.88k| ? 2 \ | | 83| 5.88k| : ((v) < 8 \ | | ------------------ | | | Branch (83:19): [True: 280, False: 5.46k] | | ------------------ | | 84| 5.74k| ? 3 \ | | 85| 5.74k| : ((v) < 16 \ | | ------------------ | | | Branch (85:24): [True: 560, False: 4.90k] | | ------------------ | | 86| 5.46k| ? 4 \ | | 87| 5.46k| : ((v) < 32 \ | | ------------------ | | | Branch (87:29): [True: 1.12k, False: 3.78k] | | ------------------ | | 88| 4.90k| ? 5 \ | | 89| 4.90k| : ((v) < 64 \ | | ------------------ | | | Branch (89:34): [True: 2.24k, False: 1.54k] | | ------------------ | | 90| 3.78k| ? 6 \ | | 91| 3.78k| : ((v) < 128 ? 7 \ | | ------------------ | | | Branch (91:39): [True: 1.44k, False: 100] | | ------------------ | | 92| 1.54k| : ((v) < 256 ? 8 : 9))))))))) | | ------------------ | | | Branch (92:52): [True: 100, False: 0] | | ------------------ ------------------ 158| 5.95k| } 159| | 160| | // 2) Subtract the threshold from the UPC counters 161| 70| ctx->bit_slice_full_subtract(&upc, threshold); 162| | 163| | // 3) Update the errors and the black errors vectors. 164| | // The last slice of the UPC array holds the MSB of the accumulated values 165| | // minus the threshold. Every zero bit indicates a potential error bit. 166| | // The errors values are stored in the black array and xored with the 167| | // errors Of the previous iteration. 168| 70| const r_t *last_slice = &(upc.slice[SLICES - 1].u.r.val); ------------------ | | 116| 70|#define SLICES (LOG2_MSB(D) + 1) | | ------------------ | | | | 77| 70| ((v) == 0 \ | | | | ------------------ | | | | | Branch (77:4): [Folded, False: 70] | | | | ------------------ | | | | 78| 70| ? 0 \ | | | | 79| 70| : ((v) < 2 \ | | | | ------------------ | | | | | Branch (79:9): [Folded, False: 70] | | | | ------------------ | | | | 80| 70| ? 1 \ | | | | 81| 70| : ((v) < 4 \ | | | | ------------------ | | | | | Branch (81:14): [Folded, False: 70] | | | | ------------------ | | | | 82| 70| ? 2 \ | | | | 83| 70| : ((v) < 8 \ | | | | ------------------ | | | | | Branch (83:19): [Folded, False: 70] | | | | ------------------ | | | | 84| 70| ? 3 \ | | | | 85| 70| : ((v) < 16 \ | | | | ------------------ | | | | | Branch (85:24): [Folded, False: 70] | | | | ------------------ | | | | 86| 70| ? 4 \ | | | | 87| 70| : ((v) < 32 \ | | | | ------------------ | | | | | Branch (87:29): [Folded, False: 70] | | | | ------------------ | | | | 88| 70| ? 5 \ | | | | 89| 70| : ((v) < 64 \ | | | | ------------------ | | | | | Branch (89:34): [Folded, False: 70] | | | | ------------------ | | | | 90| 70| ? 6 \ | | | | 91| 70| : ((v) < 128 ? 7 \ | | | | ------------------ | | | | | Branch (91:39): [True: 60, Folded] | | | | ------------------ | | | | 92| 70| : ((v) < 256 ? 8 : 9))))))))) | | | | ------------------ | | | | | Branch (92:52): [True: 10, Folded] | | | | ------------------ | | ------------------ ------------------ 169| 159k| for(size_t j = 0; j < R_BYTES; j++) { ------------------ | | 81| 159k|#define R_BYTES DIVIDE_AND_CEIL(R_BITS, 8) | | ------------------ | | | | 37| 159k|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | ------------------ ------------------ | Branch (169:23): [True: 159k, False: 70] ------------------ 170| 159k| const uint8_t sum_msb = (~last_slice->raw[j]); 171| 159k| black_e->val[i].raw[j] = sum_msb; 172| 159k| e->val[i].raw[j] ^= sum_msb; 173| 159k| } 174| | 175| | // Ensure that the padding bits (upper bits of the last byte) are zero so 176| | // they will not be included in the multiplication and in the hash function. 177| 70| e->val[i].raw[R_BYTES - 1] &= LAST_R_BYTE_MASK; ------------------ | | 81| 70|#define R_BYTES DIVIDE_AND_CEIL(R_BITS, 8) | | ------------------ | | | | 37| 70|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | ------------------ ------------------ e->val[i].raw[R_BYTES - 1] &= LAST_R_BYTE_MASK; ------------------ | | 98| 70|#define LAST_R_BYTE_MASK MASK(LAST_R_BYTE_LEAD) | | ------------------ | | | | 43| 70|#define MASK(len) (BIT(len) - 1) | | | | ------------------ | | | | | | 42| 70|#define BIT(len) (1ULL << (len)) | | | | ------------------ | | ------------------ ------------------ 178| | 179| | // 4) Calculate the gray error array by adding "DELTA" to the UPC array. 180| | // For that we reuse the rotated_syndrome variable setting it to all "1". 181| 280| for(size_t l = 0; l < DELTA; l++) { ------------------ | | 115| 280|#define DELTA 3 ------------------ | Branch (181:23): [True: 210, False: 70] ------------------ 182| 210| bike_memset((uint8_t *)rotated_syndrome.qw, 0xff, R_BYTES); ------------------ | | 81| 210|#define R_BYTES DIVIDE_AND_CEIL(R_BITS, 8) | | ------------------ | | | | 37| 210|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | ------------------ ------------------ 183| 210| ctx->bit_sliced_adder(&upc, &rotated_syndrome, SLICES); ------------------ | | 116| 210|#define SLICES (LOG2_MSB(D) + 1) | | ------------------ | | | | 77| 210| ((v) == 0 \ | | | | ------------------ | | | | | Branch (77:4): [Folded, False: 210] | | | | ------------------ | | | | 78| 210| ? 0 \ | | | | 79| 210| : ((v) < 2 \ | | | | ------------------ | | | | | Branch (79:9): [Folded, False: 210] | | | | ------------------ | | | | 80| 210| ? 1 \ | | | | 81| 210| : ((v) < 4 \ | | | | ------------------ | | | | | Branch (81:14): [Folded, False: 210] | | | | ------------------ | | | | 82| 210| ? 2 \ | | | | 83| 210| : ((v) < 8 \ | | | | ------------------ | | | | | Branch (83:19): [Folded, False: 210] | | | | ------------------ | | | | 84| 210| ? 3 \ | | | | 85| 210| : ((v) < 16 \ | | | | ------------------ | | | | | Branch (85:24): [Folded, False: 210] | | | | ------------------ | | | | 86| 210| ? 4 \ | | | | 87| 210| : ((v) < 32 \ | | | | ------------------ | | | | | Branch (87:29): [Folded, False: 210] | | | | ------------------ | | | | 88| 210| ? 5 \ | | | | 89| 210| : ((v) < 64 \ | | | | ------------------ | | | | | Branch (89:34): [Folded, False: 210] | | | | ------------------ | | | | 90| 210| ? 6 \ | | | | 91| 210| : ((v) < 128 ? 7 \ | | | | ------------------ | | | | | Branch (91:39): [True: 180, Folded] | | | | ------------------ | | | | 92| 210| : ((v) < 256 ? 8 : 9))))))))) | | | | ------------------ | | | | | Branch (92:52): [True: 30, Folded] | | | | ------------------ | | ------------------ ------------------ 184| 210| } 185| | 186| | // 5) Update the gray list with the relevant bits that are not 187| | // set in the black list. 188| 159k| for(size_t j = 0; j < R_BYTES; j++) { ------------------ | | 81| 159k|#define R_BYTES DIVIDE_AND_CEIL(R_BITS, 8) | | ------------------ | | | | 37| 159k|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | ------------------ ------------------ | Branch (188:23): [True: 159k, False: 70] ------------------ 189| 159k| const uint8_t sum_msb = (~last_slice->raw[j]); 190| 159k| gray_e->val[i].raw[j] = (~(black_e->val[i].raw[j])) & sum_msb; 191| 159k| } 192| 70| } 193| 35|} decode.c:find_err2: 203| 14|{ 204| 14| DEFER_CLEANUP(syndrome_t rotated_syndrome = {0}, syndrome_cleanup); ------------------ | | 16| 14| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 205| 14| DEFER_CLEANUP(upc_t upc, upc_cleanup); ------------------ | | 16| 14| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 206| | 207| 42| for(uint32_t i = 0; i < N0; i++) { ------------------ | | 15| 42|#define N0 2 ------------------ | Branch (207:23): [True: 28, False: 14] ------------------ 208| | // UPC must start from zero at every iteration 209| 28| bike_memset(&upc, 0, sizeof(upc)); 210| | 211| | // 1) Right-rotate the syndrome, for every index of a set bit in the secret 212| | // key. Then slice-add it to the UPC array. 213| 2.40k| for(size_t j = 0; j < D; j++) { ------------------ | | 24| 2.40k|# define D 71 ------------------ | Branch (213:23): [True: 2.38k, False: 28] ------------------ 214| 2.38k| ctx->rotate_right(&rotated_syndrome, syndrome, wlist[i].val[j]); ------------------ | | 77| 2.38k|#define rotate_right RENAME_FUNC_NAME(rotate_right) | | ------------------ | | | | 44| 2.38k|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 2.38k|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 2.38k|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 215| 2.38k| ctx->bit_sliced_adder(&upc, &rotated_syndrome, LOG2_MSB(j + 1)); ------------------ | | 77| 2.38k| ((v) == 0 \ | | ------------------ | | | Branch (77:4): [True: 0, False: 2.38k] | | ------------------ | | 78| 2.38k| ? 0 \ | | 79| 2.38k| : ((v) < 2 \ | | ------------------ | | | Branch (79:9): [True: 28, False: 2.35k] | | ------------------ | | 80| 2.38k| ? 1 \ | | 81| 2.38k| : ((v) < 4 \ | | ------------------ | | | Branch (81:14): [True: 56, False: 2.29k] | | ------------------ | | 82| 2.35k| ? 2 \ | | 83| 2.35k| : ((v) < 8 \ | | ------------------ | | | Branch (83:19): [True: 112, False: 2.18k] | | ------------------ | | 84| 2.29k| ? 3 \ | | 85| 2.29k| : ((v) < 16 \ | | ------------------ | | | Branch (85:24): [True: 224, False: 1.96k] | | ------------------ | | 86| 2.18k| ? 4 \ | | 87| 2.18k| : ((v) < 32 \ | | ------------------ | | | Branch (87:29): [True: 448, False: 1.51k] | | ------------------ | | 88| 1.96k| ? 5 \ | | 89| 1.96k| : ((v) < 64 \ | | ------------------ | | | Branch (89:34): [True: 896, False: 616] | | ------------------ | | 90| 1.51k| ? 6 \ | | 91| 1.51k| : ((v) < 128 ? 7 \ | | ------------------ | | | Branch (91:39): [True: 576, False: 40] | | ------------------ | | 92| 616| : ((v) < 256 ? 8 : 9))))))))) | | ------------------ | | | Branch (92:52): [True: 40, False: 0] | | ------------------ ------------------ 216| 2.38k| } 217| | 218| | // 2) Subtract the threshold from the UPC counters 219| 28| ctx->bit_slice_full_subtract(&upc, threshold); 220| | 221| | // 3) Update the errors vector. 222| | // The last slice of the UPC array holds the MSB of the accumulated values 223| | // minus the threshold. Every zero bit indicates a potential error bit. 224| 28| const r_t *last_slice = &(upc.slice[SLICES - 1].u.r.val); ------------------ | | 116| 28|#define SLICES (LOG2_MSB(D) + 1) | | ------------------ | | | | 77| 28| ((v) == 0 \ | | | | ------------------ | | | | | Branch (77:4): [Folded, False: 28] | | | | ------------------ | | | | 78| 28| ? 0 \ | | | | 79| 28| : ((v) < 2 \ | | | | ------------------ | | | | | Branch (79:9): [Folded, False: 28] | | | | ------------------ | | | | 80| 28| ? 1 \ | | | | 81| 28| : ((v) < 4 \ | | | | ------------------ | | | | | Branch (81:14): [Folded, False: 28] | | | | ------------------ | | | | 82| 28| ? 2 \ | | | | 83| 28| : ((v) < 8 \ | | | | ------------------ | | | | | Branch (83:19): [Folded, False: 28] | | | | ------------------ | | | | 84| 28| ? 3 \ | | | | 85| 28| : ((v) < 16 \ | | | | ------------------ | | | | | Branch (85:24): [Folded, False: 28] | | | | ------------------ | | | | 86| 28| ? 4 \ | | | | 87| 28| : ((v) < 32 \ | | | | ------------------ | | | | | Branch (87:29): [Folded, False: 28] | | | | ------------------ | | | | 88| 28| ? 5 \ | | | | 89| 28| : ((v) < 64 \ | | | | ------------------ | | | | | Branch (89:34): [Folded, False: 28] | | | | ------------------ | | | | 90| 28| ? 6 \ | | | | 91| 28| : ((v) < 128 ? 7 \ | | | | ------------------ | | | | | Branch (91:39): [True: 24, Folded] | | | | ------------------ | | | | 92| 28| : ((v) < 256 ? 8 : 9))))))))) | | | | ------------------ | | | | | Branch (92:52): [True: 4, Folded] | | | | ------------------ | | ------------------ ------------------ 225| 63.6k| for(size_t j = 0; j < R_BYTES; j++) { ------------------ | | 81| 63.6k|#define R_BYTES DIVIDE_AND_CEIL(R_BITS, 8) | | ------------------ | | | | 37| 63.6k|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | ------------------ ------------------ | Branch (225:23): [True: 63.6k, False: 28] ------------------ 226| 63.6k| const uint8_t sum_msb = (~last_slice->raw[j]); 227| 63.6k| e->val[i].raw[j] ^= (pos_e->val[i].raw[j] & sum_msb); 228| 63.6k| } 229| | 230| | // Ensure that the padding bits (upper bits of the last byte) are zero, so 231| | // they are not included in the multiplication, and in the hash function. 232| 28| e->val[i].raw[R_BYTES - 1] &= LAST_R_BYTE_MASK; ------------------ | | 81| 28|#define R_BYTES DIVIDE_AND_CEIL(R_BITS, 8) | | ------------------ | | | | 37| 28|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | ------------------ ------------------ e->val[i].raw[R_BYTES - 1] &= LAST_R_BYTE_MASK; ------------------ | | 98| 28|#define LAST_R_BYTE_MASK MASK(LAST_R_BYTE_LEAD) | | ------------------ | | | | 43| 28|#define MASK(len) (BIT(len) - 1) | | | | ------------------ | | | | | | 42| 28|#define BIT(len) (1ULL << (len)) | | | | ------------------ | | ------------------ ------------------ 233| 28| } 234| 14|} OQS_KEM_bike_l3_compute_syndrome: 60| 8|{ 61| 8| DEFER_CLEANUP(pad_r_t pad_s, pad_r_cleanup); ------------------ | | 16| 8| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 62| | 63| 8| gf2x_mod_mul(&pad_s, c0, h0); ------------------ | | 60| 8|#define gf2x_mod_mul RENAME_FUNC_NAME(gf2x_mod_mul) | | ------------------ | | | | 44| 8|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 8|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 8|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 64| | 65| 8| bike_memcpy((uint8_t *)syndrome->qw, pad_s.val.raw, R_BYTES); ------------------ | | 81| 8|#define R_BYTES DIVIDE_AND_CEIL(R_BITS, 8) | | ------------------ | | | | 37| 8|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | ------------------ ------------------ 66| 8| ctx->dup(syndrome); 67| 8|} OQS_KEM_bike_l3_recompute_syndrome: 75| 7|{ 76| 7| DEFER_CLEANUP(pad_r_t tmp_c0, pad_r_cleanup); ------------------ | | 16| 7| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 77| 7| DEFER_CLEANUP(pad_r_t e0 = {0}, pad_r_cleanup); ------------------ | | 16| 7| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 78| 7| DEFER_CLEANUP(pad_r_t e1 = {0}, pad_r_cleanup); ------------------ | | 16| 7| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 79| | 80| 7| e0.val = e->val[0]; 81| 7| e1.val = e->val[1]; 82| | 83| | // tmp_c0 = pk * e1 + c0 + e0 84| 7| gf2x_mod_mul(&tmp_c0, &e1, pk); ------------------ | | 60| 7|#define gf2x_mod_mul RENAME_FUNC_NAME(gf2x_mod_mul) | | ------------------ | | | | 44| 7|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 7|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 7|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 85| 7| gf2x_mod_add(&tmp_c0, &tmp_c0, c0); ------------------ | | 123| 7|#define gf2x_mod_add RENAME_FUNC_NAME(gf2x_mod_add) | | ------------------ | | | | 44| 7|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 7|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 7|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 86| 7| gf2x_mod_add(&tmp_c0, &tmp_c0, &e0); ------------------ | | 123| 7|#define gf2x_mod_add RENAME_FUNC_NAME(gf2x_mod_add) | | ------------------ | | | | 44| 7|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 7|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 7|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 87| | 88| | // Recompute the syndrome using the updated ciphertext 89| 7| compute_syndrome(syndrome, &tmp_c0, h0, ctx); ------------------ | | 66| 7|#define compute_syndrome RENAME_FUNC_NAME(compute_syndrome) | | ------------------ | | | | 44| 7|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 7|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 7|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 90| 7|} OQS_KEM_bike_l3_decode: 237| 1|{ 238| | // Initialize the decode methods struct 239| 1| decode_ctx ctx; 240| 1| decode_ctx_init(&ctx); ------------------ | | 94| 1|#define decode_ctx_init RENAME_FUNC_NAME(decode_ctx_init) | | ------------------ | | | | 44| 1|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 1|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 1|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 241| | 242| 1| DEFER_CLEANUP(e_t black_e = {0}, e_cleanup); ------------------ | | 16| 1| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 243| 1| DEFER_CLEANUP(e_t gray_e = {0}, e_cleanup); ------------------ | | 16| 1| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 244| | 245| 1| DEFER_CLEANUP(pad_r_t c0 = {0}, pad_r_cleanup); ------------------ | | 16| 1| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 246| 1| DEFER_CLEANUP(pad_r_t h0 = {0}, pad_r_cleanup); ------------------ | | 16| 1| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 247| 1| pad_r_t pk = {0}; 248| | 249| | // Pad ciphertext (c0), secret key (h0), and public key (h) 250| 1| c0.val = ct->c0; 251| 1| h0.val = sk->bin[0]; 252| 1| pk.val = sk->pk; 253| | 254| 1| DEFER_CLEANUP(syndrome_t s = {0}, syndrome_cleanup); ------------------ | | 16| 1| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 255| 1| DMSG(" Computing s.\n"); 256| 1| compute_syndrome(&s, &c0, &h0, &ctx); ------------------ | | 66| 1|#define compute_syndrome RENAME_FUNC_NAME(compute_syndrome) | | ------------------ | | | | 44| 1|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 1|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 1|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 257| 1| ctx.dup(&s); 258| | 259| | // Reset (init) the error because it is xored in the find_err functions. 260| 1| bike_memset(e, 0, sizeof(*e)); 261| | 262| 6| for(uint32_t iter = 0; iter < MAX_IT; iter++) { ------------------ | | 53| 6|# define MAX_IT 5 ------------------ | Branch (262:26): [True: 5, False: 1] ------------------ 263| 5| const uint8_t threshold = get_threshold(&s); ------------------ | | 141| 5|#define get_threshold RENAME_FUNC_NAME(get_threshold) | | ------------------ | | | | 44| 5|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 5|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 5|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 264| | 265| 5| DMSG(" Iteration: %d\n", iter); 266| 5| DMSG(" Weight of e: %lu\n", 267| 5| r_bits_vector_weight(&e->val[0]) + r_bits_vector_weight(&e->val[1])); 268| 5| DMSG(" Weight of syndrome: %lu\n", r_bits_vector_weight((r_t *)s.qw)); 269| | 270| 5| find_err1(e, &black_e, &gray_e, &s, sk->wlist, threshold, &ctx); 271| 5| recompute_syndrome(&s, &c0, &h0, &pk, e, &ctx); ------------------ | | 67| 5|#define recompute_syndrome RENAME_FUNC_NAME(recompute_syndrome) | | ------------------ | | | | 44| 5|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 5|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 5|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 272| 5|#if defined(BGF_DECODER) 273| 5| if(iter >= 1) { ------------------ | Branch (273:8): [True: 4, False: 1] ------------------ 274| 4| continue; 275| 4| } 276| 1|#endif 277| 1| DMSG(" Weight of e: %lu\n", 278| 1| r_bits_vector_weight(&e->val[0]) + r_bits_vector_weight(&e->val[1])); 279| 1| DMSG(" Weight of syndrome: %lu\n", r_bits_vector_weight((r_t *)s.qw)); 280| | 281| 1| find_err2(e, &black_e, &s, sk->wlist, ((D + 1) / 2) + 1, &ctx); ------------------ | | 44| 1|# define D 103 ------------------ 282| 1| recompute_syndrome(&s, &c0, &h0, &pk, e, &ctx); ------------------ | | 67| 1|#define recompute_syndrome RENAME_FUNC_NAME(recompute_syndrome) | | ------------------ | | | | 44| 1|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 1|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 1|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 283| | 284| 1| DMSG(" Weight of e: %lu\n", 285| 1| r_bits_vector_weight(&e->val[0]) + r_bits_vector_weight(&e->val[1])); 286| 1| DMSG(" Weight of syndrome: %lu\n", r_bits_vector_weight((r_t *)s.qw)); 287| | 288| 1| find_err2(e, &gray_e, &s, sk->wlist, ((D + 1) / 2) + 1, &ctx); ------------------ | | 44| 1|# define D 103 ------------------ 289| 1| recompute_syndrome(&s, &c0, &h0, &pk, e, &ctx); ------------------ | | 67| 1|#define recompute_syndrome RENAME_FUNC_NAME(recompute_syndrome) | | ------------------ | | | | 44| 1|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 1|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 1|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 290| 1| } 291| 1|} decode.c:OQS_KEM_bike_l3_get_threshold: 103| 5|{ 104| 5| bike_static_assert(sizeof(*s) >= sizeof(r_t), syndrome_is_large_enough); ------------------ | | 33| 5| typedef char static_assertion_##MSG[(COND) ? 1 : -1] BIKE_UNUSED_ATT ------------------ 105| | 106| 5| const uint64_t syndrome_weight = r_bits_vector_weight((const r_t *)s->qw); ------------------ | | 78| 5|#define r_bits_vector_weight RENAME_FUNC_NAME(r_bits_vector_weight) | | ------------------ | | | | 44| 5|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 5|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 5|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 107| | 108| | // The threshold coefficients are defined in the spec as floating point values. 109| | // Since we want to avoid floating point operations for constant-timeness, 110| | // we use integer arithmetic to compute the threshold. 111| | // For example, in the case of Level-1 parameters, instead of having: 112| | // T0 = 13.530 and T1 = 0.0069722, 113| | // we multipy the values by 10^8 and work with integers: 114| | // T0' = 1353000000 and T1' = 697220. 115| | // Then, instead of computing the threshold by: 116| | // T0 + T1*S, 117| | // we compute: 118| | // (T0' + T1'*S)/10^8, 119| | // where S is the syndrome weight. Additionally, instead of dividing by 10^8, 120| | // we compute the result by a multiplication and a right shift (both 121| | // constant-time operations), as described in: 122| | // https://dl.acm.org/doi/pdf/10.1145/178243.178249 123| 5| uint64_t thr = THRESHOLD_COEFF0 + (THRESHOLD_COEFF1 * syndrome_weight); ------------------ | | 47| 5|# define THRESHOLD_COEFF0 1525880000ULL ------------------ uint64_t thr = THRESHOLD_COEFF0 + (THRESHOLD_COEFF1 * syndrome_weight); ------------------ | | 48| 5|# define THRESHOLD_COEFF1 526500ULL ------------------ 124| 5| MUL64HIGH(thr, thr, THRESHOLD_MUL_CONST); ------------------ | | 93| 5| do { \ | | 94| 5| uint64_t a_lo, a_hi, b_lo, b_hi; \ | | 95| 5| a_lo = a & 0xffffffff; \ | | 96| 5| b_lo = b & 0xffffffff; \ | | 97| 5| a_hi = a >> 32; \ | | 98| 5| b_hi = b >> 32; \ | | 99| 5| c = a_hi*b_hi + ((a_hi*b_lo + a_lo*b_hi) >> 32); \ | | 100| 5| } while(0) | | ------------------ | | | Branch (100:11): [Folded, False: 5] | | ------------------ ------------------ 125| 5| thr >>= THRESHOLD_SHR_CONST; ------------------ | | 50| 5|# define THRESHOLD_SHR_CONST 26 ------------------ 126| | 127| 5| const uint32_t mask = secure_l32_mask((uint32_t)thr, THRESHOLD_MIN); ------------------ | | 51| 5|# define THRESHOLD_MIN 52 ------------------ 128| 5| thr = (u32_barrier(mask) & thr) | (u32_barrier(~mask) & THRESHOLD_MIN); ------------------ | | 51| 5|# define THRESHOLD_MIN 52 ------------------ 129| | 130| 5| DMSG(" Threshold: %d\n", thr); 131| 5| return thr; 132| 5|} OQS_KEM_bike_l5_compute_syndrome: 60| 8|{ 61| 8| DEFER_CLEANUP(pad_r_t pad_s, pad_r_cleanup); ------------------ | | 16| 8| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 62| | 63| 8| gf2x_mod_mul(&pad_s, c0, h0); ------------------ | | 60| 8|#define gf2x_mod_mul RENAME_FUNC_NAME(gf2x_mod_mul) | | ------------------ | | | | 44| 8|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 8|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 8|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 64| | 65| 8| bike_memcpy((uint8_t *)syndrome->qw, pad_s.val.raw, R_BYTES); ------------------ | | 81| 8|#define R_BYTES DIVIDE_AND_CEIL(R_BITS, 8) | | ------------------ | | | | 37| 8|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | ------------------ ------------------ 66| 8| ctx->dup(syndrome); 67| 8|} OQS_KEM_bike_l5_recompute_syndrome: 75| 7|{ 76| 7| DEFER_CLEANUP(pad_r_t tmp_c0, pad_r_cleanup); ------------------ | | 16| 7| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 77| 7| DEFER_CLEANUP(pad_r_t e0 = {0}, pad_r_cleanup); ------------------ | | 16| 7| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 78| 7| DEFER_CLEANUP(pad_r_t e1 = {0}, pad_r_cleanup); ------------------ | | 16| 7| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 79| | 80| 7| e0.val = e->val[0]; 81| 7| e1.val = e->val[1]; 82| | 83| | // tmp_c0 = pk * e1 + c0 + e0 84| 7| gf2x_mod_mul(&tmp_c0, &e1, pk); ------------------ | | 60| 7|#define gf2x_mod_mul RENAME_FUNC_NAME(gf2x_mod_mul) | | ------------------ | | | | 44| 7|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 7|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 7|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 85| 7| gf2x_mod_add(&tmp_c0, &tmp_c0, c0); ------------------ | | 123| 7|#define gf2x_mod_add RENAME_FUNC_NAME(gf2x_mod_add) | | ------------------ | | | | 44| 7|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 7|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 7|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 86| 7| gf2x_mod_add(&tmp_c0, &tmp_c0, &e0); ------------------ | | 123| 7|#define gf2x_mod_add RENAME_FUNC_NAME(gf2x_mod_add) | | ------------------ | | | | 44| 7|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 7|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 7|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 87| | 88| | // Recompute the syndrome using the updated ciphertext 89| 7| compute_syndrome(syndrome, &tmp_c0, h0, ctx); ------------------ | | 66| 7|#define compute_syndrome RENAME_FUNC_NAME(compute_syndrome) | | ------------------ | | | | 44| 7|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 7|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 7|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 90| 7|} OQS_KEM_bike_l5_decode: 237| 1|{ 238| | // Initialize the decode methods struct 239| 1| decode_ctx ctx; 240| 1| decode_ctx_init(&ctx); ------------------ | | 94| 1|#define decode_ctx_init RENAME_FUNC_NAME(decode_ctx_init) | | ------------------ | | | | 44| 1|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 1|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 1|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 241| | 242| 1| DEFER_CLEANUP(e_t black_e = {0}, e_cleanup); ------------------ | | 16| 1| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 243| 1| DEFER_CLEANUP(e_t gray_e = {0}, e_cleanup); ------------------ | | 16| 1| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 244| | 245| 1| DEFER_CLEANUP(pad_r_t c0 = {0}, pad_r_cleanup); ------------------ | | 16| 1| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 246| 1| DEFER_CLEANUP(pad_r_t h0 = {0}, pad_r_cleanup); ------------------ | | 16| 1| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 247| 1| pad_r_t pk = {0}; 248| | 249| | // Pad ciphertext (c0), secret key (h0), and public key (h) 250| 1| c0.val = ct->c0; 251| 1| h0.val = sk->bin[0]; 252| 1| pk.val = sk->pk; 253| | 254| 1| DEFER_CLEANUP(syndrome_t s = {0}, syndrome_cleanup); ------------------ | | 16| 1| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 255| 1| DMSG(" Computing s.\n"); 256| 1| compute_syndrome(&s, &c0, &h0, &ctx); ------------------ | | 66| 1|#define compute_syndrome RENAME_FUNC_NAME(compute_syndrome) | | ------------------ | | | | 44| 1|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 1|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 1|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 257| 1| ctx.dup(&s); 258| | 259| | // Reset (init) the error because it is xored in the find_err functions. 260| 1| bike_memset(e, 0, sizeof(*e)); 261| | 262| 6| for(uint32_t iter = 0; iter < MAX_IT; iter++) { ------------------ | | 53| 6|# define MAX_IT 5 ------------------ | Branch (262:26): [True: 5, False: 1] ------------------ 263| 5| const uint8_t threshold = get_threshold(&s); ------------------ | | 141| 5|#define get_threshold RENAME_FUNC_NAME(get_threshold) | | ------------------ | | | | 44| 5|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 5|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 5|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 264| | 265| 5| DMSG(" Iteration: %d\n", iter); 266| 5| DMSG(" Weight of e: %lu\n", 267| 5| r_bits_vector_weight(&e->val[0]) + r_bits_vector_weight(&e->val[1])); 268| 5| DMSG(" Weight of syndrome: %lu\n", r_bits_vector_weight((r_t *)s.qw)); 269| | 270| 5| find_err1(e, &black_e, &gray_e, &s, sk->wlist, threshold, &ctx); 271| 5| recompute_syndrome(&s, &c0, &h0, &pk, e, &ctx); ------------------ | | 67| 5|#define recompute_syndrome RENAME_FUNC_NAME(recompute_syndrome) | | ------------------ | | | | 44| 5|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 5|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 5|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 272| 5|#if defined(BGF_DECODER) 273| 5| if(iter >= 1) { ------------------ | Branch (273:8): [True: 4, False: 1] ------------------ 274| 4| continue; 275| 4| } 276| 1|#endif 277| 1| DMSG(" Weight of e: %lu\n", 278| 1| r_bits_vector_weight(&e->val[0]) + r_bits_vector_weight(&e->val[1])); 279| 1| DMSG(" Weight of syndrome: %lu\n", r_bits_vector_weight((r_t *)s.qw)); 280| | 281| 1| find_err2(e, &black_e, &s, sk->wlist, ((D + 1) / 2) + 1, &ctx); ------------------ | | 60| 1|# define D 137 ------------------ 282| 1| recompute_syndrome(&s, &c0, &h0, &pk, e, &ctx); ------------------ | | 67| 1|#define recompute_syndrome RENAME_FUNC_NAME(recompute_syndrome) | | ------------------ | | | | 44| 1|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 1|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 1|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 283| | 284| 1| DMSG(" Weight of e: %lu\n", 285| 1| r_bits_vector_weight(&e->val[0]) + r_bits_vector_weight(&e->val[1])); 286| 1| DMSG(" Weight of syndrome: %lu\n", r_bits_vector_weight((r_t *)s.qw)); 287| | 288| 1| find_err2(e, &gray_e, &s, sk->wlist, ((D + 1) / 2) + 1, &ctx); ------------------ | | 60| 1|# define D 137 ------------------ 289| 1| recompute_syndrome(&s, &c0, &h0, &pk, e, &ctx); ------------------ | | 67| 1|#define recompute_syndrome RENAME_FUNC_NAME(recompute_syndrome) | | ------------------ | | | | 44| 1|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 1|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 1|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 290| 1| } 291| 1|} decode.c:OQS_KEM_bike_l5_get_threshold: 103| 5|{ 104| 5| bike_static_assert(sizeof(*s) >= sizeof(r_t), syndrome_is_large_enough); ------------------ | | 33| 5| typedef char static_assertion_##MSG[(COND) ? 1 : -1] BIKE_UNUSED_ATT ------------------ 105| | 106| 5| const uint64_t syndrome_weight = r_bits_vector_weight((const r_t *)s->qw); ------------------ | | 78| 5|#define r_bits_vector_weight RENAME_FUNC_NAME(r_bits_vector_weight) | | ------------------ | | | | 44| 5|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 5|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 5|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 107| | 108| | // The threshold coefficients are defined in the spec as floating point values. 109| | // Since we want to avoid floating point operations for constant-timeness, 110| | // we use integer arithmetic to compute the threshold. 111| | // For example, in the case of Level-1 parameters, instead of having: 112| | // T0 = 13.530 and T1 = 0.0069722, 113| | // we multipy the values by 10^8 and work with integers: 114| | // T0' = 1353000000 and T1' = 697220. 115| | // Then, instead of computing the threshold by: 116| | // T0 + T1*S, 117| | // we compute: 118| | // (T0' + T1'*S)/10^8, 119| | // where S is the syndrome weight. Additionally, instead of dividing by 10^8, 120| | // we compute the result by a multiplication and a right shift (both 121| | // constant-time operations), as described in: 122| | // https://dl.acm.org/doi/pdf/10.1145/178243.178249 123| 5| uint64_t thr = THRESHOLD_COEFF0 + (THRESHOLD_COEFF1 * syndrome_weight); ------------------ | | 63| 5|# define THRESHOLD_COEFF0 1787850000ULL ------------------ uint64_t thr = THRESHOLD_COEFF0 + (THRESHOLD_COEFF1 * syndrome_weight); ------------------ | | 64| 5|# define THRESHOLD_COEFF1 402312ULL ------------------ 124| 5| MUL64HIGH(thr, thr, THRESHOLD_MUL_CONST); ------------------ | | 93| 5| do { \ | | 94| 5| uint64_t a_lo, a_hi, b_lo, b_hi; \ | | 95| 5| a_lo = a & 0xffffffff; \ | | 96| 5| b_lo = b & 0xffffffff; \ | | 97| 5| a_hi = a >> 32; \ | | 98| 5| b_hi = b >> 32; \ | | 99| 5| c = a_hi*b_hi + ((a_hi*b_lo + a_lo*b_hi) >> 32); \ | | 100| 5| } while(0) | | ------------------ | | | Branch (100:11): [Folded, False: 5] | | ------------------ ------------------ 125| 5| thr >>= THRESHOLD_SHR_CONST; ------------------ | | 66| 5|# define THRESHOLD_SHR_CONST 26 ------------------ 126| | 127| 5| const uint32_t mask = secure_l32_mask((uint32_t)thr, THRESHOLD_MIN); ------------------ | | 67| 5|# define THRESHOLD_MIN 69 ------------------ 128| 5| thr = (u32_barrier(mask) & thr) | (u32_barrier(~mask) & THRESHOLD_MIN); ------------------ | | 67| 5|# define THRESHOLD_MIN 69 ------------------ 129| | 130| 5| DMSG(" Threshold: %d\n", thr); 131| 5| return thr; 132| 5|} OQS_KEM_bike_l1_rotate_right_avx2: 99| 4.97k|{ 100| | // 1) Rotate in granularity of 256 bits blocks, using YMMs 101| 4.97k| rotate256_big(out, in, (bitscount / BITS_IN_YMM)); ------------------ | | 51| 4.97k|#define BITS_IN_YMM (BYTES_IN_YMM * 8) | | ------------------ | | | | 48| 4.97k|#define BYTES_IN_YMM 0x20 | | ------------------ ------------------ 102| | // 2) Rotate in smaller granularity (less than 256 bits), using YMMs 103| 4.97k| rotate256_small(out, out, (bitscount % BITS_IN_YMM)); ------------------ | | 79| 4.97k|#define rotate256_small RENAME_FUNC_NAME(rotate256_small) | | ------------------ | | | | 44| 4.97k|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 4.97k|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 4.97k|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ rotate256_small(out, out, (bitscount % BITS_IN_YMM)); ------------------ | | 51| 4.97k|#define BITS_IN_YMM (BYTES_IN_YMM * 8) | | ------------------ | | | | 48| 4.97k|#define BYTES_IN_YMM 0x20 | | ------------------ ------------------ 104| 4.97k|} OQS_KEM_bike_l1_dup_avx2: 112| 45|{ 113| 45| s->qw[R_QWORDS - 1] = ------------------ | | 82| 45|#define R_QWORDS DIVIDE_AND_CEIL(R_BITS, 8 * BYTES_IN_QWORD) | | ------------------ | | | | 37| 45|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | ------------------ ------------------ 114| 45| (s->qw[0] << LAST_R_QWORD_LEAD) | (s->qw[R_QWORDS - 1] & LAST_R_QWORD_MASK); ------------------ | | 92| 45|#define LAST_R_QWORD_LEAD (R_BITS & MASK(6)) | | ------------------ | | | | 23| 45|# define R_BITS 12323 | | ------------------ | | #define LAST_R_QWORD_LEAD (R_BITS & MASK(6)) | | ------------------ | | | | 43| 45|#define MASK(len) (BIT(len) - 1) | | | | ------------------ | | | | | | 42| 45|#define BIT(len) (1ULL << (len)) | | | | ------------------ | | ------------------ ------------------ (s->qw[0] << LAST_R_QWORD_LEAD) | (s->qw[R_QWORDS - 1] & LAST_R_QWORD_MASK); ------------------ | | 82| 45|#define R_QWORDS DIVIDE_AND_CEIL(R_BITS, 8 * BYTES_IN_QWORD) | | ------------------ | | | | 37| 45|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | ------------------ ------------------ (s->qw[0] << LAST_R_QWORD_LEAD) | (s->qw[R_QWORDS - 1] & LAST_R_QWORD_MASK); ------------------ | | 94| 45|#define LAST_R_QWORD_MASK MASK(LAST_R_QWORD_LEAD) | | ------------------ | | | | 43| 45|#define MASK(len) (BIT(len) - 1) | | | | ------------------ | | | | | | 42| 45|#define BIT(len) (1ULL << (len)) | | | | ------------------ | | ------------------ ------------------ 115| | 116| 17.3k| for(size_t i = 0; i < (2 * R_QWORDS) - 1; i++) { ------------------ | | 82| 17.3k|#define R_QWORDS DIVIDE_AND_CEIL(R_BITS, 8 * BYTES_IN_QWORD) | | ------------------ | | | | 37| 17.3k|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | ------------------ ------------------ | Branch (116:21): [True: 17.3k, False: 45] ------------------ 117| 17.3k| s->qw[R_QWORDS + i] = ------------------ | | 82| 17.3k|#define R_QWORDS DIVIDE_AND_CEIL(R_BITS, 8 * BYTES_IN_QWORD) | | ------------------ | | | | 37| 17.3k|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | ------------------ ------------------ 118| 17.3k| (s->qw[i] >> LAST_R_QWORD_TRAIL) | (s->qw[i + 1] << LAST_R_QWORD_LEAD); ------------------ | | 93| 17.3k|#define LAST_R_QWORD_TRAIL (64 - LAST_R_QWORD_LEAD) | | ------------------ | | | | 92| 17.3k|#define LAST_R_QWORD_LEAD (R_BITS & MASK(6)) | | | | ------------------ | | | | | | 23| 17.3k|# define R_BITS 12323 | | | | ------------------ | | | | #define LAST_R_QWORD_LEAD (R_BITS & MASK(6)) | | | | ------------------ | | | | | | 43| 17.3k|#define MASK(len) (BIT(len) - 1) | | | | | | ------------------ | | | | | | | | 42| 17.3k|#define BIT(len) (1ULL << (len)) | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ (s->qw[i] >> LAST_R_QWORD_TRAIL) | (s->qw[i + 1] << LAST_R_QWORD_LEAD); ------------------ | | 92| 17.3k|#define LAST_R_QWORD_LEAD (R_BITS & MASK(6)) | | ------------------ | | | | 23| 17.3k|# define R_BITS 12323 | | ------------------ | | #define LAST_R_QWORD_LEAD (R_BITS & MASK(6)) | | ------------------ | | | | 43| 17.3k|#define MASK(len) (BIT(len) - 1) | | | | ------------------ | | | | | | 42| 17.3k|#define BIT(len) (1ULL << (len)) | | | | ------------------ | | ------------------ ------------------ 119| 17.3k| } 120| 45|} OQS_KEM_bike_l1_bit_sliced_adder_avx2: 126| 5.12k|{ 127| | // From cache-memory perspective this loop should be the outside loop 128| 32.7k| for(size_t j = 0; j < num_of_slices; j++) { ------------------ | Branch (128:21): [True: 27.5k, False: 5.12k] ------------------ 129| 5.35M| for(size_t i = 0; i < R_QWORDS; i++) { ------------------ | | 82| 5.35M|#define R_QWORDS DIVIDE_AND_CEIL(R_BITS, 8 * BYTES_IN_QWORD) | | ------------------ | | | | 37| 5.35M|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | ------------------ ------------------ | Branch (129:23): [True: 5.32M, False: 27.5k] ------------------ 130| 5.32M| const uint64_t carry = (upc->slice[j].u.qw[i] & rotated_syndrome->qw[i]); 131| 5.32M| upc->slice[j].u.qw[i] ^= rotated_syndrome->qw[i]; 132| 5.32M| rotated_syndrome->qw[i] = carry; 133| 5.32M| } 134| 27.5k| } 135| 5.12k|} OQS_KEM_bike_l1_bit_slice_full_subtract_avx2: 138| 70|{ 139| | // Borrow 140| 70| uint64_t br[R_QWORDS] = {0}; 141| | 142| 630| for(size_t j = 0; j < SLICES; j++) { ------------------ | | 116| 630|#define SLICES (LOG2_MSB(D) + 1) | | ------------------ | | | | 77| 630| ((v) == 0 \ | | | | ------------------ | | | | | Branch (77:4): [Folded, False: 630] | | | | ------------------ | | | | 78| 630| ? 0 \ | | | | 79| 630| : ((v) < 2 \ | | | | ------------------ | | | | | Branch (79:9): [Folded, False: 630] | | | | ------------------ | | | | 80| 630| ? 1 \ | | | | 81| 630| : ((v) < 4 \ | | | | ------------------ | | | | | Branch (81:14): [Folded, False: 630] | | | | ------------------ | | | | 82| 630| ? 2 \ | | | | 83| 630| : ((v) < 8 \ | | | | ------------------ | | | | | Branch (83:19): [Folded, False: 630] | | | | ------------------ | | | | 84| 630| ? 3 \ | | | | 85| 630| : ((v) < 16 \ | | | | ------------------ | | | | | Branch (85:24): [Folded, False: 630] | | | | ------------------ | | | | 86| 630| ? 4 \ | | | | 87| 630| : ((v) < 32 \ | | | | ------------------ | | | | | Branch (87:29): [Folded, False: 630] | | | | ------------------ | | | | 88| 630| ? 5 \ | | | | 89| 630| : ((v) < 64 \ | | | | ------------------ | | | | | Branch (89:34): [Folded, False: 630] | | | | ------------------ | | | | 90| 630| ? 6 \ | | | | 91| 630| : ((v) < 128 ? 7 \ | | | | ------------------ | | | | | Branch (91:39): [True: 630, Folded] | | | | ------------------ | | | | 92| 630| : ((v) < 256 ? 8 : 9))))))))) | | | | ------------------ | | | | | Branch (92:52): [True: 0, Folded] | | | | ------------------ | | ------------------ ------------------ | Branch (142:21): [True: 560, False: 70] ------------------ 143| | 144| 560| const uint64_t lsb_mask = 0 - (val & 0x1); 145| 560| val >>= 1; 146| | 147| | // Perform a - b with c as the input/output carry 148| | // br = 0 0 0 0 1 1 1 1 149| | // a = 0 0 1 1 0 0 1 1 150| | // b = 0 1 0 1 0 1 0 1 151| | // ------------------- 152| | // o = 0 1 1 0 0 1 1 1 153| | // c = 0 1 0 0 1 1 0 1 154| | // 155| | // o = a^b^c 156| | // _ __ _ _ _ _ _ 157| | // br = abc + abc + abc + abc = abc + ((a+b))c 158| | 159| 108k| for(size_t i = 0; i < R_QWORDS; i++) { ------------------ | | 82| 108k|#define R_QWORDS DIVIDE_AND_CEIL(R_BITS, 8 * BYTES_IN_QWORD) | | ------------------ | | | | 37| 108k|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | ------------------ ------------------ | Branch (159:23): [True: 108k, False: 560] ------------------ 160| 108k| const uint64_t a = upc->slice[j].u.qw[i]; 161| 108k| const uint64_t b = lsb_mask; 162| 108k| const uint64_t tmp = ((~a) & b & (~br[i])) | ((((~a) | b) & br[i])); 163| 108k| upc->slice[j].u.qw[i] = a ^ b ^ br[i]; 164| 108k| br[i] = tmp; 165| 108k| } 166| 560| } 167| 70|} decode_avx2.c:rotate256_big: 32| 8.33k|{ 33| | // For preventing overflows (comparison in bytes) 34| 8.33k| bike_static_assert(sizeof(*out) > ------------------ | | 33| 8.33k| typedef char static_assertion_##MSG[(COND) ? 1 : -1] BIKE_UNUSED_ATT ------------------ 35| 8.33k| (BYTES_IN_YMM * (R_YMM + (2 * R_YMM_HALF_LOG2))), 36| 8.33k| rotr_big_err); 37| | 38| 8.33k| *out = *in; 39| | 40| 63.5k| for(uint32_t idx = R_YMM_HALF_LOG2; idx >= 1; idx >>= 1) { ------------------ | | 28| 8.33k|#define R_YMM_HALF_LOG2 UPTOPOW2(R_YMM / 2) | | ------------------ | | | | 73| 8.33k|#define UPTOPOW2(v) (UPTOPOW2_5(v) + 1) | | | | ------------------ | | | | | | 71| 8.33k|#define UPTOPOW2_5(v) (UPTOPOW2_4(v) | (UPTOPOW2_4(v) >> 16)) | | | | | | ------------------ | | | | | | | | 70| 8.33k|#define UPTOPOW2_4(v) (UPTOPOW2_3(v) | (UPTOPOW2_3(v) >> 8)) | | | | | | | | ------------------ | | | | | | | | | | 69| 8.33k|#define UPTOPOW2_3(v) (UPTOPOW2_2(v) | (UPTOPOW2_2(v) >> 4)) | | | | | | | | | | ------------------ | | | | | | | | | | | | 68| 8.33k|#define UPTOPOW2_2(v) (UPTOPOW2_1(v) | (UPTOPOW2_1(v) >> 2)) | | | | | | | | | | | | ------------------ | | | | | | | | | | | | | | 67| 8.33k|#define UPTOPOW2_1(v) (UPTOPOW2_0(v) | (UPTOPOW2_0(v) >> 1)) | | | | | | | | | | | | | | ------------------ | | | | | | | | | | | | | | | | 66| 8.33k|#define UPTOPOW2_0(v) ((v)-1) | | | | | | | | | | | | | | ------------------ | | | | | | | | | | | | | | #define UPTOPOW2_1(v) (UPTOPOW2_0(v) | (UPTOPOW2_0(v) >> 1)) | | | | | | | | | | | | | | ------------------ | | | | | | | | | | | | | | | | 66| 8.33k|#define UPTOPOW2_0(v) ((v)-1) | | | | | | | | | | | | | | ------------------ | | | | | | | | | | | | ------------------ | | | | | | | | | | | | #define UPTOPOW2_2(v) (UPTOPOW2_1(v) | (UPTOPOW2_1(v) >> 2)) | | | | | | | | | | | | ------------------ | | | | | | | | | | | | | | 67| 8.33k|#define UPTOPOW2_1(v) (UPTOPOW2_0(v) | (UPTOPOW2_0(v) >> 1)) | | | | | | | | | | | | | | ------------------ | | | | | | | | | | | | | | | | 66| 8.33k|#define UPTOPOW2_0(v) ((v)-1) | | | | | | | | | | | | | | ------------------ | | | | | | | | | | | | | | #define UPTOPOW2_1(v) (UPTOPOW2_0(v) | (UPTOPOW2_0(v) >> 1)) | | | | | | | | | | | | | | ------------------ | | | | | | | | | | | | | | | | 66| 8.33k|#define UPTOPOW2_0(v) ((v)-1) | | | | | | | | | | | | | | ------------------ | | | | | | | | | | | | ------------------ | | | | | | | | | | ------------------ | | | | | | | | | | #define UPTOPOW2_3(v) (UPTOPOW2_2(v) | (UPTOPOW2_2(v) >> 4)) | | | | | | | | | | ------------------ | | | | | | | | | | | | 68| 8.33k|#define UPTOPOW2_2(v) (UPTOPOW2_1(v) | (UPTOPOW2_1(v) >> 2)) | | | | | | | | | | | | ------------------ | | | | | | | | | | | | | | 67| 8.33k|#define UPTOPOW2_1(v) (UPTOPOW2_0(v) | (UPTOPOW2_0(v) >> 1)) | | | | | | | | | | | | | | ------------------ | | | | | | | | | | | | | | | | 66| 8.33k|#define UPTOPOW2_0(v) ((v)-1) | | | | | | | | | | | | | | ------------------ | | | | | | | | | | | | | | #define UPTOPOW2_1(v) (UPTOPOW2_0(v) | (UPTOPOW2_0(v) >> 1)) | | | | | | | | | | | | | | ------------------ | | | | | | | | | | | | | | | | 66| 8.33k|#define UPTOPOW2_0(v) ((v)-1) | | | | | | | | | | | | | | ------------------ | | | | | | | | | | | | ------------------ | | | | | | | | | | | | #define UPTOPOW2_2(v) (UPTOPOW2_1(v) | (UPTOPOW2_1(v) >> 2)) | | | | | | | | | | | | ------------------ | | | | | | | | | | | | | | 67| 8.33k|#define UPTOPOW2_1(v) (UPTOPOW2_0(v) | (UPTOPOW2_0(v) >> 1)) | | | | | | | | | | | | | | ------------------ | | | | | | | | | | | | | | | | 66| 8.33k|#define UPTOPOW2_0(v) ((v)-1) | | | | | | | | | | | | | | ------------------ | | | | | | | | | | | | | | #define UPTOPOW2_1(v) (UPTOPOW2_0(v) | (UPTOPOW2_0(v) >> 1)) | | | | | | | | | | | | | | ------------------ | | | | | | | | | | | | | | | | 66| 8.33k|#define UPTOPOW2_0(v) ((v)-1) | | | | | | | | | | | | | | ------------------ | | | | | | | | | | | | ------------------ | | | | | | | | | | ------------------ | | | | | | | | ------------------ | | | | | | | | #define UPTOPOW2_4(v) (UPTOPOW2_3(v) | (UPTOPOW2_3(v) >> 8)) | | | | | | | | ------------------ | | | | | | | | | | 69| 8.33k|#define UPTOPOW2_3(v) (UPTOPOW2_2(v) | (UPTOPOW2_2(v) >> 4)) | | | | | | | | | | ------------------ | | | | | | | | | | | | 68| 8.33k|#define UPTOPOW2_2(v) (UPTOPOW2_1(v) | (UPTOPOW2_1(v) >> 2)) | | | | | | | | | | | | ------------------ | | | | | | | | | | | | | | 67| 8.33k|#define UPTOPOW2_1(v) (UPTOPOW2_0(v) | (UPTOPOW2_0(v) >> 1)) | | | | | | | | | | | | | | ------------------ | | | | | | | | | | | | | | | | 66| 8.33k|#define UPTOPOW2_0(v) ((v)-1) | | | | | | | | | | | | | | ------------------ | | | | | | | | | | | | | | #define UPTOPOW2_1(v) (UPTOPOW2_0(v) | (UPTOPOW2_0(v) >> 1)) | | | | | | | | | | | | | | ------------------ | | | | | | | | | | | | | | | | 66| 8.33k|#define UPTOPOW2_0(v) ((v)-1) | | | | | | | | | | | | | | ------------------ | | | | | | | | | | | | ------------------ | | | | | | | | | | | | #define UPTOPOW2_2(v) (UPTOPOW2_1(v) | (UPTOPOW2_1(v) >> 2)) | | | | | | | | | | | | ------------------ | | | | | | | | | | | | | | 67| 8.33k|#define UPTOPOW2_1(v) (UPTOPOW2_0(v) | (UPTOPOW2_0(v) >> 1)) | | | | | | | | | | | | | | ------------------ | | | | | | | | | | | | | | | | 66| 8.33k|#define UPTOPOW2_0(v) ((v)-1) | | | | | | | | | | | | | | ------------------ | | | | | | | | | | | | | | #define UPTOPOW2_1(v) (UPTOPOW2_0(v) | (UPTOPOW2_0(v) >> 1)) | | | | | | | | | | | | | | ------------------ | | | | | | | | | | | | | | | | 66| 8.33k|#define UPTOPOW2_0(v) ((v)-1) | | | | | | | | | | | | | | ------------------ | | | | | | | | | | | | ------------------ | | | | | | | | | | ------------------ | | | | | | | | | | #define UPTOPOW2_3(v) (UPTOPOW2_2(v) | (UPTOPOW2_2(v) >> 4)) | | | | | | | | | | ------------------ | | | | | | | | | | | | 68| 8.33k|#define UPTOPOW2_2(v) (UPTOPOW2_1(v) | (UPTOPOW2_1(v) >> 2)) | | | | | | | | | | | | ------------------ | | | | | | | | | | | | | | 67| 8.33k|#define UPTOPOW2_1(v) (UPTOPOW2_0(v) | (UPTOPOW2_0(v) >> 1)) | | | | | | | | | | | | | | ------------------ | | | | | | | | | | | | | | | | 66| 8.33k|#define UPTOPOW2_0(v) ((v)-1) | | | | | | | | | | | | | | ------------------ | | | | | | | | | | | | | | #define UPTOPOW2_1(v) (UPTOPOW2_0(v) | (UPTOPOW2_0(v) >> 1)) | | | | | | | | | | | | | | ------------------ | | | | | | | | | | | | | | | | 66| 8.33k|#define UPTOPOW2_0(v) ((v)-1) | | | | | | | | | | | | | | ------------------ | | | | | | | | | | | | ------------------ | | | | | | | | | | | | #define UPTOPOW2_2(v) (UPTOPOW2_1(v) | (UPTOPOW2_1(v) >> 2)) | | | | | | | | | | | | ------------------ | | | | | | | | | | | | | | 67| 8.33k|#define UPTOPOW2_1(v) (UPTOPOW2_0(v) | (UPTOPOW2_0(v) >> 1)) | | | | | | | | | | | | | | ------------------ | | | | | | | | | | | | | | | | 66| 8.33k|#define UPTOPOW2_0(v) ((v)-1) | | | | | | | | | | | | | | ------------------ | | | | | | | | | | | | | | #define UPTOPOW2_1(v) (UPTOPOW2_0(v) | (UPTOPOW2_0(v) >> 1)) | | | | | | | | | | | | | | ------------------ | | | | | | | | | | | | | | | | 66| 8.33k|#define UPTOPOW2_0(v) ((v)-1) | | | | | | | | | | | | | | ------------------ | | | | | | | | | | | | ------------------ | | | | | | | | | | ------------------ | | | | | | | | ------------------ | | | | | | ------------------ | | | | | | #define UPTOPOW2_5(v) (UPTOPOW2_4(v) | (UPTOPOW2_4(v) >> 16)) | | | | | | ------------------ | | | | | | | | 70| 8.33k|#define UPTOPOW2_4(v) (UPTOPOW2_3(v) | (UPTOPOW2_3(v) >> 8)) | | | | | | | | ------------------ | | | | | | | | | | 69| 8.33k|#define UPTOPOW2_3(v) (UPTOPOW2_2(v) | (UPTOPOW2_2(v) >> 4)) | | | | | | | | | | ------------------ | | | | | | | | | | | | 68| 8.33k|#define UPTOPOW2_2(v) (UPTOPOW2_1(v) | (UPTOPOW2_1(v) >> 2)) | | | | | | | | | | | | ------------------ | | | | | | | | | | | | | | 67| 8.33k|#define UPTOPOW2_1(v) (UPTOPOW2_0(v) | (UPTOPOW2_0(v) >> 1)) | | | | | | | | | | | | | | ------------------ | | | | | | | | | | | | | | | | 66| 8.33k|#define UPTOPOW2_0(v) ((v)-1) | | | | | | | | | | | | | | ------------------ | | | | | | | | | | | | | | #define UPTOPOW2_1(v) (UPTOPOW2_0(v) | (UPTOPOW2_0(v) >> 1)) | | | | | | | | | | | | | | ------------------ | | | | | | | | | | | | | | | | 66| 8.33k|#define UPTOPOW2_0(v) ((v)-1) | | | | | | | | | | | | | | ------------------ | | | | | | | | | | | | ------------------ | | | | | | | | | | | | #define UPTOPOW2_2(v) (UPTOPOW2_1(v) | (UPTOPOW2_1(v) >> 2)) | | | | | | | | | | | | ------------------ | | | | | | | | | | | | | | 67| 8.33k|#define UPTOPOW2_1(v) (UPTOPOW2_0(v) | (UPTOPOW2_0(v) >> 1)) | | | | | | | | | | | | | | ------------------ | | | | | | | | | | | | | | | | 66| 8.33k|#define UPTOPOW2_0(v) ((v)-1) | | | | | | | | | | | | | | ------------------ | | | | | | | | | | | | | | #define UPTOPOW2_1(v) (UPTOPOW2_0(v) | (UPTOPOW2_0(v) >> 1)) | | | | | | | | | | | | | | ------------------ | | | | | | | | | | | | | | | | 66| 8.33k|#define UPTOPOW2_0(v) ((v)-1) | | | | | | | | | | | | | | ------------------ | | | | | | | | | | | | ------------------ | | | | | | | | | | ------------------ | | | | | | | | | | #define UPTOPOW2_3(v) (UPTOPOW2_2(v) | (UPTOPOW2_2(v) >> 4)) | | | | | | | | | | ------------------ | | | | | | | | | | | | 68| 8.33k|#define UPTOPOW2_2(v) (UPTOPOW2_1(v) | (UPTOPOW2_1(v) >> 2)) | | | | | | | | | | | | ------------------ | | | | | | | | | | | | | | 67| 8.33k|#define UPTOPOW2_1(v) (UPTOPOW2_0(v) | (UPTOPOW2_0(v) >> 1)) | | | | | | | | | | | | | | ------------------ | | | | | | | | | | | | | | | | 66| 8.33k|#define UPTOPOW2_0(v) ((v)-1) | | | | | | | | | | | | | | ------------------ | | | | | | | | | | | | | | #define UPTOPOW2_1(v) (UPTOPOW2_0(v) | (UPTOPOW2_0(v) >> 1)) | | | | | | | | | | | | | | ------------------ | | | | | | | | | | | | | | | | 66| 8.33k|#define UPTOPOW2_0(v) ((v)-1) | | | | | | | | | | | | | | ------------------ | | | | | | | | | | | | ------------------ | | | | | | | | | | | | #define UPTOPOW2_2(v) (UPTOPOW2_1(v) | (UPTOPOW2_1(v) >> 2)) | | | | | | | | | | | | ------------------ | | | | | | | | | | | | | | 67| 8.33k|#define UPTOPOW2_1(v) (UPTOPOW2_0(v) | (UPTOPOW2_0(v) >> 1)) | | | | | | | | | | | | | | ------------------ | | | | | | | | | | | | | | | | 66| 8.33k|#define UPTOPOW2_0(v) ((v)-1) | | | | | | | | | | | | | | ------------------ | | | | | | | | | | | | | | #define UPTOPOW2_1(v) (UPTOPOW2_0(v) | (UPTOPOW2_0(v) >> 1)) | | | | | | | | | | | | | | ------------------ | | | | | | | | | | | | | | | | 66| 8.33k|#define UPTOPOW2_0(v) ((v)-1) | | | | | | | | | | | | | | ------------------ | | | | | | | | | | | | ------------------ | | | | | | | | | | ------------------ | | | | | | | | ------------------ | | | | | | | | #define UPTOPOW2_4(v) (UPTOPOW2_3(v) | (UPTOPOW2_3(v) >> 8)) | | | | | | | | ------------------ | | | | | | | | | | 69| 8.33k|#define UPTOPOW2_3(v) (UPTOPOW2_2(v) | (UPTOPOW2_2(v) >> 4)) | | | | | | | | | | ------------------ | | | | | | | | | | | | 68| 8.33k|#define UPTOPOW2_2(v) (UPTOPOW2_1(v) | (UPTOPOW2_1(v) >> 2)) | | | | | | | | | | | | ------------------ | | | | | | | | | | | | | | 67| 8.33k|#define UPTOPOW2_1(v) (UPTOPOW2_0(v) | (UPTOPOW2_0(v) >> 1)) | | | | | | | | | | | | | | ------------------ | | | | | | | | | | | | | | | | 66| 8.33k|#define UPTOPOW2_0(v) ((v)-1) | | | | | | | | | | | | | | ------------------ | | | | | | | | | | | | | | #define UPTOPOW2_1(v) (UPTOPOW2_0(v) | (UPTOPOW2_0(v) >> 1)) | | | | | | | | | | | | | | ------------------ | | | | | | | | | | | | | | | | 66| 8.33k|#define UPTOPOW2_0(v) ((v)-1) | | | | | | | | | | | | | | ------------------ | | | | | | | | | | | | ------------------ | | | | | | | | | | | | #define UPTOPOW2_2(v) (UPTOPOW2_1(v) | (UPTOPOW2_1(v) >> 2)) | | | | | | | | | | | | ------------------ | | | | | | | | | | | | | | 67| 8.33k|#define UPTOPOW2_1(v) (UPTOPOW2_0(v) | (UPTOPOW2_0(v) >> 1)) | | | | | | | | | | | | | | ------------------ | | | | | | | | | | | | | | | | 66| 8.33k|#define UPTOPOW2_0(v) ((v)-1) | | | | | | | | | | | | | | ------------------ | | | | | | | | | | | | | | #define UPTOPOW2_1(v) (UPTOPOW2_0(v) | (UPTOPOW2_0(v) >> 1)) | | | | | | | | | | | | | | ------------------ | | | | | | | | | | | | | | | | 66| 8.33k|#define UPTOPOW2_0(v) ((v)-1) | | | | | | | | | | | | | | ------------------ | | | | | | | | | | | | ------------------ | | | | | | | | | | ------------------ | | | | | | | | | | #define UPTOPOW2_3(v) (UPTOPOW2_2(v) | (UPTOPOW2_2(v) >> 4)) | | | | | | | | | | ------------------ | | | | | | | | | | | | 68| 8.33k|#define UPTOPOW2_2(v) (UPTOPOW2_1(v) | (UPTOPOW2_1(v) >> 2)) | | | | | | | | | | | | ------------------ | | | | | | | | | | | | | | 67| 8.33k|#define UPTOPOW2_1(v) (UPTOPOW2_0(v) | (UPTOPOW2_0(v) >> 1)) | | | | | | | | | | | | | | ------------------ | | | | | | | | | | | | | | | | 66| 8.33k|#define UPTOPOW2_0(v) ((v)-1) | | | | | | | | | | | | | | ------------------ | | | | | | | | | | | | | | #define UPTOPOW2_1(v) (UPTOPOW2_0(v) | (UPTOPOW2_0(v) >> 1)) | | | | | | | | | | | | | | ------------------ | | | | | | | | | | | | | | | | 66| 8.33k|#define UPTOPOW2_0(v) ((v)-1) | | | | | | | | | | | | | | ------------------ | | | | | | | | | | | | ------------------ | | | | | | | | | | | | #define UPTOPOW2_2(v) (UPTOPOW2_1(v) | (UPTOPOW2_1(v) >> 2)) | | | | | | | | | | | | ------------------ | | | | | | | | | | | | | | 67| 8.33k|#define UPTOPOW2_1(v) (UPTOPOW2_0(v) | (UPTOPOW2_0(v) >> 1)) | | | | | | | | | | | | | | ------------------ | | | | | | | | | | | | | | | | 66| 8.33k|#define UPTOPOW2_0(v) ((v)-1) | | | | | | | | | | | | | | ------------------ | | | | | | | | | | | | | | #define UPTOPOW2_1(v) (UPTOPOW2_0(v) | (UPTOPOW2_0(v) >> 1)) | | | | | | | | | | | | | | ------------------ | | | | | | | | | | | | | | | | 66| 8.33k|#define UPTOPOW2_0(v) ((v)-1) | | | | | | | | | | | | | | ------------------ | | | | | | | | | | | | ------------------ | | | | | | | | | | ------------------ | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ | Branch (40:39): [True: 55.2k, False: 8.33k] ------------------ 41| 55.2k| const uint8_t mask = secure_l32_mask(ymm_num, idx); 42| 55.2k| const __m256i blend_mask = SET1_I8(mask); ------------------ | | 68| 55.2k|# define SET1_I8(a) _mm256_set1_epi8(a) ------------------ 43| 55.2k| ymm_num = ymm_num - (idx & mask); 44| | 45| 5.95M| for(size_t i = 0; i < (R_YMM + idx); i++) { ------------------ | | 84| 5.95M|#define R_YMM DIVIDE_AND_CEIL(R_BITS, 8 * BYTES_IN_YMM) | | ------------------ | | | | 37| 5.95M|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | ------------------ ------------------ | Branch (45:23): [True: 5.89M, False: 55.2k] ------------------ 46| 5.89M| __m256i a = LOAD(&out->qw[4 * (i + idx)]); ------------------ | | 28| 5.89M|# define LOAD(mem) _mm256_loadu_si256((const void *)(mem)) ------------------ 47| 5.89M| __m256i b = LOAD(&out->qw[4 * i]); ------------------ | | 28| 5.89M|# define LOAD(mem) _mm256_loadu_si256((const void *)(mem)) ------------------ 48| 5.89M| b = BLENDV_I8(b, a, blend_mask); ------------------ | | 92| 5.89M|# define BLENDV_I8(a, b, mask) _mm256_blendv_epi8(a, b, mask) ------------------ 49| 5.89M| STORE(&out->qw[4 * i], b); ------------------ | | 29| 5.89M|# define STORE(mem, reg) _mm256_storeu_si256((void *)(mem), (reg)) ------------------ 50| 5.89M| } 51| 55.2k| } 52| 8.33k|} decode_avx2.c:OQS_KEM_bike_l1_rotate256_small: 56| 4.97k|{ 57| 4.97k| __m256i carry_in = SET_ZERO; ------------------ | | 72| 4.97k|# define SET_ZERO _mm256_setzero_si256() ------------------ 58| 4.97k| const int count64 = (int)count & 0x3f; 59| 4.97k| const uint64_t count_mask = (count >> 5) & 0xe; 60| | 61| 4.97k| __m256i idx = SET_I32(7, 6, 5, 4, 3, 2, 1, 0); ------------------ | | 66| 4.97k|# define SET_I32(...) _mm256_set_epi32(__VA_ARGS__) ------------------ 62| 4.97k| const __m256i zero_mask = SET_I64(-1, -1, -1, 0); ------------------ | | 67| 4.97k|# define SET_I64(...) _mm256_set_epi64x(__VA_ARGS__) ------------------ 63| 4.97k| const __m256i count_vet = SET1_I8(count_mask); ------------------ | | 68| 4.97k|# define SET1_I8(a) _mm256_set1_epi8(a) ------------------ 64| | 65| 4.97k| ALIGN(ALIGN_BYTES) ------------------ | | 18| 4.97k|#define ALIGN(n) __attribute__((aligned(n))) ------------------ 66| 4.97k| const uint8_t zero_mask2_buf[] = { 67| 4.97k| 0x86, 0x86, 0x86, 0x86, 0x86, 0x86, 0x86, 0x86, 0x84, 0x84, 0x84, 68| 4.97k| 0x84, 0x84, 0x84, 0x84, 0x84, 0x82, 0x82, 0x82, 0x82, 0x82, 0x82, 69| 4.97k| 0x82, 0x82, 0x80, 0x80, 0x80, 0x80, 0x80, 0x80, 0x80, 0x80}; 70| 4.97k| __m256i zero_mask2 = LOAD(zero_mask2_buf); ------------------ | | 28| 4.97k|# define LOAD(mem) _mm256_loadu_si256((const void *)(mem)) ------------------ 71| | 72| 4.97k| zero_mask2 = SUB_I8(zero_mask2, count_vet); ------------------ | | 75| 4.97k|# define SUB_I8(a, b) _mm256_sub_epi8(a, b) ------------------ 73| 4.97k| idx = ADD_I8(idx, count_vet); ------------------ | | 74| 4.97k|# define ADD_I8(a, b) _mm256_add_epi8(a, b) ------------------ 74| | 75| 253k| for(int i = R_YMM; i >= 0; i--) { ------------------ | | 84| 4.97k|#define R_YMM DIVIDE_AND_CEIL(R_BITS, 8 * BYTES_IN_YMM) | | ------------------ | | | | 37| 4.97k|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | ------------------ ------------------ | Branch (75:22): [True: 248k, False: 4.97k] ------------------ 76| | // Load the next 256 bits 77| 248k| __m256i in256 = LOAD(&in->qw[4 * i]); ------------------ | | 28| 248k|# define LOAD(mem) _mm256_loadu_si256((const void *)(mem)) ------------------ 78| | 79| | // Rotate the current and previous 256 registers so that their quadwords 80| | // would be in the right positions. 81| 248k| __m256i carry_out = PERMVAR_I32(in256, idx); ------------------ | | 93| 248k|# define PERMVAR_I32(a, idx) _mm256_permutevar8x32_epi32(a, idx) ------------------ 82| 248k| in256 = BLENDV_I8(carry_in, carry_out, zero_mask2); ------------------ | | 92| 248k|# define BLENDV_I8(a, b, mask) _mm256_blendv_epi8(a, b, mask) ------------------ 83| | 84| | // Shift less than 64 (quadwords internal) 85| 248k| __m256i inner_carry = BLENDV_I8(carry_in, in256, zero_mask); ------------------ | | 92| 248k|# define BLENDV_I8(a, b, mask) _mm256_blendv_epi8(a, b, mask) ------------------ 86| 248k| inner_carry = PERM_I64(inner_carry, 0x39); ------------------ | | 94| 248k|# define PERM_I64(a, imm) _mm256_permute4x64_epi64(a, imm) ------------------ 87| 248k| const __m256i out256 = 88| 248k| SRLI_I64(in256, count64) | SLLI_I64(inner_carry, (int)64 - count64); ------------------ | | 32| 248k|# define SRLI_I64(a, imm) _mm256_srli_epi64(a, imm) ------------------ SRLI_I64(in256, count64) | SLLI_I64(inner_carry, (int)64 - count64); ------------------ | | 31| 248k|# define SLLI_I64(a, imm) _mm256_slli_epi64(a, imm) ------------------ 89| | 90| | // Store the rotated value 91| 248k| STORE(&out->qw[4 * i], out256); ------------------ | | 29| 248k|# define STORE(mem, reg) _mm256_storeu_si256((void *)(mem), (reg)) ------------------ 92| 248k| carry_in = carry_out; 93| 248k| } 94| 4.97k|} OQS_KEM_bike_l3_rotate_right_avx2: 99| 1.44k|{ 100| | // 1) Rotate in granularity of 256 bits blocks, using YMMs 101| 1.44k| rotate256_big(out, in, (bitscount / BITS_IN_YMM)); ------------------ | | 51| 1.44k|#define BITS_IN_YMM (BYTES_IN_YMM * 8) | | ------------------ | | | | 48| 1.44k|#define BYTES_IN_YMM 0x20 | | ------------------ ------------------ 102| | // 2) Rotate in smaller granularity (less than 256 bits), using YMMs 103| 1.44k| rotate256_small(out, out, (bitscount % BITS_IN_YMM)); ------------------ | | 79| 1.44k|#define rotate256_small RENAME_FUNC_NAME(rotate256_small) | | ------------------ | | | | 44| 1.44k|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 1.44k|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 1.44k|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ rotate256_small(out, out, (bitscount % BITS_IN_YMM)); ------------------ | | 51| 1.44k|#define BITS_IN_YMM (BYTES_IN_YMM * 8) | | ------------------ | | | | 48| 1.44k|#define BYTES_IN_YMM 0x20 | | ------------------ ------------------ 104| 1.44k|} OQS_KEM_bike_l3_dup_avx2: 112| 9|{ 113| 9| s->qw[R_QWORDS - 1] = ------------------ | | 82| 9|#define R_QWORDS DIVIDE_AND_CEIL(R_BITS, 8 * BYTES_IN_QWORD) | | ------------------ | | | | 37| 9|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | ------------------ ------------------ 114| 9| (s->qw[0] << LAST_R_QWORD_LEAD) | (s->qw[R_QWORDS - 1] & LAST_R_QWORD_MASK); ------------------ | | 92| 9|#define LAST_R_QWORD_LEAD (R_BITS & MASK(6)) | | ------------------ | | | | 43| 9|# define R_BITS 24659 | | ------------------ | | #define LAST_R_QWORD_LEAD (R_BITS & MASK(6)) | | ------------------ | | | | 43| 9|#define MASK(len) (BIT(len) - 1) | | | | ------------------ | | | | | | 42| 9|#define BIT(len) (1ULL << (len)) | | | | ------------------ | | ------------------ ------------------ (s->qw[0] << LAST_R_QWORD_LEAD) | (s->qw[R_QWORDS - 1] & LAST_R_QWORD_MASK); ------------------ | | 82| 9|#define R_QWORDS DIVIDE_AND_CEIL(R_BITS, 8 * BYTES_IN_QWORD) | | ------------------ | | | | 37| 9|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | ------------------ ------------------ (s->qw[0] << LAST_R_QWORD_LEAD) | (s->qw[R_QWORDS - 1] & LAST_R_QWORD_MASK); ------------------ | | 94| 9|#define LAST_R_QWORD_MASK MASK(LAST_R_QWORD_LEAD) | | ------------------ | | | | 43| 9|#define MASK(len) (BIT(len) - 1) | | | | ------------------ | | | | | | 42| 9|#define BIT(len) (1ULL << (len)) | | | | ------------------ | | ------------------ ------------------ 115| | 116| 6.94k| for(size_t i = 0; i < (2 * R_QWORDS) - 1; i++) { ------------------ | | 82| 6.94k|#define R_QWORDS DIVIDE_AND_CEIL(R_BITS, 8 * BYTES_IN_QWORD) | | ------------------ | | | | 37| 6.94k|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | ------------------ ------------------ | Branch (116:21): [True: 6.93k, False: 9] ------------------ 117| 6.93k| s->qw[R_QWORDS + i] = ------------------ | | 82| 6.93k|#define R_QWORDS DIVIDE_AND_CEIL(R_BITS, 8 * BYTES_IN_QWORD) | | ------------------ | | | | 37| 6.93k|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | ------------------ ------------------ 118| 6.93k| (s->qw[i] >> LAST_R_QWORD_TRAIL) | (s->qw[i + 1] << LAST_R_QWORD_LEAD); ------------------ | | 93| 6.93k|#define LAST_R_QWORD_TRAIL (64 - LAST_R_QWORD_LEAD) | | ------------------ | | | | 92| 6.93k|#define LAST_R_QWORD_LEAD (R_BITS & MASK(6)) | | | | ------------------ | | | | | | 43| 6.93k|# define R_BITS 24659 | | | | ------------------ | | | | #define LAST_R_QWORD_LEAD (R_BITS & MASK(6)) | | | | ------------------ | | | | | | 43| 6.93k|#define MASK(len) (BIT(len) - 1) | | | | | | ------------------ | | | | | | | | 42| 6.93k|#define BIT(len) (1ULL << (len)) | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ (s->qw[i] >> LAST_R_QWORD_TRAIL) | (s->qw[i + 1] << LAST_R_QWORD_LEAD); ------------------ | | 92| 6.93k|#define LAST_R_QWORD_LEAD (R_BITS & MASK(6)) | | ------------------ | | | | 43| 6.93k|# define R_BITS 24659 | | ------------------ | | #define LAST_R_QWORD_LEAD (R_BITS & MASK(6)) | | ------------------ | | | | 43| 6.93k|#define MASK(len) (BIT(len) - 1) | | | | ------------------ | | | | | | 42| 6.93k|#define BIT(len) (1ULL << (len)) | | | | ------------------ | | ------------------ ------------------ 119| 6.93k| } 120| 9|} OQS_KEM_bike_l3_bit_sliced_adder_avx2: 126| 1.47k|{ 127| | // From cache-memory perspective this loop should be the outside loop 128| 10.1k| for(size_t j = 0; j < num_of_slices; j++) { ------------------ | Branch (128:21): [True: 8.65k, False: 1.47k] ------------------ 129| 3.34M| for(size_t i = 0; i < R_QWORDS; i++) { ------------------ | | 82| 3.34M|#define R_QWORDS DIVIDE_AND_CEIL(R_BITS, 8 * BYTES_IN_QWORD) | | ------------------ | | | | 37| 3.34M|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | ------------------ ------------------ | Branch (129:23): [True: 3.34M, False: 8.65k] ------------------ 130| 3.34M| const uint64_t carry = (upc->slice[j].u.qw[i] & rotated_syndrome->qw[i]); 131| 3.34M| upc->slice[j].u.qw[i] ^= rotated_syndrome->qw[i]; 132| 3.34M| rotated_syndrome->qw[i] = carry; 133| 3.34M| } 134| 8.65k| } 135| 1.47k|} OQS_KEM_bike_l3_bit_slice_full_subtract_avx2: 138| 14|{ 139| | // Borrow 140| 14| uint64_t br[R_QWORDS] = {0}; 141| | 142| 126| for(size_t j = 0; j < SLICES; j++) { ------------------ | | 116| 126|#define SLICES (LOG2_MSB(D) + 1) | | ------------------ | | | | 77| 126| ((v) == 0 \ | | | | ------------------ | | | | | Branch (77:4): [Folded, False: 126] | | | | ------------------ | | | | 78| 126| ? 0 \ | | | | 79| 126| : ((v) < 2 \ | | | | ------------------ | | | | | Branch (79:9): [Folded, False: 126] | | | | ------------------ | | | | 80| 126| ? 1 \ | | | | 81| 126| : ((v) < 4 \ | | | | ------------------ | | | | | Branch (81:14): [Folded, False: 126] | | | | ------------------ | | | | 82| 126| ? 2 \ | | | | 83| 126| : ((v) < 8 \ | | | | ------------------ | | | | | Branch (83:19): [Folded, False: 126] | | | | ------------------ | | | | 84| 126| ? 3 \ | | | | 85| 126| : ((v) < 16 \ | | | | ------------------ | | | | | Branch (85:24): [Folded, False: 126] | | | | ------------------ | | | | 86| 126| ? 4 \ | | | | 87| 126| : ((v) < 32 \ | | | | ------------------ | | | | | Branch (87:29): [Folded, False: 126] | | | | ------------------ | | | | 88| 126| ? 5 \ | | | | 89| 126| : ((v) < 64 \ | | | | ------------------ | | | | | Branch (89:34): [Folded, False: 126] | | | | ------------------ | | | | 90| 126| ? 6 \ | | | | 91| 126| : ((v) < 128 ? 7 \ | | | | ------------------ | | | | | Branch (91:39): [True: 126, Folded] | | | | ------------------ | | | | 92| 126| : ((v) < 256 ? 8 : 9))))))))) | | | | ------------------ | | | | | Branch (92:52): [True: 0, Folded] | | | | ------------------ | | ------------------ ------------------ | Branch (142:21): [True: 112, False: 14] ------------------ 143| | 144| 112| const uint64_t lsb_mask = 0 - (val & 0x1); 145| 112| val >>= 1; 146| | 147| | // Perform a - b with c as the input/output carry 148| | // br = 0 0 0 0 1 1 1 1 149| | // a = 0 0 1 1 0 0 1 1 150| | // b = 0 1 0 1 0 1 0 1 151| | // ------------------- 152| | // o = 0 1 1 0 0 1 1 1 153| | // c = 0 1 0 0 1 1 0 1 154| | // 155| | // o = a^b^c 156| | // _ __ _ _ _ _ _ 157| | // br = abc + abc + abc + abc = abc + ((a+b))c 158| | 159| 43.3k| for(size_t i = 0; i < R_QWORDS; i++) { ------------------ | | 82| 43.3k|#define R_QWORDS DIVIDE_AND_CEIL(R_BITS, 8 * BYTES_IN_QWORD) | | ------------------ | | | | 37| 43.3k|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | ------------------ ------------------ | Branch (159:23): [True: 43.2k, False: 112] ------------------ 160| 43.2k| const uint64_t a = upc->slice[j].u.qw[i]; 161| 43.2k| const uint64_t b = lsb_mask; 162| 43.2k| const uint64_t tmp = ((~a) & b & (~br[i])) | ((((~a) | b) & br[i])); 163| 43.2k| upc->slice[j].u.qw[i] = a ^ b ^ br[i]; 164| 43.2k| br[i] = tmp; 165| 43.2k| } 166| 112| } 167| 14|} decode_avx2.c:OQS_KEM_bike_l3_rotate256_small: 56| 1.44k|{ 57| 1.44k| __m256i carry_in = SET_ZERO; ------------------ | | 72| 1.44k|# define SET_ZERO _mm256_setzero_si256() ------------------ 58| 1.44k| const int count64 = (int)count & 0x3f; 59| 1.44k| const uint64_t count_mask = (count >> 5) & 0xe; 60| | 61| 1.44k| __m256i idx = SET_I32(7, 6, 5, 4, 3, 2, 1, 0); ------------------ | | 66| 1.44k|# define SET_I32(...) _mm256_set_epi32(__VA_ARGS__) ------------------ 62| 1.44k| const __m256i zero_mask = SET_I64(-1, -1, -1, 0); ------------------ | | 67| 1.44k|# define SET_I64(...) _mm256_set_epi64x(__VA_ARGS__) ------------------ 63| 1.44k| const __m256i count_vet = SET1_I8(count_mask); ------------------ | | 68| 1.44k|# define SET1_I8(a) _mm256_set1_epi8(a) ------------------ 64| | 65| 1.44k| ALIGN(ALIGN_BYTES) ------------------ | | 18| 1.44k|#define ALIGN(n) __attribute__((aligned(n))) ------------------ 66| 1.44k| const uint8_t zero_mask2_buf[] = { 67| 1.44k| 0x86, 0x86, 0x86, 0x86, 0x86, 0x86, 0x86, 0x86, 0x84, 0x84, 0x84, 68| 1.44k| 0x84, 0x84, 0x84, 0x84, 0x84, 0x82, 0x82, 0x82, 0x82, 0x82, 0x82, 69| 1.44k| 0x82, 0x82, 0x80, 0x80, 0x80, 0x80, 0x80, 0x80, 0x80, 0x80}; 70| 1.44k| __m256i zero_mask2 = LOAD(zero_mask2_buf); ------------------ | | 28| 1.44k|# define LOAD(mem) _mm256_loadu_si256((const void *)(mem)) ------------------ 71| | 72| 1.44k| zero_mask2 = SUB_I8(zero_mask2, count_vet); ------------------ | | 75| 1.44k|# define SUB_I8(a, b) _mm256_sub_epi8(a, b) ------------------ 73| 1.44k| idx = ADD_I8(idx, count_vet); ------------------ | | 74| 1.44k|# define ADD_I8(a, b) _mm256_add_epi8(a, b) ------------------ 74| | 75| 142k| for(int i = R_YMM; i >= 0; i--) { ------------------ | | 84| 1.44k|#define R_YMM DIVIDE_AND_CEIL(R_BITS, 8 * BYTES_IN_YMM) | | ------------------ | | | | 37| 1.44k|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | ------------------ ------------------ | Branch (75:22): [True: 141k, False: 1.44k] ------------------ 76| | // Load the next 256 bits 77| 141k| __m256i in256 = LOAD(&in->qw[4 * i]); ------------------ | | 28| 141k|# define LOAD(mem) _mm256_loadu_si256((const void *)(mem)) ------------------ 78| | 79| | // Rotate the current and previous 256 registers so that their quadwords 80| | // would be in the right positions. 81| 141k| __m256i carry_out = PERMVAR_I32(in256, idx); ------------------ | | 93| 141k|# define PERMVAR_I32(a, idx) _mm256_permutevar8x32_epi32(a, idx) ------------------ 82| 141k| in256 = BLENDV_I8(carry_in, carry_out, zero_mask2); ------------------ | | 92| 141k|# define BLENDV_I8(a, b, mask) _mm256_blendv_epi8(a, b, mask) ------------------ 83| | 84| | // Shift less than 64 (quadwords internal) 85| 141k| __m256i inner_carry = BLENDV_I8(carry_in, in256, zero_mask); ------------------ | | 92| 141k|# define BLENDV_I8(a, b, mask) _mm256_blendv_epi8(a, b, mask) ------------------ 86| 141k| inner_carry = PERM_I64(inner_carry, 0x39); ------------------ | | 94| 141k|# define PERM_I64(a, imm) _mm256_permute4x64_epi64(a, imm) ------------------ 87| 141k| const __m256i out256 = 88| 141k| SRLI_I64(in256, count64) | SLLI_I64(inner_carry, (int)64 - count64); ------------------ | | 32| 141k|# define SRLI_I64(a, imm) _mm256_srli_epi64(a, imm) ------------------ SRLI_I64(in256, count64) | SLLI_I64(inner_carry, (int)64 - count64); ------------------ | | 31| 141k|# define SLLI_I64(a, imm) _mm256_slli_epi64(a, imm) ------------------ 89| | 90| | // Store the rotated value 91| 141k| STORE(&out->qw[4 * i], out256); ------------------ | | 29| 141k|# define STORE(mem, reg) _mm256_storeu_si256((void *)(mem), (reg)) ------------------ 92| 141k| carry_in = carry_out; 93| 141k| } 94| 1.44k|} OQS_KEM_bike_l5_rotate_right_avx2: 99| 1.91k|{ 100| | // 1) Rotate in granularity of 256 bits blocks, using YMMs 101| 1.91k| rotate256_big(out, in, (bitscount / BITS_IN_YMM)); ------------------ | | 51| 1.91k|#define BITS_IN_YMM (BYTES_IN_YMM * 8) | | ------------------ | | | | 48| 1.91k|#define BYTES_IN_YMM 0x20 | | ------------------ ------------------ 102| | // 2) Rotate in smaller granularity (less than 256 bits), using YMMs 103| 1.91k| rotate256_small(out, out, (bitscount % BITS_IN_YMM)); ------------------ | | 79| 1.91k|#define rotate256_small RENAME_FUNC_NAME(rotate256_small) | | ------------------ | | | | 44| 1.91k|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 1.91k|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 1.91k|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ rotate256_small(out, out, (bitscount % BITS_IN_YMM)); ------------------ | | 51| 1.91k|#define BITS_IN_YMM (BYTES_IN_YMM * 8) | | ------------------ | | | | 48| 1.91k|#define BYTES_IN_YMM 0x20 | | ------------------ ------------------ 104| 1.91k|} OQS_KEM_bike_l5_dup_avx2: 112| 9|{ 113| 9| s->qw[R_QWORDS - 1] = ------------------ | | 82| 9|#define R_QWORDS DIVIDE_AND_CEIL(R_BITS, 8 * BYTES_IN_QWORD) | | ------------------ | | | | 37| 9|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | ------------------ ------------------ 114| 9| (s->qw[0] << LAST_R_QWORD_LEAD) | (s->qw[R_QWORDS - 1] & LAST_R_QWORD_MASK); ------------------ | | 92| 9|#define LAST_R_QWORD_LEAD (R_BITS & MASK(6)) | | ------------------ | | | | 59| 9|# define R_BITS 40973 | | ------------------ | | #define LAST_R_QWORD_LEAD (R_BITS & MASK(6)) | | ------------------ | | | | 43| 9|#define MASK(len) (BIT(len) - 1) | | | | ------------------ | | | | | | 42| 9|#define BIT(len) (1ULL << (len)) | | | | ------------------ | | ------------------ ------------------ (s->qw[0] << LAST_R_QWORD_LEAD) | (s->qw[R_QWORDS - 1] & LAST_R_QWORD_MASK); ------------------ | | 82| 9|#define R_QWORDS DIVIDE_AND_CEIL(R_BITS, 8 * BYTES_IN_QWORD) | | ------------------ | | | | 37| 9|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | ------------------ ------------------ (s->qw[0] << LAST_R_QWORD_LEAD) | (s->qw[R_QWORDS - 1] & LAST_R_QWORD_MASK); ------------------ | | 94| 9|#define LAST_R_QWORD_MASK MASK(LAST_R_QWORD_LEAD) | | ------------------ | | | | 43| 9|#define MASK(len) (BIT(len) - 1) | | | | ------------------ | | | | | | 42| 9|#define BIT(len) (1ULL << (len)) | | | | ------------------ | | ------------------ ------------------ 115| | 116| 11.5k| for(size_t i = 0; i < (2 * R_QWORDS) - 1; i++) { ------------------ | | 82| 11.5k|#define R_QWORDS DIVIDE_AND_CEIL(R_BITS, 8 * BYTES_IN_QWORD) | | ------------------ | | | | 37| 11.5k|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | ------------------ ------------------ | Branch (116:21): [True: 11.5k, False: 9] ------------------ 117| 11.5k| s->qw[R_QWORDS + i] = ------------------ | | 82| 11.5k|#define R_QWORDS DIVIDE_AND_CEIL(R_BITS, 8 * BYTES_IN_QWORD) | | ------------------ | | | | 37| 11.5k|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | ------------------ ------------------ 118| 11.5k| (s->qw[i] >> LAST_R_QWORD_TRAIL) | (s->qw[i + 1] << LAST_R_QWORD_LEAD); ------------------ | | 93| 11.5k|#define LAST_R_QWORD_TRAIL (64 - LAST_R_QWORD_LEAD) | | ------------------ | | | | 92| 11.5k|#define LAST_R_QWORD_LEAD (R_BITS & MASK(6)) | | | | ------------------ | | | | | | 59| 11.5k|# define R_BITS 40973 | | | | ------------------ | | | | #define LAST_R_QWORD_LEAD (R_BITS & MASK(6)) | | | | ------------------ | | | | | | 43| 11.5k|#define MASK(len) (BIT(len) - 1) | | | | | | ------------------ | | | | | | | | 42| 11.5k|#define BIT(len) (1ULL << (len)) | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ (s->qw[i] >> LAST_R_QWORD_TRAIL) | (s->qw[i + 1] << LAST_R_QWORD_LEAD); ------------------ | | 92| 11.5k|#define LAST_R_QWORD_LEAD (R_BITS & MASK(6)) | | ------------------ | | | | 59| 11.5k|# define R_BITS 40973 | | ------------------ | | #define LAST_R_QWORD_LEAD (R_BITS & MASK(6)) | | ------------------ | | | | 43| 11.5k|#define MASK(len) (BIT(len) - 1) | | | | ------------------ | | | | | | 42| 11.5k|#define BIT(len) (1ULL << (len)) | | | | ------------------ | | ------------------ ------------------ 119| 11.5k| } 120| 9|} OQS_KEM_bike_l5_bit_sliced_adder_avx2: 126| 1.94k|{ 127| | // From cache-memory perspective this loop should be the outside loop 128| 14.1k| for(size_t j = 0; j < num_of_slices; j++) { ------------------ | Branch (128:21): [True: 12.1k, False: 1.94k] ------------------ 129| 7.80M| for(size_t i = 0; i < R_QWORDS; i++) { ------------------ | | 82| 7.80M|#define R_QWORDS DIVIDE_AND_CEIL(R_BITS, 8 * BYTES_IN_QWORD) | | ------------------ | | | | 37| 7.80M|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | ------------------ ------------------ | Branch (129:23): [True: 7.79M, False: 12.1k] ------------------ 130| 7.79M| const uint64_t carry = (upc->slice[j].u.qw[i] & rotated_syndrome->qw[i]); 131| 7.79M| upc->slice[j].u.qw[i] ^= rotated_syndrome->qw[i]; 132| 7.79M| rotated_syndrome->qw[i] = carry; 133| 7.79M| } 134| 12.1k| } 135| 1.94k|} OQS_KEM_bike_l5_bit_slice_full_subtract_avx2: 138| 14|{ 139| | // Borrow 140| 14| uint64_t br[R_QWORDS] = {0}; 141| | 142| 140| for(size_t j = 0; j < SLICES; j++) { ------------------ | | 116| 140|#define SLICES (LOG2_MSB(D) + 1) | | ------------------ | | | | 77| 140| ((v) == 0 \ | | | | ------------------ | | | | | Branch (77:4): [Folded, False: 140] | | | | ------------------ | | | | 78| 140| ? 0 \ | | | | 79| 140| : ((v) < 2 \ | | | | ------------------ | | | | | Branch (79:9): [Folded, False: 140] | | | | ------------------ | | | | 80| 140| ? 1 \ | | | | 81| 140| : ((v) < 4 \ | | | | ------------------ | | | | | Branch (81:14): [Folded, False: 140] | | | | ------------------ | | | | 82| 140| ? 2 \ | | | | 83| 140| : ((v) < 8 \ | | | | ------------------ | | | | | Branch (83:19): [Folded, False: 140] | | | | ------------------ | | | | 84| 140| ? 3 \ | | | | 85| 140| : ((v) < 16 \ | | | | ------------------ | | | | | Branch (85:24): [Folded, False: 140] | | | | ------------------ | | | | 86| 140| ? 4 \ | | | | 87| 140| : ((v) < 32 \ | | | | ------------------ | | | | | Branch (87:29): [Folded, False: 140] | | | | ------------------ | | | | 88| 140| ? 5 \ | | | | 89| 140| : ((v) < 64 \ | | | | ------------------ | | | | | Branch (89:34): [Folded, False: 140] | | | | ------------------ | | | | 90| 140| ? 6 \ | | | | 91| 140| : ((v) < 128 ? 7 \ | | | | ------------------ | | | | | Branch (91:39): [Folded, False: 140] | | | | ------------------ | | | | 92| 140| : ((v) < 256 ? 8 : 9))))))))) | | | | ------------------ | | | | | Branch (92:52): [True: 140, Folded] | | | | ------------------ | | ------------------ ------------------ | Branch (142:21): [True: 126, False: 14] ------------------ 143| | 144| 126| const uint64_t lsb_mask = 0 - (val & 0x1); 145| 126| val >>= 1; 146| | 147| | // Perform a - b with c as the input/output carry 148| | // br = 0 0 0 0 1 1 1 1 149| | // a = 0 0 1 1 0 0 1 1 150| | // b = 0 1 0 1 0 1 0 1 151| | // ------------------- 152| | // o = 0 1 1 0 0 1 1 1 153| | // c = 0 1 0 0 1 1 0 1 154| | // 155| | // o = a^b^c 156| | // _ __ _ _ _ _ _ 157| | // br = abc + abc + abc + abc = abc + ((a+b))c 158| | 159| 80.8k| for(size_t i = 0; i < R_QWORDS; i++) { ------------------ | | 82| 80.8k|#define R_QWORDS DIVIDE_AND_CEIL(R_BITS, 8 * BYTES_IN_QWORD) | | ------------------ | | | | 37| 80.8k|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | ------------------ ------------------ | Branch (159:23): [True: 80.7k, False: 126] ------------------ 160| 80.7k| const uint64_t a = upc->slice[j].u.qw[i]; 161| 80.7k| const uint64_t b = lsb_mask; 162| 80.7k| const uint64_t tmp = ((~a) & b & (~br[i])) | ((((~a) | b) & br[i])); 163| 80.7k| upc->slice[j].u.qw[i] = a ^ b ^ br[i]; 164| 80.7k| br[i] = tmp; 165| 80.7k| } 166| 126| } 167| 14|} decode_avx2.c:OQS_KEM_bike_l5_rotate256_small: 56| 1.91k|{ 57| 1.91k| __m256i carry_in = SET_ZERO; ------------------ | | 72| 1.91k|# define SET_ZERO _mm256_setzero_si256() ------------------ 58| 1.91k| const int count64 = (int)count & 0x3f; 59| 1.91k| const uint64_t count_mask = (count >> 5) & 0xe; 60| | 61| 1.91k| __m256i idx = SET_I32(7, 6, 5, 4, 3, 2, 1, 0); ------------------ | | 66| 1.91k|# define SET_I32(...) _mm256_set_epi32(__VA_ARGS__) ------------------ 62| 1.91k| const __m256i zero_mask = SET_I64(-1, -1, -1, 0); ------------------ | | 67| 1.91k|# define SET_I64(...) _mm256_set_epi64x(__VA_ARGS__) ------------------ 63| 1.91k| const __m256i count_vet = SET1_I8(count_mask); ------------------ | | 68| 1.91k|# define SET1_I8(a) _mm256_set1_epi8(a) ------------------ 64| | 65| 1.91k| ALIGN(ALIGN_BYTES) ------------------ | | 18| 1.91k|#define ALIGN(n) __attribute__((aligned(n))) ------------------ 66| 1.91k| const uint8_t zero_mask2_buf[] = { 67| 1.91k| 0x86, 0x86, 0x86, 0x86, 0x86, 0x86, 0x86, 0x86, 0x84, 0x84, 0x84, 68| 1.91k| 0x84, 0x84, 0x84, 0x84, 0x84, 0x82, 0x82, 0x82, 0x82, 0x82, 0x82, 69| 1.91k| 0x82, 0x82, 0x80, 0x80, 0x80, 0x80, 0x80, 0x80, 0x80, 0x80}; 70| 1.91k| __m256i zero_mask2 = LOAD(zero_mask2_buf); ------------------ | | 28| 1.91k|# define LOAD(mem) _mm256_loadu_si256((const void *)(mem)) ------------------ 71| | 72| 1.91k| zero_mask2 = SUB_I8(zero_mask2, count_vet); ------------------ | | 75| 1.91k|# define SUB_I8(a, b) _mm256_sub_epi8(a, b) ------------------ 73| 1.91k| idx = ADD_I8(idx, count_vet); ------------------ | | 74| 1.91k|# define ADD_I8(a, b) _mm256_add_epi8(a, b) ------------------ 74| | 75| 312k| for(int i = R_YMM; i >= 0; i--) { ------------------ | | 84| 1.91k|#define R_YMM DIVIDE_AND_CEIL(R_BITS, 8 * BYTES_IN_YMM) | | ------------------ | | | | 37| 1.91k|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | ------------------ ------------------ | Branch (75:22): [True: 310k, False: 1.91k] ------------------ 76| | // Load the next 256 bits 77| 310k| __m256i in256 = LOAD(&in->qw[4 * i]); ------------------ | | 28| 310k|# define LOAD(mem) _mm256_loadu_si256((const void *)(mem)) ------------------ 78| | 79| | // Rotate the current and previous 256 registers so that their quadwords 80| | // would be in the right positions. 81| 310k| __m256i carry_out = PERMVAR_I32(in256, idx); ------------------ | | 93| 310k|# define PERMVAR_I32(a, idx) _mm256_permutevar8x32_epi32(a, idx) ------------------ 82| 310k| in256 = BLENDV_I8(carry_in, carry_out, zero_mask2); ------------------ | | 92| 310k|# define BLENDV_I8(a, b, mask) _mm256_blendv_epi8(a, b, mask) ------------------ 83| | 84| | // Shift less than 64 (quadwords internal) 85| 310k| __m256i inner_carry = BLENDV_I8(carry_in, in256, zero_mask); ------------------ | | 92| 310k|# define BLENDV_I8(a, b, mask) _mm256_blendv_epi8(a, b, mask) ------------------ 86| 310k| inner_carry = PERM_I64(inner_carry, 0x39); ------------------ | | 94| 310k|# define PERM_I64(a, imm) _mm256_permute4x64_epi64(a, imm) ------------------ 87| 310k| const __m256i out256 = 88| 310k| SRLI_I64(in256, count64) | SLLI_I64(inner_carry, (int)64 - count64); ------------------ | | 32| 310k|# define SRLI_I64(a, imm) _mm256_srli_epi64(a, imm) ------------------ SRLI_I64(in256, count64) | SLLI_I64(inner_carry, (int)64 - count64); ------------------ | | 31| 310k|# define SLLI_I64(a, imm) _mm256_slli_epi64(a, imm) ------------------ 89| | 90| | // Store the rotated value 91| 310k| STORE(&out->qw[4 * i], out256); ------------------ | | 29| 310k|# define STORE(mem, reg) _mm256_storeu_si256((void *)(mem), (reg)) ------------------ 92| 310k| carry_in = carry_out; 93| 310k| } 94| 1.91k|} decode.c:OQS_KEM_bike_l1_decode_ctx_init: 62| 5|{ 63| 5|#if defined(X86_64) 64| 5|#if defined(OQS_DIST_X86_64_BUILD) || defined(OQS_USE_AVX512_INSTRUCTIONS) 65| 5| if(is_avx512_enabled()) { ------------------ | | 98| 5|#define is_avx512_enabled RENAME_FUNC_NAME(is_avx512_enabled) | | ------------------ | | | | 44| 5|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 5|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 5|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ | Branch (65:6): [True: 0, False: 5] ------------------ 66| 0| ctx->rotate_right = rotate_right_avx512; ------------------ | | 77| 0|#define rotate_right RENAME_FUNC_NAME(rotate_right) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ ctx->rotate_right = rotate_right_avx512; ------------------ | | 87| 0|#define rotate_right_avx512 RENAME_FUNC_NAME(rotate_right_avx512) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 67| 0| ctx->dup = dup_avx512; ------------------ | | 89| 0|#define dup_avx512 RENAME_FUNC_NAME(dup_avx512) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 68| 0| ctx->bit_sliced_adder = bit_sliced_adder_avx512; ------------------ | | 91| 0|#define bit_sliced_adder_avx512 RENAME_FUNC_NAME(bit_sliced_adder_avx512) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 69| 0| ctx->bit_slice_full_subtract = bit_slice_full_subtract_avx512; ------------------ | | 93| 0|#define bit_slice_full_subtract_avx512 RENAME_FUNC_NAME(bit_slice_full_subtract_avx512) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 70| 0| } else 71| 5|#endif 72| 5|#if defined(OQS_DIST_X86_64_BUILD) || defined(OQS_USE_AVX2_INSTRUCTIONS) 73| 5| if(is_avx2_enabled()) { ------------------ | | 97| 5|#define is_avx2_enabled RENAME_FUNC_NAME(is_avx2_enabled) | | ------------------ | | | | 44| 5|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 5|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 5|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ | Branch (73:6): [True: 5, False: 0] ------------------ 74| 5| ctx->rotate_right = rotate_right_avx2; ------------------ | | 77| 5|#define rotate_right RENAME_FUNC_NAME(rotate_right) | | ------------------ | | | | 44| 5|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 5|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 5|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ ctx->rotate_right = rotate_right_avx2; ------------------ | | 86| 5|#define rotate_right_avx2 RENAME_FUNC_NAME(rotate_right_avx2) | | ------------------ | | | | 44| 5|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 5|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 5|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 75| 5| ctx->dup = dup_avx2; ------------------ | | 88| 5|#define dup_avx2 RENAME_FUNC_NAME(dup_avx2) | | ------------------ | | | | 44| 5|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 5|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 5|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 76| 5| ctx->bit_sliced_adder = bit_sliced_adder_avx2; ------------------ | | 90| 5|#define bit_sliced_adder_avx2 RENAME_FUNC_NAME(bit_sliced_adder_avx2) | | ------------------ | | | | 44| 5|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 5|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 5|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 77| 5| ctx->bit_slice_full_subtract = bit_slice_full_subtract_avx2; ------------------ | | 92| 5|#define bit_slice_full_subtract_avx2 RENAME_FUNC_NAME(bit_slice_full_subtract_avx2) | | ------------------ | | | | 44| 5|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 5|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 5|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 78| 5| } else 79| 0|#endif 80| 0|#endif 81| 0| { 82| 0| ctx->rotate_right = rotate_right_port; ------------------ | | 77| 0|#define rotate_right RENAME_FUNC_NAME(rotate_right) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ ctx->rotate_right = rotate_right_port; ------------------ | | 82| 0|#define rotate_right_port RENAME_FUNC_NAME(rotate_right_port) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 83| 0| ctx->dup = dup_port; ------------------ | | 83| 0|#define dup_port RENAME_FUNC_NAME(dup_port) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 84| 0| ctx->bit_sliced_adder = bit_sliced_adder_port; ------------------ | | 84| 0|#define bit_sliced_adder_port RENAME_FUNC_NAME(bit_sliced_adder_port) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 85| 0| ctx->bit_slice_full_subtract = bit_slice_full_subtract_port; ------------------ | | 85| 0|#define bit_slice_full_subtract_port RENAME_FUNC_NAME(bit_slice_full_subtract_port) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 86| 0| } 87| 5|} decode.c:OQS_KEM_bike_l3_decode_ctx_init: 62| 1|{ 63| 1|#if defined(X86_64) 64| 1|#if defined(OQS_DIST_X86_64_BUILD) || defined(OQS_USE_AVX512_INSTRUCTIONS) 65| 1| if(is_avx512_enabled()) { ------------------ | | 98| 1|#define is_avx512_enabled RENAME_FUNC_NAME(is_avx512_enabled) | | ------------------ | | | | 44| 1|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 1|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 1|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ | Branch (65:6): [True: 0, False: 1] ------------------ 66| 0| ctx->rotate_right = rotate_right_avx512; ------------------ | | 77| 0|#define rotate_right RENAME_FUNC_NAME(rotate_right) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ ctx->rotate_right = rotate_right_avx512; ------------------ | | 87| 0|#define rotate_right_avx512 RENAME_FUNC_NAME(rotate_right_avx512) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 67| 0| ctx->dup = dup_avx512; ------------------ | | 89| 0|#define dup_avx512 RENAME_FUNC_NAME(dup_avx512) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 68| 0| ctx->bit_sliced_adder = bit_sliced_adder_avx512; ------------------ | | 91| 0|#define bit_sliced_adder_avx512 RENAME_FUNC_NAME(bit_sliced_adder_avx512) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 69| 0| ctx->bit_slice_full_subtract = bit_slice_full_subtract_avx512; ------------------ | | 93| 0|#define bit_slice_full_subtract_avx512 RENAME_FUNC_NAME(bit_slice_full_subtract_avx512) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 70| 0| } else 71| 1|#endif 72| 1|#if defined(OQS_DIST_X86_64_BUILD) || defined(OQS_USE_AVX2_INSTRUCTIONS) 73| 1| if(is_avx2_enabled()) { ------------------ | | 97| 1|#define is_avx2_enabled RENAME_FUNC_NAME(is_avx2_enabled) | | ------------------ | | | | 44| 1|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 1|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 1|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ | Branch (73:6): [True: 1, False: 0] ------------------ 74| 1| ctx->rotate_right = rotate_right_avx2; ------------------ | | 77| 1|#define rotate_right RENAME_FUNC_NAME(rotate_right) | | ------------------ | | | | 44| 1|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 1|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 1|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ ctx->rotate_right = rotate_right_avx2; ------------------ | | 86| 1|#define rotate_right_avx2 RENAME_FUNC_NAME(rotate_right_avx2) | | ------------------ | | | | 44| 1|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 1|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 1|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 75| 1| ctx->dup = dup_avx2; ------------------ | | 88| 1|#define dup_avx2 RENAME_FUNC_NAME(dup_avx2) | | ------------------ | | | | 44| 1|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 1|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 1|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 76| 1| ctx->bit_sliced_adder = bit_sliced_adder_avx2; ------------------ | | 90| 1|#define bit_sliced_adder_avx2 RENAME_FUNC_NAME(bit_sliced_adder_avx2) | | ------------------ | | | | 44| 1|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 1|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 1|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 77| 1| ctx->bit_slice_full_subtract = bit_slice_full_subtract_avx2; ------------------ | | 92| 1|#define bit_slice_full_subtract_avx2 RENAME_FUNC_NAME(bit_slice_full_subtract_avx2) | | ------------------ | | | | 44| 1|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 1|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 1|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 78| 1| } else 79| 0|#endif 80| 0|#endif 81| 0| { 82| 0| ctx->rotate_right = rotate_right_port; ------------------ | | 77| 0|#define rotate_right RENAME_FUNC_NAME(rotate_right) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ ctx->rotate_right = rotate_right_port; ------------------ | | 82| 0|#define rotate_right_port RENAME_FUNC_NAME(rotate_right_port) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 83| 0| ctx->dup = dup_port; ------------------ | | 83| 0|#define dup_port RENAME_FUNC_NAME(dup_port) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 84| 0| ctx->bit_sliced_adder = bit_sliced_adder_port; ------------------ | | 84| 0|#define bit_sliced_adder_port RENAME_FUNC_NAME(bit_sliced_adder_port) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 85| 0| ctx->bit_slice_full_subtract = bit_slice_full_subtract_port; ------------------ | | 85| 0|#define bit_slice_full_subtract_port RENAME_FUNC_NAME(bit_slice_full_subtract_port) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 86| 0| } 87| 1|} decode.c:OQS_KEM_bike_l5_decode_ctx_init: 62| 1|{ 63| 1|#if defined(X86_64) 64| 1|#if defined(OQS_DIST_X86_64_BUILD) || defined(OQS_USE_AVX512_INSTRUCTIONS) 65| 1| if(is_avx512_enabled()) { ------------------ | | 98| 1|#define is_avx512_enabled RENAME_FUNC_NAME(is_avx512_enabled) | | ------------------ | | | | 44| 1|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 1|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 1|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ | Branch (65:6): [True: 0, False: 1] ------------------ 66| 0| ctx->rotate_right = rotate_right_avx512; ------------------ | | 77| 0|#define rotate_right RENAME_FUNC_NAME(rotate_right) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ ctx->rotate_right = rotate_right_avx512; ------------------ | | 87| 0|#define rotate_right_avx512 RENAME_FUNC_NAME(rotate_right_avx512) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 67| 0| ctx->dup = dup_avx512; ------------------ | | 89| 0|#define dup_avx512 RENAME_FUNC_NAME(dup_avx512) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 68| 0| ctx->bit_sliced_adder = bit_sliced_adder_avx512; ------------------ | | 91| 0|#define bit_sliced_adder_avx512 RENAME_FUNC_NAME(bit_sliced_adder_avx512) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 69| 0| ctx->bit_slice_full_subtract = bit_slice_full_subtract_avx512; ------------------ | | 93| 0|#define bit_slice_full_subtract_avx512 RENAME_FUNC_NAME(bit_slice_full_subtract_avx512) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 70| 0| } else 71| 1|#endif 72| 1|#if defined(OQS_DIST_X86_64_BUILD) || defined(OQS_USE_AVX2_INSTRUCTIONS) 73| 1| if(is_avx2_enabled()) { ------------------ | | 97| 1|#define is_avx2_enabled RENAME_FUNC_NAME(is_avx2_enabled) | | ------------------ | | | | 44| 1|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 1|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 1|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ | Branch (73:6): [True: 1, False: 0] ------------------ 74| 1| ctx->rotate_right = rotate_right_avx2; ------------------ | | 77| 1|#define rotate_right RENAME_FUNC_NAME(rotate_right) | | ------------------ | | | | 44| 1|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 1|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 1|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ ctx->rotate_right = rotate_right_avx2; ------------------ | | 86| 1|#define rotate_right_avx2 RENAME_FUNC_NAME(rotate_right_avx2) | | ------------------ | | | | 44| 1|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 1|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 1|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 75| 1| ctx->dup = dup_avx2; ------------------ | | 88| 1|#define dup_avx2 RENAME_FUNC_NAME(dup_avx2) | | ------------------ | | | | 44| 1|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 1|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 1|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 76| 1| ctx->bit_sliced_adder = bit_sliced_adder_avx2; ------------------ | | 90| 1|#define bit_sliced_adder_avx2 RENAME_FUNC_NAME(bit_sliced_adder_avx2) | | ------------------ | | | | 44| 1|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 1|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 1|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 77| 1| ctx->bit_slice_full_subtract = bit_slice_full_subtract_avx2; ------------------ | | 92| 1|#define bit_slice_full_subtract_avx2 RENAME_FUNC_NAME(bit_slice_full_subtract_avx2) | | ------------------ | | | | 44| 1|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 1|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 1|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 78| 1| } else 79| 0|#endif 80| 0|#endif 81| 0| { 82| 0| ctx->rotate_right = rotate_right_port; ------------------ | | 77| 0|#define rotate_right RENAME_FUNC_NAME(rotate_right) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ ctx->rotate_right = rotate_right_port; ------------------ | | 82| 0|#define rotate_right_port RENAME_FUNC_NAME(rotate_right_port) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 83| 0| ctx->dup = dup_port; ------------------ | | 83| 0|#define dup_port RENAME_FUNC_NAME(dup_port) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 84| 0| ctx->bit_sliced_adder = bit_sliced_adder_port; ------------------ | | 84| 0|#define bit_sliced_adder_port RENAME_FUNC_NAME(bit_sliced_adder_port) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 85| 0| ctx->bit_slice_full_subtract = bit_slice_full_subtract_port; ------------------ | | 85| 0|#define bit_slice_full_subtract_port RENAME_FUNC_NAME(bit_slice_full_subtract_port) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 86| 0| } 87| 1|} kem.c:OQS_KEM_bike_l1_gf2x_mod_add: 15| 5|{ 16| 5| const uint64_t *a_qwords = (const uint64_t *)a; 17| 5| const uint64_t *b_qwords = (const uint64_t *)b; 18| 5| uint64_t * c_qwords = (uint64_t *)c; 19| | 20| 1.28k| for(size_t i = 0; i < R_PADDED_QWORDS; i++) { ------------------ | | 90| 1.28k|#define R_PADDED_QWORDS (R_PADDED / 64) | | ------------------ | | | | 88| 1.28k|#define R_PADDED (R_BLOCKS * BLOCK_BITS) | | | | ------------------ | | | | | | 87| 1.28k|#define R_BLOCKS DIVIDE_AND_CEIL(R_BITS, BLOCK_BITS) | | | | | | ------------------ | | | | | | | | 37| 1.28k|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | | | | | ------------------ | | | | ------------------ | | | | #define R_PADDED (R_BLOCKS * BLOCK_BITS) | | | | ------------------ | | | | | | 40| 1.28k|# define BLOCK_BITS 16384 | | | | ------------------ | | ------------------ ------------------ | Branch (20:21): [True: 1.28k, False: 5] ------------------ 21| 1.28k| c_qwords[i] = a_qwords[i] ^ b_qwords[i]; 22| 1.28k| } 23| 5|} kem.c:OQS_KEM_bike_l3_gf2x_mod_add: 15| 1|{ 16| 1| const uint64_t *a_qwords = (const uint64_t *)a; 17| 1| const uint64_t *b_qwords = (const uint64_t *)b; 18| 1| uint64_t * c_qwords = (uint64_t *)c; 19| | 20| 513| for(size_t i = 0; i < R_PADDED_QWORDS; i++) { ------------------ | | 90| 513|#define R_PADDED_QWORDS (R_PADDED / 64) | | ------------------ | | | | 88| 513|#define R_PADDED (R_BLOCKS * BLOCK_BITS) | | | | ------------------ | | | | | | 87| 513|#define R_BLOCKS DIVIDE_AND_CEIL(R_BITS, BLOCK_BITS) | | | | | | ------------------ | | | | | | | | 37| 513|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | | | | | ------------------ | | | | ------------------ | | | | #define R_PADDED (R_BLOCKS * BLOCK_BITS) | | | | ------------------ | | | | | | 56| 513|# define BLOCK_BITS 32768 | | | | ------------------ | | ------------------ ------------------ | Branch (20:21): [True: 512, False: 1] ------------------ 21| 512| c_qwords[i] = a_qwords[i] ^ b_qwords[i]; 22| 512| } 23| 1|} kem.c:OQS_KEM_bike_l5_gf2x_mod_add: 15| 1|{ 16| 1| const uint64_t *a_qwords = (const uint64_t *)a; 17| 1| const uint64_t *b_qwords = (const uint64_t *)b; 18| 1| uint64_t * c_qwords = (uint64_t *)c; 19| | 20| 1.02k| for(size_t i = 0; i < R_PADDED_QWORDS; i++) { ------------------ | | 90| 1.02k|#define R_PADDED_QWORDS (R_PADDED / 64) | | ------------------ | | | | 88| 1.02k|#define R_PADDED (R_BLOCKS * BLOCK_BITS) | | | | ------------------ | | | | | | 87| 1.02k|#define R_BLOCKS DIVIDE_AND_CEIL(R_BITS, BLOCK_BITS) | | | | | | ------------------ | | | | | | | | 37| 1.02k|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | | | | | ------------------ | | | | ------------------ | | | | #define R_PADDED (R_BLOCKS * BLOCK_BITS) | | | | ------------------ | | | | | | 71| 1.02k|# define BLOCK_BITS 65536 | | | | ------------------ | | ------------------ ------------------ | Branch (20:21): [True: 1.02k, False: 1] ------------------ 21| 1.02k| c_qwords[i] = a_qwords[i] ^ b_qwords[i]; 22| 1.02k| } 23| 1|} decode.c:OQS_KEM_bike_l1_gf2x_mod_add: 15| 70|{ 16| 70| const uint64_t *a_qwords = (const uint64_t *)a; 17| 70| const uint64_t *b_qwords = (const uint64_t *)b; 18| 70| uint64_t * c_qwords = (uint64_t *)c; 19| | 20| 17.9k| for(size_t i = 0; i < R_PADDED_QWORDS; i++) { ------------------ | | 90| 17.9k|#define R_PADDED_QWORDS (R_PADDED / 64) | | ------------------ | | | | 88| 17.9k|#define R_PADDED (R_BLOCKS * BLOCK_BITS) | | | | ------------------ | | | | | | 87| 17.9k|#define R_BLOCKS DIVIDE_AND_CEIL(R_BITS, BLOCK_BITS) | | | | | | ------------------ | | | | | | | | 37| 17.9k|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | | | | | ------------------ | | | | ------------------ | | | | #define R_PADDED (R_BLOCKS * BLOCK_BITS) | | | | ------------------ | | | | | | 40| 17.9k|# define BLOCK_BITS 16384 | | | | ------------------ | | ------------------ ------------------ | Branch (20:21): [True: 17.9k, False: 70] ------------------ 21| 17.9k| c_qwords[i] = a_qwords[i] ^ b_qwords[i]; 22| 17.9k| } 23| 70|} decode.c:OQS_KEM_bike_l3_gf2x_mod_add: 15| 14|{ 16| 14| const uint64_t *a_qwords = (const uint64_t *)a; 17| 14| const uint64_t *b_qwords = (const uint64_t *)b; 18| 14| uint64_t * c_qwords = (uint64_t *)c; 19| | 20| 7.18k| for(size_t i = 0; i < R_PADDED_QWORDS; i++) { ------------------ | | 90| 7.18k|#define R_PADDED_QWORDS (R_PADDED / 64) | | ------------------ | | | | 88| 7.18k|#define R_PADDED (R_BLOCKS * BLOCK_BITS) | | | | ------------------ | | | | | | 87| 7.18k|#define R_BLOCKS DIVIDE_AND_CEIL(R_BITS, BLOCK_BITS) | | | | | | ------------------ | | | | | | | | 37| 7.18k|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | | | | | ------------------ | | | | ------------------ | | | | #define R_PADDED (R_BLOCKS * BLOCK_BITS) | | | | ------------------ | | | | | | 56| 7.18k|# define BLOCK_BITS 32768 | | | | ------------------ | | ------------------ ------------------ | Branch (20:21): [True: 7.16k, False: 14] ------------------ 21| 7.16k| c_qwords[i] = a_qwords[i] ^ b_qwords[i]; 22| 7.16k| } 23| 14|} decode.c:OQS_KEM_bike_l5_gf2x_mod_add: 15| 14|{ 16| 14| const uint64_t *a_qwords = (const uint64_t *)a; 17| 14| const uint64_t *b_qwords = (const uint64_t *)b; 18| 14| uint64_t * c_qwords = (uint64_t *)c; 19| | 20| 14.3k| for(size_t i = 0; i < R_PADDED_QWORDS; i++) { ------------------ | | 90| 14.3k|#define R_PADDED_QWORDS (R_PADDED / 64) | | ------------------ | | | | 88| 14.3k|#define R_PADDED (R_BLOCKS * BLOCK_BITS) | | | | ------------------ | | | | | | 87| 14.3k|#define R_BLOCKS DIVIDE_AND_CEIL(R_BITS, BLOCK_BITS) | | | | | | ------------------ | | | | | | | | 37| 14.3k|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | | | | | ------------------ | | | | ------------------ | | | | #define R_PADDED (R_BLOCKS * BLOCK_BITS) | | | | ------------------ | | | | | | 71| 14.3k|# define BLOCK_BITS 65536 | | | | ------------------ | | ------------------ ------------------ | Branch (20:21): [True: 14.3k, False: 14] ------------------ 21| 14.3k| c_qwords[i] = a_qwords[i] ^ b_qwords[i]; 22| 14.3k| } 23| 14|} gf2x_inv.c:OQS_KEM_bike_l1_gf2x_ctx_init: 132| 5|{ 133| 5|#if defined(X86_64) 134| 5|#if defined(OQS_DIST_X86_64_BUILD) || defined(OQS_USE_AVX512_INSTRUCTIONS) 135| 5| if(is_avx512_enabled()) { ------------------ | | 98| 5|#define is_avx512_enabled RENAME_FUNC_NAME(is_avx512_enabled) | | ------------------ | | | | 44| 5|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 5|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 5|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ | Branch (135:6): [True: 0, False: 5] ------------------ 136| 0| ctx->karatzuba_add1 = karatzuba_add1_avx512; ------------------ | | 71| 0|#define karatzuba_add1 RENAME_FUNC_NAME(karatzuba_add1) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ ctx->karatzuba_add1 = karatzuba_add1_avx512; ------------------ | | 112| 0|#define karatzuba_add1_avx512 RENAME_FUNC_NAME(karatzuba_add1_avx512) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 137| 0| ctx->karatzuba_add2 = karatzuba_add2_avx512; ------------------ | | 72| 0|#define karatzuba_add2 RENAME_FUNC_NAME(karatzuba_add2) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ ctx->karatzuba_add2 = karatzuba_add2_avx512; ------------------ | | 114| 0|#define karatzuba_add2_avx512 RENAME_FUNC_NAME(karatzuba_add2_avx512) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 138| 0| ctx->karatzuba_add3 = karatzuba_add3_avx512; ------------------ | | 116| 0|#define karatzuba_add3_avx512 RENAME_FUNC_NAME(karatzuba_add3_avx512) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 139| 0| ctx->k_sqr = k_sqr_avx512; ------------------ | | 120| 0|#define k_sqr_avx512 RENAME_FUNC_NAME(k_sqr_avx512) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 140| 0| ctx->red = gf2x_red_avx512; ------------------ | | 75| 0|#define red RENAME_FUNC_NAME(red) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ ctx->red = gf2x_red_avx512; ------------------ | | 122| 0|#define gf2x_red_avx512 RENAME_FUNC_NAME(gf2x_red_avx512) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 141| 0| } else 142| 5|#endif 143| 5|#if defined(OQS_DIST_X86_64_BUILD) || defined(OQS_USE_AVX2_INSTRUCTIONS) 144| 5| if(is_avx2_enabled()) { ------------------ | | 97| 5|#define is_avx2_enabled RENAME_FUNC_NAME(is_avx2_enabled) | | ------------------ | | | | 44| 5|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 5|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 5|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ | Branch (144:6): [True: 5, False: 0] ------------------ 145| 5| ctx->karatzuba_add1 = karatzuba_add1_avx2; ------------------ | | 71| 5|#define karatzuba_add1 RENAME_FUNC_NAME(karatzuba_add1) | | ------------------ | | | | 44| 5|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 5|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 5|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ ctx->karatzuba_add1 = karatzuba_add1_avx2; ------------------ | | 111| 5|#define karatzuba_add1_avx2 RENAME_FUNC_NAME(karatzuba_add1_avx2) | | ------------------ | | | | 44| 5|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 5|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 5|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 146| 5| ctx->karatzuba_add2 = karatzuba_add2_avx2; ------------------ | | 72| 5|#define karatzuba_add2 RENAME_FUNC_NAME(karatzuba_add2) | | ------------------ | | | | 44| 5|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 5|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 5|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ ctx->karatzuba_add2 = karatzuba_add2_avx2; ------------------ | | 113| 5|#define karatzuba_add2_avx2 RENAME_FUNC_NAME(karatzuba_add2_avx2) | | ------------------ | | | | 44| 5|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 5|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 5|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 147| 5| ctx->karatzuba_add3 = karatzuba_add3_avx2; ------------------ | | 115| 5|#define karatzuba_add3_avx2 RENAME_FUNC_NAME(karatzuba_add3_avx2) | | ------------------ | | | | 44| 5|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 5|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 5|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 148| 5| ctx->k_sqr = k_sqr_avx2; ------------------ | | 119| 5|#define k_sqr_avx2 RENAME_FUNC_NAME(k_sqr_avx2) | | ------------------ | | | | 44| 5|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 5|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 5|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 149| 5| ctx->red = gf2x_red_avx2; ------------------ | | 75| 5|#define red RENAME_FUNC_NAME(red) | | ------------------ | | | | 44| 5|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 5|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 5|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ ctx->red = gf2x_red_avx2; ------------------ | | 121| 5|#define gf2x_red_avx2 RENAME_FUNC_NAME(gf2x_red_avx2) | | ------------------ | | | | 44| 5|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 5|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 5|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 150| 5| } else 151| 0|#endif 152| 0|#endif 153| 0| { 154| 0| ctx->karatzuba_add1 = karatzuba_add1_port; ------------------ | | 71| 0|#define karatzuba_add1 RENAME_FUNC_NAME(karatzuba_add1) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ ctx->karatzuba_add1 = karatzuba_add1_port; ------------------ | | 103| 0|#define karatzuba_add1_port RENAME_FUNC_NAME(karatzuba_add1_port) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 155| 0| ctx->karatzuba_add2 = karatzuba_add2_port; ------------------ | | 72| 0|#define karatzuba_add2 RENAME_FUNC_NAME(karatzuba_add2) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ ctx->karatzuba_add2 = karatzuba_add2_port; ------------------ | | 104| 0|#define karatzuba_add2_port RENAME_FUNC_NAME(karatzuba_add2_port) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 156| 0| ctx->karatzuba_add3 = karatzuba_add3_port; ------------------ | | 105| 0|#define karatzuba_add3_port RENAME_FUNC_NAME(karatzuba_add3_port) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 157| 0| ctx->k_sqr = k_sqr_port; ------------------ | | 107| 0|#define k_sqr_port RENAME_FUNC_NAME(k_sqr_port) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 158| 0| ctx->red = gf2x_red_port; ------------------ | | 75| 0|#define red RENAME_FUNC_NAME(red) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ ctx->red = gf2x_red_port; ------------------ | | 108| 0|#define gf2x_red_port RENAME_FUNC_NAME(gf2x_red_port) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 159| 0| } 160| | 161| 5|#if defined(X86_64) 162| |# if !defined(DISABLE_VPCLMUL) 163| | if(is_vpclmul_enabled()) { 164| | ctx->mul_base_qwords = GF2X_VPCLMUL_BASE_QWORDS; 165| | ctx->mul_base = gf2x_mul_base_vpclmul; 166| | ctx->sqr = gf2x_sqr_vpclmul; 167| | } else 168| |# endif // DISABLE_VPCLMUL 169| 5|#if defined(OQS_DIST_X86_64_BUILD) || defined(OQS_USE_PCLMULQDQ_INSTRUCTIONS) 170| 5| if(is_pclmul_enabled()) { ------------------ | | 99| 5|#define is_pclmul_enabled RENAME_FUNC_NAME(is_pclmul_enabled) | | ------------------ | | | | 44| 5|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 5|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 5|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ | Branch (170:6): [True: 5, False: 0] ------------------ 171| 5| ctx->mul_base_qwords = GF2X_PCLMUL_BASE_QWORDS; ------------------ | | 19| 5|#define GF2X_PCLMUL_BASE_QWORDS (8) ------------------ 172| 5| ctx->mul_base = gf2x_mul_base_pclmul; ------------------ | | 109| 5|#define gf2x_mul_base_pclmul RENAME_FUNC_NAME(gf2x_mul_base_pclmul) | | ------------------ | | | | 44| 5|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 5|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 5|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 173| 5| ctx->sqr = gf2x_sqr_pclmul; ------------------ | | 117| 5|#define gf2x_sqr_pclmul RENAME_FUNC_NAME(gf2x_sqr_pclmul) | | ------------------ | | | | 44| 5|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 5|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 5|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 174| 5| } else 175| 0|#endif 176| 0|#endif 177| 0| { 178| 0| ctx->mul_base_qwords = GF2X_PORT_BASE_QWORDS; ------------------ | | 18| 0|#define GF2X_PORT_BASE_QWORDS (1) ------------------ 179| 0| ctx->mul_base = gf2x_mul_base_port; ------------------ | | 102| 0|#define gf2x_mul_base_port RENAME_FUNC_NAME(gf2x_mul_base_port) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 180| 0| ctx->sqr = gf2x_sqr_port; ------------------ | | 106| 0|#define gf2x_sqr_port RENAME_FUNC_NAME(gf2x_sqr_port) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 181| 0| } 182| 5|} gf2x_mul.c:OQS_KEM_bike_l1_gf2x_ctx_init: 132| 85|{ 133| 85|#if defined(X86_64) 134| 85|#if defined(OQS_DIST_X86_64_BUILD) || defined(OQS_USE_AVX512_INSTRUCTIONS) 135| 85| if(is_avx512_enabled()) { ------------------ | | 98| 85|#define is_avx512_enabled RENAME_FUNC_NAME(is_avx512_enabled) | | ------------------ | | | | 44| 85|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 85|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 85|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ | Branch (135:6): [True: 0, False: 85] ------------------ 136| 0| ctx->karatzuba_add1 = karatzuba_add1_avx512; ------------------ | | 71| 0|#define karatzuba_add1 RENAME_FUNC_NAME(karatzuba_add1) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ ctx->karatzuba_add1 = karatzuba_add1_avx512; ------------------ | | 112| 0|#define karatzuba_add1_avx512 RENAME_FUNC_NAME(karatzuba_add1_avx512) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 137| 0| ctx->karatzuba_add2 = karatzuba_add2_avx512; ------------------ | | 72| 0|#define karatzuba_add2 RENAME_FUNC_NAME(karatzuba_add2) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ ctx->karatzuba_add2 = karatzuba_add2_avx512; ------------------ | | 114| 0|#define karatzuba_add2_avx512 RENAME_FUNC_NAME(karatzuba_add2_avx512) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 138| 0| ctx->karatzuba_add3 = karatzuba_add3_avx512; ------------------ | | 116| 0|#define karatzuba_add3_avx512 RENAME_FUNC_NAME(karatzuba_add3_avx512) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 139| 0| ctx->k_sqr = k_sqr_avx512; ------------------ | | 120| 0|#define k_sqr_avx512 RENAME_FUNC_NAME(k_sqr_avx512) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 140| 0| ctx->red = gf2x_red_avx512; ------------------ | | 75| 0|#define red RENAME_FUNC_NAME(red) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ ctx->red = gf2x_red_avx512; ------------------ | | 122| 0|#define gf2x_red_avx512 RENAME_FUNC_NAME(gf2x_red_avx512) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 141| 0| } else 142| 85|#endif 143| 85|#if defined(OQS_DIST_X86_64_BUILD) || defined(OQS_USE_AVX2_INSTRUCTIONS) 144| 85| if(is_avx2_enabled()) { ------------------ | | 97| 85|#define is_avx2_enabled RENAME_FUNC_NAME(is_avx2_enabled) | | ------------------ | | | | 44| 85|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 85|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 85|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ | Branch (144:6): [True: 85, False: 0] ------------------ 145| 85| ctx->karatzuba_add1 = karatzuba_add1_avx2; ------------------ | | 71| 85|#define karatzuba_add1 RENAME_FUNC_NAME(karatzuba_add1) | | ------------------ | | | | 44| 85|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 85|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 85|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ ctx->karatzuba_add1 = karatzuba_add1_avx2; ------------------ | | 111| 85|#define karatzuba_add1_avx2 RENAME_FUNC_NAME(karatzuba_add1_avx2) | | ------------------ | | | | 44| 85|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 85|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 85|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 146| 85| ctx->karatzuba_add2 = karatzuba_add2_avx2; ------------------ | | 72| 85|#define karatzuba_add2 RENAME_FUNC_NAME(karatzuba_add2) | | ------------------ | | | | 44| 85|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 85|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 85|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ ctx->karatzuba_add2 = karatzuba_add2_avx2; ------------------ | | 113| 85|#define karatzuba_add2_avx2 RENAME_FUNC_NAME(karatzuba_add2_avx2) | | ------------------ | | | | 44| 85|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 85|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 85|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 147| 85| ctx->karatzuba_add3 = karatzuba_add3_avx2; ------------------ | | 115| 85|#define karatzuba_add3_avx2 RENAME_FUNC_NAME(karatzuba_add3_avx2) | | ------------------ | | | | 44| 85|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 85|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 85|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 148| 85| ctx->k_sqr = k_sqr_avx2; ------------------ | | 119| 85|#define k_sqr_avx2 RENAME_FUNC_NAME(k_sqr_avx2) | | ------------------ | | | | 44| 85|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 85|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 85|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 149| 85| ctx->red = gf2x_red_avx2; ------------------ | | 75| 85|#define red RENAME_FUNC_NAME(red) | | ------------------ | | | | 44| 85|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 85|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 85|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ ctx->red = gf2x_red_avx2; ------------------ | | 121| 85|#define gf2x_red_avx2 RENAME_FUNC_NAME(gf2x_red_avx2) | | ------------------ | | | | 44| 85|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 85|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 85|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 150| 85| } else 151| 0|#endif 152| 0|#endif 153| 0| { 154| 0| ctx->karatzuba_add1 = karatzuba_add1_port; ------------------ | | 71| 0|#define karatzuba_add1 RENAME_FUNC_NAME(karatzuba_add1) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ ctx->karatzuba_add1 = karatzuba_add1_port; ------------------ | | 103| 0|#define karatzuba_add1_port RENAME_FUNC_NAME(karatzuba_add1_port) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 155| 0| ctx->karatzuba_add2 = karatzuba_add2_port; ------------------ | | 72| 0|#define karatzuba_add2 RENAME_FUNC_NAME(karatzuba_add2) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ ctx->karatzuba_add2 = karatzuba_add2_port; ------------------ | | 104| 0|#define karatzuba_add2_port RENAME_FUNC_NAME(karatzuba_add2_port) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 156| 0| ctx->karatzuba_add3 = karatzuba_add3_port; ------------------ | | 105| 0|#define karatzuba_add3_port RENAME_FUNC_NAME(karatzuba_add3_port) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 157| 0| ctx->k_sqr = k_sqr_port; ------------------ | | 107| 0|#define k_sqr_port RENAME_FUNC_NAME(k_sqr_port) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 158| 0| ctx->red = gf2x_red_port; ------------------ | | 75| 0|#define red RENAME_FUNC_NAME(red) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ ctx->red = gf2x_red_port; ------------------ | | 108| 0|#define gf2x_red_port RENAME_FUNC_NAME(gf2x_red_port) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 159| 0| } 160| | 161| 85|#if defined(X86_64) 162| |# if !defined(DISABLE_VPCLMUL) 163| | if(is_vpclmul_enabled()) { 164| | ctx->mul_base_qwords = GF2X_VPCLMUL_BASE_QWORDS; 165| | ctx->mul_base = gf2x_mul_base_vpclmul; 166| | ctx->sqr = gf2x_sqr_vpclmul; 167| | } else 168| |# endif // DISABLE_VPCLMUL 169| 85|#if defined(OQS_DIST_X86_64_BUILD) || defined(OQS_USE_PCLMULQDQ_INSTRUCTIONS) 170| 85| if(is_pclmul_enabled()) { ------------------ | | 99| 85|#define is_pclmul_enabled RENAME_FUNC_NAME(is_pclmul_enabled) | | ------------------ | | | | 44| 85|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 85|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 85|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ | Branch (170:6): [True: 85, False: 0] ------------------ 171| 85| ctx->mul_base_qwords = GF2X_PCLMUL_BASE_QWORDS; ------------------ | | 19| 85|#define GF2X_PCLMUL_BASE_QWORDS (8) ------------------ 172| 85| ctx->mul_base = gf2x_mul_base_pclmul; ------------------ | | 109| 85|#define gf2x_mul_base_pclmul RENAME_FUNC_NAME(gf2x_mul_base_pclmul) | | ------------------ | | | | 44| 85|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 85|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 85|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 173| 85| ctx->sqr = gf2x_sqr_pclmul; ------------------ | | 117| 85|#define gf2x_sqr_pclmul RENAME_FUNC_NAME(gf2x_sqr_pclmul) | | ------------------ | | | | 44| 85|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 85|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 85|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 174| 85| } else 175| 0|#endif 176| 0|#endif 177| 0| { 178| 0| ctx->mul_base_qwords = GF2X_PORT_BASE_QWORDS; ------------------ | | 18| 0|#define GF2X_PORT_BASE_QWORDS (1) ------------------ 179| 0| ctx->mul_base = gf2x_mul_base_port; ------------------ | | 102| 0|#define gf2x_mul_base_port RENAME_FUNC_NAME(gf2x_mul_base_port) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 180| 0| ctx->sqr = gf2x_sqr_port; ------------------ | | 106| 0|#define gf2x_sqr_port RENAME_FUNC_NAME(gf2x_sqr_port) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 181| 0| } 182| 85|} gf2x_inv.c:OQS_KEM_bike_l3_gf2x_ctx_init: 132| 1|{ 133| 1|#if defined(X86_64) 134| 1|#if defined(OQS_DIST_X86_64_BUILD) || defined(OQS_USE_AVX512_INSTRUCTIONS) 135| 1| if(is_avx512_enabled()) { ------------------ | | 98| 1|#define is_avx512_enabled RENAME_FUNC_NAME(is_avx512_enabled) | | ------------------ | | | | 44| 1|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 1|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 1|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ | Branch (135:6): [True: 0, False: 1] ------------------ 136| 0| ctx->karatzuba_add1 = karatzuba_add1_avx512; ------------------ | | 71| 0|#define karatzuba_add1 RENAME_FUNC_NAME(karatzuba_add1) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ ctx->karatzuba_add1 = karatzuba_add1_avx512; ------------------ | | 112| 0|#define karatzuba_add1_avx512 RENAME_FUNC_NAME(karatzuba_add1_avx512) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 137| 0| ctx->karatzuba_add2 = karatzuba_add2_avx512; ------------------ | | 72| 0|#define karatzuba_add2 RENAME_FUNC_NAME(karatzuba_add2) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ ctx->karatzuba_add2 = karatzuba_add2_avx512; ------------------ | | 114| 0|#define karatzuba_add2_avx512 RENAME_FUNC_NAME(karatzuba_add2_avx512) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 138| 0| ctx->karatzuba_add3 = karatzuba_add3_avx512; ------------------ | | 116| 0|#define karatzuba_add3_avx512 RENAME_FUNC_NAME(karatzuba_add3_avx512) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 139| 0| ctx->k_sqr = k_sqr_avx512; ------------------ | | 120| 0|#define k_sqr_avx512 RENAME_FUNC_NAME(k_sqr_avx512) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 140| 0| ctx->red = gf2x_red_avx512; ------------------ | | 75| 0|#define red RENAME_FUNC_NAME(red) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ ctx->red = gf2x_red_avx512; ------------------ | | 122| 0|#define gf2x_red_avx512 RENAME_FUNC_NAME(gf2x_red_avx512) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 141| 0| } else 142| 1|#endif 143| 1|#if defined(OQS_DIST_X86_64_BUILD) || defined(OQS_USE_AVX2_INSTRUCTIONS) 144| 1| if(is_avx2_enabled()) { ------------------ | | 97| 1|#define is_avx2_enabled RENAME_FUNC_NAME(is_avx2_enabled) | | ------------------ | | | | 44| 1|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 1|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 1|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ | Branch (144:6): [True: 1, False: 0] ------------------ 145| 1| ctx->karatzuba_add1 = karatzuba_add1_avx2; ------------------ | | 71| 1|#define karatzuba_add1 RENAME_FUNC_NAME(karatzuba_add1) | | ------------------ | | | | 44| 1|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 1|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 1|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ ctx->karatzuba_add1 = karatzuba_add1_avx2; ------------------ | | 111| 1|#define karatzuba_add1_avx2 RENAME_FUNC_NAME(karatzuba_add1_avx2) | | ------------------ | | | | 44| 1|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 1|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 1|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 146| 1| ctx->karatzuba_add2 = karatzuba_add2_avx2; ------------------ | | 72| 1|#define karatzuba_add2 RENAME_FUNC_NAME(karatzuba_add2) | | ------------------ | | | | 44| 1|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 1|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 1|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ ctx->karatzuba_add2 = karatzuba_add2_avx2; ------------------ | | 113| 1|#define karatzuba_add2_avx2 RENAME_FUNC_NAME(karatzuba_add2_avx2) | | ------------------ | | | | 44| 1|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 1|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 1|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 147| 1| ctx->karatzuba_add3 = karatzuba_add3_avx2; ------------------ | | 115| 1|#define karatzuba_add3_avx2 RENAME_FUNC_NAME(karatzuba_add3_avx2) | | ------------------ | | | | 44| 1|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 1|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 1|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 148| 1| ctx->k_sqr = k_sqr_avx2; ------------------ | | 119| 1|#define k_sqr_avx2 RENAME_FUNC_NAME(k_sqr_avx2) | | ------------------ | | | | 44| 1|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 1|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 1|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 149| 1| ctx->red = gf2x_red_avx2; ------------------ | | 75| 1|#define red RENAME_FUNC_NAME(red) | | ------------------ | | | | 44| 1|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 1|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 1|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ ctx->red = gf2x_red_avx2; ------------------ | | 121| 1|#define gf2x_red_avx2 RENAME_FUNC_NAME(gf2x_red_avx2) | | ------------------ | | | | 44| 1|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 1|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 1|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 150| 1| } else 151| 0|#endif 152| 0|#endif 153| 0| { 154| 0| ctx->karatzuba_add1 = karatzuba_add1_port; ------------------ | | 71| 0|#define karatzuba_add1 RENAME_FUNC_NAME(karatzuba_add1) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ ctx->karatzuba_add1 = karatzuba_add1_port; ------------------ | | 103| 0|#define karatzuba_add1_port RENAME_FUNC_NAME(karatzuba_add1_port) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 155| 0| ctx->karatzuba_add2 = karatzuba_add2_port; ------------------ | | 72| 0|#define karatzuba_add2 RENAME_FUNC_NAME(karatzuba_add2) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ ctx->karatzuba_add2 = karatzuba_add2_port; ------------------ | | 104| 0|#define karatzuba_add2_port RENAME_FUNC_NAME(karatzuba_add2_port) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 156| 0| ctx->karatzuba_add3 = karatzuba_add3_port; ------------------ | | 105| 0|#define karatzuba_add3_port RENAME_FUNC_NAME(karatzuba_add3_port) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 157| 0| ctx->k_sqr = k_sqr_port; ------------------ | | 107| 0|#define k_sqr_port RENAME_FUNC_NAME(k_sqr_port) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 158| 0| ctx->red = gf2x_red_port; ------------------ | | 75| 0|#define red RENAME_FUNC_NAME(red) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ ctx->red = gf2x_red_port; ------------------ | | 108| 0|#define gf2x_red_port RENAME_FUNC_NAME(gf2x_red_port) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 159| 0| } 160| | 161| 1|#if defined(X86_64) 162| |# if !defined(DISABLE_VPCLMUL) 163| | if(is_vpclmul_enabled()) { 164| | ctx->mul_base_qwords = GF2X_VPCLMUL_BASE_QWORDS; 165| | ctx->mul_base = gf2x_mul_base_vpclmul; 166| | ctx->sqr = gf2x_sqr_vpclmul; 167| | } else 168| |# endif // DISABLE_VPCLMUL 169| 1|#if defined(OQS_DIST_X86_64_BUILD) || defined(OQS_USE_PCLMULQDQ_INSTRUCTIONS) 170| 1| if(is_pclmul_enabled()) { ------------------ | | 99| 1|#define is_pclmul_enabled RENAME_FUNC_NAME(is_pclmul_enabled) | | ------------------ | | | | 44| 1|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 1|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 1|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ | Branch (170:6): [True: 1, False: 0] ------------------ 171| 1| ctx->mul_base_qwords = GF2X_PCLMUL_BASE_QWORDS; ------------------ | | 19| 1|#define GF2X_PCLMUL_BASE_QWORDS (8) ------------------ 172| 1| ctx->mul_base = gf2x_mul_base_pclmul; ------------------ | | 109| 1|#define gf2x_mul_base_pclmul RENAME_FUNC_NAME(gf2x_mul_base_pclmul) | | ------------------ | | | | 44| 1|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 1|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 1|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 173| 1| ctx->sqr = gf2x_sqr_pclmul; ------------------ | | 117| 1|#define gf2x_sqr_pclmul RENAME_FUNC_NAME(gf2x_sqr_pclmul) | | ------------------ | | | | 44| 1|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 1|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 1|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 174| 1| } else 175| 0|#endif 176| 0|#endif 177| 0| { 178| 0| ctx->mul_base_qwords = GF2X_PORT_BASE_QWORDS; ------------------ | | 18| 0|#define GF2X_PORT_BASE_QWORDS (1) ------------------ 179| 0| ctx->mul_base = gf2x_mul_base_port; ------------------ | | 102| 0|#define gf2x_mul_base_port RENAME_FUNC_NAME(gf2x_mul_base_port) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 180| 0| ctx->sqr = gf2x_sqr_port; ------------------ | | 106| 0|#define gf2x_sqr_port RENAME_FUNC_NAME(gf2x_sqr_port) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 181| 0| } 182| 1|} gf2x_mul.c:OQS_KEM_bike_l3_gf2x_ctx_init: 132| 17|{ 133| 17|#if defined(X86_64) 134| 17|#if defined(OQS_DIST_X86_64_BUILD) || defined(OQS_USE_AVX512_INSTRUCTIONS) 135| 17| if(is_avx512_enabled()) { ------------------ | | 98| 17|#define is_avx512_enabled RENAME_FUNC_NAME(is_avx512_enabled) | | ------------------ | | | | 44| 17|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 17|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 17|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ | Branch (135:6): [True: 0, False: 17] ------------------ 136| 0| ctx->karatzuba_add1 = karatzuba_add1_avx512; ------------------ | | 71| 0|#define karatzuba_add1 RENAME_FUNC_NAME(karatzuba_add1) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ ctx->karatzuba_add1 = karatzuba_add1_avx512; ------------------ | | 112| 0|#define karatzuba_add1_avx512 RENAME_FUNC_NAME(karatzuba_add1_avx512) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 137| 0| ctx->karatzuba_add2 = karatzuba_add2_avx512; ------------------ | | 72| 0|#define karatzuba_add2 RENAME_FUNC_NAME(karatzuba_add2) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ ctx->karatzuba_add2 = karatzuba_add2_avx512; ------------------ | | 114| 0|#define karatzuba_add2_avx512 RENAME_FUNC_NAME(karatzuba_add2_avx512) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 138| 0| ctx->karatzuba_add3 = karatzuba_add3_avx512; ------------------ | | 116| 0|#define karatzuba_add3_avx512 RENAME_FUNC_NAME(karatzuba_add3_avx512) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 139| 0| ctx->k_sqr = k_sqr_avx512; ------------------ | | 120| 0|#define k_sqr_avx512 RENAME_FUNC_NAME(k_sqr_avx512) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 140| 0| ctx->red = gf2x_red_avx512; ------------------ | | 75| 0|#define red RENAME_FUNC_NAME(red) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ ctx->red = gf2x_red_avx512; ------------------ | | 122| 0|#define gf2x_red_avx512 RENAME_FUNC_NAME(gf2x_red_avx512) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 141| 0| } else 142| 17|#endif 143| 17|#if defined(OQS_DIST_X86_64_BUILD) || defined(OQS_USE_AVX2_INSTRUCTIONS) 144| 17| if(is_avx2_enabled()) { ------------------ | | 97| 17|#define is_avx2_enabled RENAME_FUNC_NAME(is_avx2_enabled) | | ------------------ | | | | 44| 17|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 17|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 17|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ | Branch (144:6): [True: 17, False: 0] ------------------ 145| 17| ctx->karatzuba_add1 = karatzuba_add1_avx2; ------------------ | | 71| 17|#define karatzuba_add1 RENAME_FUNC_NAME(karatzuba_add1) | | ------------------ | | | | 44| 17|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 17|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 17|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ ctx->karatzuba_add1 = karatzuba_add1_avx2; ------------------ | | 111| 17|#define karatzuba_add1_avx2 RENAME_FUNC_NAME(karatzuba_add1_avx2) | | ------------------ | | | | 44| 17|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 17|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 17|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 146| 17| ctx->karatzuba_add2 = karatzuba_add2_avx2; ------------------ | | 72| 17|#define karatzuba_add2 RENAME_FUNC_NAME(karatzuba_add2) | | ------------------ | | | | 44| 17|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 17|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 17|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ ctx->karatzuba_add2 = karatzuba_add2_avx2; ------------------ | | 113| 17|#define karatzuba_add2_avx2 RENAME_FUNC_NAME(karatzuba_add2_avx2) | | ------------------ | | | | 44| 17|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 17|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 17|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 147| 17| ctx->karatzuba_add3 = karatzuba_add3_avx2; ------------------ | | 115| 17|#define karatzuba_add3_avx2 RENAME_FUNC_NAME(karatzuba_add3_avx2) | | ------------------ | | | | 44| 17|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 17|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 17|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 148| 17| ctx->k_sqr = k_sqr_avx2; ------------------ | | 119| 17|#define k_sqr_avx2 RENAME_FUNC_NAME(k_sqr_avx2) | | ------------------ | | | | 44| 17|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 17|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 17|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 149| 17| ctx->red = gf2x_red_avx2; ------------------ | | 75| 17|#define red RENAME_FUNC_NAME(red) | | ------------------ | | | | 44| 17|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 17|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 17|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ ctx->red = gf2x_red_avx2; ------------------ | | 121| 17|#define gf2x_red_avx2 RENAME_FUNC_NAME(gf2x_red_avx2) | | ------------------ | | | | 44| 17|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 17|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 17|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 150| 17| } else 151| 0|#endif 152| 0|#endif 153| 0| { 154| 0| ctx->karatzuba_add1 = karatzuba_add1_port; ------------------ | | 71| 0|#define karatzuba_add1 RENAME_FUNC_NAME(karatzuba_add1) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ ctx->karatzuba_add1 = karatzuba_add1_port; ------------------ | | 103| 0|#define karatzuba_add1_port RENAME_FUNC_NAME(karatzuba_add1_port) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 155| 0| ctx->karatzuba_add2 = karatzuba_add2_port; ------------------ | | 72| 0|#define karatzuba_add2 RENAME_FUNC_NAME(karatzuba_add2) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ ctx->karatzuba_add2 = karatzuba_add2_port; ------------------ | | 104| 0|#define karatzuba_add2_port RENAME_FUNC_NAME(karatzuba_add2_port) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 156| 0| ctx->karatzuba_add3 = karatzuba_add3_port; ------------------ | | 105| 0|#define karatzuba_add3_port RENAME_FUNC_NAME(karatzuba_add3_port) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 157| 0| ctx->k_sqr = k_sqr_port; ------------------ | | 107| 0|#define k_sqr_port RENAME_FUNC_NAME(k_sqr_port) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 158| 0| ctx->red = gf2x_red_port; ------------------ | | 75| 0|#define red RENAME_FUNC_NAME(red) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ ctx->red = gf2x_red_port; ------------------ | | 108| 0|#define gf2x_red_port RENAME_FUNC_NAME(gf2x_red_port) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 159| 0| } 160| | 161| 17|#if defined(X86_64) 162| |# if !defined(DISABLE_VPCLMUL) 163| | if(is_vpclmul_enabled()) { 164| | ctx->mul_base_qwords = GF2X_VPCLMUL_BASE_QWORDS; 165| | ctx->mul_base = gf2x_mul_base_vpclmul; 166| | ctx->sqr = gf2x_sqr_vpclmul; 167| | } else 168| |# endif // DISABLE_VPCLMUL 169| 17|#if defined(OQS_DIST_X86_64_BUILD) || defined(OQS_USE_PCLMULQDQ_INSTRUCTIONS) 170| 17| if(is_pclmul_enabled()) { ------------------ | | 99| 17|#define is_pclmul_enabled RENAME_FUNC_NAME(is_pclmul_enabled) | | ------------------ | | | | 44| 17|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 17|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 17|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ | Branch (170:6): [True: 17, False: 0] ------------------ 171| 17| ctx->mul_base_qwords = GF2X_PCLMUL_BASE_QWORDS; ------------------ | | 19| 17|#define GF2X_PCLMUL_BASE_QWORDS (8) ------------------ 172| 17| ctx->mul_base = gf2x_mul_base_pclmul; ------------------ | | 109| 17|#define gf2x_mul_base_pclmul RENAME_FUNC_NAME(gf2x_mul_base_pclmul) | | ------------------ | | | | 44| 17|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 17|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 17|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 173| 17| ctx->sqr = gf2x_sqr_pclmul; ------------------ | | 117| 17|#define gf2x_sqr_pclmul RENAME_FUNC_NAME(gf2x_sqr_pclmul) | | ------------------ | | | | 44| 17|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 17|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 17|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 174| 17| } else 175| 0|#endif 176| 0|#endif 177| 0| { 178| 0| ctx->mul_base_qwords = GF2X_PORT_BASE_QWORDS; ------------------ | | 18| 0|#define GF2X_PORT_BASE_QWORDS (1) ------------------ 179| 0| ctx->mul_base = gf2x_mul_base_port; ------------------ | | 102| 0|#define gf2x_mul_base_port RENAME_FUNC_NAME(gf2x_mul_base_port) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 180| 0| ctx->sqr = gf2x_sqr_port; ------------------ | | 106| 0|#define gf2x_sqr_port RENAME_FUNC_NAME(gf2x_sqr_port) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 181| 0| } 182| 17|} gf2x_inv.c:OQS_KEM_bike_l5_gf2x_ctx_init: 132| 1|{ 133| 1|#if defined(X86_64) 134| 1|#if defined(OQS_DIST_X86_64_BUILD) || defined(OQS_USE_AVX512_INSTRUCTIONS) 135| 1| if(is_avx512_enabled()) { ------------------ | | 98| 1|#define is_avx512_enabled RENAME_FUNC_NAME(is_avx512_enabled) | | ------------------ | | | | 44| 1|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 1|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 1|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ | Branch (135:6): [True: 0, False: 1] ------------------ 136| 0| ctx->karatzuba_add1 = karatzuba_add1_avx512; ------------------ | | 71| 0|#define karatzuba_add1 RENAME_FUNC_NAME(karatzuba_add1) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ ctx->karatzuba_add1 = karatzuba_add1_avx512; ------------------ | | 112| 0|#define karatzuba_add1_avx512 RENAME_FUNC_NAME(karatzuba_add1_avx512) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 137| 0| ctx->karatzuba_add2 = karatzuba_add2_avx512; ------------------ | | 72| 0|#define karatzuba_add2 RENAME_FUNC_NAME(karatzuba_add2) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ ctx->karatzuba_add2 = karatzuba_add2_avx512; ------------------ | | 114| 0|#define karatzuba_add2_avx512 RENAME_FUNC_NAME(karatzuba_add2_avx512) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 138| 0| ctx->karatzuba_add3 = karatzuba_add3_avx512; ------------------ | | 116| 0|#define karatzuba_add3_avx512 RENAME_FUNC_NAME(karatzuba_add3_avx512) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 139| 0| ctx->k_sqr = k_sqr_avx512; ------------------ | | 120| 0|#define k_sqr_avx512 RENAME_FUNC_NAME(k_sqr_avx512) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 140| 0| ctx->red = gf2x_red_avx512; ------------------ | | 75| 0|#define red RENAME_FUNC_NAME(red) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ ctx->red = gf2x_red_avx512; ------------------ | | 122| 0|#define gf2x_red_avx512 RENAME_FUNC_NAME(gf2x_red_avx512) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 141| 0| } else 142| 1|#endif 143| 1|#if defined(OQS_DIST_X86_64_BUILD) || defined(OQS_USE_AVX2_INSTRUCTIONS) 144| 1| if(is_avx2_enabled()) { ------------------ | | 97| 1|#define is_avx2_enabled RENAME_FUNC_NAME(is_avx2_enabled) | | ------------------ | | | | 44| 1|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 1|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 1|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ | Branch (144:6): [True: 1, False: 0] ------------------ 145| 1| ctx->karatzuba_add1 = karatzuba_add1_avx2; ------------------ | | 71| 1|#define karatzuba_add1 RENAME_FUNC_NAME(karatzuba_add1) | | ------------------ | | | | 44| 1|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 1|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 1|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ ctx->karatzuba_add1 = karatzuba_add1_avx2; ------------------ | | 111| 1|#define karatzuba_add1_avx2 RENAME_FUNC_NAME(karatzuba_add1_avx2) | | ------------------ | | | | 44| 1|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 1|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 1|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 146| 1| ctx->karatzuba_add2 = karatzuba_add2_avx2; ------------------ | | 72| 1|#define karatzuba_add2 RENAME_FUNC_NAME(karatzuba_add2) | | ------------------ | | | | 44| 1|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 1|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 1|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ ctx->karatzuba_add2 = karatzuba_add2_avx2; ------------------ | | 113| 1|#define karatzuba_add2_avx2 RENAME_FUNC_NAME(karatzuba_add2_avx2) | | ------------------ | | | | 44| 1|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 1|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 1|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 147| 1| ctx->karatzuba_add3 = karatzuba_add3_avx2; ------------------ | | 115| 1|#define karatzuba_add3_avx2 RENAME_FUNC_NAME(karatzuba_add3_avx2) | | ------------------ | | | | 44| 1|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 1|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 1|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 148| 1| ctx->k_sqr = k_sqr_avx2; ------------------ | | 119| 1|#define k_sqr_avx2 RENAME_FUNC_NAME(k_sqr_avx2) | | ------------------ | | | | 44| 1|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 1|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 1|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 149| 1| ctx->red = gf2x_red_avx2; ------------------ | | 75| 1|#define red RENAME_FUNC_NAME(red) | | ------------------ | | | | 44| 1|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 1|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 1|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ ctx->red = gf2x_red_avx2; ------------------ | | 121| 1|#define gf2x_red_avx2 RENAME_FUNC_NAME(gf2x_red_avx2) | | ------------------ | | | | 44| 1|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 1|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 1|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 150| 1| } else 151| 0|#endif 152| 0|#endif 153| 0| { 154| 0| ctx->karatzuba_add1 = karatzuba_add1_port; ------------------ | | 71| 0|#define karatzuba_add1 RENAME_FUNC_NAME(karatzuba_add1) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ ctx->karatzuba_add1 = karatzuba_add1_port; ------------------ | | 103| 0|#define karatzuba_add1_port RENAME_FUNC_NAME(karatzuba_add1_port) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 155| 0| ctx->karatzuba_add2 = karatzuba_add2_port; ------------------ | | 72| 0|#define karatzuba_add2 RENAME_FUNC_NAME(karatzuba_add2) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ ctx->karatzuba_add2 = karatzuba_add2_port; ------------------ | | 104| 0|#define karatzuba_add2_port RENAME_FUNC_NAME(karatzuba_add2_port) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 156| 0| ctx->karatzuba_add3 = karatzuba_add3_port; ------------------ | | 105| 0|#define karatzuba_add3_port RENAME_FUNC_NAME(karatzuba_add3_port) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 157| 0| ctx->k_sqr = k_sqr_port; ------------------ | | 107| 0|#define k_sqr_port RENAME_FUNC_NAME(k_sqr_port) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 158| 0| ctx->red = gf2x_red_port; ------------------ | | 75| 0|#define red RENAME_FUNC_NAME(red) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ ctx->red = gf2x_red_port; ------------------ | | 108| 0|#define gf2x_red_port RENAME_FUNC_NAME(gf2x_red_port) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 159| 0| } 160| | 161| 1|#if defined(X86_64) 162| |# if !defined(DISABLE_VPCLMUL) 163| | if(is_vpclmul_enabled()) { 164| | ctx->mul_base_qwords = GF2X_VPCLMUL_BASE_QWORDS; 165| | ctx->mul_base = gf2x_mul_base_vpclmul; 166| | ctx->sqr = gf2x_sqr_vpclmul; 167| | } else 168| |# endif // DISABLE_VPCLMUL 169| 1|#if defined(OQS_DIST_X86_64_BUILD) || defined(OQS_USE_PCLMULQDQ_INSTRUCTIONS) 170| 1| if(is_pclmul_enabled()) { ------------------ | | 99| 1|#define is_pclmul_enabled RENAME_FUNC_NAME(is_pclmul_enabled) | | ------------------ | | | | 44| 1|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 1|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 1|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ | Branch (170:6): [True: 1, False: 0] ------------------ 171| 1| ctx->mul_base_qwords = GF2X_PCLMUL_BASE_QWORDS; ------------------ | | 19| 1|#define GF2X_PCLMUL_BASE_QWORDS (8) ------------------ 172| 1| ctx->mul_base = gf2x_mul_base_pclmul; ------------------ | | 109| 1|#define gf2x_mul_base_pclmul RENAME_FUNC_NAME(gf2x_mul_base_pclmul) | | ------------------ | | | | 44| 1|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 1|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 1|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 173| 1| ctx->sqr = gf2x_sqr_pclmul; ------------------ | | 117| 1|#define gf2x_sqr_pclmul RENAME_FUNC_NAME(gf2x_sqr_pclmul) | | ------------------ | | | | 44| 1|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 1|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 1|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 174| 1| } else 175| 0|#endif 176| 0|#endif 177| 0| { 178| 0| ctx->mul_base_qwords = GF2X_PORT_BASE_QWORDS; ------------------ | | 18| 0|#define GF2X_PORT_BASE_QWORDS (1) ------------------ 179| 0| ctx->mul_base = gf2x_mul_base_port; ------------------ | | 102| 0|#define gf2x_mul_base_port RENAME_FUNC_NAME(gf2x_mul_base_port) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 180| 0| ctx->sqr = gf2x_sqr_port; ------------------ | | 106| 0|#define gf2x_sqr_port RENAME_FUNC_NAME(gf2x_sqr_port) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 181| 0| } 182| 1|} gf2x_mul.c:OQS_KEM_bike_l5_gf2x_ctx_init: 132| 17|{ 133| 17|#if defined(X86_64) 134| 17|#if defined(OQS_DIST_X86_64_BUILD) || defined(OQS_USE_AVX512_INSTRUCTIONS) 135| 17| if(is_avx512_enabled()) { ------------------ | | 98| 17|#define is_avx512_enabled RENAME_FUNC_NAME(is_avx512_enabled) | | ------------------ | | | | 44| 17|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 17|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 17|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ | Branch (135:6): [True: 0, False: 17] ------------------ 136| 0| ctx->karatzuba_add1 = karatzuba_add1_avx512; ------------------ | | 71| 0|#define karatzuba_add1 RENAME_FUNC_NAME(karatzuba_add1) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ ctx->karatzuba_add1 = karatzuba_add1_avx512; ------------------ | | 112| 0|#define karatzuba_add1_avx512 RENAME_FUNC_NAME(karatzuba_add1_avx512) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 137| 0| ctx->karatzuba_add2 = karatzuba_add2_avx512; ------------------ | | 72| 0|#define karatzuba_add2 RENAME_FUNC_NAME(karatzuba_add2) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ ctx->karatzuba_add2 = karatzuba_add2_avx512; ------------------ | | 114| 0|#define karatzuba_add2_avx512 RENAME_FUNC_NAME(karatzuba_add2_avx512) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 138| 0| ctx->karatzuba_add3 = karatzuba_add3_avx512; ------------------ | | 116| 0|#define karatzuba_add3_avx512 RENAME_FUNC_NAME(karatzuba_add3_avx512) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 139| 0| ctx->k_sqr = k_sqr_avx512; ------------------ | | 120| 0|#define k_sqr_avx512 RENAME_FUNC_NAME(k_sqr_avx512) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 140| 0| ctx->red = gf2x_red_avx512; ------------------ | | 75| 0|#define red RENAME_FUNC_NAME(red) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ ctx->red = gf2x_red_avx512; ------------------ | | 122| 0|#define gf2x_red_avx512 RENAME_FUNC_NAME(gf2x_red_avx512) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 141| 0| } else 142| 17|#endif 143| 17|#if defined(OQS_DIST_X86_64_BUILD) || defined(OQS_USE_AVX2_INSTRUCTIONS) 144| 17| if(is_avx2_enabled()) { ------------------ | | 97| 17|#define is_avx2_enabled RENAME_FUNC_NAME(is_avx2_enabled) | | ------------------ | | | | 44| 17|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 17|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 17|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ | Branch (144:6): [True: 17, False: 0] ------------------ 145| 17| ctx->karatzuba_add1 = karatzuba_add1_avx2; ------------------ | | 71| 17|#define karatzuba_add1 RENAME_FUNC_NAME(karatzuba_add1) | | ------------------ | | | | 44| 17|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 17|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 17|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ ctx->karatzuba_add1 = karatzuba_add1_avx2; ------------------ | | 111| 17|#define karatzuba_add1_avx2 RENAME_FUNC_NAME(karatzuba_add1_avx2) | | ------------------ | | | | 44| 17|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 17|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 17|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 146| 17| ctx->karatzuba_add2 = karatzuba_add2_avx2; ------------------ | | 72| 17|#define karatzuba_add2 RENAME_FUNC_NAME(karatzuba_add2) | | ------------------ | | | | 44| 17|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 17|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 17|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ ctx->karatzuba_add2 = karatzuba_add2_avx2; ------------------ | | 113| 17|#define karatzuba_add2_avx2 RENAME_FUNC_NAME(karatzuba_add2_avx2) | | ------------------ | | | | 44| 17|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 17|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 17|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 147| 17| ctx->karatzuba_add3 = karatzuba_add3_avx2; ------------------ | | 115| 17|#define karatzuba_add3_avx2 RENAME_FUNC_NAME(karatzuba_add3_avx2) | | ------------------ | | | | 44| 17|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 17|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 17|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 148| 17| ctx->k_sqr = k_sqr_avx2; ------------------ | | 119| 17|#define k_sqr_avx2 RENAME_FUNC_NAME(k_sqr_avx2) | | ------------------ | | | | 44| 17|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 17|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 17|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 149| 17| ctx->red = gf2x_red_avx2; ------------------ | | 75| 17|#define red RENAME_FUNC_NAME(red) | | ------------------ | | | | 44| 17|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 17|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 17|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ ctx->red = gf2x_red_avx2; ------------------ | | 121| 17|#define gf2x_red_avx2 RENAME_FUNC_NAME(gf2x_red_avx2) | | ------------------ | | | | 44| 17|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 17|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 17|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 150| 17| } else 151| 0|#endif 152| 0|#endif 153| 0| { 154| 0| ctx->karatzuba_add1 = karatzuba_add1_port; ------------------ | | 71| 0|#define karatzuba_add1 RENAME_FUNC_NAME(karatzuba_add1) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ ctx->karatzuba_add1 = karatzuba_add1_port; ------------------ | | 103| 0|#define karatzuba_add1_port RENAME_FUNC_NAME(karatzuba_add1_port) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 155| 0| ctx->karatzuba_add2 = karatzuba_add2_port; ------------------ | | 72| 0|#define karatzuba_add2 RENAME_FUNC_NAME(karatzuba_add2) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ ctx->karatzuba_add2 = karatzuba_add2_port; ------------------ | | 104| 0|#define karatzuba_add2_port RENAME_FUNC_NAME(karatzuba_add2_port) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 156| 0| ctx->karatzuba_add3 = karatzuba_add3_port; ------------------ | | 105| 0|#define karatzuba_add3_port RENAME_FUNC_NAME(karatzuba_add3_port) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 157| 0| ctx->k_sqr = k_sqr_port; ------------------ | | 107| 0|#define k_sqr_port RENAME_FUNC_NAME(k_sqr_port) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 158| 0| ctx->red = gf2x_red_port; ------------------ | | 75| 0|#define red RENAME_FUNC_NAME(red) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ ctx->red = gf2x_red_port; ------------------ | | 108| 0|#define gf2x_red_port RENAME_FUNC_NAME(gf2x_red_port) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 159| 0| } 160| | 161| 17|#if defined(X86_64) 162| |# if !defined(DISABLE_VPCLMUL) 163| | if(is_vpclmul_enabled()) { 164| | ctx->mul_base_qwords = GF2X_VPCLMUL_BASE_QWORDS; 165| | ctx->mul_base = gf2x_mul_base_vpclmul; 166| | ctx->sqr = gf2x_sqr_vpclmul; 167| | } else 168| |# endif // DISABLE_VPCLMUL 169| 17|#if defined(OQS_DIST_X86_64_BUILD) || defined(OQS_USE_PCLMULQDQ_INSTRUCTIONS) 170| 17| if(is_pclmul_enabled()) { ------------------ | | 99| 17|#define is_pclmul_enabled RENAME_FUNC_NAME(is_pclmul_enabled) | | ------------------ | | | | 44| 17|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 17|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 17|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ | Branch (170:6): [True: 17, False: 0] ------------------ 171| 17| ctx->mul_base_qwords = GF2X_PCLMUL_BASE_QWORDS; ------------------ | | 19| 17|#define GF2X_PCLMUL_BASE_QWORDS (8) ------------------ 172| 17| ctx->mul_base = gf2x_mul_base_pclmul; ------------------ | | 109| 17|#define gf2x_mul_base_pclmul RENAME_FUNC_NAME(gf2x_mul_base_pclmul) | | ------------------ | | | | 44| 17|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 17|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 17|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 173| 17| ctx->sqr = gf2x_sqr_pclmul; ------------------ | | 117| 17|#define gf2x_sqr_pclmul RENAME_FUNC_NAME(gf2x_sqr_pclmul) | | ------------------ | | | | 44| 17|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 17|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 17|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 174| 17| } else 175| 0|#endif 176| 0|#endif 177| 0| { 178| 0| ctx->mul_base_qwords = GF2X_PORT_BASE_QWORDS; ------------------ | | 18| 0|#define GF2X_PORT_BASE_QWORDS (1) ------------------ 179| 0| ctx->mul_base = gf2x_mul_base_port; ------------------ | | 102| 0|#define gf2x_mul_base_port RENAME_FUNC_NAME(gf2x_mul_base_port) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 180| 0| ctx->sqr = gf2x_sqr_port; ------------------ | | 106| 0|#define gf2x_sqr_port RENAME_FUNC_NAME(gf2x_sqr_port) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 181| 0| } 182| 17|} OQS_KEM_bike_l1_gf2x_mod_inv: 119| 5|{ 120| | // Initialize gf2x methods struct 121| 5| gf2x_ctx ctx; 122| 5| gf2x_ctx_init(&ctx); ------------------ | | 126| 5|#define gf2x_ctx_init RENAME_FUNC_NAME(gf2x_ctx_init) | | ------------------ | | | | 44| 5|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 5|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 5|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 123| | 124| | // Note that exp0/1_k/l are predefined constants that depend only on the value 125| | // of R. This value is public. Therefore, branches in this function, which 126| | // depends on R, are also "public". Code that releases these branches 127| | // (taken/not-taken) does not leak secret information. 128| 5| const size_t exp0_k[MAX_I] = {EXP0_K_VALS}; ------------------ | | 80| 5| 1, 2, 4, 8, 16, 32, 64, 128, 256, 512, 1024, 2048, 4096, 8192 ------------------ 129| 5| const size_t exp0_l[MAX_I] = {EXP0_L_VALS}; ------------------ | | 82| 5| 6162, 3081, 3851, 5632, 22, 484, 119, 1838, 1742, 3106, 10650, 1608, 10157, 8816 ------------------ 130| 5| const size_t exp1_k[MAX_I] = {EXP1_K_VALS}; ------------------ | | 83| 5|# define EXP1_K_VALS 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 33, 4129 ------------------ 131| 5| const size_t exp1_l[MAX_I] = {EXP1_L_VALS}; ------------------ | | 84| 5|# define EXP1_L_VALS 0, 0, 0, 0, 0, 6162, 0, 0, 0, 0, 0, 0, 242, 5717 ------------------ 132| | 133| 5| DEFER_CLEANUP(pad_r_t f = {0}, pad_r_cleanup); ------------------ | | 16| 5| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 134| 5| DEFER_CLEANUP(pad_r_t g = {0}, pad_r_cleanup); ------------------ | | 16| 5| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 135| 5| DEFER_CLEANUP(pad_r_t t = {0}, pad_r_cleanup); ------------------ | | 16| 5| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 136| 5| DEFER_CLEANUP(dbl_pad_r_t sec_buf = {0}, dbl_pad_r_cleanup); ------------------ | | 16| 5| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 137| | 138| | // Steps 2 and 3 in [1](Algorithm 2) 139| 5| f.val = a->val; 140| 5| t.val = a->val; 141| | 142| 70| for(size_t i = 1; i < MAX_I; i++) { ------------------ | | 78| 70|# define MAX_I (14) ------------------ | Branch (142:21): [True: 65, False: 5] ------------------ 143| | // Step 5 in [1](Algorithm 2), exponentiation 0: g = f^2^2^(i-1) 144| 65| if(exp0_k[i - 1] <= K_SQR_THR) { ------------------ | | 51| 65|#define K_SQR_THR (64) ------------------ | Branch (144:8): [True: 35, False: 30] ------------------ 145| 35| repeated_squaring(&g, &f, exp0_k[i - 1], &sec_buf, &ctx); 146| 35| } else { 147| 30| ctx.k_sqr(&g, &f, exp0_l[i - 1]); 148| 30| } 149| | 150| | // Step 6, [1](Algorithm 2): f = f*g 151| 65| gf2x_mod_mul_with_ctx(&f, &g, &f, &ctx); ------------------ | | 125| 65|#define gf2x_mod_mul_with_ctx RENAME_FUNC_NAME(gf2x_mod_mul_with_ctx) | | ------------------ | | | | 44| 65|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 65|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 65|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 152| | 153| 65| if(exp1_k[i] != 0) { ------------------ | Branch (153:8): [True: 15, False: 50] ------------------ 154| | // Step 8, [1](Algorithm 2), exponentiation 1: g = f^2^((r-2) % 2^i) 155| 15| if(exp1_k[i] <= K_SQR_THR) { ------------------ | | 51| 15|#define K_SQR_THR (64) ------------------ | Branch (155:10): [True: 10, False: 5] ------------------ 156| 10| repeated_squaring(&g, &f, exp1_k[i], &sec_buf, &ctx); 157| 10| } else { 158| 5| ctx.k_sqr(&g, &f, exp1_l[i]); 159| 5| } 160| | 161| | // Step 9, [1](Algorithm 2): t = t*g; 162| 15| gf2x_mod_mul_with_ctx(&t, &g, &t, &ctx); ------------------ | | 125| 15|#define gf2x_mod_mul_with_ctx RENAME_FUNC_NAME(gf2x_mod_mul_with_ctx) | | ------------------ | | | | 44| 15|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 15|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 15|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 163| 15| } 164| 65| } 165| | 166| | // Step 10, [1](Algorithm 2): c = t^2 167| 5| gf2x_mod_sqr_in_place(&t, &sec_buf, &ctx); 168| 5| c->val = t.val; 169| 5|} gf2x_inv.c:repeated_squaring: 32| 64|{ 33| 64| c->val = a->val; 34| | 35| 1.15k| for(size_t i = 0; i < num_sqrs; i++) { ------------------ | Branch (35:21): [True: 1.09k, False: 64] ------------------ 36| 1.09k| gf2x_mod_sqr_in_place(c, sec_buf, ctx); 37| 1.09k| } 38| 64|} gf2x_inv.c:gf2x_mod_sqr_in_place: 21| 1.09k|{ 22| 1.09k| ctx->sqr(secure_buffer, a); 23| 1.09k| ctx->red(a, secure_buffer); ------------------ | | 75| 1.09k|#define red RENAME_FUNC_NAME(red) | | ------------------ | | | | 44| 1.09k|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 1.09k|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 1.09k|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 24| 1.09k|} OQS_KEM_bike_l3_gf2x_mod_inv: 119| 1|{ 120| | // Initialize gf2x methods struct 121| 1| gf2x_ctx ctx; 122| 1| gf2x_ctx_init(&ctx); ------------------ | | 126| 1|#define gf2x_ctx_init RENAME_FUNC_NAME(gf2x_ctx_init) | | ------------------ | | | | 44| 1|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 1|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 1|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 123| | 124| | // Note that exp0/1_k/l are predefined constants that depend only on the value 125| | // of R. This value is public. Therefore, branches in this function, which 126| | // depends on R, are also "public". Code that releases these branches 127| | // (taken/not-taken) does not leak secret information. 128| 1| const size_t exp0_k[MAX_I] = {EXP0_K_VALS}; ------------------ | | 93| 1| 1, 2, 4, 8, 16, 32, 64, 128, 256, 512, 1024, 2048, 4096, 8192, 16384 ------------------ 129| 1| const size_t exp0_l[MAX_I] = {EXP0_L_VALS}; ------------------ | | 95| 1| 12330, 6165, 7706, 3564, 2711, 1139, 15053, 1258, 4388, 20524, 9538, 6393, \ | | 96| 1| 10486, 1715, 6804 ------------------ 130| 1| const size_t exp1_k[MAX_I] = {EXP1_K_VALS}; ------------------ | | 97| 1|# define EXP1_K_VALS 0, 0, 0, 0, 1, 0, 17, 0, 0, 0, 0, 0, 0, 81, 8273 ------------------ 131| 1| const size_t exp1_l[MAX_I] = {EXP1_L_VALS}; ------------------ | | 98| 1|# define EXP1_L_VALS 0, 0, 0, 0, 12330, 0, 13685, 0, 0, 0, 0, 0, 0, 23678, 19056 ------------------ 132| | 133| 1| DEFER_CLEANUP(pad_r_t f = {0}, pad_r_cleanup); ------------------ | | 16| 1| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 134| 1| DEFER_CLEANUP(pad_r_t g = {0}, pad_r_cleanup); ------------------ | | 16| 1| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 135| 1| DEFER_CLEANUP(pad_r_t t = {0}, pad_r_cleanup); ------------------ | | 16| 1| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 136| 1| DEFER_CLEANUP(dbl_pad_r_t sec_buf = {0}, dbl_pad_r_cleanup); ------------------ | | 16| 1| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 137| | 138| | // Steps 2 and 3 in [1](Algorithm 2) 139| 1| f.val = a->val; 140| 1| t.val = a->val; 141| | 142| 15| for(size_t i = 1; i < MAX_I; i++) { ------------------ | | 91| 15|# define MAX_I (15) ------------------ | Branch (142:21): [True: 14, False: 1] ------------------ 143| | // Step 5 in [1](Algorithm 2), exponentiation 0: g = f^2^2^(i-1) 144| 14| if(exp0_k[i - 1] <= K_SQR_THR) { ------------------ | | 51| 14|#define K_SQR_THR (64) ------------------ | Branch (144:8): [True: 7, False: 7] ------------------ 145| 7| repeated_squaring(&g, &f, exp0_k[i - 1], &sec_buf, &ctx); 146| 7| } else { 147| 7| ctx.k_sqr(&g, &f, exp0_l[i - 1]); 148| 7| } 149| | 150| | // Step 6, [1](Algorithm 2): f = f*g 151| 14| gf2x_mod_mul_with_ctx(&f, &g, &f, &ctx); ------------------ | | 125| 14|#define gf2x_mod_mul_with_ctx RENAME_FUNC_NAME(gf2x_mod_mul_with_ctx) | | ------------------ | | | | 44| 14|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 14|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 14|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 152| | 153| 14| if(exp1_k[i] != 0) { ------------------ | Branch (153:8): [True: 4, False: 10] ------------------ 154| | // Step 8, [1](Algorithm 2), exponentiation 1: g = f^2^((r-2) % 2^i) 155| 4| if(exp1_k[i] <= K_SQR_THR) { ------------------ | | 51| 4|#define K_SQR_THR (64) ------------------ | Branch (155:10): [True: 2, False: 2] ------------------ 156| 2| repeated_squaring(&g, &f, exp1_k[i], &sec_buf, &ctx); 157| 2| } else { 158| 2| ctx.k_sqr(&g, &f, exp1_l[i]); 159| 2| } 160| | 161| | // Step 9, [1](Algorithm 2): t = t*g; 162| 4| gf2x_mod_mul_with_ctx(&t, &g, &t, &ctx); ------------------ | | 125| 4|#define gf2x_mod_mul_with_ctx RENAME_FUNC_NAME(gf2x_mod_mul_with_ctx) | | ------------------ | | | | 44| 4|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 4|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 4|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 163| 4| } 164| 14| } 165| | 166| | // Step 10, [1](Algorithm 2): c = t^2 167| 1| gf2x_mod_sqr_in_place(&t, &sec_buf, &ctx); 168| 1| c->val = t.val; 169| 1|} OQS_KEM_bike_l5_gf2x_mod_inv: 119| 1|{ 120| | // Initialize gf2x methods struct 121| 1| gf2x_ctx ctx; 122| 1| gf2x_ctx_init(&ctx); ------------------ | | 126| 1|#define gf2x_ctx_init RENAME_FUNC_NAME(gf2x_ctx_init) | | ------------------ | | | | 44| 1|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 1|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 1|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 123| | 124| | // Note that exp0/1_k/l are predefined constants that depend only on the value 125| | // of R. This value is public. Therefore, branches in this function, which 126| | // depends on R, are also "public". Code that releases these branches 127| | // (taken/not-taken) does not leak secret information. 128| 1| const size_t exp0_k[MAX_I] = {EXP0_K_VALS}; ------------------ | | 107| 1| 1, 2, 4, 8, 16, 32, 64, 128, 256, 512, 1024, 2048, 4096, 8192, 16384, 32768 ------------------ 129| 1| const size_t exp0_l[MAX_I] = {EXP0_L_VALS}; ------------------ | | 109| 1| 20487, 30730, 28169, 9443, 13001, 12376, 8302, 6618, 38760, 21582, 1660, \ | | 110| 1| 10409, 14669, 30338, 17745, 7520 ------------------ 130| 1| const size_t exp1_k[MAX_I] = {EXP1_K_VALS}; ------------------ | | 111| 1|# define EXP1_K_VALS 0, 1, 0, 3, 0, 0, 0, 0, 0, 0, 0, 0, 0, 11, 0, 8203 ------------------ 131| 1| const size_t exp1_l[MAX_I] = {EXP1_L_VALS}; ------------------ | | 112| 1|# define EXP1_L_VALS 0, 20487, 0, 15365, 0, 0, 0, 0, 0, 0, 0, 0, 0, 6302, 0, 10058 ------------------ 132| | 133| 1| DEFER_CLEANUP(pad_r_t f = {0}, pad_r_cleanup); ------------------ | | 16| 1| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 134| 1| DEFER_CLEANUP(pad_r_t g = {0}, pad_r_cleanup); ------------------ | | 16| 1| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 135| 1| DEFER_CLEANUP(pad_r_t t = {0}, pad_r_cleanup); ------------------ | | 16| 1| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 136| 1| DEFER_CLEANUP(dbl_pad_r_t sec_buf = {0}, dbl_pad_r_cleanup); ------------------ | | 16| 1| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 137| | 138| | // Steps 2 and 3 in [1](Algorithm 2) 139| 1| f.val = a->val; 140| 1| t.val = a->val; 141| | 142| 16| for(size_t i = 1; i < MAX_I; i++) { ------------------ | | 105| 16|# define MAX_I (16) ------------------ | Branch (142:21): [True: 15, False: 1] ------------------ 143| | // Step 5 in [1](Algorithm 2), exponentiation 0: g = f^2^2^(i-1) 144| 15| if(exp0_k[i - 1] <= K_SQR_THR) { ------------------ | | 51| 15|#define K_SQR_THR (64) ------------------ | Branch (144:8): [True: 7, False: 8] ------------------ 145| 7| repeated_squaring(&g, &f, exp0_k[i - 1], &sec_buf, &ctx); 146| 8| } else { 147| 8| ctx.k_sqr(&g, &f, exp0_l[i - 1]); 148| 8| } 149| | 150| | // Step 6, [1](Algorithm 2): f = f*g 151| 15| gf2x_mod_mul_with_ctx(&f, &g, &f, &ctx); ------------------ | | 125| 15|#define gf2x_mod_mul_with_ctx RENAME_FUNC_NAME(gf2x_mod_mul_with_ctx) | | ------------------ | | | | 44| 15|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 15|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 15|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 152| | 153| 15| if(exp1_k[i] != 0) { ------------------ | Branch (153:8): [True: 4, False: 11] ------------------ 154| | // Step 8, [1](Algorithm 2), exponentiation 1: g = f^2^((r-2) % 2^i) 155| 4| if(exp1_k[i] <= K_SQR_THR) { ------------------ | | 51| 4|#define K_SQR_THR (64) ------------------ | Branch (155:10): [True: 3, False: 1] ------------------ 156| 3| repeated_squaring(&g, &f, exp1_k[i], &sec_buf, &ctx); 157| 3| } else { 158| 1| ctx.k_sqr(&g, &f, exp1_l[i]); 159| 1| } 160| | 161| | // Step 9, [1](Algorithm 2): t = t*g; 162| 4| gf2x_mod_mul_with_ctx(&t, &g, &t, &ctx); ------------------ | | 125| 4|#define gf2x_mod_mul_with_ctx RENAME_FUNC_NAME(gf2x_mod_mul_with_ctx) | | ------------------ | | | | 44| 4|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 4|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 4|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 163| 4| } 164| 15| } 165| | 166| | // Step 10, [1](Algorithm 2): c = t^2 167| 1| gf2x_mod_sqr_in_place(&t, &sec_buf, &ctx); 168| 1| c->val = t.val; 169| 1|} OQS_KEM_bike_l1_k_sqr_avx2: 191| 35|{ 192| 35| ALIGN(ALIGN_BYTES) map_word_t map[R_PADDED]; ------------------ | | 18| 35|#define ALIGN(n) __attribute__((aligned(n))) ------------------ 193| 35| ALIGN(ALIGN_BYTES) uint8_t a_bytes[R_PADDED]; ------------------ | | 18| 35|#define ALIGN(n) __attribute__((aligned(n))) ------------------ 194| 35| ALIGN(ALIGN_BYTES) uint8_t c_bytes[R_PADDED] = {0}; ------------------ | | 18| 35|#define ALIGN(n) __attribute__((aligned(n))) ------------------ 195| | 196| | // Generate the permutation map defined by pi1 and l_param. 197| 35| generate_map(map, l_param); 198| | 199| 35| bin_to_bytes(a_bytes, a); 200| | 201| | // Permute "a" using the generated permutation map. 202| 431k| for(size_t i = 0; i < R_BITS; i++) { ------------------ | | 23| 431k|# define R_BITS 12323 ------------------ | Branch (202:21): [True: 431k, False: 35] ------------------ 203| 431k| c_bytes[i] = a_bytes[map[i]]; 204| 431k| } 205| | 206| 35| bytes_to_bin(c, c_bytes); 207| | 208| 35| secure_clean(a_bytes, sizeof(a_bytes)); ------------------ | | 33| 35|#define secure_clean OQS_MEM_cleanse ------------------ 209| 35| secure_clean(c_bytes, sizeof(c_bytes)); ------------------ | | 33| 35|#define secure_clean OQS_MEM_cleanse ------------------ 210| 35|} gf2x_ksqr_avx2.c:generate_map: 51| 53|{ 52| 53| __m256i vmap[NUM_YMMS], vtmp[NUM_YMMS], vr, inc, zero; 53| | 54| | // The permutation map is generated in the following way: 55| | // 1. for i = 0 to map size: 56| | // 2. map[i] = (i * l_param) % r 57| | // However, to avoid the expensive multiplication and modulo operations 58| | // we modify the algorithm to: 59| | // 1. map[0] = l_param 60| | // 2. for i = 1 to map size: 61| | // 3. map[i] = map[i - 1] + l_param 62| | // 4. if map[i] >= r: 63| | // 5. map[i] = map[i] - r 64| | // This algorithm is parallelized with vector instructions by processing 65| | // certain number of values (NUM_OF_VALS) in parallel. Therefore, 66| | // in the beginning we need to initialize the first NUM_OF_VALS elements. 67| 1.60k| for(size_t i = 0; i < NUM_OF_VALS; i++) { ------------------ | | 48| 1.60k|#define NUM_OF_VALS (NUM_YMMS * MAP_WORDS_IN_YMM) | | ------------------ | | | | 47| 1.60k|#define NUM_YMMS (2) | | ------------------ | | #define NUM_OF_VALS (NUM_YMMS * MAP_WORDS_IN_YMM) | | ------------------ | | | | 27| 1.60k|# define MAP_WORDS_IN_YMM WORDS_IN_YMM | | | | ------------------ | | | | | | 54| 1.60k|#define WORDS_IN_YMM (BYTES_IN_YMM / sizeof(uint16_t)) | | | | | | ------------------ | | | | | | | | 48| 1.60k|#define BYTES_IN_YMM 0x20 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ | Branch (67:21): [True: 1.55k, False: 53] ------------------ 68| 1.55k| map[i] = (i * l_param) % R_BITS; ------------------ | | 23| 1.55k|# define R_BITS 12323 ------------------ 69| 1.55k| } 70| | 71| 53| vr = SET1(R_BITS); ------------------ | | 30| 53|# define SET1(x) SET1_I16(x) | | ------------------ | | | | 69| 53|# define SET1_I16(a) _mm256_set1_epi16(a) | | ------------------ ------------------ 72| 53| zero = SET_ZERO; ------------------ | | 72| 53|# define SET_ZERO _mm256_setzero_si256() ------------------ 73| | 74| | // Set the increment vector such that adding it to vmap vectors 75| | // gives the next NUM_OF_VALS elements of the map. AVX2 does not 76| | // support comparison of vectors where vector elements are considered 77| | // as unsigned integers. This is a problem when r > 2^14 because 78| | // sum of two values can be greater than 2^15 which would make the it 79| | // a negative number when considered as a signed 16-bit integer, 80| | // and therefore, the condition in step 4 of the algorithm would be 81| | // evaluated incorrectly. So, we use the following trick: 82| | // we subtract R from the increment and modify the algorithm: 83| | // 1. map[0] = l_param 84| | // 2. for i = 1 to map size: 85| | // 3. map[i] = map[i - 1] + (l_param - r) 86| | // 4. if map[i] < 0: 87| | // 5. map[i] = map[i] + r 88| 53| inc = SET1((l_param * NUM_OF_VALS) % R_BITS); ------------------ | | 30| 53|# define SET1(x) SET1_I16(x) | | ------------------ | | | | 69| 53|# define SET1_I16(a) _mm256_set1_epi16(a) | | ------------------ ------------------ 89| 53| inc = SUB(inc, vr); ------------------ | | 31| 53|# define SUB(x, y) SUB_I16(x, y) | | ------------------ | | | | 78| 53|# define SUB_I16(a, b) _mm256_sub_epi16(a, b) | | ------------------ ------------------ 90| | 91| | // Load the first NUM_OF_VALS elements in the vmap vectors 92| 159| for(size_t i = 0; i < NUM_YMMS; i++) { ------------------ | | 47| 159|#define NUM_YMMS (2) ------------------ | Branch (92:21): [True: 106, False: 53] ------------------ 93| 106| vmap[i] = LOAD(&map[i * MAP_WORDS_IN_YMM]); ------------------ | | 28| 106|# define LOAD(mem) _mm256_loadu_si256((const void *)(mem)) ------------------ 94| 106| } 95| | 96| 64.0k| for(size_t i = NUM_YMMS; i < (R_PADDED / MAP_WORDS_IN_YMM); i += NUM_YMMS) { ------------------ | | 47| 53|#define NUM_YMMS (2) ------------------ for(size_t i = NUM_YMMS; i < (R_PADDED / MAP_WORDS_IN_YMM); i += NUM_YMMS) { ------------------ | | 88| 64.0k|#define R_PADDED (R_BLOCKS * BLOCK_BITS) | | ------------------ | | | | 87| 64.0k|#define R_BLOCKS DIVIDE_AND_CEIL(R_BITS, BLOCK_BITS) | | | | ------------------ | | | | | | 37| 64.0k|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | | | ------------------ | | ------------------ | | #define R_PADDED (R_BLOCKS * BLOCK_BITS) | | ------------------ | | | | 40| 64.0k|# define BLOCK_BITS 16384 | | ------------------ ------------------ for(size_t i = NUM_YMMS; i < (R_PADDED / MAP_WORDS_IN_YMM); i += NUM_YMMS) { ------------------ | | 27| 64.0k|# define MAP_WORDS_IN_YMM WORDS_IN_YMM | | ------------------ | | | | 54| 64.0k|#define WORDS_IN_YMM (BYTES_IN_YMM / sizeof(uint16_t)) | | | | ------------------ | | | | | | 48| 64.0k|#define BYTES_IN_YMM 0x20 | | | | ------------------ | | ------------------ ------------------ for(size_t i = NUM_YMMS; i < (R_PADDED / MAP_WORDS_IN_YMM); i += NUM_YMMS) { ------------------ | | 47| 63.9k|#define NUM_YMMS (2) ------------------ | Branch (96:28): [True: 63.9k, False: 53] ------------------ 97| 191k| for(size_t j = 0; j < NUM_YMMS; j++) { ------------------ | | 47| 191k|#define NUM_YMMS (2) ------------------ | Branch (97:23): [True: 127k, False: 63.9k] ------------------ 98| 127k| vmap[j] = ADD(vmap[j], inc); ------------------ | | 32| 127k|# define ADD(x, y) ADD_I16(x, y) | | ------------------ | | | | 76| 127k|# define ADD_I16(a, b) _mm256_add_epi16(a, b) | | ------------------ ------------------ 99| 127k| vtmp[j] = CMPGT(zero, vmap[j]); ------------------ | | 33| 127k|# define CMPGT(x, y) CMPGT_I16(x, y) | | ------------------ | | | | 85| 127k|# define CMPGT_I16(a, b) _mm256_cmpgt_epi16(a, b) | | ------------------ ------------------ 100| 127k| vmap[j] = ADD(vmap[j], vtmp[j] & vr); ------------------ | | 32| 127k|# define ADD(x, y) ADD_I16(x, y) | | ------------------ | | | | 76| 127k|# define ADD_I16(a, b) _mm256_add_epi16(a, b) | | ------------------ ------------------ 101| | 102| 127k| STORE(&map[(i + j) * MAP_WORDS_IN_YMM], vmap[j]); ------------------ | | 29| 127k|# define STORE(mem, reg) _mm256_storeu_si256((void *)(mem), (reg)) ------------------ 103| 127k| } 104| 63.9k| } 105| 53|} gf2x_ksqr_avx2.c:bin_to_bytes: 124| 53|{ 125| | // The algorithm works by taking every 32 bits of the input and converting 126| | // them to 32 bytes where each byte holds one of the bits. The first step is 127| | // to broadcast a 32-bit value (call it a) to all elements of vector t. 128| | // Then t contains bytes of a in the following order: 129| | // t = [ a3 a2 a1 a0 ... a3 a2 a1 a0 ] 130| | // where a0 contains the first 8 bits of a, a1 the second 8 bits, etc. 131| | // Let the output vector be [ out31 out30 ... out0 ]. We want to store 132| | // bit 0 of a in out0 byte, bit 1 of a in out1 byte, ect. (note that 133| | // we want to store the bit in the most significant position of a byte 134| | // because this is required by MOVEMASK instruction used in bytes_to_bin.) 135| | // 136| | // Ideally, we would shuffle the bytes of t such that the byte in 137| | // i-th position contains i-th bit of val, shift t appropriately and obtain 138| | // the result. However, AVX2 doesn't support shift operation on bytes, only 139| | // shifts of individual QWORDS (64 bit) and DWORDS (32 bit) are allowed. 140| | // Consider the two least significant DWORDS of t: 141| | // t = [ ... | a3 a2 a1 a0 | a3 a2 a1 a0 ] 142| | // and shift them by 6 and 4 to the left, respectively, to obtain: 143| | // t = [ ... | t7 t6 t5 t4 | t3 t2 t1 t0 ] 144| | // where t3 = a3 << 6, t2 = a2 << 6, t1 = a1 << 6, t0 = a0 << 6, 145| | // and t7 = a3 << 4, t6 = a2 << 4, t5 = a1 << 4, t4 = a0 << 4. 146| | // Now we shuffle vector t to obtain vector p such that: 147| | // p = [ ... | t12 t12 t8 t8 | t4 t4 t0 t0 ] 148| | // Note that in every even position of the vector p we have the right byte 149| | // of the input shifted by the required shift. The values in the odd 150| | // positions contain the right bytes of the input but they need to be shifted 151| | // one more time to the left by 1. By shifting each DWORD of p by 1 we get: 152| | // q = [ ... | p7 p6 p5 p4 | p3 p2 p1 p0 ] 153| | // where p1 = t0 << 1 = a0 << 7, p3 = t4 << 1 = 5, etc. Therefore, by 154| | // blending p and q (taking even positions from p and odd positions from q) 155| | // we obtain the desired result. 156| | 157| 53| __m256i t, p, q; 158| | 159| 53| const __m256i shift_mask = SET_I32(0, 2, 4, 6, 0, 2, 4, 6); ------------------ | | 66| 53|# define SET_I32(...) _mm256_set_epi32(__VA_ARGS__) ------------------ 160| | 161| 53| const __m256i shuffle_mask = 162| 53| SET_I8(15, 15, 11, 11, 7, 7, 3, 3, 14, 14, 10, 10, 6, 6, 2, 2, 13, 13, 9, 9, ------------------ | | 65| 53|# define SET_I8(...) _mm256_set_epi8(__VA_ARGS__) ------------------ 163| 53| 5, 5, 1, 1, 12, 12, 8, 8, 4, 4, 0, 0); 164| | 165| 53| const __m256i blend_mask = SET1_I16(0x00ff); ------------------ | | 69| 53|# define SET1_I16(a) _mm256_set1_epi16(a) ------------------ 166| | 167| 53| const uint32_t *bin32 = (const uint32_t *)bin_buf; 168| | 169| 32.0k| for(size_t i = 0; i < R_QWORDS * 2; i++) { ------------------ | | 82| 32.0k|#define R_QWORDS DIVIDE_AND_CEIL(R_BITS, 8 * BYTES_IN_QWORD) | | ------------------ | | | | 37| 32.0k|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | ------------------ ------------------ | Branch (169:21): [True: 31.9k, False: 53] ------------------ 170| 31.9k| t = SET1_I32(bin32[i]); ------------------ | | 70| 31.9k|# define SET1_I32(a) _mm256_set1_epi32(a) ------------------ 171| 31.9k| t = SLLV_I32(t, shift_mask); ------------------ | | 83| 31.9k|# define SLLV_I32(a, b) _mm256_sllv_epi32(a, b) ------------------ 172| | 173| 31.9k| p = SHUF_I8(t, shuffle_mask); ------------------ | | 91| 31.9k|# define SHUF_I8(a, b) _mm256_shuffle_epi8(a, b) ------------------ 174| 31.9k| q = SLLI_I32(p, 1); ------------------ | | 82| 31.9k|# define SLLI_I32(a, imm) _mm256_slli_epi32(a, imm) ------------------ 175| | 176| 31.9k| STORE(&bytes_buf[i * 32], BLENDV_I8(p, q, blend_mask)); ------------------ | | 29| 31.9k|# define STORE(mem, reg) _mm256_storeu_si256((void *)(mem), (reg)) ------------------ 177| 31.9k| } 178| 53|} gf2x_ksqr_avx2.c:bytes_to_bin: 111| 53|{ 112| 53| uint32_t *bin32 = (uint32_t *)bin_buf; 113| | 114| 32.0k| for(size_t i = 0; i < R_QWORDS * 2; i++) { ------------------ | | 82| 32.0k|#define R_QWORDS DIVIDE_AND_CEIL(R_BITS, 8 * BYTES_IN_QWORD) | | ------------------ | | | | 37| 32.0k|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | ------------------ ------------------ | Branch (114:21): [True: 31.9k, False: 53] ------------------ 115| 31.9k| __m256i t = LOAD(&bytes_buf[i * BYTES_IN_YMM]); ------------------ | | 28| 31.9k|# define LOAD(mem) _mm256_loadu_si256((const void *)(mem)) ------------------ 116| 31.9k| bin32[i] = MOVEMASK(t); ------------------ | | 96| 31.9k|# define MOVEMASK(a) _mm256_movemask_epi8(a) ------------------ 117| 31.9k| } 118| 53|} OQS_KEM_bike_l3_k_sqr_avx2: 191| 9|{ 192| 9| ALIGN(ALIGN_BYTES) map_word_t map[R_PADDED]; ------------------ | | 18| 9|#define ALIGN(n) __attribute__((aligned(n))) ------------------ 193| 9| ALIGN(ALIGN_BYTES) uint8_t a_bytes[R_PADDED]; ------------------ | | 18| 9|#define ALIGN(n) __attribute__((aligned(n))) ------------------ 194| 9| ALIGN(ALIGN_BYTES) uint8_t c_bytes[R_PADDED] = {0}; ------------------ | | 18| 9|#define ALIGN(n) __attribute__((aligned(n))) ------------------ 195| | 196| | // Generate the permutation map defined by pi1 and l_param. 197| 9| generate_map(map, l_param); 198| | 199| 9| bin_to_bytes(a_bytes, a); 200| | 201| | // Permute "a" using the generated permutation map. 202| 221k| for(size_t i = 0; i < R_BITS; i++) { ------------------ | | 43| 221k|# define R_BITS 24659 ------------------ | Branch (202:21): [True: 221k, False: 9] ------------------ 203| 221k| c_bytes[i] = a_bytes[map[i]]; 204| 221k| } 205| | 206| 9| bytes_to_bin(c, c_bytes); 207| | 208| 9| secure_clean(a_bytes, sizeof(a_bytes)); ------------------ | | 33| 9|#define secure_clean OQS_MEM_cleanse ------------------ 209| 9| secure_clean(c_bytes, sizeof(c_bytes)); ------------------ | | 33| 9|#define secure_clean OQS_MEM_cleanse ------------------ 210| 9|} OQS_KEM_bike_l5_k_sqr_avx2: 191| 9|{ 192| 9| ALIGN(ALIGN_BYTES) map_word_t map[R_PADDED]; ------------------ | | 18| 9|#define ALIGN(n) __attribute__((aligned(n))) ------------------ 193| 9| ALIGN(ALIGN_BYTES) uint8_t a_bytes[R_PADDED]; ------------------ | | 18| 9|#define ALIGN(n) __attribute__((aligned(n))) ------------------ 194| 9| ALIGN(ALIGN_BYTES) uint8_t c_bytes[R_PADDED] = {0}; ------------------ | | 18| 9|#define ALIGN(n) __attribute__((aligned(n))) ------------------ 195| | 196| | // Generate the permutation map defined by pi1 and l_param. 197| 9| generate_map(map, l_param); 198| | 199| 9| bin_to_bytes(a_bytes, a); 200| | 201| | // Permute "a" using the generated permutation map. 202| 368k| for(size_t i = 0; i < R_BITS; i++) { ------------------ | | 59| 368k|# define R_BITS 40973 ------------------ | Branch (202:21): [True: 368k, False: 9] ------------------ 203| 368k| c_bytes[i] = a_bytes[map[i]]; 204| 368k| } 205| | 206| 9| bytes_to_bin(c, c_bytes); 207| | 208| 9| secure_clean(a_bytes, sizeof(a_bytes)); ------------------ | | 33| 9|#define secure_clean OQS_MEM_cleanse ------------------ 209| 9| secure_clean(c_bytes, sizeof(c_bytes)); ------------------ | | 33| 9|#define secure_clean OQS_MEM_cleanse ------------------ 210| 9|} OQS_KEM_bike_l1_gf2x_mod_mul_with_ctx: 90| 165|{ 91| 165| bike_static_assert((R_PADDED_BYTES % 2 == 0), karatzuba_n_is_odd); ------------------ | | 30| 165|# define bike_static_assert(COND, MSG) static_assert(COND, "MSG") ------------------ 92| | 93| 165| DEFER_CLEANUP(dbl_pad_r_t t = {0}, dbl_pad_r_cleanup); ------------------ | | 16| 165| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 94| 165| ALIGN(ALIGN_BYTES) uint64_t secure_buffer[SECURE_BUFFER_QWORDS]; ------------------ | | 18| 165|#define ALIGN(n) __attribute__((aligned(n))) ------------------ 95| | 96| 165| karatzuba((uint64_t *)&t, (const uint64_t *)a, (const uint64_t *)b, R_QWORDS, ------------------ | | 82| 165|#define R_QWORDS DIVIDE_AND_CEIL(R_BITS, 8 * BYTES_IN_QWORD) | | ------------------ | | | | 37| 165|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | ------------------ ------------------ 97| 165| R_PADDED_QWORDS, secure_buffer, ctx); ------------------ | | 90| 165|#define R_PADDED_QWORDS (R_PADDED / 64) | | ------------------ | | | | 88| 165|#define R_PADDED (R_BLOCKS * BLOCK_BITS) | | | | ------------------ | | | | | | 87| 165|#define R_BLOCKS DIVIDE_AND_CEIL(R_BITS, BLOCK_BITS) | | | | | | ------------------ | | | | | | | | 37| 165|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | | | | | ------------------ | | | | ------------------ | | | | #define R_PADDED (R_BLOCKS * BLOCK_BITS) | | | | ------------------ | | | | | | 40| 165|# define BLOCK_BITS 16384 | | | | ------------------ | | ------------------ ------------------ 98| | 99| 165| ctx->red(c, &t); ------------------ | | 75| 165|#define red RENAME_FUNC_NAME(red) | | ------------------ | | | | 44| 165|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 165|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 165|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 100| | 101| 165| secure_clean((uint8_t *)secure_buffer, sizeof(secure_buffer)); ------------------ | | 33| 165|#define secure_clean OQS_MEM_cleanse ------------------ 102| 165|} OQS_KEM_bike_l1_gf2x_mod_mul: 105| 85|{ 106| 85| bike_static_assert((R_PADDED_BYTES % 2 == 0), karatzuba_n_is_odd); ------------------ | | 30| 85|# define bike_static_assert(COND, MSG) static_assert(COND, "MSG") ------------------ 107| | 108| | // Initialize gf2x methods struct 109| 85| gf2x_ctx ctx; 110| 85| gf2x_ctx_init(&ctx); ------------------ | | 126| 85|#define gf2x_ctx_init RENAME_FUNC_NAME(gf2x_ctx_init) | | ------------------ | | | | 44| 85|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 85|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 85|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 111| | 112| 85| gf2x_mod_mul_with_ctx(c, a, b, &ctx); ------------------ | | 125| 85|#define gf2x_mod_mul_with_ctx RENAME_FUNC_NAME(gf2x_mod_mul_with_ctx) | | ------------------ | | | | 44| 85|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 85|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 85|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 113| 85|} gf2x_mul.c:karatzuba: 32| 179k|{ 33| 179k| if(qwords_len <= ctx->mul_base_qwords) { ------------------ | Branch (33:6): [True: 119k, False: 59.7k] ------------------ 34| 119k| ctx->mul_base(c, a, b); 35| 119k| return; 36| 119k| } 37| | 38| 59.7k| const size_t half_qw_len = qwords_len_pad >> 1; 39| | 40| | // Split a and b into low and high parts of size n_padded/2 41| 59.7k| const uint64_t *a_lo = a; 42| 59.7k| const uint64_t *b_lo = b; 43| 59.7k| const uint64_t *a_hi = &a[half_qw_len]; 44| 59.7k| const uint64_t *b_hi = &b[half_qw_len]; 45| | 46| | // Split c into 4 parts of size n_padded/2 (the last ptr is not needed) 47| 59.7k| uint64_t *c0 = c; 48| 59.7k| uint64_t *c1 = &c[half_qw_len]; 49| 59.7k| uint64_t *c2 = &c[half_qw_len * 2]; 50| | 51| | // Allocate 3 ptrs of size n_padded/2 on sec_buf 52| 59.7k| uint64_t *alah = sec_buf; 53| 59.7k| uint64_t *blbh = &sec_buf[half_qw_len]; 54| 59.7k| uint64_t *tmp = &sec_buf[half_qw_len * 2]; 55| | 56| | // Move sec_buf ptr to the first free location for the next recursion call 57| 59.7k| sec_buf = &sec_buf[half_qw_len * 3]; 58| | 59| | // Compute a_lo*b_lo and store the result in (c1|c0) 60| 59.7k| karatzuba(c0, a_lo, b_lo, half_qw_len, half_qw_len, sec_buf, ctx); 61| | 62| | // If the real number of digits n is less or equal to n_padded/2 then: 63| | // a_hi = 0 and b_hi = 0 64| | // and 65| | // (a_hi|a_lo)*(b_hi|b_lo) = a_lo*b_lo 66| | // so we can skip the remaining two multiplications 67| 59.7k| if(qwords_len > half_qw_len) { ------------------ | Branch (67:6): [True: 59.7k, False: 36] ------------------ 68| | // Compute a_hi*b_hi and store the result in (c3|c2) 69| 59.7k| karatzuba(c2, a_hi, b_hi, qwords_len - half_qw_len, half_qw_len, sec_buf, 70| 59.7k| ctx); 71| | 72| | // Compute alah = (a_lo + a_hi) and blbh = (b_lo + b_hi) 73| 59.7k| ctx->karatzuba_add1(alah, blbh, a, b, half_qw_len); ------------------ | | 71| 59.7k|#define karatzuba_add1 RENAME_FUNC_NAME(karatzuba_add1) | | ------------------ | | | | 44| 59.7k|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 59.7k|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 59.7k|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 74| | 75| | // Compute (c1 + c2) and store the result in tmp 76| 59.7k| ctx->karatzuba_add2(tmp, c1, c2, half_qw_len); ------------------ | | 72| 59.7k|#define karatzuba_add2 RENAME_FUNC_NAME(karatzuba_add2) | | ------------------ | | | | 44| 59.7k|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 59.7k|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 59.7k|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 77| | 78| | // Compute alah*blbh and store the result in (c2|c1) 79| 59.7k| karatzuba(c1, alah, blbh, half_qw_len, half_qw_len, sec_buf, ctx); 80| | 81| | // Add (tmp|tmp) and (c3|c0) to (c2|c1) 82| 59.7k| ctx->karatzuba_add3(c0, tmp, half_qw_len); 83| 59.7k| } 84| 59.7k|} OQS_KEM_bike_l3_gf2x_mod_mul_with_ctx: 90| 35|{ 91| 35| bike_static_assert((R_PADDED_BYTES % 2 == 0), karatzuba_n_is_odd); ------------------ | | 30| 35|# define bike_static_assert(COND, MSG) static_assert(COND, "MSG") ------------------ 92| | 93| 35| DEFER_CLEANUP(dbl_pad_r_t t = {0}, dbl_pad_r_cleanup); ------------------ | | 16| 35| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 94| 35| ALIGN(ALIGN_BYTES) uint64_t secure_buffer[SECURE_BUFFER_QWORDS]; ------------------ | | 18| 35|#define ALIGN(n) __attribute__((aligned(n))) ------------------ 95| | 96| 35| karatzuba((uint64_t *)&t, (const uint64_t *)a, (const uint64_t *)b, R_QWORDS, ------------------ | | 82| 35|#define R_QWORDS DIVIDE_AND_CEIL(R_BITS, 8 * BYTES_IN_QWORD) | | ------------------ | | | | 37| 35|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | ------------------ ------------------ 97| 35| R_PADDED_QWORDS, secure_buffer, ctx); ------------------ | | 90| 35|#define R_PADDED_QWORDS (R_PADDED / 64) | | ------------------ | | | | 88| 35|#define R_PADDED (R_BLOCKS * BLOCK_BITS) | | | | ------------------ | | | | | | 87| 35|#define R_BLOCKS DIVIDE_AND_CEIL(R_BITS, BLOCK_BITS) | | | | | | ------------------ | | | | | | | | 37| 35|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | | | | | ------------------ | | | | ------------------ | | | | #define R_PADDED (R_BLOCKS * BLOCK_BITS) | | | | ------------------ | | | | | | 56| 35|# define BLOCK_BITS 32768 | | | | ------------------ | | ------------------ ------------------ 98| | 99| 35| ctx->red(c, &t); ------------------ | | 75| 35|#define red RENAME_FUNC_NAME(red) | | ------------------ | | | | 44| 35|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 35|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 35|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 100| | 101| 35| secure_clean((uint8_t *)secure_buffer, sizeof(secure_buffer)); ------------------ | | 33| 35|#define secure_clean OQS_MEM_cleanse ------------------ 102| 35|} OQS_KEM_bike_l3_gf2x_mod_mul: 105| 17|{ 106| 17| bike_static_assert((R_PADDED_BYTES % 2 == 0), karatzuba_n_is_odd); ------------------ | | 30| 17|# define bike_static_assert(COND, MSG) static_assert(COND, "MSG") ------------------ 107| | 108| | // Initialize gf2x methods struct 109| 17| gf2x_ctx ctx; 110| 17| gf2x_ctx_init(&ctx); ------------------ | | 126| 17|#define gf2x_ctx_init RENAME_FUNC_NAME(gf2x_ctx_init) | | ------------------ | | | | 44| 17|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 17|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 17|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 111| | 112| 17| gf2x_mod_mul_with_ctx(c, a, b, &ctx); ------------------ | | 125| 17|#define gf2x_mod_mul_with_ctx RENAME_FUNC_NAME(gf2x_mod_mul_with_ctx) | | ------------------ | | | | 44| 17|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 17|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 17|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 113| 17|} OQS_KEM_bike_l5_gf2x_mod_mul_with_ctx: 90| 36|{ 91| 36| bike_static_assert((R_PADDED_BYTES % 2 == 0), karatzuba_n_is_odd); ------------------ | | 30| 36|# define bike_static_assert(COND, MSG) static_assert(COND, "MSG") ------------------ 92| | 93| 36| DEFER_CLEANUP(dbl_pad_r_t t = {0}, dbl_pad_r_cleanup); ------------------ | | 16| 36| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 94| 36| ALIGN(ALIGN_BYTES) uint64_t secure_buffer[SECURE_BUFFER_QWORDS]; ------------------ | | 18| 36|#define ALIGN(n) __attribute__((aligned(n))) ------------------ 95| | 96| 36| karatzuba((uint64_t *)&t, (const uint64_t *)a, (const uint64_t *)b, R_QWORDS, ------------------ | | 82| 36|#define R_QWORDS DIVIDE_AND_CEIL(R_BITS, 8 * BYTES_IN_QWORD) | | ------------------ | | | | 37| 36|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | ------------------ ------------------ 97| 36| R_PADDED_QWORDS, secure_buffer, ctx); ------------------ | | 90| 36|#define R_PADDED_QWORDS (R_PADDED / 64) | | ------------------ | | | | 88| 36|#define R_PADDED (R_BLOCKS * BLOCK_BITS) | | | | ------------------ | | | | | | 87| 36|#define R_BLOCKS DIVIDE_AND_CEIL(R_BITS, BLOCK_BITS) | | | | | | ------------------ | | | | | | | | 37| 36|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | | | | | ------------------ | | | | ------------------ | | | | #define R_PADDED (R_BLOCKS * BLOCK_BITS) | | | | ------------------ | | | | | | 71| 36|# define BLOCK_BITS 65536 | | | | ------------------ | | ------------------ ------------------ 98| | 99| 36| ctx->red(c, &t); ------------------ | | 75| 36|#define red RENAME_FUNC_NAME(red) | | ------------------ | | | | 44| 36|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 36|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 36|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 100| | 101| 36| secure_clean((uint8_t *)secure_buffer, sizeof(secure_buffer)); ------------------ | | 33| 36|#define secure_clean OQS_MEM_cleanse ------------------ 102| 36|} OQS_KEM_bike_l5_gf2x_mod_mul: 105| 17|{ 106| 17| bike_static_assert((R_PADDED_BYTES % 2 == 0), karatzuba_n_is_odd); ------------------ | | 30| 17|# define bike_static_assert(COND, MSG) static_assert(COND, "MSG") ------------------ 107| | 108| | // Initialize gf2x methods struct 109| 17| gf2x_ctx ctx; 110| 17| gf2x_ctx_init(&ctx); ------------------ | | 126| 17|#define gf2x_ctx_init RENAME_FUNC_NAME(gf2x_ctx_init) | | ------------------ | | | | 44| 17|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 17|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 17|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 111| | 112| 17| gf2x_mod_mul_with_ctx(c, a, b, &ctx); ------------------ | | 125| 17|#define gf2x_mod_mul_with_ctx RENAME_FUNC_NAME(gf2x_mod_mul_with_ctx) | | ------------------ | | | | 44| 17|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 17|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 17|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 113| 17|} OQS_KEM_bike_l1_karatzuba_add1_avx2: 21| 17.8k|{ 22| 17.8k| assert(qwords_len % REG_QWORDS == 0); 23| | 24| 17.8k| REG_T va0, va1, vb0, vb1; ------------------ | | 26| 17.8k|# define REG_T __m256i ------------------ 25| | 26| 81.1k| for(size_t i = 0; i < qwords_len; i += REG_QWORDS) { ------------------ | | 58| 63.3k|#define REG_QWORDS (sizeof(REG_T) / sizeof(uint64_t)) // NOLINT ------------------ | Branch (26:21): [True: 63.3k, False: 17.8k] ------------------ 27| 63.3k| va0 = LOAD(&a[i]); ------------------ | | 28| 63.3k|# define LOAD(mem) _mm256_loadu_si256((const void *)(mem)) ------------------ 28| 63.3k| va1 = LOAD(&a[i + qwords_len]); ------------------ | | 28| 63.3k|# define LOAD(mem) _mm256_loadu_si256((const void *)(mem)) ------------------ 29| 63.3k| vb0 = LOAD(&b[i]); ------------------ | | 28| 63.3k|# define LOAD(mem) _mm256_loadu_si256((const void *)(mem)) ------------------ 30| 63.3k| vb1 = LOAD(&b[i + qwords_len]); ------------------ | | 28| 63.3k|# define LOAD(mem) _mm256_loadu_si256((const void *)(mem)) ------------------ 31| | 32| 63.3k| STORE(&alah[i], va0 ^ va1); ------------------ | | 29| 63.3k|# define STORE(mem, reg) _mm256_storeu_si256((void *)(mem), (reg)) ------------------ 33| 63.3k| STORE(&blbh[i], vb0 ^ vb1); ------------------ | | 29| 63.3k|# define STORE(mem, reg) _mm256_storeu_si256((void *)(mem), (reg)) ------------------ 34| 63.3k| } 35| 17.8k|} OQS_KEM_bike_l1_karatzuba_add2_avx2: 41| 17.8k|{ 42| 17.8k| assert(qwords_len % REG_QWORDS == 0); 43| | 44| 17.8k| REG_T vx, vy; ------------------ | | 26| 17.8k|# define REG_T __m256i ------------------ 45| | 46| 81.1k| for(size_t i = 0; i < qwords_len; i += REG_QWORDS) { ------------------ | | 58| 63.3k|#define REG_QWORDS (sizeof(REG_T) / sizeof(uint64_t)) // NOLINT ------------------ | Branch (46:21): [True: 63.3k, False: 17.8k] ------------------ 47| 63.3k| vx = LOAD(&x[i]); ------------------ | | 28| 63.3k|# define LOAD(mem) _mm256_loadu_si256((const void *)(mem)) ------------------ 48| 63.3k| vy = LOAD(&y[i]); ------------------ | | 28| 63.3k|# define LOAD(mem) _mm256_loadu_si256((const void *)(mem)) ------------------ 49| | 50| 63.3k| STORE(&z[i], vx ^ vy); ------------------ | | 29| 63.3k|# define STORE(mem, reg) _mm256_storeu_si256((void *)(mem), (reg)) ------------------ 51| 63.3k| } 52| 17.8k|} OQS_KEM_bike_l1_karatzuba_add3_avx2: 57| 17.8k|{ 58| 17.8k| assert(qwords_len % REG_QWORDS == 0); 59| | 60| 17.8k| REG_T vr0, vr1, vr2, vr3, vt; ------------------ | | 26| 17.8k|# define REG_T __m256i ------------------ 61| | 62| 17.8k| uint64_t *c0 = c; 63| 17.8k| uint64_t *c1 = &c[qwords_len]; 64| 17.8k| uint64_t *c2 = &c[2 * qwords_len]; 65| 17.8k| uint64_t *c3 = &c[3 * qwords_len]; 66| | 67| 81.1k| for(size_t i = 0; i < qwords_len; i += REG_QWORDS) { ------------------ | | 58| 63.3k|#define REG_QWORDS (sizeof(REG_T) / sizeof(uint64_t)) // NOLINT ------------------ | Branch (67:21): [True: 63.3k, False: 17.8k] ------------------ 68| 63.3k| vr0 = LOAD(&c0[i]); ------------------ | | 28| 63.3k|# define LOAD(mem) _mm256_loadu_si256((const void *)(mem)) ------------------ 69| 63.3k| vr1 = LOAD(&c1[i]); ------------------ | | 28| 63.3k|# define LOAD(mem) _mm256_loadu_si256((const void *)(mem)) ------------------ 70| 63.3k| vr2 = LOAD(&c2[i]); ------------------ | | 28| 63.3k|# define LOAD(mem) _mm256_loadu_si256((const void *)(mem)) ------------------ 71| 63.3k| vr3 = LOAD(&c3[i]); ------------------ | | 28| 63.3k|# define LOAD(mem) _mm256_loadu_si256((const void *)(mem)) ------------------ 72| 63.3k| vt = LOAD(&mid[i]); ------------------ | | 28| 63.3k|# define LOAD(mem) _mm256_loadu_si256((const void *)(mem)) ------------------ 73| | 74| 63.3k| STORE(&c1[i], vt ^ vr0 ^ vr1); ------------------ | | 29| 63.3k|# define STORE(mem, reg) _mm256_storeu_si256((void *)(mem), (reg)) ------------------ 75| 63.3k| STORE(&c2[i], vt ^ vr2 ^ vr3); ------------------ | | 29| 63.3k|# define STORE(mem, reg) _mm256_storeu_si256((void *)(mem), (reg)) ------------------ 76| 63.3k| } 77| 17.8k|} OQS_KEM_bike_l1_gf2x_red_avx2: 81| 975|{ 82| 975| const uint64_t *a64 = (const uint64_t *)a; 83| 975| uint64_t * c64 = (uint64_t *)c; 84| | 85| 48.7k| for(size_t i = 0; i < R_QWORDS; i += REG_QWORDS) { ------------------ | | 82| 48.7k|#define R_QWORDS DIVIDE_AND_CEIL(R_BITS, 8 * BYTES_IN_QWORD) | | ------------------ | | | | 37| 48.7k|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | ------------------ ------------------ for(size_t i = 0; i < R_QWORDS; i += REG_QWORDS) { ------------------ | | 58| 47.7k|#define REG_QWORDS (sizeof(REG_T) / sizeof(uint64_t)) // NOLINT ------------------ | Branch (85:21): [True: 47.7k, False: 975] ------------------ 86| 47.7k| REG_T vt0 = LOAD(&a64[i]); ------------------ | | 26| 47.7k|# define REG_T __m256i ------------------ REG_T vt0 = LOAD(&a64[i]); ------------------ | | 28| 47.7k|# define LOAD(mem) _mm256_loadu_si256((const void *)(mem)) ------------------ 87| 47.7k| REG_T vt1 = LOAD(&a64[i + R_QWORDS]); ------------------ | | 26| 47.7k|# define REG_T __m256i ------------------ REG_T vt1 = LOAD(&a64[i + R_QWORDS]); ------------------ | | 28| 47.7k|# define LOAD(mem) _mm256_loadu_si256((const void *)(mem)) ------------------ 88| 47.7k| REG_T vt2 = LOAD(&a64[i + R_QWORDS - 1]); ------------------ | | 26| 47.7k|# define REG_T __m256i ------------------ REG_T vt2 = LOAD(&a64[i + R_QWORDS - 1]); ------------------ | | 28| 47.7k|# define LOAD(mem) _mm256_loadu_si256((const void *)(mem)) ------------------ 89| | 90| 47.7k| vt1 = SLLI_I64(vt1, LAST_R_QWORD_TRAIL); ------------------ | | 31| 47.7k|# define SLLI_I64(a, imm) _mm256_slli_epi64(a, imm) ------------------ 91| 47.7k| vt2 = SRLI_I64(vt2, LAST_R_QWORD_LEAD); ------------------ | | 32| 47.7k|# define SRLI_I64(a, imm) _mm256_srli_epi64(a, imm) ------------------ 92| | 93| 47.7k| vt0 ^= (vt1 | vt2); 94| | 95| 47.7k| STORE(&c64[i], vt0); ------------------ | | 29| 47.7k|# define STORE(mem, reg) _mm256_storeu_si256((void *)(mem), (reg)) ------------------ 96| 47.7k| } 97| | 98| 975| c64[R_QWORDS - 1] &= LAST_R_QWORD_MASK; ------------------ | | 82| 975|#define R_QWORDS DIVIDE_AND_CEIL(R_BITS, 8 * BYTES_IN_QWORD) | | ------------------ | | | | 37| 975|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | ------------------ ------------------ c64[R_QWORDS - 1] &= LAST_R_QWORD_MASK; ------------------ | | 94| 975|#define LAST_R_QWORD_MASK MASK(LAST_R_QWORD_LEAD) | | ------------------ | | | | 43| 975|#define MASK(len) (BIT(len) - 1) | | | | ------------------ | | | | | | 42| 975|#define BIT(len) (1ULL << (len)) | | | | ------------------ | | ------------------ ------------------ 99| | 100| | // Clean the secrets from the upper part of c 101| 975| secure_clean((uint8_t *)&c64[R_QWORDS], ------------------ | | 33| 975|#define secure_clean OQS_MEM_cleanse ------------------ secure_clean((uint8_t *)&c64[R_QWORDS], ------------------ | | 82| 975|#define R_QWORDS DIVIDE_AND_CEIL(R_BITS, 8 * BYTES_IN_QWORD) | | ------------------ | | | | 37| 975|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | ------------------ ------------------ 102| 975| (R_PADDED_QWORDS - R_QWORDS) * sizeof(uint64_t)); ------------------ | | 90| 975|#define R_PADDED_QWORDS (R_PADDED / 64) | | ------------------ | | | | 88| 975|#define R_PADDED (R_BLOCKS * BLOCK_BITS) | | | | ------------------ | | | | | | 87| 975|#define R_BLOCKS DIVIDE_AND_CEIL(R_BITS, BLOCK_BITS) | | | | | | ------------------ | | | | | | | | 37| 975|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | | | | | ------------------ | | | | ------------------ | | | | #define R_PADDED (R_BLOCKS * BLOCK_BITS) | | | | ------------------ | | | | | | 40| 975|# define BLOCK_BITS 16384 | | | | ------------------ | | ------------------ ------------------ (R_PADDED_QWORDS - R_QWORDS) * sizeof(uint64_t)); ------------------ | | 82| 975|#define R_QWORDS DIVIDE_AND_CEIL(R_BITS, 8 * BYTES_IN_QWORD) | | ------------------ | | | | 37| 975|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | ------------------ ------------------ 103| 975|} OQS_KEM_bike_l3_karatzuba_add1_avx2: 21| 11.3k|{ 22| 11.3k| assert(qwords_len % REG_QWORDS == 0); 23| | 24| 11.3k| REG_T va0, va1, vb0, vb1; ------------------ | | 26| 11.3k|# define REG_T __m256i ------------------ 25| | 26| 53.3k| for(size_t i = 0; i < qwords_len; i += REG_QWORDS) { ------------------ | | 58| 42.0k|#define REG_QWORDS (sizeof(REG_T) / sizeof(uint64_t)) // NOLINT ------------------ | Branch (26:21): [True: 42.0k, False: 11.3k] ------------------ 27| 42.0k| va0 = LOAD(&a[i]); ------------------ | | 28| 42.0k|# define LOAD(mem) _mm256_loadu_si256((const void *)(mem)) ------------------ 28| 42.0k| va1 = LOAD(&a[i + qwords_len]); ------------------ | | 28| 42.0k|# define LOAD(mem) _mm256_loadu_si256((const void *)(mem)) ------------------ 29| 42.0k| vb0 = LOAD(&b[i]); ------------------ | | 28| 42.0k|# define LOAD(mem) _mm256_loadu_si256((const void *)(mem)) ------------------ 30| 42.0k| vb1 = LOAD(&b[i + qwords_len]); ------------------ | | 28| 42.0k|# define LOAD(mem) _mm256_loadu_si256((const void *)(mem)) ------------------ 31| | 32| 42.0k| STORE(&alah[i], va0 ^ va1); ------------------ | | 29| 42.0k|# define STORE(mem, reg) _mm256_storeu_si256((void *)(mem), (reg)) ------------------ 33| 42.0k| STORE(&blbh[i], vb0 ^ vb1); ------------------ | | 29| 42.0k|# define STORE(mem, reg) _mm256_storeu_si256((void *)(mem), (reg)) ------------------ 34| 42.0k| } 35| 11.3k|} OQS_KEM_bike_l3_karatzuba_add2_avx2: 41| 11.3k|{ 42| 11.3k| assert(qwords_len % REG_QWORDS == 0); 43| | 44| 11.3k| REG_T vx, vy; ------------------ | | 26| 11.3k|# define REG_T __m256i ------------------ 45| | 46| 53.3k| for(size_t i = 0; i < qwords_len; i += REG_QWORDS) { ------------------ | | 58| 42.0k|#define REG_QWORDS (sizeof(REG_T) / sizeof(uint64_t)) // NOLINT ------------------ | Branch (46:21): [True: 42.0k, False: 11.3k] ------------------ 47| 42.0k| vx = LOAD(&x[i]); ------------------ | | 28| 42.0k|# define LOAD(mem) _mm256_loadu_si256((const void *)(mem)) ------------------ 48| 42.0k| vy = LOAD(&y[i]); ------------------ | | 28| 42.0k|# define LOAD(mem) _mm256_loadu_si256((const void *)(mem)) ------------------ 49| | 50| 42.0k| STORE(&z[i], vx ^ vy); ------------------ | | 29| 42.0k|# define STORE(mem, reg) _mm256_storeu_si256((void *)(mem), (reg)) ------------------ 51| 42.0k| } 52| 11.3k|} OQS_KEM_bike_l3_karatzuba_add3_avx2: 57| 11.3k|{ 58| 11.3k| assert(qwords_len % REG_QWORDS == 0); 59| | 60| 11.3k| REG_T vr0, vr1, vr2, vr3, vt; ------------------ | | 26| 11.3k|# define REG_T __m256i ------------------ 61| | 62| 11.3k| uint64_t *c0 = c; 63| 11.3k| uint64_t *c1 = &c[qwords_len]; 64| 11.3k| uint64_t *c2 = &c[2 * qwords_len]; 65| 11.3k| uint64_t *c3 = &c[3 * qwords_len]; 66| | 67| 53.3k| for(size_t i = 0; i < qwords_len; i += REG_QWORDS) { ------------------ | | 58| 42.0k|#define REG_QWORDS (sizeof(REG_T) / sizeof(uint64_t)) // NOLINT ------------------ | Branch (67:21): [True: 42.0k, False: 11.3k] ------------------ 68| 42.0k| vr0 = LOAD(&c0[i]); ------------------ | | 28| 42.0k|# define LOAD(mem) _mm256_loadu_si256((const void *)(mem)) ------------------ 69| 42.0k| vr1 = LOAD(&c1[i]); ------------------ | | 28| 42.0k|# define LOAD(mem) _mm256_loadu_si256((const void *)(mem)) ------------------ 70| 42.0k| vr2 = LOAD(&c2[i]); ------------------ | | 28| 42.0k|# define LOAD(mem) _mm256_loadu_si256((const void *)(mem)) ------------------ 71| 42.0k| vr3 = LOAD(&c3[i]); ------------------ | | 28| 42.0k|# define LOAD(mem) _mm256_loadu_si256((const void *)(mem)) ------------------ 72| 42.0k| vt = LOAD(&mid[i]); ------------------ | | 28| 42.0k|# define LOAD(mem) _mm256_loadu_si256((const void *)(mem)) ------------------ 73| | 74| 42.0k| STORE(&c1[i], vt ^ vr0 ^ vr1); ------------------ | | 29| 42.0k|# define STORE(mem, reg) _mm256_storeu_si256((void *)(mem), (reg)) ------------------ 75| 42.0k| STORE(&c2[i], vt ^ vr2 ^ vr3); ------------------ | | 29| 42.0k|# define STORE(mem, reg) _mm256_storeu_si256((void *)(mem), (reg)) ------------------ 76| 42.0k| } 77| 11.3k|} OQS_KEM_bike_l3_gf2x_red_avx2: 81| 181|{ 82| 181| const uint64_t *a64 = (const uint64_t *)a; 83| 181| uint64_t * c64 = (uint64_t *)c; 84| | 85| 17.7k| for(size_t i = 0; i < R_QWORDS; i += REG_QWORDS) { ------------------ | | 82| 17.7k|#define R_QWORDS DIVIDE_AND_CEIL(R_BITS, 8 * BYTES_IN_QWORD) | | ------------------ | | | | 37| 17.7k|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | ------------------ ------------------ for(size_t i = 0; i < R_QWORDS; i += REG_QWORDS) { ------------------ | | 58| 17.5k|#define REG_QWORDS (sizeof(REG_T) / sizeof(uint64_t)) // NOLINT ------------------ | Branch (85:21): [True: 17.5k, False: 181] ------------------ 86| 17.5k| REG_T vt0 = LOAD(&a64[i]); ------------------ | | 26| 17.5k|# define REG_T __m256i ------------------ REG_T vt0 = LOAD(&a64[i]); ------------------ | | 28| 17.5k|# define LOAD(mem) _mm256_loadu_si256((const void *)(mem)) ------------------ 87| 17.5k| REG_T vt1 = LOAD(&a64[i + R_QWORDS]); ------------------ | | 26| 17.5k|# define REG_T __m256i ------------------ REG_T vt1 = LOAD(&a64[i + R_QWORDS]); ------------------ | | 28| 17.5k|# define LOAD(mem) _mm256_loadu_si256((const void *)(mem)) ------------------ 88| 17.5k| REG_T vt2 = LOAD(&a64[i + R_QWORDS - 1]); ------------------ | | 26| 17.5k|# define REG_T __m256i ------------------ REG_T vt2 = LOAD(&a64[i + R_QWORDS - 1]); ------------------ | | 28| 17.5k|# define LOAD(mem) _mm256_loadu_si256((const void *)(mem)) ------------------ 89| | 90| 17.5k| vt1 = SLLI_I64(vt1, LAST_R_QWORD_TRAIL); ------------------ | | 31| 17.5k|# define SLLI_I64(a, imm) _mm256_slli_epi64(a, imm) ------------------ 91| 17.5k| vt2 = SRLI_I64(vt2, LAST_R_QWORD_LEAD); ------------------ | | 32| 17.5k|# define SRLI_I64(a, imm) _mm256_srli_epi64(a, imm) ------------------ 92| | 93| 17.5k| vt0 ^= (vt1 | vt2); 94| | 95| 17.5k| STORE(&c64[i], vt0); ------------------ | | 29| 17.5k|# define STORE(mem, reg) _mm256_storeu_si256((void *)(mem), (reg)) ------------------ 96| 17.5k| } 97| | 98| 181| c64[R_QWORDS - 1] &= LAST_R_QWORD_MASK; ------------------ | | 82| 181|#define R_QWORDS DIVIDE_AND_CEIL(R_BITS, 8 * BYTES_IN_QWORD) | | ------------------ | | | | 37| 181|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | ------------------ ------------------ c64[R_QWORDS - 1] &= LAST_R_QWORD_MASK; ------------------ | | 94| 181|#define LAST_R_QWORD_MASK MASK(LAST_R_QWORD_LEAD) | | ------------------ | | | | 43| 181|#define MASK(len) (BIT(len) - 1) | | | | ------------------ | | | | | | 42| 181|#define BIT(len) (1ULL << (len)) | | | | ------------------ | | ------------------ ------------------ 99| | 100| | // Clean the secrets from the upper part of c 101| 181| secure_clean((uint8_t *)&c64[R_QWORDS], ------------------ | | 33| 181|#define secure_clean OQS_MEM_cleanse ------------------ secure_clean((uint8_t *)&c64[R_QWORDS], ------------------ | | 82| 181|#define R_QWORDS DIVIDE_AND_CEIL(R_BITS, 8 * BYTES_IN_QWORD) | | ------------------ | | | | 37| 181|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | ------------------ ------------------ 102| 181| (R_PADDED_QWORDS - R_QWORDS) * sizeof(uint64_t)); ------------------ | | 90| 181|#define R_PADDED_QWORDS (R_PADDED / 64) | | ------------------ | | | | 88| 181|#define R_PADDED (R_BLOCKS * BLOCK_BITS) | | | | ------------------ | | | | | | 87| 181|#define R_BLOCKS DIVIDE_AND_CEIL(R_BITS, BLOCK_BITS) | | | | | | ------------------ | | | | | | | | 37| 181|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | | | | | ------------------ | | | | ------------------ | | | | #define R_PADDED (R_BLOCKS * BLOCK_BITS) | | | | ------------------ | | | | | | 56| 181|# define BLOCK_BITS 32768 | | | | ------------------ | | ------------------ ------------------ (R_PADDED_QWORDS - R_QWORDS) * sizeof(uint64_t)); ------------------ | | 82| 181|#define R_QWORDS DIVIDE_AND_CEIL(R_BITS, 8 * BYTES_IN_QWORD) | | ------------------ | | | | 37| 181|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | ------------------ ------------------ 103| 181|} OQS_KEM_bike_l5_karatzuba_add1_avx2: 21| 30.6k|{ 22| 30.6k| assert(qwords_len % REG_QWORDS == 0); 23| | 24| 30.6k| REG_T va0, va1, vb0, vb1; ------------------ | | 26| 30.6k|# define REG_T __m256i ------------------ 25| | 26| 146k| for(size_t i = 0; i < qwords_len; i += REG_QWORDS) { ------------------ | | 58| 115k|#define REG_QWORDS (sizeof(REG_T) / sizeof(uint64_t)) // NOLINT ------------------ | Branch (26:21): [True: 115k, False: 30.6k] ------------------ 27| 115k| va0 = LOAD(&a[i]); ------------------ | | 28| 115k|# define LOAD(mem) _mm256_loadu_si256((const void *)(mem)) ------------------ 28| 115k| va1 = LOAD(&a[i + qwords_len]); ------------------ | | 28| 115k|# define LOAD(mem) _mm256_loadu_si256((const void *)(mem)) ------------------ 29| 115k| vb0 = LOAD(&b[i]); ------------------ | | 28| 115k|# define LOAD(mem) _mm256_loadu_si256((const void *)(mem)) ------------------ 30| 115k| vb1 = LOAD(&b[i + qwords_len]); ------------------ | | 28| 115k|# define LOAD(mem) _mm256_loadu_si256((const void *)(mem)) ------------------ 31| | 32| 115k| STORE(&alah[i], va0 ^ va1); ------------------ | | 29| 115k|# define STORE(mem, reg) _mm256_storeu_si256((void *)(mem), (reg)) ------------------ 33| 115k| STORE(&blbh[i], vb0 ^ vb1); ------------------ | | 29| 115k|# define STORE(mem, reg) _mm256_storeu_si256((void *)(mem), (reg)) ------------------ 34| 115k| } 35| 30.6k|} OQS_KEM_bike_l5_karatzuba_add2_avx2: 41| 30.6k|{ 42| 30.6k| assert(qwords_len % REG_QWORDS == 0); 43| | 44| 30.6k| REG_T vx, vy; ------------------ | | 26| 30.6k|# define REG_T __m256i ------------------ 45| | 46| 146k| for(size_t i = 0; i < qwords_len; i += REG_QWORDS) { ------------------ | | 58| 115k|#define REG_QWORDS (sizeof(REG_T) / sizeof(uint64_t)) // NOLINT ------------------ | Branch (46:21): [True: 115k, False: 30.6k] ------------------ 47| 115k| vx = LOAD(&x[i]); ------------------ | | 28| 115k|# define LOAD(mem) _mm256_loadu_si256((const void *)(mem)) ------------------ 48| 115k| vy = LOAD(&y[i]); ------------------ | | 28| 115k|# define LOAD(mem) _mm256_loadu_si256((const void *)(mem)) ------------------ 49| | 50| 115k| STORE(&z[i], vx ^ vy); ------------------ | | 29| 115k|# define STORE(mem, reg) _mm256_storeu_si256((void *)(mem), (reg)) ------------------ 51| 115k| } 52| 30.6k|} OQS_KEM_bike_l5_karatzuba_add3_avx2: 57| 30.6k|{ 58| 30.6k| assert(qwords_len % REG_QWORDS == 0); 59| | 60| 30.6k| REG_T vr0, vr1, vr2, vr3, vt; ------------------ | | 26| 30.6k|# define REG_T __m256i ------------------ 61| | 62| 30.6k| uint64_t *c0 = c; 63| 30.6k| uint64_t *c1 = &c[qwords_len]; 64| 30.6k| uint64_t *c2 = &c[2 * qwords_len]; 65| 30.6k| uint64_t *c3 = &c[3 * qwords_len]; 66| | 67| 146k| for(size_t i = 0; i < qwords_len; i += REG_QWORDS) { ------------------ | | 58| 115k|#define REG_QWORDS (sizeof(REG_T) / sizeof(uint64_t)) // NOLINT ------------------ | Branch (67:21): [True: 115k, False: 30.6k] ------------------ 68| 115k| vr0 = LOAD(&c0[i]); ------------------ | | 28| 115k|# define LOAD(mem) _mm256_loadu_si256((const void *)(mem)) ------------------ 69| 115k| vr1 = LOAD(&c1[i]); ------------------ | | 28| 115k|# define LOAD(mem) _mm256_loadu_si256((const void *)(mem)) ------------------ 70| 115k| vr2 = LOAD(&c2[i]); ------------------ | | 28| 115k|# define LOAD(mem) _mm256_loadu_si256((const void *)(mem)) ------------------ 71| 115k| vr3 = LOAD(&c3[i]); ------------------ | | 28| 115k|# define LOAD(mem) _mm256_loadu_si256((const void *)(mem)) ------------------ 72| 115k| vt = LOAD(&mid[i]); ------------------ | | 28| 115k|# define LOAD(mem) _mm256_loadu_si256((const void *)(mem)) ------------------ 73| | 74| 115k| STORE(&c1[i], vt ^ vr0 ^ vr1); ------------------ | | 29| 115k|# define STORE(mem, reg) _mm256_storeu_si256((void *)(mem), (reg)) ------------------ 75| 115k| STORE(&c2[i], vt ^ vr2 ^ vr3); ------------------ | | 29| 115k|# define STORE(mem, reg) _mm256_storeu_si256((void *)(mem), (reg)) ------------------ 76| 115k| } 77| 30.6k|} OQS_KEM_bike_l5_gf2x_red_avx2: 81| 179|{ 82| 179| const uint64_t *a64 = (const uint64_t *)a; 83| 179| uint64_t * c64 = (uint64_t *)c; 84| | 85| 28.9k| for(size_t i = 0; i < R_QWORDS; i += REG_QWORDS) { ------------------ | | 82| 28.9k|#define R_QWORDS DIVIDE_AND_CEIL(R_BITS, 8 * BYTES_IN_QWORD) | | ------------------ | | | | 37| 28.9k|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | ------------------ ------------------ for(size_t i = 0; i < R_QWORDS; i += REG_QWORDS) { ------------------ | | 58| 28.8k|#define REG_QWORDS (sizeof(REG_T) / sizeof(uint64_t)) // NOLINT ------------------ | Branch (85:21): [True: 28.8k, False: 179] ------------------ 86| 28.8k| REG_T vt0 = LOAD(&a64[i]); ------------------ | | 26| 28.8k|# define REG_T __m256i ------------------ REG_T vt0 = LOAD(&a64[i]); ------------------ | | 28| 28.8k|# define LOAD(mem) _mm256_loadu_si256((const void *)(mem)) ------------------ 87| 28.8k| REG_T vt1 = LOAD(&a64[i + R_QWORDS]); ------------------ | | 26| 28.8k|# define REG_T __m256i ------------------ REG_T vt1 = LOAD(&a64[i + R_QWORDS]); ------------------ | | 28| 28.8k|# define LOAD(mem) _mm256_loadu_si256((const void *)(mem)) ------------------ 88| 28.8k| REG_T vt2 = LOAD(&a64[i + R_QWORDS - 1]); ------------------ | | 26| 28.8k|# define REG_T __m256i ------------------ REG_T vt2 = LOAD(&a64[i + R_QWORDS - 1]); ------------------ | | 28| 28.8k|# define LOAD(mem) _mm256_loadu_si256((const void *)(mem)) ------------------ 89| | 90| 28.8k| vt1 = SLLI_I64(vt1, LAST_R_QWORD_TRAIL); ------------------ | | 31| 28.8k|# define SLLI_I64(a, imm) _mm256_slli_epi64(a, imm) ------------------ 91| 28.8k| vt2 = SRLI_I64(vt2, LAST_R_QWORD_LEAD); ------------------ | | 32| 28.8k|# define SRLI_I64(a, imm) _mm256_srli_epi64(a, imm) ------------------ 92| | 93| 28.8k| vt0 ^= (vt1 | vt2); 94| | 95| 28.8k| STORE(&c64[i], vt0); ------------------ | | 29| 28.8k|# define STORE(mem, reg) _mm256_storeu_si256((void *)(mem), (reg)) ------------------ 96| 28.8k| } 97| | 98| 179| c64[R_QWORDS - 1] &= LAST_R_QWORD_MASK; ------------------ | | 82| 179|#define R_QWORDS DIVIDE_AND_CEIL(R_BITS, 8 * BYTES_IN_QWORD) | | ------------------ | | | | 37| 179|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | ------------------ ------------------ c64[R_QWORDS - 1] &= LAST_R_QWORD_MASK; ------------------ | | 94| 179|#define LAST_R_QWORD_MASK MASK(LAST_R_QWORD_LEAD) | | ------------------ | | | | 43| 179|#define MASK(len) (BIT(len) - 1) | | | | ------------------ | | | | | | 42| 179|#define BIT(len) (1ULL << (len)) | | | | ------------------ | | ------------------ ------------------ 99| | 100| | // Clean the secrets from the upper part of c 101| 179| secure_clean((uint8_t *)&c64[R_QWORDS], ------------------ | | 33| 179|#define secure_clean OQS_MEM_cleanse ------------------ secure_clean((uint8_t *)&c64[R_QWORDS], ------------------ | | 82| 179|#define R_QWORDS DIVIDE_AND_CEIL(R_BITS, 8 * BYTES_IN_QWORD) | | ------------------ | | | | 37| 179|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | ------------------ ------------------ 102| 179| (R_PADDED_QWORDS - R_QWORDS) * sizeof(uint64_t)); ------------------ | | 90| 179|#define R_PADDED_QWORDS (R_PADDED / 64) | | ------------------ | | | | 88| 179|#define R_PADDED (R_BLOCKS * BLOCK_BITS) | | | | ------------------ | | | | | | 87| 179|#define R_BLOCKS DIVIDE_AND_CEIL(R_BITS, BLOCK_BITS) | | | | | | ------------------ | | | | | | | | 37| 179|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | | | | | ------------------ | | | | ------------------ | | | | #define R_PADDED (R_BLOCKS * BLOCK_BITS) | | | | ------------------ | | | | | | 71| 179|# define BLOCK_BITS 65536 | | | | ------------------ | | ------------------ ------------------ (R_PADDED_QWORDS - R_QWORDS) * sizeof(uint64_t)); ------------------ | | 82| 179|#define R_QWORDS DIVIDE_AND_CEIL(R_BITS, 8 * BYTES_IN_QWORD) | | ------------------ | | | | 37| 179|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | ------------------ ------------------ 103| 179|} OQS_KEM_bike_l1_gf2x_mul_base_pclmul: 94| 35.8k|{ 95| 35.8k| __m128i va[4], vb[4]; 96| 35.8k| __m128i aa[2], bb[2]; 97| 35.8k| __m128i lo[4], hi[4], mi[4], m[2]; 98| | 99| 179k| for(size_t i = 0; i < 4; i++) { ------------------ | Branch (99:21): [True: 143k, False: 35.8k] ------------------ 100| 143k| va[i] = LOAD128(&a[QWORDS_IN_XMM * i]); ------------------ | | 12| 143k|#define LOAD128(mem) _mm_loadu_si128((const void *)(mem)) ------------------ 101| 143k| vb[i] = LOAD128(&b[QWORDS_IN_XMM * i]); ------------------ | | 12| 143k|#define LOAD128(mem) _mm_loadu_si128((const void *)(mem)) ------------------ 102| 143k| } 103| | 104| | // Multiply the low and the high halves of a and b 105| | // lo <-- a_lo * b_lo 106| | // hi <-- a_hi * b_hi 107| 35.8k| gf2x_mul4_int(lo, va[0], va[1], vb[0], vb[1]); 108| 35.8k| gf2x_mul4_int(hi, va[2], va[3], vb[2], vb[3]); 109| | 110| | // Compute the middle multiplication 111| | // aa <-- a_lo + a_hi 112| | // bb <-- b_lo + b_hi 113| | // mi <-- aa * bb 114| 35.8k| aa[0] = va[0] ^ va[2]; 115| 35.8k| aa[1] = va[1] ^ va[3]; 116| 35.8k| bb[0] = vb[0] ^ vb[2]; 117| 35.8k| bb[1] = vb[1] ^ vb[3]; 118| 35.8k| gf2x_mul4_int(mi, aa[0], aa[1], bb[0], bb[1]); 119| | 120| 35.8k| m[0] = lo[2] ^ hi[0]; 121| 35.8k| m[1] = lo[3] ^ hi[1]; 122| | 123| 35.8k| STORE128(&c[0 * QWORDS_IN_XMM], lo[0]); ------------------ | | 13| 35.8k|#define STORE128(mem, reg) _mm_storeu_si128((void *)(mem), (reg)) ------------------ 124| 35.8k| STORE128(&c[1 * QWORDS_IN_XMM], lo[1]); ------------------ | | 13| 35.8k|#define STORE128(mem, reg) _mm_storeu_si128((void *)(mem), (reg)) ------------------ 125| 35.8k| STORE128(&c[2 * QWORDS_IN_XMM], mi[0] ^ lo[0] ^ m[0]); ------------------ | | 13| 35.8k|#define STORE128(mem, reg) _mm_storeu_si128((void *)(mem), (reg)) ------------------ 126| 35.8k| STORE128(&c[3 * QWORDS_IN_XMM], mi[1] ^ lo[1] ^ m[1]); ------------------ | | 13| 35.8k|#define STORE128(mem, reg) _mm_storeu_si128((void *)(mem), (reg)) ------------------ 127| 35.8k| STORE128(&c[4 * QWORDS_IN_XMM], mi[2] ^ hi[2] ^ m[0]); ------------------ | | 13| 35.8k|#define STORE128(mem, reg) _mm_storeu_si128((void *)(mem), (reg)) ------------------ 128| 35.8k| STORE128(&c[5 * QWORDS_IN_XMM], mi[3] ^ hi[3] ^ m[1]); ------------------ | | 13| 35.8k|#define STORE128(mem, reg) _mm_storeu_si128((void *)(mem), (reg)) ------------------ 129| 35.8k| STORE128(&c[6 * QWORDS_IN_XMM], hi[2]); ------------------ | | 13| 35.8k|#define STORE128(mem, reg) _mm_storeu_si128((void *)(mem), (reg)) ------------------ 130| 35.8k| STORE128(&c[7 * QWORDS_IN_XMM], hi[3]); ------------------ | | 13| 35.8k|#define STORE128(mem, reg) _mm_storeu_si128((void *)(mem), (reg)) ------------------ 131| 35.8k|} OQS_KEM_bike_l1_gf2x_sqr_pclmul: 134| 810|{ 135| 810| __m128i va, vr0, vr1; 136| | 137| 810| const uint64_t *a64 = (const uint64_t *)a; 138| 810| uint64_t * c64 = (uint64_t *)c; 139| | 140| 79.3k| for(size_t i = 0; i < (R_XMM * QWORDS_IN_XMM); i += QWORDS_IN_XMM) { ------------------ | | 83| 79.3k|#define R_XMM DIVIDE_AND_CEIL(R_BITS, 8 * BYTES_IN_XMM) | | ------------------ | | | | 37| 79.3k|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | ------------------ ------------------ for(size_t i = 0; i < (R_XMM * QWORDS_IN_XMM); i += QWORDS_IN_XMM) { ------------------ | | 60| 79.3k|#define QWORDS_IN_XMM (BYTES_IN_XMM / sizeof(uint64_t)) | | ------------------ | | | | 47| 79.3k|#define BYTES_IN_XMM 0x10 | | ------------------ ------------------ for(size_t i = 0; i < (R_XMM * QWORDS_IN_XMM); i += QWORDS_IN_XMM) { ------------------ | | 60| 78.5k|#define QWORDS_IN_XMM (BYTES_IN_XMM / sizeof(uint64_t)) | | ------------------ | | | | 47| 78.5k|#define BYTES_IN_XMM 0x10 | | ------------------ ------------------ | Branch (140:21): [True: 78.5k, False: 810] ------------------ 141| 78.5k| va = LOAD128(&a64[i]); ------------------ | | 12| 78.5k|#define LOAD128(mem) _mm_loadu_si128((const void *)(mem)) ------------------ 142| | 143| 78.5k| vr0 = CLMUL(va, va, 0x00); ------------------ | | 16| 78.5k|#define CLMUL(x, y, imm) _mm_clmulepi64_si128((x), (y), (imm)) ------------------ 144| 78.5k| vr1 = CLMUL(va, va, 0x11); ------------------ | | 16| 78.5k|#define CLMUL(x, y, imm) _mm_clmulepi64_si128((x), (y), (imm)) ------------------ 145| | 146| 78.5k| STORE128(&c64[i * 2], vr0); ------------------ | | 13| 78.5k|#define STORE128(mem, reg) _mm_storeu_si128((void *)(mem), (reg)) ------------------ 147| 78.5k| STORE128(&c64[i * 2 + QWORDS_IN_XMM], vr1); ------------------ | | 13| 78.5k|#define STORE128(mem, reg) _mm_storeu_si128((void *)(mem), (reg)) ------------------ 148| 78.5k| } 149| 810|} gf2x_mul_base_pclmul.c:gf2x_mul4_int: 26| 359k|{ 27| | // a_lo = [a1 | a0]; a_hi = [a3 | a2]; 28| | // b_lo = [b1 | b0]; b_hi = [b3 | b2]; 29| | // 4x4 Karatsuba requires three 2x2 multiplications: 30| | // (1) a_lo * b_lo 31| | // (2) a_hi * b_hi 32| | // (3) aa * bb = (a_lo + a_hi) * (b_lo + b_hi) 33| | // Each of the three 2x2 multiplications requires three 1x1 multiplications: 34| | // (1) is computed by a0*b0, a1*b1, (a0+a1)*(b0+b1) 35| | // (2) is computed by a2*b2, a3*b3, (a2+a3)*(b2+b3) 36| | // (3) is computed by aa0*bb0, aa1*bb1, (aa0+aa1)*(bb0+bb1) 37| | // All the required additions are performed in the end. 38| | 39| 359k| __m128i aa, bb; 40| 359k| __m128i xx, yy, uu, vv, m; 41| 359k| __m128i lo[2], hi[2], mi[2]; 42| 359k| __m128i t[9]; 43| | 44| 359k| aa = a_lo ^ a_hi; 45| 359k| bb = b_lo ^ b_hi; 46| | 47| | // xx <-- [(a2+a3) | (a0+a1)] 48| | // yy <-- [(b2+b3) | (b0+b1)] 49| 359k| xx = UNPACKLO(a_lo, a_hi); ------------------ | | 14| 359k|#define UNPACKLO(x, y) _mm_unpacklo_epi64((x), (y)) ------------------ 50| 359k| yy = UNPACKLO(b_lo, b_hi); ------------------ | | 14| 359k|#define UNPACKLO(x, y) _mm_unpacklo_epi64((x), (y)) ------------------ 51| 359k| xx = xx ^ UNPACKHI(a_lo, a_hi); ------------------ | | 15| 359k|#define UNPACKHI(x, y) _mm_unpackhi_epi64((x), (y)) ------------------ 52| 359k| yy = yy ^ UNPACKHI(b_lo, b_hi); ------------------ | | 15| 359k|#define UNPACKHI(x, y) _mm_unpackhi_epi64((x), (y)) ------------------ 53| | 54| | // uu <-- [ 0 | (aa0+aa1)] 55| | // vv <-- [ 0 | (bb0+bb1)] 56| 359k| uu = aa ^ BSRLI(aa, 8); ------------------ | | 17| 359k|#define BSRLI(x, imm) _mm_bsrli_si128((x), (imm)) ------------------ 57| 359k| vv = bb ^ BSRLI(bb, 8); ------------------ | | 17| 359k|#define BSRLI(x, imm) _mm_bsrli_si128((x), (imm)) ------------------ 58| | 59| | // 9 multiplications 60| 359k| t[0] = CLMUL(a_lo, b_lo, 0x00); ------------------ | | 16| 359k|#define CLMUL(x, y, imm) _mm_clmulepi64_si128((x), (y), (imm)) ------------------ 61| 359k| t[1] = CLMUL(a_lo, b_lo, 0x11); ------------------ | | 16| 359k|#define CLMUL(x, y, imm) _mm_clmulepi64_si128((x), (y), (imm)) ------------------ 62| 359k| t[2] = CLMUL(a_hi, b_hi, 0x00); ------------------ | | 16| 359k|#define CLMUL(x, y, imm) _mm_clmulepi64_si128((x), (y), (imm)) ------------------ 63| 359k| t[3] = CLMUL(a_hi, b_hi, 0x11); ------------------ | | 16| 359k|#define CLMUL(x, y, imm) _mm_clmulepi64_si128((x), (y), (imm)) ------------------ 64| 359k| t[4] = CLMUL(xx, yy, 0x00); ------------------ | | 16| 359k|#define CLMUL(x, y, imm) _mm_clmulepi64_si128((x), (y), (imm)) ------------------ 65| 359k| t[5] = CLMUL(xx, yy, 0x11); ------------------ | | 16| 359k|#define CLMUL(x, y, imm) _mm_clmulepi64_si128((x), (y), (imm)) ------------------ 66| 359k| t[6] = CLMUL(aa, bb, 0x00); ------------------ | | 16| 359k|#define CLMUL(x, y, imm) _mm_clmulepi64_si128((x), (y), (imm)) ------------------ 67| 359k| t[7] = CLMUL(aa, bb, 0x11); ------------------ | | 16| 359k|#define CLMUL(x, y, imm) _mm_clmulepi64_si128((x), (y), (imm)) ------------------ 68| 359k| t[8] = CLMUL(uu, vv, 0x00); ------------------ | | 16| 359k|#define CLMUL(x, y, imm) _mm_clmulepi64_si128((x), (y), (imm)) ------------------ 69| | 70| 359k| t[4] ^= (t[0] ^ t[1]); 71| 359k| t[5] ^= (t[2] ^ t[3]); 72| 359k| t[8] ^= (t[6] ^ t[7]); 73| | 74| 359k| lo[0] = t[0] ^ BSLLI(t[4], 8); ------------------ | | 18| 359k|#define BSLLI(x, imm) _mm_bslli_si128((x), (imm)) ------------------ 75| 359k| lo[1] = t[1] ^ BSRLI(t[4], 8); ------------------ | | 17| 359k|#define BSRLI(x, imm) _mm_bsrli_si128((x), (imm)) ------------------ 76| 359k| hi[0] = t[2] ^ BSLLI(t[5], 8); ------------------ | | 18| 359k|#define BSLLI(x, imm) _mm_bslli_si128((x), (imm)) ------------------ 77| 359k| hi[1] = t[3] ^ BSRLI(t[5], 8); ------------------ | | 17| 359k|#define BSRLI(x, imm) _mm_bsrli_si128((x), (imm)) ------------------ 78| 359k| mi[0] = t[6] ^ BSLLI(t[8], 8); ------------------ | | 18| 359k|#define BSLLI(x, imm) _mm_bslli_si128((x), (imm)) ------------------ 79| 359k| mi[1] = t[7] ^ BSRLI(t[8], 8); ------------------ | | 17| 359k|#define BSRLI(x, imm) _mm_bsrli_si128((x), (imm)) ------------------ 80| | 81| 359k| m = lo[1] ^ hi[0]; 82| | 83| 359k| c[0] = lo[0]; 84| 359k| c[1] = lo[0] ^ mi[0] ^ m; 85| 359k| c[2] = hi[1] ^ mi[1] ^ m; 86| 359k| c[3] = hi[1]; 87| 359k|} OQS_KEM_bike_l3_gf2x_mul_base_pclmul: 94| 22.7k|{ 95| 22.7k| __m128i va[4], vb[4]; 96| 22.7k| __m128i aa[2], bb[2]; 97| 22.7k| __m128i lo[4], hi[4], mi[4], m[2]; 98| | 99| 113k| for(size_t i = 0; i < 4; i++) { ------------------ | Branch (99:21): [True: 90.8k, False: 22.7k] ------------------ 100| 90.8k| va[i] = LOAD128(&a[QWORDS_IN_XMM * i]); ------------------ | | 12| 90.8k|#define LOAD128(mem) _mm_loadu_si128((const void *)(mem)) ------------------ 101| 90.8k| vb[i] = LOAD128(&b[QWORDS_IN_XMM * i]); ------------------ | | 12| 90.8k|#define LOAD128(mem) _mm_loadu_si128((const void *)(mem)) ------------------ 102| 90.8k| } 103| | 104| | // Multiply the low and the high halves of a and b 105| | // lo <-- a_lo * b_lo 106| | // hi <-- a_hi * b_hi 107| 22.7k| gf2x_mul4_int(lo, va[0], va[1], vb[0], vb[1]); 108| 22.7k| gf2x_mul4_int(hi, va[2], va[3], vb[2], vb[3]); 109| | 110| | // Compute the middle multiplication 111| | // aa <-- a_lo + a_hi 112| | // bb <-- b_lo + b_hi 113| | // mi <-- aa * bb 114| 22.7k| aa[0] = va[0] ^ va[2]; 115| 22.7k| aa[1] = va[1] ^ va[3]; 116| 22.7k| bb[0] = vb[0] ^ vb[2]; 117| 22.7k| bb[1] = vb[1] ^ vb[3]; 118| 22.7k| gf2x_mul4_int(mi, aa[0], aa[1], bb[0], bb[1]); 119| | 120| 22.7k| m[0] = lo[2] ^ hi[0]; 121| 22.7k| m[1] = lo[3] ^ hi[1]; 122| | 123| 22.7k| STORE128(&c[0 * QWORDS_IN_XMM], lo[0]); ------------------ | | 13| 22.7k|#define STORE128(mem, reg) _mm_storeu_si128((void *)(mem), (reg)) ------------------ 124| 22.7k| STORE128(&c[1 * QWORDS_IN_XMM], lo[1]); ------------------ | | 13| 22.7k|#define STORE128(mem, reg) _mm_storeu_si128((void *)(mem), (reg)) ------------------ 125| 22.7k| STORE128(&c[2 * QWORDS_IN_XMM], mi[0] ^ lo[0] ^ m[0]); ------------------ | | 13| 22.7k|#define STORE128(mem, reg) _mm_storeu_si128((void *)(mem), (reg)) ------------------ 126| 22.7k| STORE128(&c[3 * QWORDS_IN_XMM], mi[1] ^ lo[1] ^ m[1]); ------------------ | | 13| 22.7k|#define STORE128(mem, reg) _mm_storeu_si128((void *)(mem), (reg)) ------------------ 127| 22.7k| STORE128(&c[4 * QWORDS_IN_XMM], mi[2] ^ hi[2] ^ m[0]); ------------------ | | 13| 22.7k|#define STORE128(mem, reg) _mm_storeu_si128((void *)(mem), (reg)) ------------------ 128| 22.7k| STORE128(&c[5 * QWORDS_IN_XMM], mi[3] ^ hi[3] ^ m[1]); ------------------ | | 13| 22.7k|#define STORE128(mem, reg) _mm_storeu_si128((void *)(mem), (reg)) ------------------ 129| 22.7k| STORE128(&c[6 * QWORDS_IN_XMM], hi[2]); ------------------ | | 13| 22.7k|#define STORE128(mem, reg) _mm_storeu_si128((void *)(mem), (reg)) ------------------ 130| 22.7k| STORE128(&c[7 * QWORDS_IN_XMM], hi[3]); ------------------ | | 13| 22.7k|#define STORE128(mem, reg) _mm_storeu_si128((void *)(mem), (reg)) ------------------ 131| 22.7k|} OQS_KEM_bike_l3_gf2x_sqr_pclmul: 134| 146|{ 135| 146| __m128i va, vr0, vr1; 136| | 137| 146| const uint64_t *a64 = (const uint64_t *)a; 138| 146| uint64_t * c64 = (uint64_t *)c; 139| | 140| 28.3k| for(size_t i = 0; i < (R_XMM * QWORDS_IN_XMM); i += QWORDS_IN_XMM) { ------------------ | | 83| 28.3k|#define R_XMM DIVIDE_AND_CEIL(R_BITS, 8 * BYTES_IN_XMM) | | ------------------ | | | | 37| 28.3k|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | ------------------ ------------------ for(size_t i = 0; i < (R_XMM * QWORDS_IN_XMM); i += QWORDS_IN_XMM) { ------------------ | | 60| 28.3k|#define QWORDS_IN_XMM (BYTES_IN_XMM / sizeof(uint64_t)) | | ------------------ | | | | 47| 28.3k|#define BYTES_IN_XMM 0x10 | | ------------------ ------------------ for(size_t i = 0; i < (R_XMM * QWORDS_IN_XMM); i += QWORDS_IN_XMM) { ------------------ | | 60| 28.1k|#define QWORDS_IN_XMM (BYTES_IN_XMM / sizeof(uint64_t)) | | ------------------ | | | | 47| 28.1k|#define BYTES_IN_XMM 0x10 | | ------------------ ------------------ | Branch (140:21): [True: 28.1k, False: 146] ------------------ 141| 28.1k| va = LOAD128(&a64[i]); ------------------ | | 12| 28.1k|#define LOAD128(mem) _mm_loadu_si128((const void *)(mem)) ------------------ 142| | 143| 28.1k| vr0 = CLMUL(va, va, 0x00); ------------------ | | 16| 28.1k|#define CLMUL(x, y, imm) _mm_clmulepi64_si128((x), (y), (imm)) ------------------ 144| 28.1k| vr1 = CLMUL(va, va, 0x11); ------------------ | | 16| 28.1k|#define CLMUL(x, y, imm) _mm_clmulepi64_si128((x), (y), (imm)) ------------------ 145| | 146| 28.1k| STORE128(&c64[i * 2], vr0); ------------------ | | 13| 28.1k|#define STORE128(mem, reg) _mm_storeu_si128((void *)(mem), (reg)) ------------------ 147| 28.1k| STORE128(&c64[i * 2 + QWORDS_IN_XMM], vr1); ------------------ | | 13| 28.1k|#define STORE128(mem, reg) _mm_storeu_si128((void *)(mem), (reg)) ------------------ 148| 28.1k| } 149| 146|} OQS_KEM_bike_l5_gf2x_mul_base_pclmul: 94| 61.2k|{ 95| 61.2k| __m128i va[4], vb[4]; 96| 61.2k| __m128i aa[2], bb[2]; 97| 61.2k| __m128i lo[4], hi[4], mi[4], m[2]; 98| | 99| 306k| for(size_t i = 0; i < 4; i++) { ------------------ | Branch (99:21): [True: 244k, False: 61.2k] ------------------ 100| 244k| va[i] = LOAD128(&a[QWORDS_IN_XMM * i]); ------------------ | | 12| 244k|#define LOAD128(mem) _mm_loadu_si128((const void *)(mem)) ------------------ 101| 244k| vb[i] = LOAD128(&b[QWORDS_IN_XMM * i]); ------------------ | | 12| 244k|#define LOAD128(mem) _mm_loadu_si128((const void *)(mem)) ------------------ 102| 244k| } 103| | 104| | // Multiply the low and the high halves of a and b 105| | // lo <-- a_lo * b_lo 106| | // hi <-- a_hi * b_hi 107| 61.2k| gf2x_mul4_int(lo, va[0], va[1], vb[0], vb[1]); 108| 61.2k| gf2x_mul4_int(hi, va[2], va[3], vb[2], vb[3]); 109| | 110| | // Compute the middle multiplication 111| | // aa <-- a_lo + a_hi 112| | // bb <-- b_lo + b_hi 113| | // mi <-- aa * bb 114| 61.2k| aa[0] = va[0] ^ va[2]; 115| 61.2k| aa[1] = va[1] ^ va[3]; 116| 61.2k| bb[0] = vb[0] ^ vb[2]; 117| 61.2k| bb[1] = vb[1] ^ vb[3]; 118| 61.2k| gf2x_mul4_int(mi, aa[0], aa[1], bb[0], bb[1]); 119| | 120| 61.2k| m[0] = lo[2] ^ hi[0]; 121| 61.2k| m[1] = lo[3] ^ hi[1]; 122| | 123| 61.2k| STORE128(&c[0 * QWORDS_IN_XMM], lo[0]); ------------------ | | 13| 61.2k|#define STORE128(mem, reg) _mm_storeu_si128((void *)(mem), (reg)) ------------------ 124| 61.2k| STORE128(&c[1 * QWORDS_IN_XMM], lo[1]); ------------------ | | 13| 61.2k|#define STORE128(mem, reg) _mm_storeu_si128((void *)(mem), (reg)) ------------------ 125| 61.2k| STORE128(&c[2 * QWORDS_IN_XMM], mi[0] ^ lo[0] ^ m[0]); ------------------ | | 13| 61.2k|#define STORE128(mem, reg) _mm_storeu_si128((void *)(mem), (reg)) ------------------ 126| 61.2k| STORE128(&c[3 * QWORDS_IN_XMM], mi[1] ^ lo[1] ^ m[1]); ------------------ | | 13| 61.2k|#define STORE128(mem, reg) _mm_storeu_si128((void *)(mem), (reg)) ------------------ 127| 61.2k| STORE128(&c[4 * QWORDS_IN_XMM], mi[2] ^ hi[2] ^ m[0]); ------------------ | | 13| 61.2k|#define STORE128(mem, reg) _mm_storeu_si128((void *)(mem), (reg)) ------------------ 128| 61.2k| STORE128(&c[5 * QWORDS_IN_XMM], mi[3] ^ hi[3] ^ m[1]); ------------------ | | 13| 61.2k|#define STORE128(mem, reg) _mm_storeu_si128((void *)(mem), (reg)) ------------------ 129| 61.2k| STORE128(&c[6 * QWORDS_IN_XMM], hi[2]); ------------------ | | 13| 61.2k|#define STORE128(mem, reg) _mm_storeu_si128((void *)(mem), (reg)) ------------------ 130| 61.2k| STORE128(&c[7 * QWORDS_IN_XMM], hi[3]); ------------------ | | 13| 61.2k|#define STORE128(mem, reg) _mm_storeu_si128((void *)(mem), (reg)) ------------------ 131| 61.2k|} OQS_KEM_bike_l5_gf2x_sqr_pclmul: 134| 143|{ 135| 143| __m128i va, vr0, vr1; 136| | 137| 143| const uint64_t *a64 = (const uint64_t *)a; 138| 143| uint64_t * c64 = (uint64_t *)c; 139| | 140| 46.0k| for(size_t i = 0; i < (R_XMM * QWORDS_IN_XMM); i += QWORDS_IN_XMM) { ------------------ | | 83| 46.0k|#define R_XMM DIVIDE_AND_CEIL(R_BITS, 8 * BYTES_IN_XMM) | | ------------------ | | | | 37| 46.0k|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | ------------------ ------------------ for(size_t i = 0; i < (R_XMM * QWORDS_IN_XMM); i += QWORDS_IN_XMM) { ------------------ | | 60| 46.0k|#define QWORDS_IN_XMM (BYTES_IN_XMM / sizeof(uint64_t)) | | ------------------ | | | | 47| 46.0k|#define BYTES_IN_XMM 0x10 | | ------------------ ------------------ for(size_t i = 0; i < (R_XMM * QWORDS_IN_XMM); i += QWORDS_IN_XMM) { ------------------ | | 60| 45.9k|#define QWORDS_IN_XMM (BYTES_IN_XMM / sizeof(uint64_t)) | | ------------------ | | | | 47| 45.9k|#define BYTES_IN_XMM 0x10 | | ------------------ ------------------ | Branch (140:21): [True: 45.9k, False: 143] ------------------ 141| 45.9k| va = LOAD128(&a64[i]); ------------------ | | 12| 45.9k|#define LOAD128(mem) _mm_loadu_si128((const void *)(mem)) ------------------ 142| | 143| 45.9k| vr0 = CLMUL(va, va, 0x00); ------------------ | | 16| 45.9k|#define CLMUL(x, y, imm) _mm_clmulepi64_si128((x), (y), (imm)) ------------------ 144| 45.9k| vr1 = CLMUL(va, va, 0x11); ------------------ | | 16| 45.9k|#define CLMUL(x, y, imm) _mm_clmulepi64_si128((x), (y), (imm)) ------------------ 145| | 146| 45.9k| STORE128(&c64[i * 2], vr0); ------------------ | | 13| 45.9k|#define STORE128(mem, reg) _mm_storeu_si128((void *)(mem), (reg)) ------------------ 147| 45.9k| STORE128(&c64[i * 2 + QWORDS_IN_XMM], vr1); ------------------ | | 13| 45.9k|#define STORE128(mem, reg) _mm_storeu_si128((void *)(mem), (reg)) ------------------ 148| 45.9k| } 149| 143|} OQS_KEM_bike_l1_keypair: 133| 5|{ 134| 5| DEFER_CLEANUP(aligned_sk_t l_sk = {0}, sk_cleanup); ------------------ | | 16| 5| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 135| | 136| | // The secret key is (h0, h1), 137| | // and the public key h=(h0^-1 * h1). 138| | // Padded structures are used internally, and are required by the 139| | // decoder and the gf2x multiplication. 140| 5| DEFER_CLEANUP(pad_r_t h0 = {0}, pad_r_cleanup); ------------------ | | 16| 5| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 141| 5| DEFER_CLEANUP(pad_r_t h1 = {0}, pad_r_cleanup); ------------------ | | 16| 5| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 142| 5| DEFER_CLEANUP(pad_r_t h0inv = {0}, pad_r_cleanup); ------------------ | | 16| 5| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 143| 5| DEFER_CLEANUP(pad_r_t h = {0}, pad_r_cleanup); ------------------ | | 16| 5| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 144| | 145| | // The randomness of the key generation 146| 5| DEFER_CLEANUP(seeds_t seeds = {0}, seeds_cleanup); ------------------ | | 16| 5| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 147| | 148| 5| get_seeds(&seeds); ------------------ | | 128| 5|#define get_seeds RENAME_FUNC_NAME(get_seeds) | | ------------------ | | | | 44| 5|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 5|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 5|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 149| 5| GUARD(generate_secret_key(&h0, &h1, ------------------ | | 17| 5| if((x) != SUCCESS) return FAIL | | ------------------ | | | | 12| 5|#define SUCCESS OQS_SUCCESS | | ------------------ | | if((x) != SUCCESS) return FAIL | | ------------------ | | | | 13| 0|#define FAIL OQS_ERROR | | ------------------ | | | Branch (17:6): [True: 0, False: 5] | | ------------------ ------------------ 150| 5| l_sk.wlist[0].val, l_sk.wlist[1].val, 151| 5| &seeds.seed[0])); 152| | 153| | // Generate sigma 154| 5| convert_seed_to_m_type(&l_sk.sigma, &seeds.seed[1]); 155| | 156| | // Calculate the public key 157| 5| gf2x_mod_inv(&h0inv, &h0); ------------------ | | 124| 5|#define gf2x_mod_inv RENAME_FUNC_NAME(gf2x_mod_inv) | | ------------------ | | | | 44| 5|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 5|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 5|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 158| 5| gf2x_mod_mul(&h, &h1, &h0inv); ------------------ | | 60| 5|#define gf2x_mod_mul RENAME_FUNC_NAME(gf2x_mod_mul) | | ------------------ | | | | 44| 5|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 5|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 5|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 159| | 160| | // Fill the secret key data structure with contents - cancel the padding 161| 5| l_sk.bin[0] = h0.val; 162| 5| l_sk.bin[1] = h1.val; 163| 5| l_sk.pk = h.val; 164| | 165| | // Copy the data to the output buffers 166| 5| bike_memcpy(sk, &l_sk, sizeof(l_sk)); 167| 5| bike_memcpy(pk, &l_sk.pk, sizeof(l_sk.pk)); 168| | 169| 5| print("h: ", (uint64_t *)&l_sk.pk, R_BITS); 170| 5| print("h0: ", (uint64_t *)&l_sk.bin[0], R_BITS); 171| 5| print("h1: ", (uint64_t *)&l_sk.bin[1], R_BITS); 172| 5| print("h0 wlist:", (uint64_t *)&l_sk.wlist[0], SIZEOF_BITS(compressed_idx_d_t)); 173| 5| print("h1 wlist:", (uint64_t *)&l_sk.wlist[1], SIZEOF_BITS(compressed_idx_d_t)); 174| 5| print("sigma: ", (uint64_t *)l_sk.sigma.raw, M_BITS); 175| | 176| 5| return SUCCESS; ------------------ | | 12| 5|#define SUCCESS OQS_SUCCESS ------------------ 177| 5|} OQS_KEM_bike_l1_encaps: 185| 5|{ 186| | // Public values (they do not require cleanup on exit). 187| 5| pk_t l_pk; 188| 5| ct_t l_ct; 189| | 190| 5| DEFER_CLEANUP(m_t m, m_cleanup); ------------------ | | 16| 5| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 191| 5| DEFER_CLEANUP(ss_t l_ss, ss_cleanup); ------------------ | | 16| 5| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 192| 5| DEFER_CLEANUP(seeds_t seeds = {0}, seeds_cleanup); ------------------ | | 16| 5| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 193| 5| DEFER_CLEANUP(pad_e_t e, pad_e_cleanup); ------------------ | | 16| 5| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 194| | 195| | // Copy the data from the input buffer. This is required in order to avoid 196| | // alignment issues on non x86_64 processors. 197| 5| bike_memcpy(&l_pk, pk, sizeof(l_pk)); 198| | 199| 5| get_seeds(&seeds); ------------------ | | 128| 5|#define get_seeds RENAME_FUNC_NAME(get_seeds) | | ------------------ | | | | 44| 5|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 5|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 5|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 200| | 201| | // e = H(m) = H(seed[0]) 202| 5| convert_seed_to_m_type(&m, &seeds.seed[0]); 203| 5| GUARD(function_h(&e, &m, &l_pk)); ------------------ | | 17| 5| if((x) != SUCCESS) return FAIL | | ------------------ | | | | 12| 5|#define SUCCESS OQS_SUCCESS | | ------------------ | | if((x) != SUCCESS) return FAIL | | ------------------ | | | | 13| 0|#define FAIL OQS_ERROR | | ------------------ | | | Branch (17:6): [True: 0, False: 5] | | ------------------ ------------------ 204| | 205| | // Calculate the ciphertext 206| 5| GUARD(encrypt(&l_ct, &e, &l_pk, &m)); ------------------ | | 17| 5| if((x) != SUCCESS) return FAIL | | ------------------ | | | | 12| 5|#define SUCCESS OQS_SUCCESS | | ------------------ | | if((x) != SUCCESS) return FAIL | | ------------------ | | | | 13| 0|#define FAIL OQS_ERROR | | ------------------ | | | Branch (17:6): [True: 0, False: 5] | | ------------------ ------------------ 207| | 208| | // Generate the shared secret 209| 5| GUARD(function_k(&l_ss, &m, &l_ct)); ------------------ | | 17| 5| if((x) != SUCCESS) return FAIL | | ------------------ | | | | 12| 5|#define SUCCESS OQS_SUCCESS | | ------------------ | | if((x) != SUCCESS) return FAIL | | ------------------ | | | | 13| 0|#define FAIL OQS_ERROR | | ------------------ | | | Branch (17:6): [True: 0, False: 5] | | ------------------ ------------------ 210| | 211| 5| print("ss: ", (uint64_t *)l_ss.raw, SIZEOF_BITS(l_ss)); 212| | 213| | // Copy the data to the output buffers 214| 5| bike_memcpy(ct, &l_ct, sizeof(l_ct)); 215| 5| bike_memcpy(ss, &l_ss, sizeof(l_ss)); 216| | 217| 5| return SUCCESS; ------------------ | | 12| 5|#define SUCCESS OQS_SUCCESS ------------------ 218| 5|} OQS_KEM_bike_l1_decaps: 226| 5|{ 227| | // Public values, does not require a cleanup on exit 228| 5| ct_t l_ct; 229| | 230| 5| DEFER_CLEANUP(ss_t l_ss, ss_cleanup); ------------------ | | 16| 5| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 231| 5| DEFER_CLEANUP(aligned_sk_t l_sk, sk_cleanup); ------------------ | | 16| 5| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 232| 5| DEFER_CLEANUP(e_t e, e_cleanup); ------------------ | | 16| 5| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 233| 5| DEFER_CLEANUP(m_t m_prime, m_cleanup); ------------------ | | 16| 5| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 234| 5| DEFER_CLEANUP(pad_e_t e_tmp, pad_e_cleanup); ------------------ | | 16| 5| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 235| 5| DEFER_CLEANUP(pad_e_t e_prime = {0}, pad_e_cleanup); ------------------ | | 16| 5| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 236| | 237| | // Copy the data from the input buffers. This is required in order to avoid 238| | // alignment issues on non x86_64 processors. 239| 5| bike_memcpy(&l_ct, ct, sizeof(l_ct)); 240| 5| bike_memcpy(&l_sk, sk, sizeof(l_sk)); 241| | 242| | // Decode. 243| 5| decode(&e, &l_ct, &l_sk); ------------------ | | 57| 5|#define decode RENAME_FUNC_NAME(decode) | | ------------------ | | | | 44| 5|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 5|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 5|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 244| | 245| | // Copy the error vector in the padded struct. 246| 5| e_prime.val[0].val = e.val[0]; 247| 5| e_prime.val[1].val = e.val[1]; 248| | 249| 5| GUARD(reencrypt(&m_prime, &e_prime, &l_ct)); ------------------ | | 17| 5| if((x) != SUCCESS) return FAIL | | ------------------ | | | | 12| 5|#define SUCCESS OQS_SUCCESS | | ------------------ | | if((x) != SUCCESS) return FAIL | | ------------------ | | | | 13| 0|#define FAIL OQS_ERROR | | ------------------ | | | Branch (17:6): [True: 0, False: 5] | | ------------------ ------------------ 250| | 251| | // Check if H(m') is equal to (e0', e1') 252| | // (in constant-time) 253| 5| GUARD(function_h(&e_tmp, &m_prime, &l_sk.pk)); ------------------ | | 17| 5| if((x) != SUCCESS) return FAIL | | ------------------ | | | | 12| 5|#define SUCCESS OQS_SUCCESS | | ------------------ | | if((x) != SUCCESS) return FAIL | | ------------------ | | | | 13| 0|#define FAIL OQS_ERROR | | ------------------ | | | Branch (17:6): [True: 0, False: 5] | | ------------------ ------------------ 254| 5| uint32_t success_cond; 255| 5| success_cond = secure_cmp(PE0_RAW(&e_prime), PE0_RAW(&e_tmp), R_BYTES); ------------------ | | 95| 5|#define PE0_RAW(e) ((e)->val[0].val.raw) ------------------ success_cond = secure_cmp(PE0_RAW(&e_prime), PE0_RAW(&e_tmp), R_BYTES); ------------------ | | 95| 5|#define PE0_RAW(e) ((e)->val[0].val.raw) ------------------ success_cond = secure_cmp(PE0_RAW(&e_prime), PE0_RAW(&e_tmp), R_BYTES); ------------------ | | 81| 5|#define R_BYTES DIVIDE_AND_CEIL(R_BITS, 8) | | ------------------ | | | | 37| 5|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | ------------------ ------------------ 256| 5| success_cond &= secure_cmp(PE1_RAW(&e_prime), PE1_RAW(&e_tmp), R_BYTES); ------------------ | | 96| 5|#define PE1_RAW(e) ((e)->val[1].val.raw) ------------------ success_cond &= secure_cmp(PE1_RAW(&e_prime), PE1_RAW(&e_tmp), R_BYTES); ------------------ | | 96| 5|#define PE1_RAW(e) ((e)->val[1].val.raw) ------------------ success_cond &= secure_cmp(PE1_RAW(&e_prime), PE1_RAW(&e_tmp), R_BYTES); ------------------ | | 81| 5|#define R_BYTES DIVIDE_AND_CEIL(R_BITS, 8) | | ------------------ | | | | 37| 5|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | ------------------ ------------------ 257| | 258| | // Compute either K(m', C) or K(sigma, C) based on the success condition 259| 5| uint32_t mask = secure_l32_mask(0, success_cond); 260| 165| for(size_t i = 0; i < M_BYTES; i++) { ------------------ | | 104| 165|#define M_BYTES (M_BITS / 8) | | ------------------ | | | | 103| 165|#define M_BITS 256 | | ------------------ ------------------ | Branch (260:21): [True: 160, False: 5] ------------------ 261| 160| m_prime.raw[i] &= u8_barrier(~mask); 262| 160| m_prime.raw[i] |= (u8_barrier(mask) & l_sk.sigma.raw[i]); 263| 160| } 264| | 265| | // Generate the shared secret 266| 5| GUARD(function_k(&l_ss, &m_prime, &l_ct)); ------------------ | | 17| 5| if((x) != SUCCESS) return FAIL | | ------------------ | | | | 12| 5|#define SUCCESS OQS_SUCCESS | | ------------------ | | if((x) != SUCCESS) return FAIL | | ------------------ | | | | 13| 0|#define FAIL OQS_ERROR | | ------------------ | | | Branch (17:6): [True: 0, False: 5] | | ------------------ ------------------ 267| | 268| | // Copy the data into the output buffer 269| 5| bike_memcpy(ss, &l_ss, sizeof(l_ss)); 270| | 271| 5| return SUCCESS; ------------------ | | 12| 5|#define SUCCESS OQS_SUCCESS ------------------ 272| 5|} kem.c:convert_seed_to_m_type: 18| 14|{ 19| 14| bike_static_assert(sizeof(*m) == sizeof(*seed), m_size_eq_seed_size); ------------------ | | 33| 14| typedef char static_assertion_##MSG[(COND) ? 1 : -1] BIKE_UNUSED_ATT ------------------ 20| 14| bike_memcpy(m->raw, seed->raw, sizeof(*m)); 21| 14|} kem.c:OQS_KEM_bike_l1_function_h: 31| 10|{ 32| 10| DEFER_CLEANUP(seed_t seed = {0}, seed_cleanup); ------------------ | | 16| 10| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 33| | // pk is unused parameter in this case so we do this to avoid 34| | // clang sanitizers complaining. 35| 10| (void)pk; 36| | 37| 10| convert_m_to_seed_type(&seed, m); 38| | 39| 10| return generate_error_vector(e, &seed); ------------------ | | 132| 10|#define generate_error_vector RENAME_FUNC_NAME(generate_error_vector) | | ------------------ | | | | 44| 10|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 10|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 10|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 40| 10|} kem.c:convert_m_to_seed_type: 24| 14|{ 25| 14| bike_static_assert(sizeof(*m) == sizeof(*seed), m_size_eq_seed_size); ------------------ | | 33| 14| typedef char static_assertion_##MSG[(COND) ? 1 : -1] BIKE_UNUSED_ATT ------------------ 26| 14| bike_memcpy(seed->raw, m->raw, sizeof(*seed)); 27| 14|} kem.c:encrypt: 86| 7|{ 87| | // Pad the public key and the ciphertext 88| 7| pad_r_t p_ct = {0}; 89| 7| pad_r_t p_pk = {0}; 90| 7| p_pk.val = *pk; 91| | 92| | // Generate the ciphertext 93| | // ct = pk * e1 + e0 94| 7| gf2x_mod_mul(&p_ct, &e->val[1], &p_pk); ------------------ | | 60| 7|#define gf2x_mod_mul RENAME_FUNC_NAME(gf2x_mod_mul) | | ------------------ | | | | 44| 7|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 7|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 7|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 95| 7| gf2x_mod_add(&p_ct, &p_ct, &e->val[0]); ------------------ | | 123| 7|#define gf2x_mod_add RENAME_FUNC_NAME(gf2x_mod_add) | | ------------------ | | | | 44| 7|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 7|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 7|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 96| | 97| 7| ct->c0 = p_ct.val; 98| | 99| | // c1 = L(e0, e1) 100| 7| GUARD(function_l(&ct->c1, e)); ------------------ | | 17| 7| if((x) != SUCCESS) return FAIL | | ------------------ | | | | 12| 7|#define SUCCESS OQS_SUCCESS | | ------------------ | | if((x) != SUCCESS) return FAIL | | ------------------ | | | | 13| 0|#define FAIL OQS_ERROR | | ------------------ | | | Branch (17:6): [True: 0, False: 7] | | ------------------ ------------------ 101| | 102| | // m xor L(e0, e1) 103| 231| for(size_t i = 0; i < sizeof(*m); i++) { ------------------ | Branch (103:21): [True: 224, False: 7] ------------------ 104| 224| ct->c1.raw[i] ^= m->raw[i]; 105| 224| } 106| | 107| 7| print("e0: ", (const uint64_t *)PE0_RAW(e), R_BITS); 108| 7| print("e1: ", (const uint64_t *)PE1_RAW(e), R_BITS); 109| 7| print("c0: ", (uint64_t *)ct->c0.raw, R_BITS); 110| 7| print("c1: ", (uint64_t *)ct->c1.raw, M_BITS); 111| | 112| 7| return SUCCESS; ------------------ | | 12| 7|#define SUCCESS OQS_SUCCESS ------------------ 113| 7|} kem.c:function_l: 44| 14|{ 45| 14| DEFER_CLEANUP(sha_dgst_t dgst = {0}, sha_dgst_cleanup); ------------------ | | 16| 14| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 46| 14| DEFER_CLEANUP(e_t tmp, e_cleanup); ------------------ | | 16| 14| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 47| | 48| | // Take the padding away 49| 14| tmp.val[0] = e->val[0].val; 50| 14| tmp.val[1] = e->val[1].val; 51| | 52| 14| GUARD(sha(&dgst, sizeof(tmp), (uint8_t *)&tmp)); ------------------ | | 17| 14| if((x) != SUCCESS) return FAIL | | ------------------ | | | | 12| 14|#define SUCCESS OQS_SUCCESS | | ------------------ | | if((x) != SUCCESS) return FAIL | | ------------------ | | | | 13| 0|#define FAIL OQS_ERROR | | ------------------ | | | Branch (17:6): [True: 0, False: 14] | | ------------------ ------------------ 53| | 54| | // Truncate the SHA384 digest to a 256-bits m_t 55| 14| bike_static_assert(sizeof(dgst) >= sizeof(*out), dgst_size_lt_m_size); ------------------ | | 33| 14| typedef char static_assertion_##MSG[(COND) ? 1 : -1] BIKE_UNUSED_ATT ------------------ 56| 14| bike_memcpy(out->raw, dgst.u.raw, sizeof(*out)); 57| | 58| 14| return SUCCESS; ------------------ | | 12| 14|#define SUCCESS OQS_SUCCESS ------------------ 59| 14|} kem.c:function_k: 63| 14|{ 64| 14| DEFER_CLEANUP(func_k_t tmp, func_k_cleanup); ------------------ | | 16| 14| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 65| 14| DEFER_CLEANUP(sha_dgst_t dgst = {0}, sha_dgst_cleanup); ------------------ | | 16| 14| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 66| | 67| | // Copy every element, padded to the nearest byte 68| 14| tmp.m = *m; 69| 14| tmp.c0 = ct->c0; 70| 14| tmp.c1 = ct->c1; 71| | 72| 14| GUARD(sha(&dgst, sizeof(tmp), (uint8_t *)&tmp)); ------------------ | | 17| 14| if((x) != SUCCESS) return FAIL | | ------------------ | | | | 12| 14|#define SUCCESS OQS_SUCCESS | | ------------------ | | if((x) != SUCCESS) return FAIL | | ------------------ | | | | 13| 0|#define FAIL OQS_ERROR | | ------------------ | | | Branch (17:6): [True: 0, False: 14] | | ------------------ ------------------ 73| | 74| | // Truncate the SHA384 digest to a 256-bits value 75| | // to subsequently use it as a seed. 76| 14| bike_static_assert(sizeof(dgst) >= sizeof(*out), dgst_size_lt_out_size); ------------------ | | 33| 14| typedef char static_assertion_##MSG[(COND) ? 1 : -1] BIKE_UNUSED_ATT ------------------ 77| 14| bike_memcpy(out->raw, dgst.u.raw, sizeof(*out)); 78| | 79| 14| return SUCCESS; ------------------ | | 12| 14|#define SUCCESS OQS_SUCCESS ------------------ 80| 14|} kem.c:reencrypt: 116| 7|{ 117| 7| DEFER_CLEANUP(m_t tmp, m_cleanup); ------------------ | | 16| 7| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 118| | 119| 7| GUARD(function_l(&tmp, e)); ------------------ | | 17| 7| if((x) != SUCCESS) return FAIL | | ------------------ | | | | 12| 7|#define SUCCESS OQS_SUCCESS | | ------------------ | | if((x) != SUCCESS) return FAIL | | ------------------ | | | | 13| 0|#define FAIL OQS_ERROR | | ------------------ | | | Branch (17:6): [True: 0, False: 7] | | ------------------ ------------------ 120| | 121| | // m' = c1 ^ L(e') 122| 231| for(size_t i = 0; i < sizeof(*m); i++) { ------------------ | Branch (122:21): [True: 224, False: 7] ------------------ 123| 224| m->raw[i] = tmp.raw[i] ^ l_ct->c1.raw[i]; 124| 224| } 125| | 126| 7| return SUCCESS; ------------------ | | 12| 7|#define SUCCESS OQS_SUCCESS ------------------ 127| 7|} OQS_KEM_bike_l3_keypair: 133| 1|{ 134| 1| DEFER_CLEANUP(aligned_sk_t l_sk = {0}, sk_cleanup); ------------------ | | 16| 1| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 135| | 136| | // The secret key is (h0, h1), 137| | // and the public key h=(h0^-1 * h1). 138| | // Padded structures are used internally, and are required by the 139| | // decoder and the gf2x multiplication. 140| 1| DEFER_CLEANUP(pad_r_t h0 = {0}, pad_r_cleanup); ------------------ | | 16| 1| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 141| 1| DEFER_CLEANUP(pad_r_t h1 = {0}, pad_r_cleanup); ------------------ | | 16| 1| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 142| 1| DEFER_CLEANUP(pad_r_t h0inv = {0}, pad_r_cleanup); ------------------ | | 16| 1| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 143| 1| DEFER_CLEANUP(pad_r_t h = {0}, pad_r_cleanup); ------------------ | | 16| 1| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 144| | 145| | // The randomness of the key generation 146| 1| DEFER_CLEANUP(seeds_t seeds = {0}, seeds_cleanup); ------------------ | | 16| 1| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 147| | 148| 1| get_seeds(&seeds); ------------------ | | 128| 1|#define get_seeds RENAME_FUNC_NAME(get_seeds) | | ------------------ | | | | 44| 1|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 1|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 1|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 149| 1| GUARD(generate_secret_key(&h0, &h1, ------------------ | | 17| 1| if((x) != SUCCESS) return FAIL | | ------------------ | | | | 12| 1|#define SUCCESS OQS_SUCCESS | | ------------------ | | if((x) != SUCCESS) return FAIL | | ------------------ | | | | 13| 0|#define FAIL OQS_ERROR | | ------------------ | | | Branch (17:6): [True: 0, False: 1] | | ------------------ ------------------ 150| 1| l_sk.wlist[0].val, l_sk.wlist[1].val, 151| 1| &seeds.seed[0])); 152| | 153| | // Generate sigma 154| 1| convert_seed_to_m_type(&l_sk.sigma, &seeds.seed[1]); 155| | 156| | // Calculate the public key 157| 1| gf2x_mod_inv(&h0inv, &h0); ------------------ | | 124| 1|#define gf2x_mod_inv RENAME_FUNC_NAME(gf2x_mod_inv) | | ------------------ | | | | 44| 1|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 1|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 1|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 158| 1| gf2x_mod_mul(&h, &h1, &h0inv); ------------------ | | 60| 1|#define gf2x_mod_mul RENAME_FUNC_NAME(gf2x_mod_mul) | | ------------------ | | | | 44| 1|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 1|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 1|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 159| | 160| | // Fill the secret key data structure with contents - cancel the padding 161| 1| l_sk.bin[0] = h0.val; 162| 1| l_sk.bin[1] = h1.val; 163| 1| l_sk.pk = h.val; 164| | 165| | // Copy the data to the output buffers 166| 1| bike_memcpy(sk, &l_sk, sizeof(l_sk)); 167| 1| bike_memcpy(pk, &l_sk.pk, sizeof(l_sk.pk)); 168| | 169| 1| print("h: ", (uint64_t *)&l_sk.pk, R_BITS); 170| 1| print("h0: ", (uint64_t *)&l_sk.bin[0], R_BITS); 171| 1| print("h1: ", (uint64_t *)&l_sk.bin[1], R_BITS); 172| 1| print("h0 wlist:", (uint64_t *)&l_sk.wlist[0], SIZEOF_BITS(compressed_idx_d_t)); 173| 1| print("h1 wlist:", (uint64_t *)&l_sk.wlist[1], SIZEOF_BITS(compressed_idx_d_t)); 174| 1| print("sigma: ", (uint64_t *)l_sk.sigma.raw, M_BITS); 175| | 176| 1| return SUCCESS; ------------------ | | 12| 1|#define SUCCESS OQS_SUCCESS ------------------ 177| 1|} OQS_KEM_bike_l3_encaps: 185| 1|{ 186| | // Public values (they do not require cleanup on exit). 187| 1| pk_t l_pk; 188| 1| ct_t l_ct; 189| | 190| 1| DEFER_CLEANUP(m_t m, m_cleanup); ------------------ | | 16| 1| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 191| 1| DEFER_CLEANUP(ss_t l_ss, ss_cleanup); ------------------ | | 16| 1| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 192| 1| DEFER_CLEANUP(seeds_t seeds = {0}, seeds_cleanup); ------------------ | | 16| 1| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 193| 1| DEFER_CLEANUP(pad_e_t e, pad_e_cleanup); ------------------ | | 16| 1| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 194| | 195| | // Copy the data from the input buffer. This is required in order to avoid 196| | // alignment issues on non x86_64 processors. 197| 1| bike_memcpy(&l_pk, pk, sizeof(l_pk)); 198| | 199| 1| get_seeds(&seeds); ------------------ | | 128| 1|#define get_seeds RENAME_FUNC_NAME(get_seeds) | | ------------------ | | | | 44| 1|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 1|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 1|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 200| | 201| | // e = H(m) = H(seed[0]) 202| 1| convert_seed_to_m_type(&m, &seeds.seed[0]); 203| 1| GUARD(function_h(&e, &m, &l_pk)); ------------------ | | 17| 1| if((x) != SUCCESS) return FAIL | | ------------------ | | | | 12| 1|#define SUCCESS OQS_SUCCESS | | ------------------ | | if((x) != SUCCESS) return FAIL | | ------------------ | | | | 13| 0|#define FAIL OQS_ERROR | | ------------------ | | | Branch (17:6): [True: 0, False: 1] | | ------------------ ------------------ 204| | 205| | // Calculate the ciphertext 206| 1| GUARD(encrypt(&l_ct, &e, &l_pk, &m)); ------------------ | | 17| 1| if((x) != SUCCESS) return FAIL | | ------------------ | | | | 12| 1|#define SUCCESS OQS_SUCCESS | | ------------------ | | if((x) != SUCCESS) return FAIL | | ------------------ | | | | 13| 0|#define FAIL OQS_ERROR | | ------------------ | | | Branch (17:6): [True: 0, False: 1] | | ------------------ ------------------ 207| | 208| | // Generate the shared secret 209| 1| GUARD(function_k(&l_ss, &m, &l_ct)); ------------------ | | 17| 1| if((x) != SUCCESS) return FAIL | | ------------------ | | | | 12| 1|#define SUCCESS OQS_SUCCESS | | ------------------ | | if((x) != SUCCESS) return FAIL | | ------------------ | | | | 13| 0|#define FAIL OQS_ERROR | | ------------------ | | | Branch (17:6): [True: 0, False: 1] | | ------------------ ------------------ 210| | 211| 1| print("ss: ", (uint64_t *)l_ss.raw, SIZEOF_BITS(l_ss)); 212| | 213| | // Copy the data to the output buffers 214| 1| bike_memcpy(ct, &l_ct, sizeof(l_ct)); 215| 1| bike_memcpy(ss, &l_ss, sizeof(l_ss)); 216| | 217| 1| return SUCCESS; ------------------ | | 12| 1|#define SUCCESS OQS_SUCCESS ------------------ 218| 1|} OQS_KEM_bike_l3_decaps: 226| 1|{ 227| | // Public values, does not require a cleanup on exit 228| 1| ct_t l_ct; 229| | 230| 1| DEFER_CLEANUP(ss_t l_ss, ss_cleanup); ------------------ | | 16| 1| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 231| 1| DEFER_CLEANUP(aligned_sk_t l_sk, sk_cleanup); ------------------ | | 16| 1| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 232| 1| DEFER_CLEANUP(e_t e, e_cleanup); ------------------ | | 16| 1| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 233| 1| DEFER_CLEANUP(m_t m_prime, m_cleanup); ------------------ | | 16| 1| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 234| 1| DEFER_CLEANUP(pad_e_t e_tmp, pad_e_cleanup); ------------------ | | 16| 1| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 235| 1| DEFER_CLEANUP(pad_e_t e_prime = {0}, pad_e_cleanup); ------------------ | | 16| 1| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 236| | 237| | // Copy the data from the input buffers. This is required in order to avoid 238| | // alignment issues on non x86_64 processors. 239| 1| bike_memcpy(&l_ct, ct, sizeof(l_ct)); 240| 1| bike_memcpy(&l_sk, sk, sizeof(l_sk)); 241| | 242| | // Decode. 243| 1| decode(&e, &l_ct, &l_sk); ------------------ | | 57| 1|#define decode RENAME_FUNC_NAME(decode) | | ------------------ | | | | 44| 1|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 1|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 1|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 244| | 245| | // Copy the error vector in the padded struct. 246| 1| e_prime.val[0].val = e.val[0]; 247| 1| e_prime.val[1].val = e.val[1]; 248| | 249| 1| GUARD(reencrypt(&m_prime, &e_prime, &l_ct)); ------------------ | | 17| 1| if((x) != SUCCESS) return FAIL | | ------------------ | | | | 12| 1|#define SUCCESS OQS_SUCCESS | | ------------------ | | if((x) != SUCCESS) return FAIL | | ------------------ | | | | 13| 0|#define FAIL OQS_ERROR | | ------------------ | | | Branch (17:6): [True: 0, False: 1] | | ------------------ ------------------ 250| | 251| | // Check if H(m') is equal to (e0', e1') 252| | // (in constant-time) 253| 1| GUARD(function_h(&e_tmp, &m_prime, &l_sk.pk)); ------------------ | | 17| 1| if((x) != SUCCESS) return FAIL | | ------------------ | | | | 12| 1|#define SUCCESS OQS_SUCCESS | | ------------------ | | if((x) != SUCCESS) return FAIL | | ------------------ | | | | 13| 0|#define FAIL OQS_ERROR | | ------------------ | | | Branch (17:6): [True: 0, False: 1] | | ------------------ ------------------ 254| 1| uint32_t success_cond; 255| 1| success_cond = secure_cmp(PE0_RAW(&e_prime), PE0_RAW(&e_tmp), R_BYTES); ------------------ | | 95| 1|#define PE0_RAW(e) ((e)->val[0].val.raw) ------------------ success_cond = secure_cmp(PE0_RAW(&e_prime), PE0_RAW(&e_tmp), R_BYTES); ------------------ | | 95| 1|#define PE0_RAW(e) ((e)->val[0].val.raw) ------------------ success_cond = secure_cmp(PE0_RAW(&e_prime), PE0_RAW(&e_tmp), R_BYTES); ------------------ | | 81| 1|#define R_BYTES DIVIDE_AND_CEIL(R_BITS, 8) | | ------------------ | | | | 37| 1|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | ------------------ ------------------ 256| 1| success_cond &= secure_cmp(PE1_RAW(&e_prime), PE1_RAW(&e_tmp), R_BYTES); ------------------ | | 96| 1|#define PE1_RAW(e) ((e)->val[1].val.raw) ------------------ success_cond &= secure_cmp(PE1_RAW(&e_prime), PE1_RAW(&e_tmp), R_BYTES); ------------------ | | 96| 1|#define PE1_RAW(e) ((e)->val[1].val.raw) ------------------ success_cond &= secure_cmp(PE1_RAW(&e_prime), PE1_RAW(&e_tmp), R_BYTES); ------------------ | | 81| 1|#define R_BYTES DIVIDE_AND_CEIL(R_BITS, 8) | | ------------------ | | | | 37| 1|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | ------------------ ------------------ 257| | 258| | // Compute either K(m', C) or K(sigma, C) based on the success condition 259| 1| uint32_t mask = secure_l32_mask(0, success_cond); 260| 33| for(size_t i = 0; i < M_BYTES; i++) { ------------------ | | 104| 33|#define M_BYTES (M_BITS / 8) | | ------------------ | | | | 103| 33|#define M_BITS 256 | | ------------------ ------------------ | Branch (260:21): [True: 32, False: 1] ------------------ 261| 32| m_prime.raw[i] &= u8_barrier(~mask); 262| 32| m_prime.raw[i] |= (u8_barrier(mask) & l_sk.sigma.raw[i]); 263| 32| } 264| | 265| | // Generate the shared secret 266| 1| GUARD(function_k(&l_ss, &m_prime, &l_ct)); ------------------ | | 17| 1| if((x) != SUCCESS) return FAIL | | ------------------ | | | | 12| 1|#define SUCCESS OQS_SUCCESS | | ------------------ | | if((x) != SUCCESS) return FAIL | | ------------------ | | | | 13| 0|#define FAIL OQS_ERROR | | ------------------ | | | Branch (17:6): [True: 0, False: 1] | | ------------------ ------------------ 267| | 268| | // Copy the data into the output buffer 269| 1| bike_memcpy(ss, &l_ss, sizeof(l_ss)); 270| | 271| 1| return SUCCESS; ------------------ | | 12| 1|#define SUCCESS OQS_SUCCESS ------------------ 272| 1|} kem.c:OQS_KEM_bike_l3_function_h: 31| 2|{ 32| 2| DEFER_CLEANUP(seed_t seed = {0}, seed_cleanup); ------------------ | | 16| 2| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 33| | // pk is unused parameter in this case so we do this to avoid 34| | // clang sanitizers complaining. 35| 2| (void)pk; 36| | 37| 2| convert_m_to_seed_type(&seed, m); 38| | 39| 2| return generate_error_vector(e, &seed); ------------------ | | 132| 2|#define generate_error_vector RENAME_FUNC_NAME(generate_error_vector) | | ------------------ | | | | 44| 2|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 2|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 2|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 40| 2|} OQS_KEM_bike_l5_keypair: 133| 1|{ 134| 1| DEFER_CLEANUP(aligned_sk_t l_sk = {0}, sk_cleanup); ------------------ | | 16| 1| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 135| | 136| | // The secret key is (h0, h1), 137| | // and the public key h=(h0^-1 * h1). 138| | // Padded structures are used internally, and are required by the 139| | // decoder and the gf2x multiplication. 140| 1| DEFER_CLEANUP(pad_r_t h0 = {0}, pad_r_cleanup); ------------------ | | 16| 1| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 141| 1| DEFER_CLEANUP(pad_r_t h1 = {0}, pad_r_cleanup); ------------------ | | 16| 1| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 142| 1| DEFER_CLEANUP(pad_r_t h0inv = {0}, pad_r_cleanup); ------------------ | | 16| 1| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 143| 1| DEFER_CLEANUP(pad_r_t h = {0}, pad_r_cleanup); ------------------ | | 16| 1| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 144| | 145| | // The randomness of the key generation 146| 1| DEFER_CLEANUP(seeds_t seeds = {0}, seeds_cleanup); ------------------ | | 16| 1| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 147| | 148| 1| get_seeds(&seeds); ------------------ | | 128| 1|#define get_seeds RENAME_FUNC_NAME(get_seeds) | | ------------------ | | | | 44| 1|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 1|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 1|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 149| 1| GUARD(generate_secret_key(&h0, &h1, ------------------ | | 17| 1| if((x) != SUCCESS) return FAIL | | ------------------ | | | | 12| 1|#define SUCCESS OQS_SUCCESS | | ------------------ | | if((x) != SUCCESS) return FAIL | | ------------------ | | | | 13| 0|#define FAIL OQS_ERROR | | ------------------ | | | Branch (17:6): [True: 0, False: 1] | | ------------------ ------------------ 150| 1| l_sk.wlist[0].val, l_sk.wlist[1].val, 151| 1| &seeds.seed[0])); 152| | 153| | // Generate sigma 154| 1| convert_seed_to_m_type(&l_sk.sigma, &seeds.seed[1]); 155| | 156| | // Calculate the public key 157| 1| gf2x_mod_inv(&h0inv, &h0); ------------------ | | 124| 1|#define gf2x_mod_inv RENAME_FUNC_NAME(gf2x_mod_inv) | | ------------------ | | | | 44| 1|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 1|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 1|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 158| 1| gf2x_mod_mul(&h, &h1, &h0inv); ------------------ | | 60| 1|#define gf2x_mod_mul RENAME_FUNC_NAME(gf2x_mod_mul) | | ------------------ | | | | 44| 1|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 1|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 1|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 159| | 160| | // Fill the secret key data structure with contents - cancel the padding 161| 1| l_sk.bin[0] = h0.val; 162| 1| l_sk.bin[1] = h1.val; 163| 1| l_sk.pk = h.val; 164| | 165| | // Copy the data to the output buffers 166| 1| bike_memcpy(sk, &l_sk, sizeof(l_sk)); 167| 1| bike_memcpy(pk, &l_sk.pk, sizeof(l_sk.pk)); 168| | 169| 1| print("h: ", (uint64_t *)&l_sk.pk, R_BITS); 170| 1| print("h0: ", (uint64_t *)&l_sk.bin[0], R_BITS); 171| 1| print("h1: ", (uint64_t *)&l_sk.bin[1], R_BITS); 172| 1| print("h0 wlist:", (uint64_t *)&l_sk.wlist[0], SIZEOF_BITS(compressed_idx_d_t)); 173| 1| print("h1 wlist:", (uint64_t *)&l_sk.wlist[1], SIZEOF_BITS(compressed_idx_d_t)); 174| 1| print("sigma: ", (uint64_t *)l_sk.sigma.raw, M_BITS); 175| | 176| 1| return SUCCESS; ------------------ | | 12| 1|#define SUCCESS OQS_SUCCESS ------------------ 177| 1|} OQS_KEM_bike_l5_encaps: 185| 1|{ 186| | // Public values (they do not require cleanup on exit). 187| 1| pk_t l_pk; 188| 1| ct_t l_ct; 189| | 190| 1| DEFER_CLEANUP(m_t m, m_cleanup); ------------------ | | 16| 1| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 191| 1| DEFER_CLEANUP(ss_t l_ss, ss_cleanup); ------------------ | | 16| 1| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 192| 1| DEFER_CLEANUP(seeds_t seeds = {0}, seeds_cleanup); ------------------ | | 16| 1| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 193| 1| DEFER_CLEANUP(pad_e_t e, pad_e_cleanup); ------------------ | | 16| 1| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 194| | 195| | // Copy the data from the input buffer. This is required in order to avoid 196| | // alignment issues on non x86_64 processors. 197| 1| bike_memcpy(&l_pk, pk, sizeof(l_pk)); 198| | 199| 1| get_seeds(&seeds); ------------------ | | 128| 1|#define get_seeds RENAME_FUNC_NAME(get_seeds) | | ------------------ | | | | 44| 1|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 1|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 1|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 200| | 201| | // e = H(m) = H(seed[0]) 202| 1| convert_seed_to_m_type(&m, &seeds.seed[0]); 203| 1| GUARD(function_h(&e, &m, &l_pk)); ------------------ | | 17| 1| if((x) != SUCCESS) return FAIL | | ------------------ | | | | 12| 1|#define SUCCESS OQS_SUCCESS | | ------------------ | | if((x) != SUCCESS) return FAIL | | ------------------ | | | | 13| 0|#define FAIL OQS_ERROR | | ------------------ | | | Branch (17:6): [True: 0, False: 1] | | ------------------ ------------------ 204| | 205| | // Calculate the ciphertext 206| 1| GUARD(encrypt(&l_ct, &e, &l_pk, &m)); ------------------ | | 17| 1| if((x) != SUCCESS) return FAIL | | ------------------ | | | | 12| 1|#define SUCCESS OQS_SUCCESS | | ------------------ | | if((x) != SUCCESS) return FAIL | | ------------------ | | | | 13| 0|#define FAIL OQS_ERROR | | ------------------ | | | Branch (17:6): [True: 0, False: 1] | | ------------------ ------------------ 207| | 208| | // Generate the shared secret 209| 1| GUARD(function_k(&l_ss, &m, &l_ct)); ------------------ | | 17| 1| if((x) != SUCCESS) return FAIL | | ------------------ | | | | 12| 1|#define SUCCESS OQS_SUCCESS | | ------------------ | | if((x) != SUCCESS) return FAIL | | ------------------ | | | | 13| 0|#define FAIL OQS_ERROR | | ------------------ | | | Branch (17:6): [True: 0, False: 1] | | ------------------ ------------------ 210| | 211| 1| print("ss: ", (uint64_t *)l_ss.raw, SIZEOF_BITS(l_ss)); 212| | 213| | // Copy the data to the output buffers 214| 1| bike_memcpy(ct, &l_ct, sizeof(l_ct)); 215| 1| bike_memcpy(ss, &l_ss, sizeof(l_ss)); 216| | 217| 1| return SUCCESS; ------------------ | | 12| 1|#define SUCCESS OQS_SUCCESS ------------------ 218| 1|} OQS_KEM_bike_l5_decaps: 226| 1|{ 227| | // Public values, does not require a cleanup on exit 228| 1| ct_t l_ct; 229| | 230| 1| DEFER_CLEANUP(ss_t l_ss, ss_cleanup); ------------------ | | 16| 1| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 231| 1| DEFER_CLEANUP(aligned_sk_t l_sk, sk_cleanup); ------------------ | | 16| 1| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 232| 1| DEFER_CLEANUP(e_t e, e_cleanup); ------------------ | | 16| 1| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 233| 1| DEFER_CLEANUP(m_t m_prime, m_cleanup); ------------------ | | 16| 1| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 234| 1| DEFER_CLEANUP(pad_e_t e_tmp, pad_e_cleanup); ------------------ | | 16| 1| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 235| 1| DEFER_CLEANUP(pad_e_t e_prime = {0}, pad_e_cleanup); ------------------ | | 16| 1| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 236| | 237| | // Copy the data from the input buffers. This is required in order to avoid 238| | // alignment issues on non x86_64 processors. 239| 1| bike_memcpy(&l_ct, ct, sizeof(l_ct)); 240| 1| bike_memcpy(&l_sk, sk, sizeof(l_sk)); 241| | 242| | // Decode. 243| 1| decode(&e, &l_ct, &l_sk); ------------------ | | 57| 1|#define decode RENAME_FUNC_NAME(decode) | | ------------------ | | | | 44| 1|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 1|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 1|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 244| | 245| | // Copy the error vector in the padded struct. 246| 1| e_prime.val[0].val = e.val[0]; 247| 1| e_prime.val[1].val = e.val[1]; 248| | 249| 1| GUARD(reencrypt(&m_prime, &e_prime, &l_ct)); ------------------ | | 17| 1| if((x) != SUCCESS) return FAIL | | ------------------ | | | | 12| 1|#define SUCCESS OQS_SUCCESS | | ------------------ | | if((x) != SUCCESS) return FAIL | | ------------------ | | | | 13| 0|#define FAIL OQS_ERROR | | ------------------ | | | Branch (17:6): [True: 0, False: 1] | | ------------------ ------------------ 250| | 251| | // Check if H(m') is equal to (e0', e1') 252| | // (in constant-time) 253| 1| GUARD(function_h(&e_tmp, &m_prime, &l_sk.pk)); ------------------ | | 17| 1| if((x) != SUCCESS) return FAIL | | ------------------ | | | | 12| 1|#define SUCCESS OQS_SUCCESS | | ------------------ | | if((x) != SUCCESS) return FAIL | | ------------------ | | | | 13| 0|#define FAIL OQS_ERROR | | ------------------ | | | Branch (17:6): [True: 0, False: 1] | | ------------------ ------------------ 254| 1| uint32_t success_cond; 255| 1| success_cond = secure_cmp(PE0_RAW(&e_prime), PE0_RAW(&e_tmp), R_BYTES); ------------------ | | 95| 1|#define PE0_RAW(e) ((e)->val[0].val.raw) ------------------ success_cond = secure_cmp(PE0_RAW(&e_prime), PE0_RAW(&e_tmp), R_BYTES); ------------------ | | 95| 1|#define PE0_RAW(e) ((e)->val[0].val.raw) ------------------ success_cond = secure_cmp(PE0_RAW(&e_prime), PE0_RAW(&e_tmp), R_BYTES); ------------------ | | 81| 1|#define R_BYTES DIVIDE_AND_CEIL(R_BITS, 8) | | ------------------ | | | | 37| 1|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | ------------------ ------------------ 256| 1| success_cond &= secure_cmp(PE1_RAW(&e_prime), PE1_RAW(&e_tmp), R_BYTES); ------------------ | | 96| 1|#define PE1_RAW(e) ((e)->val[1].val.raw) ------------------ success_cond &= secure_cmp(PE1_RAW(&e_prime), PE1_RAW(&e_tmp), R_BYTES); ------------------ | | 96| 1|#define PE1_RAW(e) ((e)->val[1].val.raw) ------------------ success_cond &= secure_cmp(PE1_RAW(&e_prime), PE1_RAW(&e_tmp), R_BYTES); ------------------ | | 81| 1|#define R_BYTES DIVIDE_AND_CEIL(R_BITS, 8) | | ------------------ | | | | 37| 1|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | ------------------ ------------------ 257| | 258| | // Compute either K(m', C) or K(sigma, C) based on the success condition 259| 1| uint32_t mask = secure_l32_mask(0, success_cond); 260| 33| for(size_t i = 0; i < M_BYTES; i++) { ------------------ | | 104| 33|#define M_BYTES (M_BITS / 8) | | ------------------ | | | | 103| 33|#define M_BITS 256 | | ------------------ ------------------ | Branch (260:21): [True: 32, False: 1] ------------------ 261| 32| m_prime.raw[i] &= u8_barrier(~mask); 262| 32| m_prime.raw[i] |= (u8_barrier(mask) & l_sk.sigma.raw[i]); 263| 32| } 264| | 265| | // Generate the shared secret 266| 1| GUARD(function_k(&l_ss, &m_prime, &l_ct)); ------------------ | | 17| 1| if((x) != SUCCESS) return FAIL | | ------------------ | | | | 12| 1|#define SUCCESS OQS_SUCCESS | | ------------------ | | if((x) != SUCCESS) return FAIL | | ------------------ | | | | 13| 0|#define FAIL OQS_ERROR | | ------------------ | | | Branch (17:6): [True: 0, False: 1] | | ------------------ ------------------ 267| | 268| | // Copy the data into the output buffer 269| 1| bike_memcpy(ss, &l_ss, sizeof(l_ss)); 270| | 271| 1| return SUCCESS; ------------------ | | 12| 1|#define SUCCESS OQS_SUCCESS ------------------ 272| 1|} kem.c:OQS_KEM_bike_l5_function_h: 31| 2|{ 32| 2| DEFER_CLEANUP(seed_t seed = {0}, seed_cleanup); ------------------ | | 16| 2| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 33| | // pk is unused parameter in this case so we do this to avoid 34| | // clang sanitizers complaining. 35| 2| (void)pk; 36| | 37| 2| convert_m_to_seed_type(&seed, m); 38| | 39| 2| return generate_error_vector(e, &seed); ------------------ | | 132| 2|#define generate_error_vector RENAME_FUNC_NAME(generate_error_vector) | | ------------------ | | | | 44| 2|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 2|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 2|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 40| 2|} OQS_KEM_bike_l1_get_seeds: 17| 10|{ 18| 10| OQS_randombytes((uint8_t *)seeds, NUM_OF_SEEDS * sizeof(seed_t)); ------------------ | | 76| 10|#define NUM_OF_SEEDS 2 ------------------ 19| | 20| 30| for(uint32_t i = 0; i < NUM_OF_SEEDS; ++i) { ------------------ | | 76| 30|#define NUM_OF_SEEDS 2 ------------------ | Branch (20:23): [True: 20, False: 10] ------------------ 21| 20| print("s: ", (uint64_t *)&seeds->seed[i], SIZEOF_BITS(seed_t)); 22| 20| } 23| 10|} OQS_KEM_bike_l1_sample_indices_fisher_yates: 60| 20| IN OUT prf_state_t *prf_state) { 61| | 62| 2.07k| for (size_t i = num_indices; i-- > 0;) { ------------------ | Branch (62:34): [True: 2.05k, False: 20] ------------------ 63| 2.05k|#define CWW_RAND_BYTES 4 64| 2.05k| uint64_t rand = 0ULL; 65| 2.05k| GUARD(get_prf_output((uint8_t *)&rand, prf_state, CWW_RAND_BYTES)); ------------------ | | 17| 2.05k| if((x) != SUCCESS) return FAIL | | ------------------ | | | | 12| 2.05k|#define SUCCESS OQS_SUCCESS | | ------------------ | | if((x) != SUCCESS) return FAIL | | ------------------ | | | | 13| 0|#define FAIL OQS_ERROR | | ------------------ | | | Branch (17:6): [True: 0, False: 2.05k] | | ------------------ ------------------ 66| 2.05k| rand *= (max_idx_val - i); 67| | 68| | // new index l is such that i <= l < max_idx_val 69| 2.05k| uint32_t l = i + (uint32_t)(rand >> (CWW_RAND_BYTES * 8)); ------------------ | | 63| 2.05k|#define CWW_RAND_BYTES 4 ------------------ 70| | 71| | // Loop over (the end of) the output array to determine if l is a duplicate 72| 2.05k| uint32_t is_dup = 0; 73| 116k| for (size_t j = i + 1; j < num_indices; ++j) { ------------------ | Branch (73:32): [True: 113k, False: 2.05k] ------------------ 74| 113k| is_dup |= secure_cmp32(l, out[j]); 75| 113k| } 76| | 77| | // if l is a duplicate out[i] gets i else out[i] gets l 78| | // mask is all 1 if l is a duplicate, all 0 else 79| 2.05k| uint32_t mask = -is_dup; 80| 2.05k| out[i] = (mask & i) ^ (~mask & l); 81| 2.05k| } 82| | 83| 20| return SUCCESS; ------------------ | | 12| 20|#define SUCCESS OQS_SUCCESS ------------------ 84| 20|} OQS_KEM_bike_l1_generate_secret_key: 105| 5|{ 106| | // Initialize the sampling context. 107| 5| sampling_ctx ctx = {0}; 108| 5| sampling_ctx_init(&ctx); ------------------ | | 138| 5|#define sampling_ctx_init RENAME_FUNC_NAME(sampling_ctx_init) | | ------------------ | | | | 44| 5|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 5|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 5|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 109| | 110| 5| DEFER_CLEANUP(prf_state_t prf_state = {0}, clean_prf_state); ------------------ | | 16| 5| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 111| | 112| 5| GUARD(init_prf_state(&prf_state, MAX_PRF_INVOCATION, seed)); ------------------ | | 17| 5| if((x) != SUCCESS) return FAIL | | ------------------ | | | | 12| 5|#define SUCCESS OQS_SUCCESS | | ------------------ | | if((x) != SUCCESS) return FAIL | | ------------------ | | | | 13| 0|#define FAIL OQS_ERROR | | ------------------ | | | Branch (17:6): [True: 0, False: 5] | | ------------------ ------------------ 113| | 114| 5| GUARD(generate_sparse_rep_for_sk(h0, h0_wlist, &prf_state, &ctx)); ------------------ | | 17| 5| if((x) != SUCCESS) return FAIL | | ------------------ | | | | 12| 5|#define SUCCESS OQS_SUCCESS | | ------------------ | | if((x) != SUCCESS) return FAIL | | ------------------ | | | | 13| 0|#define FAIL OQS_ERROR | | ------------------ | | | Branch (17:6): [True: 0, False: 5] | | ------------------ ------------------ 115| 5| GUARD(generate_sparse_rep_for_sk(h1, h1_wlist, &prf_state, &ctx)); ------------------ | | 17| 5| if((x) != SUCCESS) return FAIL | | ------------------ | | | | 12| 5|#define SUCCESS OQS_SUCCESS | | ------------------ | | if((x) != SUCCESS) return FAIL | | ------------------ | | | | 13| 0|#define FAIL OQS_ERROR | | ------------------ | | | Branch (17:6): [True: 0, False: 5] | | ------------------ ------------------ 116| | 117| 5| return SUCCESS; ------------------ | | 12| 5|#define SUCCESS OQS_SUCCESS ------------------ 118| 5|} OQS_KEM_bike_l1_generate_error_vector: 121| 10|{ 122| | // Initialize the sampling context. 123| 10| sampling_ctx ctx; 124| 10| sampling_ctx_init(&ctx); ------------------ | | 138| 10|#define sampling_ctx_init RENAME_FUNC_NAME(sampling_ctx_init) | | ------------------ | | | | 44| 10|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 10|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 10|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 125| | 126| 10| DEFER_CLEANUP(prf_state_t prf_state = {0}, clean_prf_state); ------------------ | | 16| 10| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 127| | 128| 10| GUARD(init_prf_state(&prf_state, MAX_PRF_INVOCATION, seed)); ------------------ | | 17| 10| if((x) != SUCCESS) return FAIL | | ------------------ | | | | 12| 10|#define SUCCESS OQS_SUCCESS | | ------------------ | | if((x) != SUCCESS) return FAIL | | ------------------ | | | | 13| 0|#define FAIL OQS_ERROR | | ------------------ | | | Branch (17:6): [True: 0, False: 10] | | ------------------ ------------------ 129| | 130| 10| idx_t wlist[T]; 131| 10| GUARD(sample_indices_fisher_yates(wlist, T, N_BITS, &prf_state)); ------------------ | | 17| 10| if((x) != SUCCESS) return FAIL | | ------------------ | | | | 12| 10|#define SUCCESS OQS_SUCCESS | | ------------------ | | if((x) != SUCCESS) return FAIL | | ------------------ | | | | 13| 0|#define FAIL OQS_ERROR | | ------------------ | | | Branch (17:6): [True: 0, False: 10] | | ------------------ ------------------ 132| | 133| | // (e0, e1) hold bits 0..R_BITS-1 and R_BITS..2*R_BITS-1 of the error, resp. 134| 10| ctx.secure_set_bits(&e->val[0], 0, wlist, T); ------------------ | | 61| 10|#define secure_set_bits RENAME_FUNC_NAME(secure_set_bits) | | ------------------ | | | | 44| 10|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 10|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 10|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ ctx.secure_set_bits(&e->val[0], 0, wlist, T); ------------------ | | 25| 10|# define T 134 ------------------ 135| 10| ctx.secure_set_bits(&e->val[1], R_BITS, wlist, T); ------------------ | | 61| 10|#define secure_set_bits RENAME_FUNC_NAME(secure_set_bits) | | ------------------ | | | | 44| 10|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 10|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 10|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ ctx.secure_set_bits(&e->val[1], R_BITS, wlist, T); ------------------ | | 23| 10|# define R_BITS 12323 ------------------ ctx.secure_set_bits(&e->val[1], R_BITS, wlist, T); ------------------ | | 25| 10|# define T 134 ------------------ 136| | 137| | // Clean the padding of the elements. 138| 10| PE0_RAW(e)[R_BYTES - 1] &= LAST_R_BYTE_MASK; ------------------ | | 95| 10|#define PE0_RAW(e) ((e)->val[0].val.raw) ------------------ PE0_RAW(e)[R_BYTES - 1] &= LAST_R_BYTE_MASK; ------------------ | | 81| 10|#define R_BYTES DIVIDE_AND_CEIL(R_BITS, 8) | | ------------------ | | | | 37| 10|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | ------------------ ------------------ PE0_RAW(e)[R_BYTES - 1] &= LAST_R_BYTE_MASK; ------------------ | | 98| 10|#define LAST_R_BYTE_MASK MASK(LAST_R_BYTE_LEAD) | | ------------------ | | | | 43| 10|#define MASK(len) (BIT(len) - 1) | | | | ------------------ | | | | | | 42| 10|#define BIT(len) (1ULL << (len)) | | | | ------------------ | | ------------------ ------------------ 139| 10| PE1_RAW(e)[R_BYTES - 1] &= LAST_R_BYTE_MASK; ------------------ | | 96| 10|#define PE1_RAW(e) ((e)->val[1].val.raw) ------------------ PE1_RAW(e)[R_BYTES - 1] &= LAST_R_BYTE_MASK; ------------------ | | 81| 10|#define R_BYTES DIVIDE_AND_CEIL(R_BITS, 8) | | ------------------ | | | | 37| 10|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | ------------------ ------------------ PE1_RAW(e)[R_BYTES - 1] &= LAST_R_BYTE_MASK; ------------------ | | 98| 10|#define LAST_R_BYTE_MASK MASK(LAST_R_BYTE_LEAD) | | ------------------ | | | | 43| 10|#define MASK(len) (BIT(len) - 1) | | | | ------------------ | | | | | | 42| 10|#define BIT(len) (1ULL << (len)) | | | | ------------------ | | ------------------ ------------------ 140| 10| bike_memset(&PE0_RAW(e)[R_BYTES], 0, R_PADDED_BYTES - R_BYTES); ------------------ | | 95| 10|#define PE0_RAW(e) ((e)->val[0].val.raw) ------------------ bike_memset(&PE0_RAW(e)[R_BYTES], 0, R_PADDED_BYTES - R_BYTES); ------------------ | | 81| 10|#define R_BYTES DIVIDE_AND_CEIL(R_BITS, 8) | | ------------------ | | | | 37| 10|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | ------------------ ------------------ bike_memset(&PE0_RAW(e)[R_BYTES], 0, R_PADDED_BYTES - R_BYTES); ------------------ | | 89| 10|#define R_PADDED_BYTES (R_PADDED / 8) | | ------------------ | | | | 88| 10|#define R_PADDED (R_BLOCKS * BLOCK_BITS) | | | | ------------------ | | | | | | 87| 10|#define R_BLOCKS DIVIDE_AND_CEIL(R_BITS, BLOCK_BITS) | | | | | | ------------------ | | | | | | | | 37| 10|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | | | | | ------------------ | | | | ------------------ | | | | #define R_PADDED (R_BLOCKS * BLOCK_BITS) | | | | ------------------ | | | | | | 40| 10|# define BLOCK_BITS 16384 | | | | ------------------ | | ------------------ ------------------ bike_memset(&PE0_RAW(e)[R_BYTES], 0, R_PADDED_BYTES - R_BYTES); ------------------ | | 81| 10|#define R_BYTES DIVIDE_AND_CEIL(R_BITS, 8) | | ------------------ | | | | 37| 10|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | ------------------ ------------------ 141| 10| bike_memset(&PE1_RAW(e)[R_BYTES], 0, R_PADDED_BYTES - R_BYTES); ------------------ | | 96| 10|#define PE1_RAW(e) ((e)->val[1].val.raw) ------------------ bike_memset(&PE1_RAW(e)[R_BYTES], 0, R_PADDED_BYTES - R_BYTES); ------------------ | | 81| 10|#define R_BYTES DIVIDE_AND_CEIL(R_BITS, 8) | | ------------------ | | | | 37| 10|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | ------------------ ------------------ bike_memset(&PE1_RAW(e)[R_BYTES], 0, R_PADDED_BYTES - R_BYTES); ------------------ | | 89| 10|#define R_PADDED_BYTES (R_PADDED / 8) | | ------------------ | | | | 88| 10|#define R_PADDED (R_BLOCKS * BLOCK_BITS) | | | | ------------------ | | | | | | 87| 10|#define R_BLOCKS DIVIDE_AND_CEIL(R_BITS, BLOCK_BITS) | | | | | | ------------------ | | | | | | | | 37| 10|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | | | | | ------------------ | | | | ------------------ | | | | #define R_PADDED (R_BLOCKS * BLOCK_BITS) | | | | ------------------ | | | | | | 40| 10|# define BLOCK_BITS 16384 | | | | ------------------ | | ------------------ ------------------ bike_memset(&PE1_RAW(e)[R_BYTES], 0, R_PADDED_BYTES - R_BYTES); ------------------ | | 81| 10|#define R_BYTES DIVIDE_AND_CEIL(R_BITS, 8) | | ------------------ | | | | 37| 10|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | ------------------ ------------------ 142| | 143| 10| secure_clean((uint8_t *)wlist, sizeof(wlist)); ------------------ | | 33| 10|#define secure_clean OQS_MEM_cleanse ------------------ 144| | 145| 10| return SUCCESS; ------------------ | | 12| 10|#define SUCCESS OQS_SUCCESS ------------------ 146| 10|} sampling.c:OQS_KEM_bike_l1_generate_sparse_rep_for_sk: 90| 10|{ 91| 10| idx_t wlist_temp[D] = {0}; 92| | 93| 10| GUARD(sample_indices_fisher_yates(wlist_temp, D, R_BITS, prf_state)); ------------------ | | 17| 10| if((x) != SUCCESS) return FAIL | | ------------------ | | | | 12| 10|#define SUCCESS OQS_SUCCESS | | ------------------ | | if((x) != SUCCESS) return FAIL | | ------------------ | | | | 13| 0|#define FAIL OQS_ERROR | | ------------------ | | | Branch (17:6): [True: 0, False: 10] | | ------------------ ------------------ 94| | 95| 10| bike_memcpy(wlist, wlist_temp, D * sizeof(idx_t)); ------------------ | | 24| 10|# define D 71 ------------------ 96| 10| ctx->secure_set_bits(r, 0, wlist, D); ------------------ | | 61| 10|#define secure_set_bits RENAME_FUNC_NAME(secure_set_bits) | | ------------------ | | | | 44| 10|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 10|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 10|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ ctx->secure_set_bits(r, 0, wlist, D); ------------------ | | 24| 10|# define D 71 ------------------ 97| | 98| 10| secure_clean((uint8_t *)wlist_temp, sizeof(wlist_temp)); ------------------ | | 33| 10|#define secure_clean OQS_MEM_cleanse ------------------ 99| 10| return SUCCESS; ------------------ | | 12| 10|#define SUCCESS OQS_SUCCESS ------------------ 100| 10|} OQS_KEM_bike_l3_get_seeds: 17| 2|{ 18| 2| OQS_randombytes((uint8_t *)seeds, NUM_OF_SEEDS * sizeof(seed_t)); ------------------ | | 76| 2|#define NUM_OF_SEEDS 2 ------------------ 19| | 20| 6| for(uint32_t i = 0; i < NUM_OF_SEEDS; ++i) { ------------------ | | 76| 6|#define NUM_OF_SEEDS 2 ------------------ | Branch (20:23): [True: 4, False: 2] ------------------ 21| 4| print("s: ", (uint64_t *)&seeds->seed[i], SIZEOF_BITS(seed_t)); 22| 4| } 23| 2|} OQS_KEM_bike_l3_sample_indices_fisher_yates: 60| 4| IN OUT prf_state_t *prf_state) { 61| | 62| 608| for (size_t i = num_indices; i-- > 0;) { ------------------ | Branch (62:34): [True: 604, False: 4] ------------------ 63| 604|#define CWW_RAND_BYTES 4 64| 604| uint64_t rand = 0ULL; 65| 604| GUARD(get_prf_output((uint8_t *)&rand, prf_state, CWW_RAND_BYTES)); ------------------ | | 17| 604| if((x) != SUCCESS) return FAIL | | ------------------ | | | | 12| 604|#define SUCCESS OQS_SUCCESS | | ------------------ | | if((x) != SUCCESS) return FAIL | | ------------------ | | | | 13| 0|#define FAIL OQS_ERROR | | ------------------ | | | Branch (17:6): [True: 0, False: 604] | | ------------------ ------------------ 66| 604| rand *= (max_idx_val - i); 67| | 68| | // new index l is such that i <= l < max_idx_val 69| 604| uint32_t l = i + (uint32_t)(rand >> (CWW_RAND_BYTES * 8)); ------------------ | | 63| 604|#define CWW_RAND_BYTES 4 ------------------ 70| | 71| | // Loop over (the end of) the output array to determine if l is a duplicate 72| 604| uint32_t is_dup = 0; 73| 50.5k| for (size_t j = i + 1; j < num_indices; ++j) { ------------------ | Branch (73:32): [True: 49.9k, False: 604] ------------------ 74| 49.9k| is_dup |= secure_cmp32(l, out[j]); 75| 49.9k| } 76| | 77| | // if l is a duplicate out[i] gets i else out[i] gets l 78| | // mask is all 1 if l is a duplicate, all 0 else 79| 604| uint32_t mask = -is_dup; 80| 604| out[i] = (mask & i) ^ (~mask & l); 81| 604| } 82| | 83| 4| return SUCCESS; ------------------ | | 12| 4|#define SUCCESS OQS_SUCCESS ------------------ 84| 4|} OQS_KEM_bike_l3_generate_secret_key: 105| 1|{ 106| | // Initialize the sampling context. 107| 1| sampling_ctx ctx = {0}; 108| 1| sampling_ctx_init(&ctx); ------------------ | | 138| 1|#define sampling_ctx_init RENAME_FUNC_NAME(sampling_ctx_init) | | ------------------ | | | | 44| 1|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 1|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 1|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 109| | 110| 1| DEFER_CLEANUP(prf_state_t prf_state = {0}, clean_prf_state); ------------------ | | 16| 1| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 111| | 112| 1| GUARD(init_prf_state(&prf_state, MAX_PRF_INVOCATION, seed)); ------------------ | | 17| 1| if((x) != SUCCESS) return FAIL | | ------------------ | | | | 12| 1|#define SUCCESS OQS_SUCCESS | | ------------------ | | if((x) != SUCCESS) return FAIL | | ------------------ | | | | 13| 0|#define FAIL OQS_ERROR | | ------------------ | | | Branch (17:6): [True: 0, False: 1] | | ------------------ ------------------ 113| | 114| 1| GUARD(generate_sparse_rep_for_sk(h0, h0_wlist, &prf_state, &ctx)); ------------------ | | 17| 1| if((x) != SUCCESS) return FAIL | | ------------------ | | | | 12| 1|#define SUCCESS OQS_SUCCESS | | ------------------ | | if((x) != SUCCESS) return FAIL | | ------------------ | | | | 13| 0|#define FAIL OQS_ERROR | | ------------------ | | | Branch (17:6): [True: 0, False: 1] | | ------------------ ------------------ 115| 1| GUARD(generate_sparse_rep_for_sk(h1, h1_wlist, &prf_state, &ctx)); ------------------ | | 17| 1| if((x) != SUCCESS) return FAIL | | ------------------ | | | | 12| 1|#define SUCCESS OQS_SUCCESS | | ------------------ | | if((x) != SUCCESS) return FAIL | | ------------------ | | | | 13| 0|#define FAIL OQS_ERROR | | ------------------ | | | Branch (17:6): [True: 0, False: 1] | | ------------------ ------------------ 116| | 117| 1| return SUCCESS; ------------------ | | 12| 1|#define SUCCESS OQS_SUCCESS ------------------ 118| 1|} OQS_KEM_bike_l3_generate_error_vector: 121| 2|{ 122| | // Initialize the sampling context. 123| 2| sampling_ctx ctx; 124| 2| sampling_ctx_init(&ctx); ------------------ | | 138| 2|#define sampling_ctx_init RENAME_FUNC_NAME(sampling_ctx_init) | | ------------------ | | | | 44| 2|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 2|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 2|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 125| | 126| 2| DEFER_CLEANUP(prf_state_t prf_state = {0}, clean_prf_state); ------------------ | | 16| 2| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 127| | 128| 2| GUARD(init_prf_state(&prf_state, MAX_PRF_INVOCATION, seed)); ------------------ | | 17| 2| if((x) != SUCCESS) return FAIL | | ------------------ | | | | 12| 2|#define SUCCESS OQS_SUCCESS | | ------------------ | | if((x) != SUCCESS) return FAIL | | ------------------ | | | | 13| 0|#define FAIL OQS_ERROR | | ------------------ | | | Branch (17:6): [True: 0, False: 2] | | ------------------ ------------------ 129| | 130| 2| idx_t wlist[T]; 131| 2| GUARD(sample_indices_fisher_yates(wlist, T, N_BITS, &prf_state)); ------------------ | | 17| 2| if((x) != SUCCESS) return FAIL | | ------------------ | | | | 12| 2|#define SUCCESS OQS_SUCCESS | | ------------------ | | if((x) != SUCCESS) return FAIL | | ------------------ | | | | 13| 0|#define FAIL OQS_ERROR | | ------------------ | | | Branch (17:6): [True: 0, False: 2] | | ------------------ ------------------ 132| | 133| | // (e0, e1) hold bits 0..R_BITS-1 and R_BITS..2*R_BITS-1 of the error, resp. 134| 2| ctx.secure_set_bits(&e->val[0], 0, wlist, T); ------------------ | | 61| 2|#define secure_set_bits RENAME_FUNC_NAME(secure_set_bits) | | ------------------ | | | | 44| 2|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 2|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 2|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ ctx.secure_set_bits(&e->val[0], 0, wlist, T); ------------------ | | 45| 2|# define T 199 ------------------ 135| 2| ctx.secure_set_bits(&e->val[1], R_BITS, wlist, T); ------------------ | | 61| 2|#define secure_set_bits RENAME_FUNC_NAME(secure_set_bits) | | ------------------ | | | | 44| 2|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 2|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 2|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ ctx.secure_set_bits(&e->val[1], R_BITS, wlist, T); ------------------ | | 43| 2|# define R_BITS 24659 ------------------ ctx.secure_set_bits(&e->val[1], R_BITS, wlist, T); ------------------ | | 45| 2|# define T 199 ------------------ 136| | 137| | // Clean the padding of the elements. 138| 2| PE0_RAW(e)[R_BYTES - 1] &= LAST_R_BYTE_MASK; ------------------ | | 95| 2|#define PE0_RAW(e) ((e)->val[0].val.raw) ------------------ PE0_RAW(e)[R_BYTES - 1] &= LAST_R_BYTE_MASK; ------------------ | | 81| 2|#define R_BYTES DIVIDE_AND_CEIL(R_BITS, 8) | | ------------------ | | | | 37| 2|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | ------------------ ------------------ PE0_RAW(e)[R_BYTES - 1] &= LAST_R_BYTE_MASK; ------------------ | | 98| 2|#define LAST_R_BYTE_MASK MASK(LAST_R_BYTE_LEAD) | | ------------------ | | | | 43| 2|#define MASK(len) (BIT(len) - 1) | | | | ------------------ | | | | | | 42| 2|#define BIT(len) (1ULL << (len)) | | | | ------------------ | | ------------------ ------------------ 139| 2| PE1_RAW(e)[R_BYTES - 1] &= LAST_R_BYTE_MASK; ------------------ | | 96| 2|#define PE1_RAW(e) ((e)->val[1].val.raw) ------------------ PE1_RAW(e)[R_BYTES - 1] &= LAST_R_BYTE_MASK; ------------------ | | 81| 2|#define R_BYTES DIVIDE_AND_CEIL(R_BITS, 8) | | ------------------ | | | | 37| 2|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | ------------------ ------------------ PE1_RAW(e)[R_BYTES - 1] &= LAST_R_BYTE_MASK; ------------------ | | 98| 2|#define LAST_R_BYTE_MASK MASK(LAST_R_BYTE_LEAD) | | ------------------ | | | | 43| 2|#define MASK(len) (BIT(len) - 1) | | | | ------------------ | | | | | | 42| 2|#define BIT(len) (1ULL << (len)) | | | | ------------------ | | ------------------ ------------------ 140| 2| bike_memset(&PE0_RAW(e)[R_BYTES], 0, R_PADDED_BYTES - R_BYTES); ------------------ | | 95| 2|#define PE0_RAW(e) ((e)->val[0].val.raw) ------------------ bike_memset(&PE0_RAW(e)[R_BYTES], 0, R_PADDED_BYTES - R_BYTES); ------------------ | | 81| 2|#define R_BYTES DIVIDE_AND_CEIL(R_BITS, 8) | | ------------------ | | | | 37| 2|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | ------------------ ------------------ bike_memset(&PE0_RAW(e)[R_BYTES], 0, R_PADDED_BYTES - R_BYTES); ------------------ | | 89| 2|#define R_PADDED_BYTES (R_PADDED / 8) | | ------------------ | | | | 88| 2|#define R_PADDED (R_BLOCKS * BLOCK_BITS) | | | | ------------------ | | | | | | 87| 2|#define R_BLOCKS DIVIDE_AND_CEIL(R_BITS, BLOCK_BITS) | | | | | | ------------------ | | | | | | | | 37| 2|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | | | | | ------------------ | | | | ------------------ | | | | #define R_PADDED (R_BLOCKS * BLOCK_BITS) | | | | ------------------ | | | | | | 56| 2|# define BLOCK_BITS 32768 | | | | ------------------ | | ------------------ ------------------ bike_memset(&PE0_RAW(e)[R_BYTES], 0, R_PADDED_BYTES - R_BYTES); ------------------ | | 81| 2|#define R_BYTES DIVIDE_AND_CEIL(R_BITS, 8) | | ------------------ | | | | 37| 2|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | ------------------ ------------------ 141| 2| bike_memset(&PE1_RAW(e)[R_BYTES], 0, R_PADDED_BYTES - R_BYTES); ------------------ | | 96| 2|#define PE1_RAW(e) ((e)->val[1].val.raw) ------------------ bike_memset(&PE1_RAW(e)[R_BYTES], 0, R_PADDED_BYTES - R_BYTES); ------------------ | | 81| 2|#define R_BYTES DIVIDE_AND_CEIL(R_BITS, 8) | | ------------------ | | | | 37| 2|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | ------------------ ------------------ bike_memset(&PE1_RAW(e)[R_BYTES], 0, R_PADDED_BYTES - R_BYTES); ------------------ | | 89| 2|#define R_PADDED_BYTES (R_PADDED / 8) | | ------------------ | | | | 88| 2|#define R_PADDED (R_BLOCKS * BLOCK_BITS) | | | | ------------------ | | | | | | 87| 2|#define R_BLOCKS DIVIDE_AND_CEIL(R_BITS, BLOCK_BITS) | | | | | | ------------------ | | | | | | | | 37| 2|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | | | | | ------------------ | | | | ------------------ | | | | #define R_PADDED (R_BLOCKS * BLOCK_BITS) | | | | ------------------ | | | | | | 56| 2|# define BLOCK_BITS 32768 | | | | ------------------ | | ------------------ ------------------ bike_memset(&PE1_RAW(e)[R_BYTES], 0, R_PADDED_BYTES - R_BYTES); ------------------ | | 81| 2|#define R_BYTES DIVIDE_AND_CEIL(R_BITS, 8) | | ------------------ | | | | 37| 2|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | ------------------ ------------------ 142| | 143| 2| secure_clean((uint8_t *)wlist, sizeof(wlist)); ------------------ | | 33| 2|#define secure_clean OQS_MEM_cleanse ------------------ 144| | 145| 2| return SUCCESS; ------------------ | | 12| 2|#define SUCCESS OQS_SUCCESS ------------------ 146| 2|} sampling.c:OQS_KEM_bike_l3_generate_sparse_rep_for_sk: 90| 2|{ 91| 2| idx_t wlist_temp[D] = {0}; 92| | 93| 2| GUARD(sample_indices_fisher_yates(wlist_temp, D, R_BITS, prf_state)); ------------------ | | 17| 2| if((x) != SUCCESS) return FAIL | | ------------------ | | | | 12| 2|#define SUCCESS OQS_SUCCESS | | ------------------ | | if((x) != SUCCESS) return FAIL | | ------------------ | | | | 13| 0|#define FAIL OQS_ERROR | | ------------------ | | | Branch (17:6): [True: 0, False: 2] | | ------------------ ------------------ 94| | 95| 2| bike_memcpy(wlist, wlist_temp, D * sizeof(idx_t)); ------------------ | | 44| 2|# define D 103 ------------------ 96| 2| ctx->secure_set_bits(r, 0, wlist, D); ------------------ | | 61| 2|#define secure_set_bits RENAME_FUNC_NAME(secure_set_bits) | | ------------------ | | | | 44| 2|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 2|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 2|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ ctx->secure_set_bits(r, 0, wlist, D); ------------------ | | 44| 2|# define D 103 ------------------ 97| | 98| 2| secure_clean((uint8_t *)wlist_temp, sizeof(wlist_temp)); ------------------ | | 33| 2|#define secure_clean OQS_MEM_cleanse ------------------ 99| 2| return SUCCESS; ------------------ | | 12| 2|#define SUCCESS OQS_SUCCESS ------------------ 100| 2|} OQS_KEM_bike_l5_get_seeds: 17| 2|{ 18| 2| OQS_randombytes((uint8_t *)seeds, NUM_OF_SEEDS * sizeof(seed_t)); ------------------ | | 76| 2|#define NUM_OF_SEEDS 2 ------------------ 19| | 20| 6| for(uint32_t i = 0; i < NUM_OF_SEEDS; ++i) { ------------------ | | 76| 6|#define NUM_OF_SEEDS 2 ------------------ | Branch (20:23): [True: 4, False: 2] ------------------ 21| 4| print("s: ", (uint64_t *)&seeds->seed[i], SIZEOF_BITS(seed_t)); 22| 4| } 23| 2|} OQS_KEM_bike_l5_sample_indices_fisher_yates: 60| 4| IN OUT prf_state_t *prf_state) { 61| | 62| 806| for (size_t i = num_indices; i-- > 0;) { ------------------ | Branch (62:34): [True: 802, False: 4] ------------------ 63| 802|#define CWW_RAND_BYTES 4 64| 802| uint64_t rand = 0ULL; 65| 802| GUARD(get_prf_output((uint8_t *)&rand, prf_state, CWW_RAND_BYTES)); ------------------ | | 17| 802| if((x) != SUCCESS) return FAIL | | ------------------ | | | | 12| 802|#define SUCCESS OQS_SUCCESS | | ------------------ | | if((x) != SUCCESS) return FAIL | | ------------------ | | | | 13| 0|#define FAIL OQS_ERROR | | ------------------ | | | Branch (17:6): [True: 0, False: 802] | | ------------------ ------------------ 66| 802| rand *= (max_idx_val - i); 67| | 68| | // new index l is such that i <= l < max_idx_val 69| 802| uint32_t l = i + (uint32_t)(rand >> (CWW_RAND_BYTES * 8)); ------------------ | | 63| 802|#define CWW_RAND_BYTES 4 ------------------ 70| | 71| | // Loop over (the end of) the output array to determine if l is a duplicate 72| 802| uint32_t is_dup = 0; 73| 88.8k| for (size_t j = i + 1; j < num_indices; ++j) { ------------------ | Branch (73:32): [True: 88.0k, False: 802] ------------------ 74| 88.0k| is_dup |= secure_cmp32(l, out[j]); 75| 88.0k| } 76| | 77| | // if l is a duplicate out[i] gets i else out[i] gets l 78| | // mask is all 1 if l is a duplicate, all 0 else 79| 802| uint32_t mask = -is_dup; 80| 802| out[i] = (mask & i) ^ (~mask & l); 81| 802| } 82| | 83| 4| return SUCCESS; ------------------ | | 12| 4|#define SUCCESS OQS_SUCCESS ------------------ 84| 4|} OQS_KEM_bike_l5_generate_secret_key: 105| 1|{ 106| | // Initialize the sampling context. 107| 1| sampling_ctx ctx = {0}; 108| 1| sampling_ctx_init(&ctx); ------------------ | | 138| 1|#define sampling_ctx_init RENAME_FUNC_NAME(sampling_ctx_init) | | ------------------ | | | | 44| 1|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 1|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 1|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 109| | 110| 1| DEFER_CLEANUP(prf_state_t prf_state = {0}, clean_prf_state); ------------------ | | 16| 1| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 111| | 112| 1| GUARD(init_prf_state(&prf_state, MAX_PRF_INVOCATION, seed)); ------------------ | | 17| 1| if((x) != SUCCESS) return FAIL | | ------------------ | | | | 12| 1|#define SUCCESS OQS_SUCCESS | | ------------------ | | if((x) != SUCCESS) return FAIL | | ------------------ | | | | 13| 0|#define FAIL OQS_ERROR | | ------------------ | | | Branch (17:6): [True: 0, False: 1] | | ------------------ ------------------ 113| | 114| 1| GUARD(generate_sparse_rep_for_sk(h0, h0_wlist, &prf_state, &ctx)); ------------------ | | 17| 1| if((x) != SUCCESS) return FAIL | | ------------------ | | | | 12| 1|#define SUCCESS OQS_SUCCESS | | ------------------ | | if((x) != SUCCESS) return FAIL | | ------------------ | | | | 13| 0|#define FAIL OQS_ERROR | | ------------------ | | | Branch (17:6): [True: 0, False: 1] | | ------------------ ------------------ 115| 1| GUARD(generate_sparse_rep_for_sk(h1, h1_wlist, &prf_state, &ctx)); ------------------ | | 17| 1| if((x) != SUCCESS) return FAIL | | ------------------ | | | | 12| 1|#define SUCCESS OQS_SUCCESS | | ------------------ | | if((x) != SUCCESS) return FAIL | | ------------------ | | | | 13| 0|#define FAIL OQS_ERROR | | ------------------ | | | Branch (17:6): [True: 0, False: 1] | | ------------------ ------------------ 116| | 117| 1| return SUCCESS; ------------------ | | 12| 1|#define SUCCESS OQS_SUCCESS ------------------ 118| 1|} OQS_KEM_bike_l5_generate_error_vector: 121| 2|{ 122| | // Initialize the sampling context. 123| 2| sampling_ctx ctx; 124| 2| sampling_ctx_init(&ctx); ------------------ | | 138| 2|#define sampling_ctx_init RENAME_FUNC_NAME(sampling_ctx_init) | | ------------------ | | | | 44| 2|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 2|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 2|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 125| | 126| 2| DEFER_CLEANUP(prf_state_t prf_state = {0}, clean_prf_state); ------------------ | | 16| 2| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 127| | 128| 2| GUARD(init_prf_state(&prf_state, MAX_PRF_INVOCATION, seed)); ------------------ | | 17| 2| if((x) != SUCCESS) return FAIL | | ------------------ | | | | 12| 2|#define SUCCESS OQS_SUCCESS | | ------------------ | | if((x) != SUCCESS) return FAIL | | ------------------ | | | | 13| 0|#define FAIL OQS_ERROR | | ------------------ | | | Branch (17:6): [True: 0, False: 2] | | ------------------ ------------------ 129| | 130| 2| idx_t wlist[T]; 131| 2| GUARD(sample_indices_fisher_yates(wlist, T, N_BITS, &prf_state)); ------------------ | | 17| 2| if((x) != SUCCESS) return FAIL | | ------------------ | | | | 12| 2|#define SUCCESS OQS_SUCCESS | | ------------------ | | if((x) != SUCCESS) return FAIL | | ------------------ | | | | 13| 0|#define FAIL OQS_ERROR | | ------------------ | | | Branch (17:6): [True: 0, False: 2] | | ------------------ ------------------ 132| | 133| | // (e0, e1) hold bits 0..R_BITS-1 and R_BITS..2*R_BITS-1 of the error, resp. 134| 2| ctx.secure_set_bits(&e->val[0], 0, wlist, T); ------------------ | | 61| 2|#define secure_set_bits RENAME_FUNC_NAME(secure_set_bits) | | ------------------ | | | | 44| 2|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 2|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 2|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ ctx.secure_set_bits(&e->val[0], 0, wlist, T); ------------------ | | 61| 2|# define T 264 ------------------ 135| 2| ctx.secure_set_bits(&e->val[1], R_BITS, wlist, T); ------------------ | | 61| 2|#define secure_set_bits RENAME_FUNC_NAME(secure_set_bits) | | ------------------ | | | | 44| 2|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 2|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 2|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ ctx.secure_set_bits(&e->val[1], R_BITS, wlist, T); ------------------ | | 59| 2|# define R_BITS 40973 ------------------ ctx.secure_set_bits(&e->val[1], R_BITS, wlist, T); ------------------ | | 61| 2|# define T 264 ------------------ 136| | 137| | // Clean the padding of the elements. 138| 2| PE0_RAW(e)[R_BYTES - 1] &= LAST_R_BYTE_MASK; ------------------ | | 95| 2|#define PE0_RAW(e) ((e)->val[0].val.raw) ------------------ PE0_RAW(e)[R_BYTES - 1] &= LAST_R_BYTE_MASK; ------------------ | | 81| 2|#define R_BYTES DIVIDE_AND_CEIL(R_BITS, 8) | | ------------------ | | | | 37| 2|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | ------------------ ------------------ PE0_RAW(e)[R_BYTES - 1] &= LAST_R_BYTE_MASK; ------------------ | | 98| 2|#define LAST_R_BYTE_MASK MASK(LAST_R_BYTE_LEAD) | | ------------------ | | | | 43| 2|#define MASK(len) (BIT(len) - 1) | | | | ------------------ | | | | | | 42| 2|#define BIT(len) (1ULL << (len)) | | | | ------------------ | | ------------------ ------------------ 139| 2| PE1_RAW(e)[R_BYTES - 1] &= LAST_R_BYTE_MASK; ------------------ | | 96| 2|#define PE1_RAW(e) ((e)->val[1].val.raw) ------------------ PE1_RAW(e)[R_BYTES - 1] &= LAST_R_BYTE_MASK; ------------------ | | 81| 2|#define R_BYTES DIVIDE_AND_CEIL(R_BITS, 8) | | ------------------ | | | | 37| 2|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | ------------------ ------------------ PE1_RAW(e)[R_BYTES - 1] &= LAST_R_BYTE_MASK; ------------------ | | 98| 2|#define LAST_R_BYTE_MASK MASK(LAST_R_BYTE_LEAD) | | ------------------ | | | | 43| 2|#define MASK(len) (BIT(len) - 1) | | | | ------------------ | | | | | | 42| 2|#define BIT(len) (1ULL << (len)) | | | | ------------------ | | ------------------ ------------------ 140| 2| bike_memset(&PE0_RAW(e)[R_BYTES], 0, R_PADDED_BYTES - R_BYTES); ------------------ | | 95| 2|#define PE0_RAW(e) ((e)->val[0].val.raw) ------------------ bike_memset(&PE0_RAW(e)[R_BYTES], 0, R_PADDED_BYTES - R_BYTES); ------------------ | | 81| 2|#define R_BYTES DIVIDE_AND_CEIL(R_BITS, 8) | | ------------------ | | | | 37| 2|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | ------------------ ------------------ bike_memset(&PE0_RAW(e)[R_BYTES], 0, R_PADDED_BYTES - R_BYTES); ------------------ | | 89| 2|#define R_PADDED_BYTES (R_PADDED / 8) | | ------------------ | | | | 88| 2|#define R_PADDED (R_BLOCKS * BLOCK_BITS) | | | | ------------------ | | | | | | 87| 2|#define R_BLOCKS DIVIDE_AND_CEIL(R_BITS, BLOCK_BITS) | | | | | | ------------------ | | | | | | | | 37| 2|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | | | | | ------------------ | | | | ------------------ | | | | #define R_PADDED (R_BLOCKS * BLOCK_BITS) | | | | ------------------ | | | | | | 71| 2|# define BLOCK_BITS 65536 | | | | ------------------ | | ------------------ ------------------ bike_memset(&PE0_RAW(e)[R_BYTES], 0, R_PADDED_BYTES - R_BYTES); ------------------ | | 81| 2|#define R_BYTES DIVIDE_AND_CEIL(R_BITS, 8) | | ------------------ | | | | 37| 2|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | ------------------ ------------------ 141| 2| bike_memset(&PE1_RAW(e)[R_BYTES], 0, R_PADDED_BYTES - R_BYTES); ------------------ | | 96| 2|#define PE1_RAW(e) ((e)->val[1].val.raw) ------------------ bike_memset(&PE1_RAW(e)[R_BYTES], 0, R_PADDED_BYTES - R_BYTES); ------------------ | | 81| 2|#define R_BYTES DIVIDE_AND_CEIL(R_BITS, 8) | | ------------------ | | | | 37| 2|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | ------------------ ------------------ bike_memset(&PE1_RAW(e)[R_BYTES], 0, R_PADDED_BYTES - R_BYTES); ------------------ | | 89| 2|#define R_PADDED_BYTES (R_PADDED / 8) | | ------------------ | | | | 88| 2|#define R_PADDED (R_BLOCKS * BLOCK_BITS) | | | | ------------------ | | | | | | 87| 2|#define R_BLOCKS DIVIDE_AND_CEIL(R_BITS, BLOCK_BITS) | | | | | | ------------------ | | | | | | | | 37| 2|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | | | | | ------------------ | | | | ------------------ | | | | #define R_PADDED (R_BLOCKS * BLOCK_BITS) | | | | ------------------ | | | | | | 71| 2|# define BLOCK_BITS 65536 | | | | ------------------ | | ------------------ ------------------ bike_memset(&PE1_RAW(e)[R_BYTES], 0, R_PADDED_BYTES - R_BYTES); ------------------ | | 81| 2|#define R_BYTES DIVIDE_AND_CEIL(R_BITS, 8) | | ------------------ | | | | 37| 2|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | ------------------ ------------------ 142| | 143| 2| secure_clean((uint8_t *)wlist, sizeof(wlist)); ------------------ | | 33| 2|#define secure_clean OQS_MEM_cleanse ------------------ 144| | 145| 2| return SUCCESS; ------------------ | | 12| 2|#define SUCCESS OQS_SUCCESS ------------------ 146| 2|} sampling.c:OQS_KEM_bike_l5_generate_sparse_rep_for_sk: 90| 2|{ 91| 2| idx_t wlist_temp[D] = {0}; 92| | 93| 2| GUARD(sample_indices_fisher_yates(wlist_temp, D, R_BITS, prf_state)); ------------------ | | 17| 2| if((x) != SUCCESS) return FAIL | | ------------------ | | | | 12| 2|#define SUCCESS OQS_SUCCESS | | ------------------ | | if((x) != SUCCESS) return FAIL | | ------------------ | | | | 13| 0|#define FAIL OQS_ERROR | | ------------------ | | | Branch (17:6): [True: 0, False: 2] | | ------------------ ------------------ 94| | 95| 2| bike_memcpy(wlist, wlist_temp, D * sizeof(idx_t)); ------------------ | | 60| 2|# define D 137 ------------------ 96| 2| ctx->secure_set_bits(r, 0, wlist, D); ------------------ | | 61| 2|#define secure_set_bits RENAME_FUNC_NAME(secure_set_bits) | | ------------------ | | | | 44| 2|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 2|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 2|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ ctx->secure_set_bits(r, 0, wlist, D); ------------------ | | 60| 2|# define D 137 ------------------ 97| | 98| 2| secure_clean((uint8_t *)wlist_temp, sizeof(wlist_temp)); ------------------ | | 33| 2|#define secure_clean OQS_MEM_cleanse ------------------ 99| 2| return SUCCESS; ------------------ | | 12| 2|#define SUCCESS OQS_SUCCESS ------------------ 100| 2|} OQS_KEM_bike_l1_secure_set_bits_avx2: 23| 30|{ 24| | // The function assumes that the size of r is a multiple 25| | // of the cumulative size of used YMM registers. 26| 30| assert((sizeof(*r) / sizeof(uint64_t)) % YMMS_QWORDS == 0); 27| | 28| | // va vectors hold the bits of the output array "r" 29| | // va_pos_qw vectors hold the qw position indices of "r" 30| | // The algorithm works as follows: 31| | // 1. Initialize va_pos_qw with starting positions of qw's of "r" 32| | // va_pos_qw = (3, 2, 1, 0); 33| | // 2. While the size of "r" is not exceeded: 34| | // 3. For each w in wlist: 35| | // 4. Compare the pos_qw of w with positions in va_pos_qw 36| | // and for the position which is equal set the appropriate 37| | // bit in va vector. 38| | // 5. Set va_pos_qw to the next qw positions of "r" 39| 30| __m256i va[NUM_YMMS], va_pos_qw[NUM_YMMS], va_mask; 40| 30| __m256i w_pos_qw, w_pos_bit; 41| 30| __m256i one, inc; 42| | 43| 30| uint64_t *r64 = (uint64_t *)r; 44| | 45| 30| one = SET1_I64(1); ------------------ | | 71| 30|# define SET1_I64(a) _mm256_set1_epi64x(a) ------------------ 46| 30| inc = SET1_I64(QWORDS_IN_YMM); ------------------ | | 71| 30|# define SET1_I64(a) _mm256_set1_epi64x(a) ------------------ 47| | 48| | // 1. Initialize 49| 30| va_pos_qw[0] = SET_I64(3, 2, 1, 0); ------------------ | | 67| 30|# define SET_I64(...) _mm256_set_epi64x(__VA_ARGS__) ------------------ 50| 120| for(size_t i = 1; i < NUM_YMMS; i++) { ------------------ | | 16| 120|#define NUM_YMMS (4) ------------------ | Branch (50:21): [True: 90, False: 30] ------------------ 51| 90| va_pos_qw[i] = ADD_I64(va_pos_qw[i - 1], inc); ------------------ | | 80| 90|# define ADD_I64(a, b) _mm256_add_epi64(a, b) ------------------ 52| 90| } 53| | 54| | // va_pos_qw vectors hold qw positions 0 .. (NUM_YMMS * QWORDS_IN_YMM - 1) 55| | // Therefore, we set the increment vector inc such that by adding it to 56| | // va_pos_qw vectors, they hold the next YMM_QWORDS qw positions. 57| 30| inc = SET1_I64(YMMS_QWORDS); ------------------ | | 71| 30|# define SET1_I64(a) _mm256_set1_epi64x(a) ------------------ 58| | 59| 510| for(size_t i = 0; i < (sizeof(*r) / sizeof(uint64_t)); i += YMMS_QWORDS) { ------------------ | | 17| 480|#define YMMS_QWORDS (QWORDS_IN_YMM * NUM_YMMS) | | ------------------ | | | | 61| 480|#define QWORDS_IN_YMM (BYTES_IN_YMM / sizeof(uint64_t)) | | | | ------------------ | | | | | | 48| 480|#define BYTES_IN_YMM 0x20 | | | | ------------------ | | ------------------ | | #define YMMS_QWORDS (QWORDS_IN_YMM * NUM_YMMS) | | ------------------ | | | | 16| 480|#define NUM_YMMS (4) | | ------------------ ------------------ | Branch (59:21): [True: 480, False: 30] ------------------ 60| 2.40k| for(size_t va_iter = 0; va_iter < NUM_YMMS; va_iter++) { ------------------ | | 16| 2.40k|#define NUM_YMMS (4) ------------------ | Branch (60:29): [True: 1.92k, False: 480] ------------------ 61| 1.92k| va[va_iter] = SET_ZERO; ------------------ | | 72| 1.92k|# define SET_ZERO _mm256_setzero_si256() ------------------ 62| 1.92k| } 63| | 64| 54.7k| for(size_t w_iter = 0; w_iter < w_size; w_iter++) { ------------------ | Branch (64:28): [True: 54.2k, False: 480] ------------------ 65| 54.2k| int32_t w = wlist[w_iter] - first_pos; 66| 54.2k| w_pos_qw = SET1_I64(w >> 6); ------------------ | | 71| 54.2k|# define SET1_I64(a) _mm256_set1_epi64x(a) ------------------ 67| 54.2k| w_pos_bit = SLLI_I64(one, w & MASK(6)); ------------------ | | 31| 54.2k|# define SLLI_I64(a, imm) _mm256_slli_epi64(a, imm) ------------------ 68| | 69| | // 4. Compare the positions in va_pos_qw with w_pos_qw 70| | // and set the appropriate bit in va 71| 271k| for(size_t va_iter = 0; va_iter < NUM_YMMS; va_iter++) { ------------------ | | 16| 271k|#define NUM_YMMS (4) ------------------ | Branch (71:31): [True: 216k, False: 54.2k] ------------------ 72| 216k| va_mask = CMPEQ_I64(va_pos_qw[va_iter], w_pos_qw); ------------------ | | 89| 216k|# define CMPEQ_I64(a, b) _mm256_cmpeq_epi64(a, b) ------------------ 73| 216k| va[va_iter] |= (va_mask & w_pos_bit); 74| 216k| } 75| 54.2k| } 76| | 77| | // 5. Set the va_pos_qw to the next qw positions of r 78| | // and store the previously computed data in r 79| 2.40k| for(size_t va_iter = 0; va_iter < NUM_YMMS; va_iter++) { ------------------ | | 16| 2.40k|#define NUM_YMMS (4) ------------------ | Branch (79:29): [True: 1.92k, False: 480] ------------------ 80| 1.92k| STORE(&r64[i + (va_iter * QWORDS_IN_YMM)], va[va_iter]); ------------------ | | 29| 1.92k|# define STORE(mem, reg) _mm256_storeu_si256((void *)(mem), (reg)) ------------------ 81| 1.92k| va_pos_qw[va_iter] = ADD_I64(va_pos_qw[va_iter], inc); ------------------ | | 80| 1.92k|# define ADD_I64(a, b) _mm256_add_epi64(a, b) ------------------ 82| 1.92k| } 83| 480| } 84| 30|} OQS_KEM_bike_l3_secure_set_bits_avx2: 23| 6|{ 24| | // The function assumes that the size of r is a multiple 25| | // of the cumulative size of used YMM registers. 26| 6| assert((sizeof(*r) / sizeof(uint64_t)) % YMMS_QWORDS == 0); 27| | 28| | // va vectors hold the bits of the output array "r" 29| | // va_pos_qw vectors hold the qw position indices of "r" 30| | // The algorithm works as follows: 31| | // 1. Initialize va_pos_qw with starting positions of qw's of "r" 32| | // va_pos_qw = (3, 2, 1, 0); 33| | // 2. While the size of "r" is not exceeded: 34| | // 3. For each w in wlist: 35| | // 4. Compare the pos_qw of w with positions in va_pos_qw 36| | // and for the position which is equal set the appropriate 37| | // bit in va vector. 38| | // 5. Set va_pos_qw to the next qw positions of "r" 39| 6| __m256i va[NUM_YMMS], va_pos_qw[NUM_YMMS], va_mask; 40| 6| __m256i w_pos_qw, w_pos_bit; 41| 6| __m256i one, inc; 42| | 43| 6| uint64_t *r64 = (uint64_t *)r; 44| | 45| 6| one = SET1_I64(1); ------------------ | | 71| 6|# define SET1_I64(a) _mm256_set1_epi64x(a) ------------------ 46| 6| inc = SET1_I64(QWORDS_IN_YMM); ------------------ | | 71| 6|# define SET1_I64(a) _mm256_set1_epi64x(a) ------------------ 47| | 48| | // 1. Initialize 49| 6| va_pos_qw[0] = SET_I64(3, 2, 1, 0); ------------------ | | 67| 6|# define SET_I64(...) _mm256_set_epi64x(__VA_ARGS__) ------------------ 50| 24| for(size_t i = 1; i < NUM_YMMS; i++) { ------------------ | | 16| 24|#define NUM_YMMS (4) ------------------ | Branch (50:21): [True: 18, False: 6] ------------------ 51| 18| va_pos_qw[i] = ADD_I64(va_pos_qw[i - 1], inc); ------------------ | | 80| 18|# define ADD_I64(a, b) _mm256_add_epi64(a, b) ------------------ 52| 18| } 53| | 54| | // va_pos_qw vectors hold qw positions 0 .. (NUM_YMMS * QWORDS_IN_YMM - 1) 55| | // Therefore, we set the increment vector inc such that by adding it to 56| | // va_pos_qw vectors, they hold the next YMM_QWORDS qw positions. 57| 6| inc = SET1_I64(YMMS_QWORDS); ------------------ | | 71| 6|# define SET1_I64(a) _mm256_set1_epi64x(a) ------------------ 58| | 59| 198| for(size_t i = 0; i < (sizeof(*r) / sizeof(uint64_t)); i += YMMS_QWORDS) { ------------------ | | 17| 192|#define YMMS_QWORDS (QWORDS_IN_YMM * NUM_YMMS) | | ------------------ | | | | 61| 192|#define QWORDS_IN_YMM (BYTES_IN_YMM / sizeof(uint64_t)) | | | | ------------------ | | | | | | 48| 192|#define BYTES_IN_YMM 0x20 | | | | ------------------ | | ------------------ | | #define YMMS_QWORDS (QWORDS_IN_YMM * NUM_YMMS) | | ------------------ | | | | 16| 192|#define NUM_YMMS (4) | | ------------------ ------------------ | Branch (59:21): [True: 192, False: 6] ------------------ 60| 960| for(size_t va_iter = 0; va_iter < NUM_YMMS; va_iter++) { ------------------ | | 16| 960|#define NUM_YMMS (4) ------------------ | Branch (60:29): [True: 768, False: 192] ------------------ 61| 768| va[va_iter] = SET_ZERO; ------------------ | | 72| 768|# define SET_ZERO _mm256_setzero_si256() ------------------ 62| 768| } 63| | 64| 32.2k| for(size_t w_iter = 0; w_iter < w_size; w_iter++) { ------------------ | Branch (64:28): [True: 32.0k, False: 192] ------------------ 65| 32.0k| int32_t w = wlist[w_iter] - first_pos; 66| 32.0k| w_pos_qw = SET1_I64(w >> 6); ------------------ | | 71| 32.0k|# define SET1_I64(a) _mm256_set1_epi64x(a) ------------------ 67| 32.0k| w_pos_bit = SLLI_I64(one, w & MASK(6)); ------------------ | | 31| 32.0k|# define SLLI_I64(a, imm) _mm256_slli_epi64(a, imm) ------------------ 68| | 69| | // 4. Compare the positions in va_pos_qw with w_pos_qw 70| | // and set the appropriate bit in va 71| 160k| for(size_t va_iter = 0; va_iter < NUM_YMMS; va_iter++) { ------------------ | | 16| 160k|#define NUM_YMMS (4) ------------------ | Branch (71:31): [True: 128k, False: 32.0k] ------------------ 72| 128k| va_mask = CMPEQ_I64(va_pos_qw[va_iter], w_pos_qw); ------------------ | | 89| 128k|# define CMPEQ_I64(a, b) _mm256_cmpeq_epi64(a, b) ------------------ 73| 128k| va[va_iter] |= (va_mask & w_pos_bit); 74| 128k| } 75| 32.0k| } 76| | 77| | // 5. Set the va_pos_qw to the next qw positions of r 78| | // and store the previously computed data in r 79| 960| for(size_t va_iter = 0; va_iter < NUM_YMMS; va_iter++) { ------------------ | | 16| 960|#define NUM_YMMS (4) ------------------ | Branch (79:29): [True: 768, False: 192] ------------------ 80| 768| STORE(&r64[i + (va_iter * QWORDS_IN_YMM)], va[va_iter]); ------------------ | | 29| 768|# define STORE(mem, reg) _mm256_storeu_si256((void *)(mem), (reg)) ------------------ 81| 768| va_pos_qw[va_iter] = ADD_I64(va_pos_qw[va_iter], inc); ------------------ | | 80| 768|# define ADD_I64(a, b) _mm256_add_epi64(a, b) ------------------ 82| 768| } 83| 192| } 84| 6|} OQS_KEM_bike_l5_secure_set_bits_avx2: 23| 6|{ 24| | // The function assumes that the size of r is a multiple 25| | // of the cumulative size of used YMM registers. 26| 6| assert((sizeof(*r) / sizeof(uint64_t)) % YMMS_QWORDS == 0); 27| | 28| | // va vectors hold the bits of the output array "r" 29| | // va_pos_qw vectors hold the qw position indices of "r" 30| | // The algorithm works as follows: 31| | // 1. Initialize va_pos_qw with starting positions of qw's of "r" 32| | // va_pos_qw = (3, 2, 1, 0); 33| | // 2. While the size of "r" is not exceeded: 34| | // 3. For each w in wlist: 35| | // 4. Compare the pos_qw of w with positions in va_pos_qw 36| | // and for the position which is equal set the appropriate 37| | // bit in va vector. 38| | // 5. Set va_pos_qw to the next qw positions of "r" 39| 6| __m256i va[NUM_YMMS], va_pos_qw[NUM_YMMS], va_mask; 40| 6| __m256i w_pos_qw, w_pos_bit; 41| 6| __m256i one, inc; 42| | 43| 6| uint64_t *r64 = (uint64_t *)r; 44| | 45| 6| one = SET1_I64(1); ------------------ | | 71| 6|# define SET1_I64(a) _mm256_set1_epi64x(a) ------------------ 46| 6| inc = SET1_I64(QWORDS_IN_YMM); ------------------ | | 71| 6|# define SET1_I64(a) _mm256_set1_epi64x(a) ------------------ 47| | 48| | // 1. Initialize 49| 6| va_pos_qw[0] = SET_I64(3, 2, 1, 0); ------------------ | | 67| 6|# define SET_I64(...) _mm256_set_epi64x(__VA_ARGS__) ------------------ 50| 24| for(size_t i = 1; i < NUM_YMMS; i++) { ------------------ | | 16| 24|#define NUM_YMMS (4) ------------------ | Branch (50:21): [True: 18, False: 6] ------------------ 51| 18| va_pos_qw[i] = ADD_I64(va_pos_qw[i - 1], inc); ------------------ | | 80| 18|# define ADD_I64(a, b) _mm256_add_epi64(a, b) ------------------ 52| 18| } 53| | 54| | // va_pos_qw vectors hold qw positions 0 .. (NUM_YMMS * QWORDS_IN_YMM - 1) 55| | // Therefore, we set the increment vector inc such that by adding it to 56| | // va_pos_qw vectors, they hold the next YMM_QWORDS qw positions. 57| 6| inc = SET1_I64(YMMS_QWORDS); ------------------ | | 71| 6|# define SET1_I64(a) _mm256_set1_epi64x(a) ------------------ 58| | 59| 390| for(size_t i = 0; i < (sizeof(*r) / sizeof(uint64_t)); i += YMMS_QWORDS) { ------------------ | | 17| 384|#define YMMS_QWORDS (QWORDS_IN_YMM * NUM_YMMS) | | ------------------ | | | | 61| 384|#define QWORDS_IN_YMM (BYTES_IN_YMM / sizeof(uint64_t)) | | | | ------------------ | | | | | | 48| 384|#define BYTES_IN_YMM 0x20 | | | | ------------------ | | ------------------ | | #define YMMS_QWORDS (QWORDS_IN_YMM * NUM_YMMS) | | ------------------ | | | | 16| 384|#define NUM_YMMS (4) | | ------------------ ------------------ | Branch (59:21): [True: 384, False: 6] ------------------ 60| 1.92k| for(size_t va_iter = 0; va_iter < NUM_YMMS; va_iter++) { ------------------ | | 16| 1.92k|#define NUM_YMMS (4) ------------------ | Branch (60:29): [True: 1.53k, False: 384] ------------------ 61| 1.53k| va[va_iter] = SET_ZERO; ------------------ | | 72| 1.53k|# define SET_ZERO _mm256_setzero_si256() ------------------ 62| 1.53k| } 63| | 64| 85.5k| for(size_t w_iter = 0; w_iter < w_size; w_iter++) { ------------------ | Branch (64:28): [True: 85.1k, False: 384] ------------------ 65| 85.1k| int32_t w = wlist[w_iter] - first_pos; 66| 85.1k| w_pos_qw = SET1_I64(w >> 6); ------------------ | | 71| 85.1k|# define SET1_I64(a) _mm256_set1_epi64x(a) ------------------ 67| 85.1k| w_pos_bit = SLLI_I64(one, w & MASK(6)); ------------------ | | 31| 85.1k|# define SLLI_I64(a, imm) _mm256_slli_epi64(a, imm) ------------------ 68| | 69| | // 4. Compare the positions in va_pos_qw with w_pos_qw 70| | // and set the appropriate bit in va 71| 425k| for(size_t va_iter = 0; va_iter < NUM_YMMS; va_iter++) { ------------------ | | 16| 425k|#define NUM_YMMS (4) ------------------ | Branch (71:31): [True: 340k, False: 85.1k] ------------------ 72| 340k| va_mask = CMPEQ_I64(va_pos_qw[va_iter], w_pos_qw); ------------------ | | 89| 340k|# define CMPEQ_I64(a, b) _mm256_cmpeq_epi64(a, b) ------------------ 73| 340k| va[va_iter] |= (va_mask & w_pos_bit); 74| 340k| } 75| 85.1k| } 76| | 77| | // 5. Set the va_pos_qw to the next qw positions of r 78| | // and store the previously computed data in r 79| 1.92k| for(size_t va_iter = 0; va_iter < NUM_YMMS; va_iter++) { ------------------ | | 16| 1.92k|#define NUM_YMMS (4) ------------------ | Branch (79:29): [True: 1.53k, False: 384] ------------------ 80| 1.53k| STORE(&r64[i + (va_iter * QWORDS_IN_YMM)], va[va_iter]); ------------------ | | 29| 1.53k|# define STORE(mem, reg) _mm256_storeu_si256((void *)(mem), (reg)) ------------------ 81| 1.53k| va_pos_qw[va_iter] = ADD_I64(va_pos_qw[va_iter], inc); ------------------ | | 80| 1.53k|# define ADD_I64(a, b) _mm256_add_epi64(a, b) ------------------ 82| 1.53k| } 83| 384| } 84| 6|} sampling.c:OQS_KEM_bike_l1_sampling_ctx_init: 39| 15|{ 40| 15|#if defined(X86_64) 41| 15|#if defined(OQS_DIST_X86_64_BUILD) || defined(OQS_USE_AVX512_INSTRUCTIONS) 42| 15| if(is_avx512_enabled()) { ------------------ | | 98| 15|#define is_avx512_enabled RENAME_FUNC_NAME(is_avx512_enabled) | | ------------------ | | | | 44| 15|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 15|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 15|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ | Branch (42:6): [True: 0, False: 15] ------------------ 43| 0| ctx->secure_set_bits = secure_set_bits_avx512; ------------------ | | 61| 0|#define secure_set_bits RENAME_FUNC_NAME(secure_set_bits) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ ctx->secure_set_bits = secure_set_bits_avx512; ------------------ | | 137| 0|#define secure_set_bits_avx512 RENAME_FUNC_NAME(secure_set_bits_avx512) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 44| 0| } else 45| 15|#endif 46| 15|#if defined(OQS_DIST_X86_64_BUILD) || defined(OQS_USE_AVX2_INSTRUCTIONS) 47| 15| if(is_avx2_enabled()) { ------------------ | | 97| 15|#define is_avx2_enabled RENAME_FUNC_NAME(is_avx2_enabled) | | ------------------ | | | | 44| 15|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 15|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 15|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ | Branch (47:6): [True: 15, False: 0] ------------------ 48| 15| ctx->secure_set_bits = secure_set_bits_avx2; ------------------ | | 61| 15|#define secure_set_bits RENAME_FUNC_NAME(secure_set_bits) | | ------------------ | | | | 44| 15|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 15|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 15|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ ctx->secure_set_bits = secure_set_bits_avx2; ------------------ | | 136| 15|#define secure_set_bits_avx2 RENAME_FUNC_NAME(secure_set_bits_avx2) | | ------------------ | | | | 44| 15|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 15|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 15|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 49| 15| } else 50| 0|#endif 51| 0|#endif 52| 0| { 53| 0| ctx->secure_set_bits = secure_set_bits_port; ------------------ | | 61| 0|#define secure_set_bits RENAME_FUNC_NAME(secure_set_bits) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ ctx->secure_set_bits = secure_set_bits_port; ------------------ | | 135| 0|#define secure_set_bits_port RENAME_FUNC_NAME(secure_set_bits_port) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 54| 0| } 55| 15|} sampling.c:OQS_KEM_bike_l3_sampling_ctx_init: 39| 3|{ 40| 3|#if defined(X86_64) 41| 3|#if defined(OQS_DIST_X86_64_BUILD) || defined(OQS_USE_AVX512_INSTRUCTIONS) 42| 3| if(is_avx512_enabled()) { ------------------ | | 98| 3|#define is_avx512_enabled RENAME_FUNC_NAME(is_avx512_enabled) | | ------------------ | | | | 44| 3|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 3|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 3|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ | Branch (42:6): [True: 0, False: 3] ------------------ 43| 0| ctx->secure_set_bits = secure_set_bits_avx512; ------------------ | | 61| 0|#define secure_set_bits RENAME_FUNC_NAME(secure_set_bits) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ ctx->secure_set_bits = secure_set_bits_avx512; ------------------ | | 137| 0|#define secure_set_bits_avx512 RENAME_FUNC_NAME(secure_set_bits_avx512) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 44| 0| } else 45| 3|#endif 46| 3|#if defined(OQS_DIST_X86_64_BUILD) || defined(OQS_USE_AVX2_INSTRUCTIONS) 47| 3| if(is_avx2_enabled()) { ------------------ | | 97| 3|#define is_avx2_enabled RENAME_FUNC_NAME(is_avx2_enabled) | | ------------------ | | | | 44| 3|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 3|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 3|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ | Branch (47:6): [True: 3, False: 0] ------------------ 48| 3| ctx->secure_set_bits = secure_set_bits_avx2; ------------------ | | 61| 3|#define secure_set_bits RENAME_FUNC_NAME(secure_set_bits) | | ------------------ | | | | 44| 3|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 3|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 3|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ ctx->secure_set_bits = secure_set_bits_avx2; ------------------ | | 136| 3|#define secure_set_bits_avx2 RENAME_FUNC_NAME(secure_set_bits_avx2) | | ------------------ | | | | 44| 3|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 3|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 3|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 49| 3| } else 50| 0|#endif 51| 0|#endif 52| 0| { 53| 0| ctx->secure_set_bits = secure_set_bits_port; ------------------ | | 61| 0|#define secure_set_bits RENAME_FUNC_NAME(secure_set_bits) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ ctx->secure_set_bits = secure_set_bits_port; ------------------ | | 135| 0|#define secure_set_bits_port RENAME_FUNC_NAME(secure_set_bits_port) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 54| 0| } 55| 3|} sampling.c:OQS_KEM_bike_l5_sampling_ctx_init: 39| 3|{ 40| 3|#if defined(X86_64) 41| 3|#if defined(OQS_DIST_X86_64_BUILD) || defined(OQS_USE_AVX512_INSTRUCTIONS) 42| 3| if(is_avx512_enabled()) { ------------------ | | 98| 3|#define is_avx512_enabled RENAME_FUNC_NAME(is_avx512_enabled) | | ------------------ | | | | 44| 3|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 3|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 3|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ | Branch (42:6): [True: 0, False: 3] ------------------ 43| 0| ctx->secure_set_bits = secure_set_bits_avx512; ------------------ | | 61| 0|#define secure_set_bits RENAME_FUNC_NAME(secure_set_bits) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ ctx->secure_set_bits = secure_set_bits_avx512; ------------------ | | 137| 0|#define secure_set_bits_avx512 RENAME_FUNC_NAME(secure_set_bits_avx512) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 44| 0| } else 45| 3|#endif 46| 3|#if defined(OQS_DIST_X86_64_BUILD) || defined(OQS_USE_AVX2_INSTRUCTIONS) 47| 3| if(is_avx2_enabled()) { ------------------ | | 97| 3|#define is_avx2_enabled RENAME_FUNC_NAME(is_avx2_enabled) | | ------------------ | | | | 44| 3|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 3|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 3|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ | Branch (47:6): [True: 3, False: 0] ------------------ 48| 3| ctx->secure_set_bits = secure_set_bits_avx2; ------------------ | | 61| 3|#define secure_set_bits RENAME_FUNC_NAME(secure_set_bits) | | ------------------ | | | | 44| 3|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 3|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 3|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ ctx->secure_set_bits = secure_set_bits_avx2; ------------------ | | 136| 3|#define secure_set_bits_avx2 RENAME_FUNC_NAME(secure_set_bits_avx2) | | ------------------ | | | | 44| 3|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 3|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 3|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 49| 3| } else 50| 0|#endif 51| 0|#endif 52| 0| { 53| 0| ctx->secure_set_bits = secure_set_bits_port; ------------------ | | 61| 0|#define secure_set_bits RENAME_FUNC_NAME(secure_set_bits) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ ctx->secure_set_bits = secure_set_bits_port; ------------------ | | 135| 0|#define secure_set_bits_port RENAME_FUNC_NAME(secure_set_bits_port) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 54| 0| } 55| 3|} kem.c:sha_dgst_cleanup: 27| 28|sha_dgst_cleanup(IN OUT sha_dgst_t *o) { 28| 28| secure_clean(o->u.raw, sizeof(*o)); ------------------ | | 33| 28|#define secure_clean OQS_MEM_cleanse ------------------ 29| 28|} kem.c:OQS_KEM_bike_l1_sha: 32| 20|sha(OUT sha_dgst_t *hash_out, IN const uint32_t byte_len, IN const uint8_t *msg) { 33| 20| OQS_SHA3_sha3_384(hash_out->u.raw, msg, byte_len); 34| 20| return SUCCESS; ------------------ | | 12| 20|#define SUCCESS OQS_SUCCESS ------------------ 35| 20|} kem.c:OQS_KEM_bike_l3_sha: 32| 4|sha(OUT sha_dgst_t *hash_out, IN const uint32_t byte_len, IN const uint8_t *msg) { 33| 4| OQS_SHA3_sha3_384(hash_out->u.raw, msg, byte_len); 34| 4| return SUCCESS; ------------------ | | 12| 4|#define SUCCESS OQS_SUCCESS ------------------ 35| 4|} kem.c:OQS_KEM_bike_l5_sha: 32| 4|sha(OUT sha_dgst_t *hash_out, IN const uint32_t byte_len, IN const uint8_t *msg) { 33| 4| OQS_SHA3_sha3_384(hash_out->u.raw, msg, byte_len); 34| 4| return SUCCESS; ------------------ | | 12| 4|#define SUCCESS OQS_SUCCESS ------------------ 35| 4|} OQS_KEM_bike_l1_init_prf_state: 14| 15|{ 15| 15| if(0 == max_num_invocations) { ------------------ | Branch (15:6): [True: 0, False: 15] ------------------ 16| 0| BIKE_ERROR(E_SHAKE_PRF_INIT_FAIL); ------------------ | | 31| 0| do { \ | | 32| 0| bike_errno = (x); \ | | ------------------ | | | | 68| 0|#define bike_errno RENAME_FUNC_NAME(bike_errno) | | | | ------------------ | | | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | | | ------------------ | | | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | | | ------------------ | | | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ | | 33| 0| return FAIL; \ | | ------------------ | | | | 13| 0|#define FAIL OQS_ERROR | | ------------------ | | 34| 0| } while(0) | | ------------------ | | | Branch (34:11): [Folded, False: 0] | | ------------------ ------------------ 17| 0| } 18| | 19| 15| OQS_SHA3_shake256_inc_init(&s->s); 20| | 21| | // Initialize the SHAKE state with the given seed. 22| 15| OQS_SHA3_shake256_inc_absorb(&s->s, seed->raw, sizeof(*seed)); 23| | 24| 15| OQS_SHA3_shake256_inc_finalize(&s->s); 25| | 26| | // Initialize the PRF parameters. 27| 15| s->curr_pos_in_buffer = OQS_SHA3_SHAKE256_RATE; ------------------ | | 320| 15|#define OQS_SHA3_SHAKE256_RATE 136 ------------------ 28| 15| s->rem_invocations = max_num_invocations; 29| | 30| 15| return SUCCESS; ------------------ | | 12| 15|#define SUCCESS OQS_SUCCESS ------------------ 31| 15|} OQS_KEM_bike_l1_get_prf_output: 35| 2.05k|{ 36| | // Check if the maximum number of SHAKE invocations is reached. 37| 2.05k| if (s->rem_invocations == 0) ------------------ | Branch (37:7): [True: 0, False: 2.05k] ------------------ 38| 0| { 39| 0| BIKE_ERROR(E_SHAKE_OVER_USED); ------------------ | | 31| 0| do { \ | | 32| 0| bike_errno = (x); \ | | ------------------ | | | | 68| 0|#define bike_errno RENAME_FUNC_NAME(bike_errno) | | | | ------------------ | | | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | | | ------------------ | | | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | | | ------------------ | | | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ | | 33| 0| return FAIL; \ | | ------------------ | | | | 13| 0|#define FAIL OQS_ERROR | | ------------------ | | 34| 0| } while(0) | | ------------------ | | | Branch (34:11): [Folded, False: 0] | | ------------------ ------------------ 40| 0| } 41| | 42| | // When |len| is smaller then use what's left in the buffer, 43| | // there is no need for additional SHAKE256 invocations. 44| 2.05k| if((len + s->curr_pos_in_buffer) <= OQS_SHA3_SHAKE256_RATE) { ------------------ | | 320| 2.05k|#define OQS_SHA3_SHAKE256_RATE 136 ------------------ | Branch (44:6): [True: 1.98k, False: 65] ------------------ 45| 1.98k| bike_memcpy(out, &s->buffer[s->curr_pos_in_buffer], len); 46| 1.98k| s->curr_pos_in_buffer += len; 47| | 48| 1.98k| return SUCCESS; ------------------ | | 12| 1.98k|#define SUCCESS OQS_SUCCESS ------------------ 49| 1.98k| } 50| | 51| | // Generate one block (SHAKE256_RATE bytes) of random data with SHAKE256. 52| 65| OQS_SHA3_shake256_inc_squeeze(s->buffer, OQS_SHA3_SHAKE256_RATE, &s->s); ------------------ | | 320| 65|#define OQS_SHA3_SHAKE256_RATE 136 ------------------ 53| | 54| | // Copy |len| bytes to the output, set the new buffer position indicator, 55| | // and update the remaining allowable number of SHAKE invocations. 56| 65| bike_memcpy(out, s->buffer, len); 57| 65| s->curr_pos_in_buffer = len; 58| 65| s->rem_invocations -= 1; 59| | 60| 65| return SUCCESS; ------------------ | | 12| 65|#define SUCCESS OQS_SUCCESS ------------------ 61| 2.05k|} OQS_KEM_bike_l1_clean_prf_state: 64| 15|{ 65| 15| OQS_SHA3_shake256_inc_ctx_release(&s->s); 66| 15| secure_clean((uint8_t*)s, sizeof(*s)); ------------------ | | 33| 15|#define secure_clean OQS_MEM_cleanse ------------------ 67| 15|} OQS_KEM_bike_l3_init_prf_state: 14| 3|{ 15| 3| if(0 == max_num_invocations) { ------------------ | Branch (15:6): [True: 0, False: 3] ------------------ 16| 0| BIKE_ERROR(E_SHAKE_PRF_INIT_FAIL); ------------------ | | 31| 0| do { \ | | 32| 0| bike_errno = (x); \ | | ------------------ | | | | 68| 0|#define bike_errno RENAME_FUNC_NAME(bike_errno) | | | | ------------------ | | | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | | | ------------------ | | | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | | | ------------------ | | | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ | | 33| 0| return FAIL; \ | | ------------------ | | | | 13| 0|#define FAIL OQS_ERROR | | ------------------ | | 34| 0| } while(0) | | ------------------ | | | Branch (34:11): [Folded, False: 0] | | ------------------ ------------------ 17| 0| } 18| | 19| 3| OQS_SHA3_shake256_inc_init(&s->s); 20| | 21| | // Initialize the SHAKE state with the given seed. 22| 3| OQS_SHA3_shake256_inc_absorb(&s->s, seed->raw, sizeof(*seed)); 23| | 24| 3| OQS_SHA3_shake256_inc_finalize(&s->s); 25| | 26| | // Initialize the PRF parameters. 27| 3| s->curr_pos_in_buffer = OQS_SHA3_SHAKE256_RATE; ------------------ | | 320| 3|#define OQS_SHA3_SHAKE256_RATE 136 ------------------ 28| 3| s->rem_invocations = max_num_invocations; 29| | 30| 3| return SUCCESS; ------------------ | | 12| 3|#define SUCCESS OQS_SUCCESS ------------------ 31| 3|} OQS_KEM_bike_l3_get_prf_output: 35| 604|{ 36| | // Check if the maximum number of SHAKE invocations is reached. 37| 604| if (s->rem_invocations == 0) ------------------ | Branch (37:7): [True: 0, False: 604] ------------------ 38| 0| { 39| 0| BIKE_ERROR(E_SHAKE_OVER_USED); ------------------ | | 31| 0| do { \ | | 32| 0| bike_errno = (x); \ | | ------------------ | | | | 68| 0|#define bike_errno RENAME_FUNC_NAME(bike_errno) | | | | ------------------ | | | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | | | ------------------ | | | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | | | ------------------ | | | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ | | 33| 0| return FAIL; \ | | ------------------ | | | | 13| 0|#define FAIL OQS_ERROR | | ------------------ | | 34| 0| } while(0) | | ------------------ | | | Branch (34:11): [Folded, False: 0] | | ------------------ ------------------ 40| 0| } 41| | 42| | // When |len| is smaller then use what's left in the buffer, 43| | // there is no need for additional SHAKE256 invocations. 44| 604| if((len + s->curr_pos_in_buffer) <= OQS_SHA3_SHAKE256_RATE) { ------------------ | | 320| 604|#define OQS_SHA3_SHAKE256_RATE 136 ------------------ | Branch (44:6): [True: 585, False: 19] ------------------ 45| 585| bike_memcpy(out, &s->buffer[s->curr_pos_in_buffer], len); 46| 585| s->curr_pos_in_buffer += len; 47| | 48| 585| return SUCCESS; ------------------ | | 12| 585|#define SUCCESS OQS_SUCCESS ------------------ 49| 585| } 50| | 51| | // Generate one block (SHAKE256_RATE bytes) of random data with SHAKE256. 52| 19| OQS_SHA3_shake256_inc_squeeze(s->buffer, OQS_SHA3_SHAKE256_RATE, &s->s); ------------------ | | 320| 19|#define OQS_SHA3_SHAKE256_RATE 136 ------------------ 53| | 54| | // Copy |len| bytes to the output, set the new buffer position indicator, 55| | // and update the remaining allowable number of SHAKE invocations. 56| 19| bike_memcpy(out, s->buffer, len); 57| 19| s->curr_pos_in_buffer = len; 58| 19| s->rem_invocations -= 1; 59| | 60| 19| return SUCCESS; ------------------ | | 12| 19|#define SUCCESS OQS_SUCCESS ------------------ 61| 604|} OQS_KEM_bike_l3_clean_prf_state: 64| 3|{ 65| 3| OQS_SHA3_shake256_inc_ctx_release(&s->s); 66| 3| secure_clean((uint8_t*)s, sizeof(*s)); ------------------ | | 33| 3|#define secure_clean OQS_MEM_cleanse ------------------ 67| 3|} OQS_KEM_bike_l5_init_prf_state: 14| 3|{ 15| 3| if(0 == max_num_invocations) { ------------------ | Branch (15:6): [True: 0, False: 3] ------------------ 16| 0| BIKE_ERROR(E_SHAKE_PRF_INIT_FAIL); ------------------ | | 31| 0| do { \ | | 32| 0| bike_errno = (x); \ | | ------------------ | | | | 68| 0|#define bike_errno RENAME_FUNC_NAME(bike_errno) | | | | ------------------ | | | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | | | ------------------ | | | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | | | ------------------ | | | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ | | 33| 0| return FAIL; \ | | ------------------ | | | | 13| 0|#define FAIL OQS_ERROR | | ------------------ | | 34| 0| } while(0) | | ------------------ | | | Branch (34:11): [Folded, False: 0] | | ------------------ ------------------ 17| 0| } 18| | 19| 3| OQS_SHA3_shake256_inc_init(&s->s); 20| | 21| | // Initialize the SHAKE state with the given seed. 22| 3| OQS_SHA3_shake256_inc_absorb(&s->s, seed->raw, sizeof(*seed)); 23| | 24| 3| OQS_SHA3_shake256_inc_finalize(&s->s); 25| | 26| | // Initialize the PRF parameters. 27| 3| s->curr_pos_in_buffer = OQS_SHA3_SHAKE256_RATE; ------------------ | | 320| 3|#define OQS_SHA3_SHAKE256_RATE 136 ------------------ 28| 3| s->rem_invocations = max_num_invocations; 29| | 30| 3| return SUCCESS; ------------------ | | 12| 3|#define SUCCESS OQS_SUCCESS ------------------ 31| 3|} OQS_KEM_bike_l5_get_prf_output: 35| 802|{ 36| | // Check if the maximum number of SHAKE invocations is reached. 37| 802| if (s->rem_invocations == 0) ------------------ | Branch (37:7): [True: 0, False: 802] ------------------ 38| 0| { 39| 0| BIKE_ERROR(E_SHAKE_OVER_USED); ------------------ | | 31| 0| do { \ | | 32| 0| bike_errno = (x); \ | | ------------------ | | | | 68| 0|#define bike_errno RENAME_FUNC_NAME(bike_errno) | | | | ------------------ | | | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | | | ------------------ | | | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | | | ------------------ | | | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ | | 33| 0| return FAIL; \ | | ------------------ | | | | 13| 0|#define FAIL OQS_ERROR | | ------------------ | | 34| 0| } while(0) | | ------------------ | | | Branch (34:11): [Folded, False: 0] | | ------------------ ------------------ 40| 0| } 41| | 42| | // When |len| is smaller then use what's left in the buffer, 43| | // there is no need for additional SHAKE256 invocations. 44| 802| if((len + s->curr_pos_in_buffer) <= OQS_SHA3_SHAKE256_RATE) { ------------------ | | 320| 802|#define OQS_SHA3_SHAKE256_RATE 136 ------------------ | Branch (44:6): [True: 777, False: 25] ------------------ 45| 777| bike_memcpy(out, &s->buffer[s->curr_pos_in_buffer], len); 46| 777| s->curr_pos_in_buffer += len; 47| | 48| 777| return SUCCESS; ------------------ | | 12| 777|#define SUCCESS OQS_SUCCESS ------------------ 49| 777| } 50| | 51| | // Generate one block (SHAKE256_RATE bytes) of random data with SHAKE256. 52| 25| OQS_SHA3_shake256_inc_squeeze(s->buffer, OQS_SHA3_SHAKE256_RATE, &s->s); ------------------ | | 320| 25|#define OQS_SHA3_SHAKE256_RATE 136 ------------------ 53| | 54| | // Copy |len| bytes to the output, set the new buffer position indicator, 55| | // and update the remaining allowable number of SHAKE invocations. 56| 25| bike_memcpy(out, s->buffer, len); 57| 25| s->curr_pos_in_buffer = len; 58| 25| s->rem_invocations -= 1; 59| | 60| 25| return SUCCESS; ------------------ | | 12| 25|#define SUCCESS OQS_SUCCESS ------------------ 61| 802|} OQS_KEM_bike_l5_clean_prf_state: 64| 3|{ 65| 3| OQS_SHA3_shake256_inc_ctx_release(&s->s); 66| 3| secure_clean((uint8_t*)s, sizeof(*s)); ------------------ | | 33| 3|#define secure_clean OQS_MEM_cleanse ------------------ 67| 3|} OQS_KEM_bike_l1_r_bits_vector_weight: 16| 25|{ 17| 25| uint64_t acc = 0; 18| 38.5k| for(size_t i = 0; i < (R_BYTES - 1); i++) { ------------------ | | 81| 38.5k|#define R_BYTES DIVIDE_AND_CEIL(R_BITS, 8) | | ------------------ | | | | 37| 38.5k|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | ------------------ ------------------ | Branch (18:21): [True: 38.5k, False: 25] ------------------ 19| 38.5k| acc += __builtin_popcount(in->raw[i]); 20| 38.5k| } 21| | 22| 25| acc += __builtin_popcount(in->raw[R_BYTES - 1] & LAST_R_BYTE_MASK); ------------------ | | 81| 25|#define R_BYTES DIVIDE_AND_CEIL(R_BITS, 8) | | ------------------ | | | | 37| 25|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | ------------------ ------------------ acc += __builtin_popcount(in->raw[R_BYTES - 1] & LAST_R_BYTE_MASK); ------------------ | | 98| 25|#define LAST_R_BYTE_MASK MASK(LAST_R_BYTE_LEAD) | | ------------------ | | | | 43| 25|#define MASK(len) (BIT(len) - 1) | | | | ------------------ | | | | | | 42| 25|#define BIT(len) (1ULL << (len)) | | | | ------------------ | | ------------------ ------------------ 23| 25| return acc; 24| 25|} OQS_KEM_bike_l3_r_bits_vector_weight: 16| 5|{ 17| 5| uint64_t acc = 0; 18| 15.4k| for(size_t i = 0; i < (R_BYTES - 1); i++) { ------------------ | | 81| 15.4k|#define R_BYTES DIVIDE_AND_CEIL(R_BITS, 8) | | ------------------ | | | | 37| 15.4k|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | ------------------ ------------------ | Branch (18:21): [True: 15.4k, False: 5] ------------------ 19| 15.4k| acc += __builtin_popcount(in->raw[i]); 20| 15.4k| } 21| | 22| 5| acc += __builtin_popcount(in->raw[R_BYTES - 1] & LAST_R_BYTE_MASK); ------------------ | | 81| 5|#define R_BYTES DIVIDE_AND_CEIL(R_BITS, 8) | | ------------------ | | | | 37| 5|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | ------------------ ------------------ acc += __builtin_popcount(in->raw[R_BYTES - 1] & LAST_R_BYTE_MASK); ------------------ | | 98| 5|#define LAST_R_BYTE_MASK MASK(LAST_R_BYTE_LEAD) | | ------------------ | | | | 43| 5|#define MASK(len) (BIT(len) - 1) | | | | ------------------ | | | | | | 42| 5|#define BIT(len) (1ULL << (len)) | | | | ------------------ | | ------------------ ------------------ 23| 5| return acc; 24| 5|} OQS_KEM_bike_l5_r_bits_vector_weight: 16| 5|{ 17| 5| uint64_t acc = 0; 18| 25.6k| for(size_t i = 0; i < (R_BYTES - 1); i++) { ------------------ | | 81| 25.6k|#define R_BYTES DIVIDE_AND_CEIL(R_BITS, 8) | | ------------------ | | | | 37| 25.6k|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | ------------------ ------------------ | Branch (18:21): [True: 25.6k, False: 5] ------------------ 19| 25.6k| acc += __builtin_popcount(in->raw[i]); 20| 25.6k| } 21| | 22| 5| acc += __builtin_popcount(in->raw[R_BYTES - 1] & LAST_R_BYTE_MASK); ------------------ | | 81| 5|#define R_BYTES DIVIDE_AND_CEIL(R_BITS, 8) | | ------------------ | | | | 37| 5|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | ------------------ ------------------ acc += __builtin_popcount(in->raw[R_BYTES - 1] & LAST_R_BYTE_MASK); ------------------ | | 98| 5|#define LAST_R_BYTE_MASK MASK(LAST_R_BYTE_LEAD) | | ------------------ | | | | 43| 5|#define MASK(len) (BIT(len) - 1) | | | | ------------------ | | | | | | 42| 5|#define BIT(len) (1ULL << (len)) | | | | ------------------ | | ------------------ ------------------ 23| 5| return acc; 24| 5|} kem.c:bike_memcpy: 148| 112|{ 149| 112| if(byte_len == 0) { ------------------ | Branch (149:6): [True: 0, False: 112] ------------------ 150| 0| return dst; 151| 0| } 152| | 153| 112| return memcpy(dst, src, byte_len); 154| 112|} kem.c:secure_cmp: 65| 14|{ 66| 14| volatile uint8_t res = 0; 67| | 68| 31.8k| for(uint32_t i = 0; i < size; ++i) { ------------------ | Branch (68:23): [True: 31.8k, False: 14] ------------------ 69| 31.8k| res |= (a[i] ^ b[i]); 70| 31.8k| } 71| | 72| 14| return (0 == res); 73| 14|} kem.c:secure_l32_mask: 111| 7|{ 112| |#if defined(__aarch64__) 113| | uint32_t res; 114| | __asm__ __volatile__("cmp %w[V2], %w[V1]; \n " 115| | "cset %w[RES], HI; \n" 116| | : [RES] "=r"(res) 117| | : [V1] "r"(v1), [V2] "r"(v2) 118| | : "cc" /*The condition code flag*/); 119| | return (res - 1); 120| |#elif defined(__x86_64__) || defined(__i386__) 121| | uint32_t res; 122| 7| __asm__ __volatile__("xor %%edx, %%edx; \n" 123| 7| "cmp %1, %2; \n " 124| 7| "setl %%dl; \n" 125| 7| "dec %%edx; \n" 126| 7| "mov %%edx, %0; \n" 127| | 128| 7| : "=r"(res) 129| 7| : "r"(v2), "r"(v1) 130| 7| : "rdx"); 131| | 132| 7| return res; 133| |#else 134| | // If v1 >= v2 then the subtraction result is 0^32||(v1-v2). 135| | // else it is 1^32||(v2-v1+1). Subsequently, negating the upper 136| | // 32 bits gives 0 if v1 < v2 and otherwise (-1). 137| | return ~((uint32_t)(((uint64_t)v1 - (uint64_t)v2) >> 32)); 138| |#endif 139| 7|} kem.c:u8_barrier: 48| 448| { \ 49| 448| __asm__("" : "+r"(a) : /* no inputs */); \ 50| 448| return a; \ 51| 448| } sampling.c:secure_cmp32: 77| 251k|{ 78| |#if defined(__aarch64__) 79| | uint32_t res; 80| | __asm__ __volatile__("cmp %w[V1], %w[V2]; \n " 81| | "cset %w[RES], EQ; \n" 82| | : [RES] "=r"(res) 83| | : [V1] "r"(v1), [V2] "r"(v2) 84| | : "cc" /*The condition code flag*/); 85| | return res; 86| |#elif defined(__x86_64__) || defined(__i386__) 87| | uint32_t res; 88| 251k| __asm__ __volatile__("xor %%edx, %%edx; \n" 89| 251k| "cmp %1, %2; \n " 90| 251k| "sete %%dl; \n" 91| 251k| "mov %%edx, %0; \n" 92| 251k| : "=r"(res) 93| 251k| : "r"(v1), "r"(v2) 94| 251k| : "rdx"); 95| 251k| return res; 96| |#else 97| | // Insecure comparison: The main purpose of secure_cmp32 is to avoid 98| | // branches to prevent potential side channel leaks. To do that, 99| | // we normally leverage some special CPU instructions such as "sete" 100| | // (for __x86_64__) and "cset" (for __aarch64__). When dealing with general 101| | // CPU architectures, the interpretation of the line below is left for the 102| | // compiler. It could lead to an "insecure" branch. This case needs to be 103| | // checked individually on such platforms 104| | // (e.g., by checking the compiler-generated assembly). 105| | return (v1 == v2 ? 1 : 0); 106| |#endif 107| 251k|} sampling.c:bike_memcpy: 148| 14|{ 149| 14| if(byte_len == 0) { ------------------ | Branch (149:6): [True: 0, False: 14] ------------------ 150| 0| return dst; 151| 0| } 152| | 153| 14| return memcpy(dst, src, byte_len); 154| 14|} sampling.c:bike_memset: 158| 28|{ 159| 28| if(byte_len == 0) { ------------------ | Branch (159:6): [True: 0, False: 28] ------------------ 160| 0| return dst; 161| 0| } 162| | 163| 28| return memset(dst, ch, byte_len); 164| 28|} decode.c:bike_memcpy: 148| 56|{ 149| 56| if(byte_len == 0) { ------------------ | Branch (149:6): [True: 0, False: 56] ------------------ 150| 0| return dst; 151| 0| } 152| | 153| 56| return memcpy(dst, src, byte_len); 154| 56|} decode.c:bike_memset: 158| 315|{ 159| 315| if(byte_len == 0) { ------------------ | Branch (159:6): [True: 0, False: 315] ------------------ 160| 0| return dst; 161| 0| } 162| | 163| 315| return memset(dst, ch, byte_len); 164| 315|} decode.c:secure_l32_mask: 111| 35|{ 112| |#if defined(__aarch64__) 113| | uint32_t res; 114| | __asm__ __volatile__("cmp %w[V2], %w[V1]; \n " 115| | "cset %w[RES], HI; \n" 116| | : [RES] "=r"(res) 117| | : [V1] "r"(v1), [V2] "r"(v2) 118| | : "cc" /*The condition code flag*/); 119| | return (res - 1); 120| |#elif defined(__x86_64__) || defined(__i386__) 121| | uint32_t res; 122| 35| __asm__ __volatile__("xor %%edx, %%edx; \n" 123| 35| "cmp %1, %2; \n " 124| 35| "setl %%dl; \n" 125| 35| "dec %%edx; \n" 126| 35| "mov %%edx, %0; \n" 127| | 128| 35| : "=r"(res) 129| 35| : "r"(v2), "r"(v1) 130| 35| : "rdx"); 131| | 132| 35| return res; 133| |#else 134| | // If v1 >= v2 then the subtraction result is 0^32||(v1-v2). 135| | // else it is 1^32||(v2-v1+1). Subsequently, negating the upper 136| | // 32 bits gives 0 if v1 < v2 and otherwise (-1). 137| | return ~((uint32_t)(((uint64_t)v1 - (uint64_t)v2) >> 32)); 138| |#endif 139| 35|} decode.c:u32_barrier: 48| 70| { \ 49| 70| __asm__("" : "+r"(a) : /* no inputs */); \ 50| 70| return a; \ 51| 70| } shake_prf.c:bike_memcpy: 148| 3.45k|{ 149| 3.45k| if(byte_len == 0) { ------------------ | Branch (149:6): [True: 0, False: 3.45k] ------------------ 150| 0| return dst; 151| 0| } 152| | 153| 3.45k| return memcpy(dst, src, byte_len); 154| 3.45k|} decode_avx2.c:secure_l32_mask: 111| 55.2k|{ 112| |#if defined(__aarch64__) 113| | uint32_t res; 114| | __asm__ __volatile__("cmp %w[V2], %w[V1]; \n " 115| | "cset %w[RES], HI; \n" 116| | : [RES] "=r"(res) 117| | : [V1] "r"(v1), [V2] "r"(v2) 118| | : "cc" /*The condition code flag*/); 119| | return (res - 1); 120| |#elif defined(__x86_64__) || defined(__i386__) 121| | uint32_t res; 122| 55.2k| __asm__ __volatile__("xor %%edx, %%edx; \n" 123| 55.2k| "cmp %1, %2; \n " 124| 55.2k| "setl %%dl; \n" 125| 55.2k| "dec %%edx; \n" 126| 55.2k| "mov %%edx, %0; \n" 127| | 128| 55.2k| : "=r"(res) 129| 55.2k| : "r"(v2), "r"(v1) 130| 55.2k| : "rdx"); 131| | 132| 55.2k| return res; 133| |#else 134| | // If v1 >= v2 then the subtraction result is 0^32||(v1-v2). 135| | // else it is 1^32||(v2-v1+1). Subsequently, negating the upper 136| | // 32 bits gives 0 if v1 < v2 and otherwise (-1). 137| | return ~((uint32_t)(((uint64_t)v1 - (uint64_t)v2) >> 32)); 138| |#endif 139| 55.2k|} OQS_KEM_bike_l1_new: 8| 5|OQS_KEM *OQS_KEM_bike_l1_new(void) { 9| 5| OQS_KEM *kem = OQS_MEM_calloc(1, sizeof(OQS_KEM)); 10| 5| if (kem == NULL) { ------------------ | Branch (10:6): [True: 0, False: 5] ------------------ 11| 0| return NULL; 12| 0| } 13| 5| kem->method_name = OQS_KEM_alg_bike_l1; ------------------ | | 35| 5|#define OQS_KEM_alg_bike_l1 "BIKE-L1" ------------------ 14| 5| kem->alg_version = "Additional - 01/27/2023"; 15| | 16| 5| kem->claimed_nist_level = 1; 17| 5| kem->ind_cca = false; 18| | 19| 5| kem->length_public_key = OQS_KEM_bike_l1_length_public_key; ------------------ | | 11| 5|#define OQS_KEM_bike_l1_length_public_key 1541 ------------------ 20| 5| kem->length_secret_key = OQS_KEM_bike_l1_length_secret_key; ------------------ | | 10| 5|#define OQS_KEM_bike_l1_length_secret_key 5223 ------------------ 21| 5| kem->length_ciphertext = OQS_KEM_bike_l1_length_ciphertext; ------------------ | | 12| 5|#define OQS_KEM_bike_l1_length_ciphertext 1573 ------------------ 22| 5| kem->length_shared_secret = OQS_KEM_bike_l1_length_shared_secret; ------------------ | | 13| 5|#define OQS_KEM_bike_l1_length_shared_secret 32 ------------------ 23| 5| kem->length_keypair_seed = OQS_KEM_bike_l1_length_keypair_seed; ------------------ | | 14| 5|#define OQS_KEM_bike_l1_length_keypair_seed 0 ------------------ 24| 5| kem->length_encaps_seed = OQS_KEM_bike_l1_length_encaps_seed; ------------------ | | 15| 5|#define OQS_KEM_bike_l1_length_encaps_seed 0 ------------------ 25| | 26| 5| kem->keypair = OQS_KEM_bike_l1_keypair; 27| 5| kem->keypair_derand = OQS_KEM_bike_l1_keypair_derand; 28| 5| kem->encaps = OQS_KEM_bike_l1_encaps; 29| 5| kem->encaps_derand = OQS_KEM_bike_l1_encaps_derand; 30| 5| kem->decaps = OQS_KEM_bike_l1_decaps; 31| | 32| 5| return kem; 33| 5|} OQS_KEM_bike_l3_new: 37| 1|OQS_KEM *OQS_KEM_bike_l3_new(void) { 38| 1| OQS_KEM *kem = OQS_MEM_calloc(1, sizeof(OQS_KEM)); 39| 1| if (kem == NULL) { ------------------ | Branch (39:6): [True: 0, False: 1] ------------------ 40| 0| return NULL; 41| 0| } 42| 1| kem->method_name = OQS_KEM_alg_bike_l3; ------------------ | | 37| 1|#define OQS_KEM_alg_bike_l3 "BIKE-L3" ------------------ 43| 1| kem->alg_version = "Additional - 01/27/2023"; 44| | 45| 1| kem->claimed_nist_level = 3; 46| 1| kem->ind_cca = false; 47| | 48| 1| kem->length_public_key = OQS_KEM_bike_l3_length_public_key; ------------------ | | 26| 1|#define OQS_KEM_bike_l3_length_public_key 3083 ------------------ 49| 1| kem->length_secret_key = OQS_KEM_bike_l3_length_secret_key; ------------------ | | 25| 1|#define OQS_KEM_bike_l3_length_secret_key 10105 ------------------ 50| 1| kem->length_ciphertext = OQS_KEM_bike_l3_length_ciphertext; ------------------ | | 27| 1|#define OQS_KEM_bike_l3_length_ciphertext 3115 ------------------ 51| 1| kem->length_shared_secret = OQS_KEM_bike_l3_length_shared_secret; ------------------ | | 28| 1|#define OQS_KEM_bike_l3_length_shared_secret 32 ------------------ 52| 1| kem->length_keypair_seed = OQS_KEM_bike_l3_length_keypair_seed; ------------------ | | 29| 1|#define OQS_KEM_bike_l3_length_keypair_seed 0 ------------------ 53| 1| kem->length_encaps_seed = OQS_KEM_bike_l3_length_encaps_seed; ------------------ | | 30| 1|#define OQS_KEM_bike_l3_length_encaps_seed 0 ------------------ 54| | 55| 1| kem->keypair = OQS_KEM_bike_l3_keypair; 56| 1| kem->keypair_derand = OQS_KEM_bike_l3_keypair_derand; 57| 1| kem->encaps = OQS_KEM_bike_l3_encaps; 58| 1| kem->encaps_derand = OQS_KEM_bike_l3_encaps_derand; 59| 1| kem->decaps = OQS_KEM_bike_l3_decaps; 60| | 61| 1| return kem; 62| 1|} OQS_KEM_bike_l5_new: 66| 1|OQS_KEM *OQS_KEM_bike_l5_new(void) { 67| 1| OQS_KEM *kem = OQS_MEM_calloc(1, sizeof(OQS_KEM)); 68| 1| if (kem == NULL) { ------------------ | Branch (68:6): [True: 0, False: 1] ------------------ 69| 0| return NULL; 70| 0| } 71| 1| kem->method_name = OQS_KEM_alg_bike_l5; ------------------ | | 39| 1|#define OQS_KEM_alg_bike_l5 "BIKE-L5" ------------------ 72| 1| kem->alg_version = "Additional - 01/07/2023"; 73| | 74| 1| kem->claimed_nist_level = 5; 75| 1| kem->ind_cca = false; 76| | 77| 1| kem->length_public_key = OQS_KEM_bike_l5_length_public_key; ------------------ | | 41| 1|#define OQS_KEM_bike_l5_length_public_key 5122 ------------------ 78| 1| kem->length_secret_key = OQS_KEM_bike_l5_length_secret_key; ------------------ | | 40| 1|#define OQS_KEM_bike_l5_length_secret_key 16494 ------------------ 79| 1| kem->length_ciphertext = OQS_KEM_bike_l5_length_ciphertext; ------------------ | | 42| 1|#define OQS_KEM_bike_l5_length_ciphertext 5154 ------------------ 80| 1| kem->length_shared_secret = OQS_KEM_bike_l5_length_shared_secret; ------------------ | | 43| 1|#define OQS_KEM_bike_l5_length_shared_secret 32 ------------------ 81| 1| kem->length_keypair_seed = OQS_KEM_bike_l5_length_keypair_seed; ------------------ | | 44| 1|#define OQS_KEM_bike_l5_length_keypair_seed 0 ------------------ 82| 1| kem->length_encaps_seed = OQS_KEM_bike_l5_length_encaps_seed; ------------------ | | 45| 1|#define OQS_KEM_bike_l5_length_encaps_seed 0 ------------------ 83| | 84| 1| kem->keypair = OQS_KEM_bike_l5_keypair; 85| 1| kem->keypair_derand = OQS_KEM_bike_l5_keypair_derand; 86| 1| kem->encaps = OQS_KEM_bike_l5_encaps; 87| 1| kem->encaps_derand = OQS_KEM_bike_l5_encaps_derand; 88| 1| kem->decaps = OQS_KEM_bike_l5_decaps; 89| | 90| 1| return kem; 91| 1|} OQS_KEM_classic_mceliece_348864_new: 9| 98|OQS_KEM *OQS_KEM_classic_mceliece_348864_new(void) { 10| | 11| 98| OQS_KEM *kem = OQS_MEM_calloc(1, sizeof(OQS_KEM)); 12| 98| if (kem == NULL) { ------------------ | Branch (12:6): [True: 0, False: 98] ------------------ 13| 0| return NULL; 14| 0| } 15| 98| kem->method_name = OQS_KEM_alg_classic_mceliece_348864; ------------------ | | 42| 98|#define OQS_KEM_alg_classic_mceliece_348864 "Classic-McEliece-348864" ------------------ 16| 98| kem->alg_version = "SUPERCOP-20221025"; 17| | 18| 98| kem->claimed_nist_level = 1; 19| 98| kem->ind_cca = true; 20| | 21| 98| kem->length_public_key = OQS_KEM_classic_mceliece_348864_length_public_key; ------------------ | | 9| 98|#define OQS_KEM_classic_mceliece_348864_length_public_key 261120 ------------------ 22| 98| kem->length_secret_key = OQS_KEM_classic_mceliece_348864_length_secret_key; ------------------ | | 10| 98|#define OQS_KEM_classic_mceliece_348864_length_secret_key 6492 ------------------ 23| 98| kem->length_ciphertext = OQS_KEM_classic_mceliece_348864_length_ciphertext; ------------------ | | 11| 98|#define OQS_KEM_classic_mceliece_348864_length_ciphertext 96 ------------------ 24| 98| kem->length_shared_secret = OQS_KEM_classic_mceliece_348864_length_shared_secret; ------------------ | | 12| 98|#define OQS_KEM_classic_mceliece_348864_length_shared_secret 32 ------------------ 25| 98| kem->length_keypair_seed = OQS_KEM_classic_mceliece_348864_length_keypair_seed; ------------------ | | 13| 98|#define OQS_KEM_classic_mceliece_348864_length_keypair_seed 0 ------------------ 26| 98| kem->length_encaps_seed = OQS_KEM_classic_mceliece_348864_length_encaps_seed; ------------------ | | 14| 98|#define OQS_KEM_classic_mceliece_348864_length_encaps_seed 0 ------------------ 27| | 28| 98| kem->keypair = OQS_KEM_classic_mceliece_348864_keypair; 29| 98| kem->keypair_derand = OQS_KEM_classic_mceliece_348864_keypair_derand; 30| 98| kem->encaps = OQS_KEM_classic_mceliece_348864_encaps; 31| 98| kem->encaps_derand = OQS_KEM_classic_mceliece_348864_encaps_derand; 32| 98| kem->decaps = OQS_KEM_classic_mceliece_348864_decaps; 33| | 34| 98| return kem; 35| 98|} OQS_KEM_classic_mceliece_348864_keypair: 54| 98|OQS_API OQS_STATUS OQS_KEM_classic_mceliece_348864_keypair(uint8_t *public_key, uint8_t *secret_key) { 55| 98|#if defined(OQS_ENABLE_KEM_classic_mceliece_348864_avx2) 56| 98|#if defined(OQS_DIST_BUILD) 57| 98| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2) && OQS_CPU_has_extension(OQS_CPU_EXT_POPCNT)) { ------------------ | Branch (57:6): [True: 98, False: 0] | Branch (57:49): [True: 98, False: 0] ------------------ 58| 98|#endif /* OQS_DIST_BUILD */ 59| 98| return (OQS_STATUS) PQCLEAN_MCELIECE348864_AVX2_crypto_kem_keypair(public_key, secret_key); 60| 98|#if defined(OQS_DIST_BUILD) 61| 98| } else { 62| 0| return (OQS_STATUS) PQCLEAN_MCELIECE348864_CLEAN_crypto_kem_keypair(public_key, secret_key); 63| 0| } 64| 98|#endif /* OQS_DIST_BUILD */ 65| |#else 66| | return (OQS_STATUS) PQCLEAN_MCELIECE348864_CLEAN_crypto_kem_keypair(public_key, secret_key); 67| |#endif 68| 98|} OQS_KEM_classic_mceliece_348864_encaps: 78| 98|OQS_API OQS_STATUS OQS_KEM_classic_mceliece_348864_encaps(uint8_t *ciphertext, uint8_t *shared_secret, const uint8_t *public_key) { 79| 98|#if defined(OQS_ENABLE_KEM_classic_mceliece_348864_avx2) 80| 98|#if defined(OQS_DIST_BUILD) 81| 98| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2) && OQS_CPU_has_extension(OQS_CPU_EXT_POPCNT)) { ------------------ | Branch (81:6): [True: 98, False: 0] | Branch (81:49): [True: 98, False: 0] ------------------ 82| 98|#endif /* OQS_DIST_BUILD */ 83| 98| return (OQS_STATUS) PQCLEAN_MCELIECE348864_AVX2_crypto_kem_enc(ciphertext, shared_secret, public_key); 84| 98|#if defined(OQS_DIST_BUILD) 85| 98| } else { 86| 0| return (OQS_STATUS) PQCLEAN_MCELIECE348864_CLEAN_crypto_kem_enc(ciphertext, shared_secret, public_key); 87| 0| } 88| 98|#endif /* OQS_DIST_BUILD */ 89| |#else 90| | return (OQS_STATUS) PQCLEAN_MCELIECE348864_CLEAN_crypto_kem_enc(ciphertext, shared_secret, public_key); 91| |#endif 92| 98|} OQS_KEM_classic_mceliece_348864_decaps: 94| 98|OQS_API OQS_STATUS OQS_KEM_classic_mceliece_348864_decaps(uint8_t *shared_secret, const uint8_t *ciphertext, const uint8_t *secret_key) { 95| 98|#if defined(OQS_ENABLE_KEM_classic_mceliece_348864_avx2) 96| 98|#if defined(OQS_DIST_BUILD) 97| 98| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2) && OQS_CPU_has_extension(OQS_CPU_EXT_POPCNT)) { ------------------ | Branch (97:6): [True: 98, False: 0] | Branch (97:49): [True: 98, False: 0] ------------------ 98| 98|#endif /* OQS_DIST_BUILD */ 99| 98| return (OQS_STATUS) PQCLEAN_MCELIECE348864_AVX2_crypto_kem_dec(shared_secret, ciphertext, secret_key); 100| 98|#if defined(OQS_DIST_BUILD) 101| 98| } else { 102| 0| return (OQS_STATUS) PQCLEAN_MCELIECE348864_CLEAN_crypto_kem_dec(shared_secret, ciphertext, secret_key); 103| 0| } 104| 98|#endif /* OQS_DIST_BUILD */ 105| |#else 106| | return (OQS_STATUS) PQCLEAN_MCELIECE348864_CLEAN_crypto_kem_dec(shared_secret, ciphertext, secret_key); 107| |#endif 108| 98|} OQS_KEM_classic_mceliece_348864f_new: 9| 83|OQS_KEM *OQS_KEM_classic_mceliece_348864f_new(void) { 10| | 11| 83| OQS_KEM *kem = OQS_MEM_calloc(1, sizeof(OQS_KEM)); 12| 83| if (kem == NULL) { ------------------ | Branch (12:6): [True: 0, False: 83] ------------------ 13| 0| return NULL; 14| 0| } 15| 83| kem->method_name = OQS_KEM_alg_classic_mceliece_348864f; ------------------ | | 44| 83|#define OQS_KEM_alg_classic_mceliece_348864f "Classic-McEliece-348864f" ------------------ 16| 83| kem->alg_version = "SUPERCOP-20221025"; 17| | 18| 83| kem->claimed_nist_level = 1; 19| 83| kem->ind_cca = true; 20| | 21| 83| kem->length_public_key = OQS_KEM_classic_mceliece_348864f_length_public_key; ------------------ | | 24| 83|#define OQS_KEM_classic_mceliece_348864f_length_public_key 261120 ------------------ 22| 83| kem->length_secret_key = OQS_KEM_classic_mceliece_348864f_length_secret_key; ------------------ | | 25| 83|#define OQS_KEM_classic_mceliece_348864f_length_secret_key 6492 ------------------ 23| 83| kem->length_ciphertext = OQS_KEM_classic_mceliece_348864f_length_ciphertext; ------------------ | | 26| 83|#define OQS_KEM_classic_mceliece_348864f_length_ciphertext 96 ------------------ 24| 83| kem->length_shared_secret = OQS_KEM_classic_mceliece_348864f_length_shared_secret; ------------------ | | 27| 83|#define OQS_KEM_classic_mceliece_348864f_length_shared_secret 32 ------------------ 25| 83| kem->length_keypair_seed = OQS_KEM_classic_mceliece_348864f_length_keypair_seed; ------------------ | | 28| 83|#define OQS_KEM_classic_mceliece_348864f_length_keypair_seed 0 ------------------ 26| 83| kem->length_encaps_seed = OQS_KEM_classic_mceliece_348864f_length_encaps_seed; ------------------ | | 29| 83|#define OQS_KEM_classic_mceliece_348864f_length_encaps_seed 0 ------------------ 27| | 28| 83| kem->keypair = OQS_KEM_classic_mceliece_348864f_keypair; 29| 83| kem->keypair_derand = OQS_KEM_classic_mceliece_348864f_keypair_derand; 30| 83| kem->encaps = OQS_KEM_classic_mceliece_348864f_encaps; 31| 83| kem->encaps_derand = OQS_KEM_classic_mceliece_348864f_encaps_derand; 32| 83| kem->decaps = OQS_KEM_classic_mceliece_348864f_decaps; 33| | 34| 83| return kem; 35| 83|} OQS_KEM_classic_mceliece_348864f_keypair: 54| 83|OQS_API OQS_STATUS OQS_KEM_classic_mceliece_348864f_keypair(uint8_t *public_key, uint8_t *secret_key) { 55| 83|#if defined(OQS_ENABLE_KEM_classic_mceliece_348864f_avx2) 56| 83|#if defined(OQS_DIST_BUILD) 57| 83| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2) && OQS_CPU_has_extension(OQS_CPU_EXT_POPCNT) && OQS_CPU_has_extension(OQS_CPU_EXT_BMI1)) { ------------------ | Branch (57:6): [True: 83, False: 0] | Branch (57:49): [True: 83, False: 0] | Branch (57:94): [True: 83, False: 0] ------------------ 58| 83|#endif /* OQS_DIST_BUILD */ 59| 83| return (OQS_STATUS) PQCLEAN_MCELIECE348864F_AVX2_crypto_kem_keypair(public_key, secret_key); 60| 83|#if defined(OQS_DIST_BUILD) 61| 83| } else { 62| 0| return (OQS_STATUS) PQCLEAN_MCELIECE348864F_CLEAN_crypto_kem_keypair(public_key, secret_key); 63| 0| } 64| 83|#endif /* OQS_DIST_BUILD */ 65| |#else 66| | return (OQS_STATUS) PQCLEAN_MCELIECE348864F_CLEAN_crypto_kem_keypair(public_key, secret_key); 67| |#endif 68| 83|} OQS_KEM_classic_mceliece_348864f_encaps: 78| 83|OQS_API OQS_STATUS OQS_KEM_classic_mceliece_348864f_encaps(uint8_t *ciphertext, uint8_t *shared_secret, const uint8_t *public_key) { 79| 83|#if defined(OQS_ENABLE_KEM_classic_mceliece_348864f_avx2) 80| 83|#if defined(OQS_DIST_BUILD) 81| 83| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2) && OQS_CPU_has_extension(OQS_CPU_EXT_POPCNT) && OQS_CPU_has_extension(OQS_CPU_EXT_BMI1)) { ------------------ | Branch (81:6): [True: 83, False: 0] | Branch (81:49): [True: 83, False: 0] | Branch (81:94): [True: 83, False: 0] ------------------ 82| 83|#endif /* OQS_DIST_BUILD */ 83| 83| return (OQS_STATUS) PQCLEAN_MCELIECE348864F_AVX2_crypto_kem_enc(ciphertext, shared_secret, public_key); 84| 83|#if defined(OQS_DIST_BUILD) 85| 83| } else { 86| 0| return (OQS_STATUS) PQCLEAN_MCELIECE348864F_CLEAN_crypto_kem_enc(ciphertext, shared_secret, public_key); 87| 0| } 88| 83|#endif /* OQS_DIST_BUILD */ 89| |#else 90| | return (OQS_STATUS) PQCLEAN_MCELIECE348864F_CLEAN_crypto_kem_enc(ciphertext, shared_secret, public_key); 91| |#endif 92| 83|} OQS_KEM_classic_mceliece_348864f_decaps: 94| 83|OQS_API OQS_STATUS OQS_KEM_classic_mceliece_348864f_decaps(uint8_t *shared_secret, const uint8_t *ciphertext, const uint8_t *secret_key) { 95| 83|#if defined(OQS_ENABLE_KEM_classic_mceliece_348864f_avx2) 96| 83|#if defined(OQS_DIST_BUILD) 97| 83| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2) && OQS_CPU_has_extension(OQS_CPU_EXT_POPCNT) && OQS_CPU_has_extension(OQS_CPU_EXT_BMI1)) { ------------------ | Branch (97:6): [True: 83, False: 0] | Branch (97:49): [True: 83, False: 0] | Branch (97:94): [True: 83, False: 0] ------------------ 98| 83|#endif /* OQS_DIST_BUILD */ 99| 83| return (OQS_STATUS) PQCLEAN_MCELIECE348864F_AVX2_crypto_kem_dec(shared_secret, ciphertext, secret_key); 100| 83|#if defined(OQS_DIST_BUILD) 101| 83| } else { 102| 0| return (OQS_STATUS) PQCLEAN_MCELIECE348864F_CLEAN_crypto_kem_dec(shared_secret, ciphertext, secret_key); 103| 0| } 104| 83|#endif /* OQS_DIST_BUILD */ 105| |#else 106| | return (OQS_STATUS) PQCLEAN_MCELIECE348864F_CLEAN_crypto_kem_dec(shared_secret, ciphertext, secret_key); 107| |#endif 108| 83|} OQS_KEM_classic_mceliece_460896_new: 9| 111|OQS_KEM *OQS_KEM_classic_mceliece_460896_new(void) { 10| | 11| 111| OQS_KEM *kem = OQS_MEM_calloc(1, sizeof(OQS_KEM)); 12| 111| if (kem == NULL) { ------------------ | Branch (12:6): [True: 0, False: 111] ------------------ 13| 0| return NULL; 14| 0| } 15| 111| kem->method_name = OQS_KEM_alg_classic_mceliece_460896; ------------------ | | 46| 111|#define OQS_KEM_alg_classic_mceliece_460896 "Classic-McEliece-460896" ------------------ 16| 111| kem->alg_version = "SUPERCOP-20221025"; 17| | 18| 111| kem->claimed_nist_level = 3; 19| 111| kem->ind_cca = true; 20| | 21| 111| kem->length_public_key = OQS_KEM_classic_mceliece_460896_length_public_key; ------------------ | | 39| 111|#define OQS_KEM_classic_mceliece_460896_length_public_key 524160 ------------------ 22| 111| kem->length_secret_key = OQS_KEM_classic_mceliece_460896_length_secret_key; ------------------ | | 40| 111|#define OQS_KEM_classic_mceliece_460896_length_secret_key 13608 ------------------ 23| 111| kem->length_ciphertext = OQS_KEM_classic_mceliece_460896_length_ciphertext; ------------------ | | 41| 111|#define OQS_KEM_classic_mceliece_460896_length_ciphertext 156 ------------------ 24| 111| kem->length_shared_secret = OQS_KEM_classic_mceliece_460896_length_shared_secret; ------------------ | | 42| 111|#define OQS_KEM_classic_mceliece_460896_length_shared_secret 32 ------------------ 25| 111| kem->length_keypair_seed = OQS_KEM_classic_mceliece_460896_length_keypair_seed; ------------------ | | 43| 111|#define OQS_KEM_classic_mceliece_460896_length_keypair_seed 0 ------------------ 26| 111| kem->length_encaps_seed = OQS_KEM_classic_mceliece_460896_length_encaps_seed; ------------------ | | 44| 111|#define OQS_KEM_classic_mceliece_460896_length_encaps_seed 0 ------------------ 27| | 28| 111| kem->keypair = OQS_KEM_classic_mceliece_460896_keypair; 29| 111| kem->keypair_derand = OQS_KEM_classic_mceliece_460896_keypair_derand; 30| 111| kem->encaps = OQS_KEM_classic_mceliece_460896_encaps; 31| 111| kem->encaps_derand = OQS_KEM_classic_mceliece_460896_encaps_derand; 32| 111| kem->decaps = OQS_KEM_classic_mceliece_460896_decaps; 33| | 34| 111| return kem; 35| 111|} OQS_KEM_classic_mceliece_460896_keypair: 54| 111|OQS_API OQS_STATUS OQS_KEM_classic_mceliece_460896_keypair(uint8_t *public_key, uint8_t *secret_key) { 55| 111|#if defined(OQS_ENABLE_KEM_classic_mceliece_460896_avx2) 56| 111|#if defined(OQS_DIST_BUILD) 57| 111| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2) && OQS_CPU_has_extension(OQS_CPU_EXT_POPCNT)) { ------------------ | Branch (57:6): [True: 111, False: 0] | Branch (57:49): [True: 111, False: 0] ------------------ 58| 111|#endif /* OQS_DIST_BUILD */ 59| 111| return (OQS_STATUS) PQCLEAN_MCELIECE460896_AVX2_crypto_kem_keypair(public_key, secret_key); 60| 111|#if defined(OQS_DIST_BUILD) 61| 111| } else { 62| 0| return (OQS_STATUS) PQCLEAN_MCELIECE460896_CLEAN_crypto_kem_keypair(public_key, secret_key); 63| 0| } 64| 111|#endif /* OQS_DIST_BUILD */ 65| |#else 66| | return (OQS_STATUS) PQCLEAN_MCELIECE460896_CLEAN_crypto_kem_keypair(public_key, secret_key); 67| |#endif 68| 111|} OQS_KEM_classic_mceliece_460896_encaps: 78| 111|OQS_API OQS_STATUS OQS_KEM_classic_mceliece_460896_encaps(uint8_t *ciphertext, uint8_t *shared_secret, const uint8_t *public_key) { 79| 111|#if defined(OQS_ENABLE_KEM_classic_mceliece_460896_avx2) 80| 111|#if defined(OQS_DIST_BUILD) 81| 111| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2) && OQS_CPU_has_extension(OQS_CPU_EXT_POPCNT)) { ------------------ | Branch (81:6): [True: 111, False: 0] | Branch (81:49): [True: 111, False: 0] ------------------ 82| 111|#endif /* OQS_DIST_BUILD */ 83| 111| return (OQS_STATUS) PQCLEAN_MCELIECE460896_AVX2_crypto_kem_enc(ciphertext, shared_secret, public_key); 84| 111|#if defined(OQS_DIST_BUILD) 85| 111| } else { 86| 0| return (OQS_STATUS) PQCLEAN_MCELIECE460896_CLEAN_crypto_kem_enc(ciphertext, shared_secret, public_key); 87| 0| } 88| 111|#endif /* OQS_DIST_BUILD */ 89| |#else 90| | return (OQS_STATUS) PQCLEAN_MCELIECE460896_CLEAN_crypto_kem_enc(ciphertext, shared_secret, public_key); 91| |#endif 92| 111|} OQS_KEM_classic_mceliece_460896_decaps: 94| 111|OQS_API OQS_STATUS OQS_KEM_classic_mceliece_460896_decaps(uint8_t *shared_secret, const uint8_t *ciphertext, const uint8_t *secret_key) { 95| 111|#if defined(OQS_ENABLE_KEM_classic_mceliece_460896_avx2) 96| 111|#if defined(OQS_DIST_BUILD) 97| 111| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2) && OQS_CPU_has_extension(OQS_CPU_EXT_POPCNT)) { ------------------ | Branch (97:6): [True: 111, False: 0] | Branch (97:49): [True: 111, False: 0] ------------------ 98| 111|#endif /* OQS_DIST_BUILD */ 99| 111| return (OQS_STATUS) PQCLEAN_MCELIECE460896_AVX2_crypto_kem_dec(shared_secret, ciphertext, secret_key); 100| 111|#if defined(OQS_DIST_BUILD) 101| 111| } else { 102| 0| return (OQS_STATUS) PQCLEAN_MCELIECE460896_CLEAN_crypto_kem_dec(shared_secret, ciphertext, secret_key); 103| 0| } 104| 111|#endif /* OQS_DIST_BUILD */ 105| |#else 106| | return (OQS_STATUS) PQCLEAN_MCELIECE460896_CLEAN_crypto_kem_dec(shared_secret, ciphertext, secret_key); 107| |#endif 108| 111|} OQS_KEM_classic_mceliece_460896f_new: 9| 88|OQS_KEM *OQS_KEM_classic_mceliece_460896f_new(void) { 10| | 11| 88| OQS_KEM *kem = OQS_MEM_calloc(1, sizeof(OQS_KEM)); 12| 88| if (kem == NULL) { ------------------ | Branch (12:6): [True: 0, False: 88] ------------------ 13| 0| return NULL; 14| 0| } 15| 88| kem->method_name = OQS_KEM_alg_classic_mceliece_460896f; ------------------ | | 48| 88|#define OQS_KEM_alg_classic_mceliece_460896f "Classic-McEliece-460896f" ------------------ 16| 88| kem->alg_version = "SUPERCOP-20221025"; 17| | 18| 88| kem->claimed_nist_level = 3; 19| 88| kem->ind_cca = true; 20| | 21| 88| kem->length_public_key = OQS_KEM_classic_mceliece_460896f_length_public_key; ------------------ | | 54| 88|#define OQS_KEM_classic_mceliece_460896f_length_public_key 524160 ------------------ 22| 88| kem->length_secret_key = OQS_KEM_classic_mceliece_460896f_length_secret_key; ------------------ | | 55| 88|#define OQS_KEM_classic_mceliece_460896f_length_secret_key 13608 ------------------ 23| 88| kem->length_ciphertext = OQS_KEM_classic_mceliece_460896f_length_ciphertext; ------------------ | | 56| 88|#define OQS_KEM_classic_mceliece_460896f_length_ciphertext 156 ------------------ 24| 88| kem->length_shared_secret = OQS_KEM_classic_mceliece_460896f_length_shared_secret; ------------------ | | 57| 88|#define OQS_KEM_classic_mceliece_460896f_length_shared_secret 32 ------------------ 25| 88| kem->length_keypair_seed = OQS_KEM_classic_mceliece_460896f_length_keypair_seed; ------------------ | | 58| 88|#define OQS_KEM_classic_mceliece_460896f_length_keypair_seed 0 ------------------ 26| 88| kem->length_encaps_seed = OQS_KEM_classic_mceliece_460896f_length_encaps_seed; ------------------ | | 59| 88|#define OQS_KEM_classic_mceliece_460896f_length_encaps_seed 0 ------------------ 27| | 28| 88| kem->keypair = OQS_KEM_classic_mceliece_460896f_keypair; 29| 88| kem->keypair_derand = OQS_KEM_classic_mceliece_460896f_keypair_derand; 30| 88| kem->encaps = OQS_KEM_classic_mceliece_460896f_encaps; 31| 88| kem->encaps_derand = OQS_KEM_classic_mceliece_460896f_encaps_derand; 32| 88| kem->decaps = OQS_KEM_classic_mceliece_460896f_decaps; 33| | 34| 88| return kem; 35| 88|} OQS_KEM_classic_mceliece_460896f_keypair: 54| 88|OQS_API OQS_STATUS OQS_KEM_classic_mceliece_460896f_keypair(uint8_t *public_key, uint8_t *secret_key) { 55| 88|#if defined(OQS_ENABLE_KEM_classic_mceliece_460896f_avx2) 56| 88|#if defined(OQS_DIST_BUILD) 57| 88| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2) && OQS_CPU_has_extension(OQS_CPU_EXT_POPCNT) && OQS_CPU_has_extension(OQS_CPU_EXT_BMI1)) { ------------------ | Branch (57:6): [True: 88, False: 0] | Branch (57:49): [True: 88, False: 0] | Branch (57:94): [True: 88, False: 0] ------------------ 58| 88|#endif /* OQS_DIST_BUILD */ 59| 88| return (OQS_STATUS) PQCLEAN_MCELIECE460896F_AVX2_crypto_kem_keypair(public_key, secret_key); 60| 88|#if defined(OQS_DIST_BUILD) 61| 88| } else { 62| 0| return (OQS_STATUS) PQCLEAN_MCELIECE460896F_CLEAN_crypto_kem_keypair(public_key, secret_key); 63| 0| } 64| 88|#endif /* OQS_DIST_BUILD */ 65| |#else 66| | return (OQS_STATUS) PQCLEAN_MCELIECE460896F_CLEAN_crypto_kem_keypair(public_key, secret_key); 67| |#endif 68| 88|} OQS_KEM_classic_mceliece_460896f_encaps: 78| 88|OQS_API OQS_STATUS OQS_KEM_classic_mceliece_460896f_encaps(uint8_t *ciphertext, uint8_t *shared_secret, const uint8_t *public_key) { 79| 88|#if defined(OQS_ENABLE_KEM_classic_mceliece_460896f_avx2) 80| 88|#if defined(OQS_DIST_BUILD) 81| 88| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2) && OQS_CPU_has_extension(OQS_CPU_EXT_POPCNT) && OQS_CPU_has_extension(OQS_CPU_EXT_BMI1)) { ------------------ | Branch (81:6): [True: 88, False: 0] | Branch (81:49): [True: 88, False: 0] | Branch (81:94): [True: 88, False: 0] ------------------ 82| 88|#endif /* OQS_DIST_BUILD */ 83| 88| return (OQS_STATUS) PQCLEAN_MCELIECE460896F_AVX2_crypto_kem_enc(ciphertext, shared_secret, public_key); 84| 88|#if defined(OQS_DIST_BUILD) 85| 88| } else { 86| 0| return (OQS_STATUS) PQCLEAN_MCELIECE460896F_CLEAN_crypto_kem_enc(ciphertext, shared_secret, public_key); 87| 0| } 88| 88|#endif /* OQS_DIST_BUILD */ 89| |#else 90| | return (OQS_STATUS) PQCLEAN_MCELIECE460896F_CLEAN_crypto_kem_enc(ciphertext, shared_secret, public_key); 91| |#endif 92| 88|} OQS_KEM_classic_mceliece_460896f_decaps: 94| 88|OQS_API OQS_STATUS OQS_KEM_classic_mceliece_460896f_decaps(uint8_t *shared_secret, const uint8_t *ciphertext, const uint8_t *secret_key) { 95| 88|#if defined(OQS_ENABLE_KEM_classic_mceliece_460896f_avx2) 96| 88|#if defined(OQS_DIST_BUILD) 97| 88| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2) && OQS_CPU_has_extension(OQS_CPU_EXT_POPCNT) && OQS_CPU_has_extension(OQS_CPU_EXT_BMI1)) { ------------------ | Branch (97:6): [True: 88, False: 0] | Branch (97:49): [True: 88, False: 0] | Branch (97:94): [True: 88, False: 0] ------------------ 98| 88|#endif /* OQS_DIST_BUILD */ 99| 88| return (OQS_STATUS) PQCLEAN_MCELIECE460896F_AVX2_crypto_kem_dec(shared_secret, ciphertext, secret_key); 100| 88|#if defined(OQS_DIST_BUILD) 101| 88| } else { 102| 0| return (OQS_STATUS) PQCLEAN_MCELIECE460896F_CLEAN_crypto_kem_dec(shared_secret, ciphertext, secret_key); 103| 0| } 104| 88|#endif /* OQS_DIST_BUILD */ 105| |#else 106| | return (OQS_STATUS) PQCLEAN_MCELIECE460896F_CLEAN_crypto_kem_dec(shared_secret, ciphertext, secret_key); 107| |#endif 108| 88|} OQS_KEM_classic_mceliece_6688128_new: 9| 111|OQS_KEM *OQS_KEM_classic_mceliece_6688128_new(void) { 10| | 11| 111| OQS_KEM *kem = OQS_MEM_calloc(1, sizeof(OQS_KEM)); 12| 111| if (kem == NULL) { ------------------ | Branch (12:6): [True: 0, False: 111] ------------------ 13| 0| return NULL; 14| 0| } 15| 111| kem->method_name = OQS_KEM_alg_classic_mceliece_6688128; ------------------ | | 50| 111|#define OQS_KEM_alg_classic_mceliece_6688128 "Classic-McEliece-6688128" ------------------ 16| 111| kem->alg_version = "SUPERCOP-20221025"; 17| | 18| 111| kem->claimed_nist_level = 5; 19| 111| kem->ind_cca = true; 20| | 21| 111| kem->length_public_key = OQS_KEM_classic_mceliece_6688128_length_public_key; ------------------ | | 69| 111|#define OQS_KEM_classic_mceliece_6688128_length_public_key 1044992 ------------------ 22| 111| kem->length_secret_key = OQS_KEM_classic_mceliece_6688128_length_secret_key; ------------------ | | 70| 111|#define OQS_KEM_classic_mceliece_6688128_length_secret_key 13932 ------------------ 23| 111| kem->length_ciphertext = OQS_KEM_classic_mceliece_6688128_length_ciphertext; ------------------ | | 71| 111|#define OQS_KEM_classic_mceliece_6688128_length_ciphertext 208 ------------------ 24| 111| kem->length_shared_secret = OQS_KEM_classic_mceliece_6688128_length_shared_secret; ------------------ | | 72| 111|#define OQS_KEM_classic_mceliece_6688128_length_shared_secret 32 ------------------ 25| 111| kem->length_keypair_seed = OQS_KEM_classic_mceliece_6688128_length_keypair_seed; ------------------ | | 73| 111|#define OQS_KEM_classic_mceliece_6688128_length_keypair_seed 0 ------------------ 26| 111| kem->length_encaps_seed = OQS_KEM_classic_mceliece_6688128_length_encaps_seed; ------------------ | | 74| 111|#define OQS_KEM_classic_mceliece_6688128_length_encaps_seed 0 ------------------ 27| | 28| 111| kem->keypair = OQS_KEM_classic_mceliece_6688128_keypair; 29| 111| kem->keypair_derand = OQS_KEM_classic_mceliece_6688128_keypair_derand; 30| 111| kem->encaps = OQS_KEM_classic_mceliece_6688128_encaps; 31| 111| kem->encaps_derand = OQS_KEM_classic_mceliece_6688128_encaps_derand; 32| 111| kem->decaps = OQS_KEM_classic_mceliece_6688128_decaps; 33| | 34| 111| return kem; 35| 111|} OQS_KEM_classic_mceliece_6688128_keypair: 54| 111|OQS_API OQS_STATUS OQS_KEM_classic_mceliece_6688128_keypair(uint8_t *public_key, uint8_t *secret_key) { 55| 111|#if defined(OQS_ENABLE_KEM_classic_mceliece_6688128_avx2) 56| 111|#if defined(OQS_DIST_BUILD) 57| 111| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2) && OQS_CPU_has_extension(OQS_CPU_EXT_POPCNT)) { ------------------ | Branch (57:6): [True: 111, False: 0] | Branch (57:49): [True: 111, False: 0] ------------------ 58| 111|#endif /* OQS_DIST_BUILD */ 59| 111| return (OQS_STATUS) PQCLEAN_MCELIECE6688128_AVX2_crypto_kem_keypair(public_key, secret_key); 60| 111|#if defined(OQS_DIST_BUILD) 61| 111| } else { 62| 0| return (OQS_STATUS) PQCLEAN_MCELIECE6688128_CLEAN_crypto_kem_keypair(public_key, secret_key); 63| 0| } 64| 111|#endif /* OQS_DIST_BUILD */ 65| |#else 66| | return (OQS_STATUS) PQCLEAN_MCELIECE6688128_CLEAN_crypto_kem_keypair(public_key, secret_key); 67| |#endif 68| 111|} OQS_KEM_classic_mceliece_6688128_encaps: 78| 111|OQS_API OQS_STATUS OQS_KEM_classic_mceliece_6688128_encaps(uint8_t *ciphertext, uint8_t *shared_secret, const uint8_t *public_key) { 79| 111|#if defined(OQS_ENABLE_KEM_classic_mceliece_6688128_avx2) 80| 111|#if defined(OQS_DIST_BUILD) 81| 111| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2) && OQS_CPU_has_extension(OQS_CPU_EXT_POPCNT)) { ------------------ | Branch (81:6): [True: 111, False: 0] | Branch (81:49): [True: 111, False: 0] ------------------ 82| 111|#endif /* OQS_DIST_BUILD */ 83| 111| return (OQS_STATUS) PQCLEAN_MCELIECE6688128_AVX2_crypto_kem_enc(ciphertext, shared_secret, public_key); 84| 111|#if defined(OQS_DIST_BUILD) 85| 111| } else { 86| 0| return (OQS_STATUS) PQCLEAN_MCELIECE6688128_CLEAN_crypto_kem_enc(ciphertext, shared_secret, public_key); 87| 0| } 88| 111|#endif /* OQS_DIST_BUILD */ 89| |#else 90| | return (OQS_STATUS) PQCLEAN_MCELIECE6688128_CLEAN_crypto_kem_enc(ciphertext, shared_secret, public_key); 91| |#endif 92| 111|} OQS_KEM_classic_mceliece_6688128_decaps: 94| 111|OQS_API OQS_STATUS OQS_KEM_classic_mceliece_6688128_decaps(uint8_t *shared_secret, const uint8_t *ciphertext, const uint8_t *secret_key) { 95| 111|#if defined(OQS_ENABLE_KEM_classic_mceliece_6688128_avx2) 96| 111|#if defined(OQS_DIST_BUILD) 97| 111| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2) && OQS_CPU_has_extension(OQS_CPU_EXT_POPCNT)) { ------------------ | Branch (97:6): [True: 111, False: 0] | Branch (97:49): [True: 111, False: 0] ------------------ 98| 111|#endif /* OQS_DIST_BUILD */ 99| 111| return (OQS_STATUS) PQCLEAN_MCELIECE6688128_AVX2_crypto_kem_dec(shared_secret, ciphertext, secret_key); 100| 111|#if defined(OQS_DIST_BUILD) 101| 111| } else { 102| 0| return (OQS_STATUS) PQCLEAN_MCELIECE6688128_CLEAN_crypto_kem_dec(shared_secret, ciphertext, secret_key); 103| 0| } 104| 111|#endif /* OQS_DIST_BUILD */ 105| |#else 106| | return (OQS_STATUS) PQCLEAN_MCELIECE6688128_CLEAN_crypto_kem_dec(shared_secret, ciphertext, secret_key); 107| |#endif 108| 111|} OQS_KEM_classic_mceliece_6688128f_new: 9| 92|OQS_KEM *OQS_KEM_classic_mceliece_6688128f_new(void) { 10| | 11| 92| OQS_KEM *kem = OQS_MEM_calloc(1, sizeof(OQS_KEM)); 12| 92| if (kem == NULL) { ------------------ | Branch (12:6): [True: 0, False: 92] ------------------ 13| 0| return NULL; 14| 0| } 15| 92| kem->method_name = OQS_KEM_alg_classic_mceliece_6688128f; ------------------ | | 52| 92|#define OQS_KEM_alg_classic_mceliece_6688128f "Classic-McEliece-6688128f" ------------------ 16| 92| kem->alg_version = "SUPERCOP-20221025"; 17| | 18| 92| kem->claimed_nist_level = 5; 19| 92| kem->ind_cca = true; 20| | 21| 92| kem->length_public_key = OQS_KEM_classic_mceliece_6688128f_length_public_key; ------------------ | | 84| 92|#define OQS_KEM_classic_mceliece_6688128f_length_public_key 1044992 ------------------ 22| 92| kem->length_secret_key = OQS_KEM_classic_mceliece_6688128f_length_secret_key; ------------------ | | 85| 92|#define OQS_KEM_classic_mceliece_6688128f_length_secret_key 13932 ------------------ 23| 92| kem->length_ciphertext = OQS_KEM_classic_mceliece_6688128f_length_ciphertext; ------------------ | | 86| 92|#define OQS_KEM_classic_mceliece_6688128f_length_ciphertext 208 ------------------ 24| 92| kem->length_shared_secret = OQS_KEM_classic_mceliece_6688128f_length_shared_secret; ------------------ | | 87| 92|#define OQS_KEM_classic_mceliece_6688128f_length_shared_secret 32 ------------------ 25| 92| kem->length_keypair_seed = OQS_KEM_classic_mceliece_6688128f_length_keypair_seed; ------------------ | | 88| 92|#define OQS_KEM_classic_mceliece_6688128f_length_keypair_seed 0 ------------------ 26| 92| kem->length_encaps_seed = OQS_KEM_classic_mceliece_6688128f_length_encaps_seed; ------------------ | | 89| 92|#define OQS_KEM_classic_mceliece_6688128f_length_encaps_seed 0 ------------------ 27| | 28| 92| kem->keypair = OQS_KEM_classic_mceliece_6688128f_keypair; 29| 92| kem->keypair_derand = OQS_KEM_classic_mceliece_6688128f_keypair_derand; 30| 92| kem->encaps = OQS_KEM_classic_mceliece_6688128f_encaps; 31| 92| kem->encaps_derand = OQS_KEM_classic_mceliece_6688128f_encaps_derand; 32| 92| kem->decaps = OQS_KEM_classic_mceliece_6688128f_decaps; 33| | 34| 92| return kem; 35| 92|} OQS_KEM_classic_mceliece_6688128f_keypair: 54| 92|OQS_API OQS_STATUS OQS_KEM_classic_mceliece_6688128f_keypair(uint8_t *public_key, uint8_t *secret_key) { 55| 92|#if defined(OQS_ENABLE_KEM_classic_mceliece_6688128f_avx2) 56| 92|#if defined(OQS_DIST_BUILD) 57| 92| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2) && OQS_CPU_has_extension(OQS_CPU_EXT_POPCNT) && OQS_CPU_has_extension(OQS_CPU_EXT_BMI1)) { ------------------ | Branch (57:6): [True: 92, False: 0] | Branch (57:49): [True: 92, False: 0] | Branch (57:94): [True: 92, False: 0] ------------------ 58| 92|#endif /* OQS_DIST_BUILD */ 59| 92| return (OQS_STATUS) PQCLEAN_MCELIECE6688128F_AVX2_crypto_kem_keypair(public_key, secret_key); 60| 92|#if defined(OQS_DIST_BUILD) 61| 92| } else { 62| 0| return (OQS_STATUS) PQCLEAN_MCELIECE6688128F_CLEAN_crypto_kem_keypair(public_key, secret_key); 63| 0| } 64| 92|#endif /* OQS_DIST_BUILD */ 65| |#else 66| | return (OQS_STATUS) PQCLEAN_MCELIECE6688128F_CLEAN_crypto_kem_keypair(public_key, secret_key); 67| |#endif 68| 92|} OQS_KEM_classic_mceliece_6688128f_encaps: 78| 92|OQS_API OQS_STATUS OQS_KEM_classic_mceliece_6688128f_encaps(uint8_t *ciphertext, uint8_t *shared_secret, const uint8_t *public_key) { 79| 92|#if defined(OQS_ENABLE_KEM_classic_mceliece_6688128f_avx2) 80| 92|#if defined(OQS_DIST_BUILD) 81| 92| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2) && OQS_CPU_has_extension(OQS_CPU_EXT_POPCNT) && OQS_CPU_has_extension(OQS_CPU_EXT_BMI1)) { ------------------ | Branch (81:6): [True: 92, False: 0] | Branch (81:49): [True: 92, False: 0] | Branch (81:94): [True: 92, False: 0] ------------------ 82| 92|#endif /* OQS_DIST_BUILD */ 83| 92| return (OQS_STATUS) PQCLEAN_MCELIECE6688128F_AVX2_crypto_kem_enc(ciphertext, shared_secret, public_key); 84| 92|#if defined(OQS_DIST_BUILD) 85| 92| } else { 86| 0| return (OQS_STATUS) PQCLEAN_MCELIECE6688128F_CLEAN_crypto_kem_enc(ciphertext, shared_secret, public_key); 87| 0| } 88| 92|#endif /* OQS_DIST_BUILD */ 89| |#else 90| | return (OQS_STATUS) PQCLEAN_MCELIECE6688128F_CLEAN_crypto_kem_enc(ciphertext, shared_secret, public_key); 91| |#endif 92| 92|} OQS_KEM_classic_mceliece_6688128f_decaps: 94| 92|OQS_API OQS_STATUS OQS_KEM_classic_mceliece_6688128f_decaps(uint8_t *shared_secret, const uint8_t *ciphertext, const uint8_t *secret_key) { 95| 92|#if defined(OQS_ENABLE_KEM_classic_mceliece_6688128f_avx2) 96| 92|#if defined(OQS_DIST_BUILD) 97| 92| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2) && OQS_CPU_has_extension(OQS_CPU_EXT_POPCNT) && OQS_CPU_has_extension(OQS_CPU_EXT_BMI1)) { ------------------ | Branch (97:6): [True: 92, False: 0] | Branch (97:49): [True: 92, False: 0] | Branch (97:94): [True: 92, False: 0] ------------------ 98| 92|#endif /* OQS_DIST_BUILD */ 99| 92| return (OQS_STATUS) PQCLEAN_MCELIECE6688128F_AVX2_crypto_kem_dec(shared_secret, ciphertext, secret_key); 100| 92|#if defined(OQS_DIST_BUILD) 101| 92| } else { 102| 0| return (OQS_STATUS) PQCLEAN_MCELIECE6688128F_CLEAN_crypto_kem_dec(shared_secret, ciphertext, secret_key); 103| 0| } 104| 92|#endif /* OQS_DIST_BUILD */ 105| |#else 106| | return (OQS_STATUS) PQCLEAN_MCELIECE6688128F_CLEAN_crypto_kem_dec(shared_secret, ciphertext, secret_key); 107| |#endif 108| 92|} OQS_KEM_classic_mceliece_6960119_new: 9| 109|OQS_KEM *OQS_KEM_classic_mceliece_6960119_new(void) { 10| | 11| 109| OQS_KEM *kem = OQS_MEM_calloc(1, sizeof(OQS_KEM)); 12| 109| if (kem == NULL) { ------------------ | Branch (12:6): [True: 0, False: 109] ------------------ 13| 0| return NULL; 14| 0| } 15| 109| kem->method_name = OQS_KEM_alg_classic_mceliece_6960119; ------------------ | | 54| 109|#define OQS_KEM_alg_classic_mceliece_6960119 "Classic-McEliece-6960119" ------------------ 16| 109| kem->alg_version = "SUPERCOP-20221025"; 17| | 18| 109| kem->claimed_nist_level = 5; 19| 109| kem->ind_cca = true; 20| | 21| 109| kem->length_public_key = OQS_KEM_classic_mceliece_6960119_length_public_key; ------------------ | | 99| 109|#define OQS_KEM_classic_mceliece_6960119_length_public_key 1047319 ------------------ 22| 109| kem->length_secret_key = OQS_KEM_classic_mceliece_6960119_length_secret_key; ------------------ | | 100| 109|#define OQS_KEM_classic_mceliece_6960119_length_secret_key 13948 ------------------ 23| 109| kem->length_ciphertext = OQS_KEM_classic_mceliece_6960119_length_ciphertext; ------------------ | | 101| 109|#define OQS_KEM_classic_mceliece_6960119_length_ciphertext 194 ------------------ 24| 109| kem->length_shared_secret = OQS_KEM_classic_mceliece_6960119_length_shared_secret; ------------------ | | 102| 109|#define OQS_KEM_classic_mceliece_6960119_length_shared_secret 32 ------------------ 25| 109| kem->length_keypair_seed = OQS_KEM_classic_mceliece_6960119_length_keypair_seed; ------------------ | | 103| 109|#define OQS_KEM_classic_mceliece_6960119_length_keypair_seed 0 ------------------ 26| 109| kem->length_encaps_seed = OQS_KEM_classic_mceliece_6960119_length_encaps_seed; ------------------ | | 104| 109|#define OQS_KEM_classic_mceliece_6960119_length_encaps_seed 0 ------------------ 27| | 28| 109| kem->keypair = OQS_KEM_classic_mceliece_6960119_keypair; 29| 109| kem->keypair_derand = OQS_KEM_classic_mceliece_6960119_keypair_derand; 30| 109| kem->encaps = OQS_KEM_classic_mceliece_6960119_encaps; 31| 109| kem->encaps_derand = OQS_KEM_classic_mceliece_6960119_encaps_derand; 32| 109| kem->decaps = OQS_KEM_classic_mceliece_6960119_decaps; 33| | 34| 109| return kem; 35| 109|} OQS_KEM_classic_mceliece_6960119_keypair: 54| 109|OQS_API OQS_STATUS OQS_KEM_classic_mceliece_6960119_keypair(uint8_t *public_key, uint8_t *secret_key) { 55| 109|#if defined(OQS_ENABLE_KEM_classic_mceliece_6960119_avx2) 56| 109|#if defined(OQS_DIST_BUILD) 57| 109| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2) && OQS_CPU_has_extension(OQS_CPU_EXT_POPCNT)) { ------------------ | Branch (57:6): [True: 109, False: 0] | Branch (57:49): [True: 109, False: 0] ------------------ 58| 109|#endif /* OQS_DIST_BUILD */ 59| 109| return (OQS_STATUS) PQCLEAN_MCELIECE6960119_AVX2_crypto_kem_keypair(public_key, secret_key); 60| 109|#if defined(OQS_DIST_BUILD) 61| 109| } else { 62| 0| return (OQS_STATUS) PQCLEAN_MCELIECE6960119_CLEAN_crypto_kem_keypair(public_key, secret_key); 63| 0| } 64| 109|#endif /* OQS_DIST_BUILD */ 65| |#else 66| | return (OQS_STATUS) PQCLEAN_MCELIECE6960119_CLEAN_crypto_kem_keypair(public_key, secret_key); 67| |#endif 68| 109|} OQS_KEM_classic_mceliece_6960119_encaps: 78| 109|OQS_API OQS_STATUS OQS_KEM_classic_mceliece_6960119_encaps(uint8_t *ciphertext, uint8_t *shared_secret, const uint8_t *public_key) { 79| 109|#if defined(OQS_ENABLE_KEM_classic_mceliece_6960119_avx2) 80| 109|#if defined(OQS_DIST_BUILD) 81| 109| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2) && OQS_CPU_has_extension(OQS_CPU_EXT_POPCNT)) { ------------------ | Branch (81:6): [True: 109, False: 0] | Branch (81:49): [True: 109, False: 0] ------------------ 82| 109|#endif /* OQS_DIST_BUILD */ 83| 109| return (OQS_STATUS) PQCLEAN_MCELIECE6960119_AVX2_crypto_kem_enc(ciphertext, shared_secret, public_key); 84| 109|#if defined(OQS_DIST_BUILD) 85| 109| } else { 86| 0| return (OQS_STATUS) PQCLEAN_MCELIECE6960119_CLEAN_crypto_kem_enc(ciphertext, shared_secret, public_key); 87| 0| } 88| 109|#endif /* OQS_DIST_BUILD */ 89| |#else 90| | return (OQS_STATUS) PQCLEAN_MCELIECE6960119_CLEAN_crypto_kem_enc(ciphertext, shared_secret, public_key); 91| |#endif 92| 109|} OQS_KEM_classic_mceliece_6960119_decaps: 94| 109|OQS_API OQS_STATUS OQS_KEM_classic_mceliece_6960119_decaps(uint8_t *shared_secret, const uint8_t *ciphertext, const uint8_t *secret_key) { 95| 109|#if defined(OQS_ENABLE_KEM_classic_mceliece_6960119_avx2) 96| 109|#if defined(OQS_DIST_BUILD) 97| 109| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2) && OQS_CPU_has_extension(OQS_CPU_EXT_POPCNT)) { ------------------ | Branch (97:6): [True: 109, False: 0] | Branch (97:49): [True: 109, False: 0] ------------------ 98| 109|#endif /* OQS_DIST_BUILD */ 99| 109| return (OQS_STATUS) PQCLEAN_MCELIECE6960119_AVX2_crypto_kem_dec(shared_secret, ciphertext, secret_key); 100| 109|#if defined(OQS_DIST_BUILD) 101| 109| } else { 102| 0| return (OQS_STATUS) PQCLEAN_MCELIECE6960119_CLEAN_crypto_kem_dec(shared_secret, ciphertext, secret_key); 103| 0| } 104| 109|#endif /* OQS_DIST_BUILD */ 105| |#else 106| | return (OQS_STATUS) PQCLEAN_MCELIECE6960119_CLEAN_crypto_kem_dec(shared_secret, ciphertext, secret_key); 107| |#endif 108| 109|} OQS_KEM_classic_mceliece_6960119f_new: 9| 99|OQS_KEM *OQS_KEM_classic_mceliece_6960119f_new(void) { 10| | 11| 99| OQS_KEM *kem = OQS_MEM_calloc(1, sizeof(OQS_KEM)); 12| 99| if (kem == NULL) { ------------------ | Branch (12:6): [True: 0, False: 99] ------------------ 13| 0| return NULL; 14| 0| } 15| 99| kem->method_name = OQS_KEM_alg_classic_mceliece_6960119f; ------------------ | | 56| 99|#define OQS_KEM_alg_classic_mceliece_6960119f "Classic-McEliece-6960119f" ------------------ 16| 99| kem->alg_version = "SUPERCOP-20221025"; 17| | 18| 99| kem->claimed_nist_level = 5; 19| 99| kem->ind_cca = true; 20| | 21| 99| kem->length_public_key = OQS_KEM_classic_mceliece_6960119f_length_public_key; ------------------ | | 114| 99|#define OQS_KEM_classic_mceliece_6960119f_length_public_key 1047319 ------------------ 22| 99| kem->length_secret_key = OQS_KEM_classic_mceliece_6960119f_length_secret_key; ------------------ | | 115| 99|#define OQS_KEM_classic_mceliece_6960119f_length_secret_key 13948 ------------------ 23| 99| kem->length_ciphertext = OQS_KEM_classic_mceliece_6960119f_length_ciphertext; ------------------ | | 116| 99|#define OQS_KEM_classic_mceliece_6960119f_length_ciphertext 194 ------------------ 24| 99| kem->length_shared_secret = OQS_KEM_classic_mceliece_6960119f_length_shared_secret; ------------------ | | 117| 99|#define OQS_KEM_classic_mceliece_6960119f_length_shared_secret 32 ------------------ 25| 99| kem->length_keypair_seed = OQS_KEM_classic_mceliece_6960119f_length_keypair_seed; ------------------ | | 118| 99|#define OQS_KEM_classic_mceliece_6960119f_length_keypair_seed 0 ------------------ 26| 99| kem->length_encaps_seed = OQS_KEM_classic_mceliece_6960119f_length_encaps_seed; ------------------ | | 119| 99|#define OQS_KEM_classic_mceliece_6960119f_length_encaps_seed 0 ------------------ 27| | 28| 99| kem->keypair = OQS_KEM_classic_mceliece_6960119f_keypair; 29| 99| kem->keypair_derand = OQS_KEM_classic_mceliece_6960119f_keypair_derand; 30| 99| kem->encaps = OQS_KEM_classic_mceliece_6960119f_encaps; 31| 99| kem->encaps_derand = OQS_KEM_classic_mceliece_6960119f_encaps_derand; 32| 99| kem->decaps = OQS_KEM_classic_mceliece_6960119f_decaps; 33| | 34| 99| return kem; 35| 99|} OQS_KEM_classic_mceliece_6960119f_keypair: 54| 99|OQS_API OQS_STATUS OQS_KEM_classic_mceliece_6960119f_keypair(uint8_t *public_key, uint8_t *secret_key) { 55| 99|#if defined(OQS_ENABLE_KEM_classic_mceliece_6960119f_avx2) 56| 99|#if defined(OQS_DIST_BUILD) 57| 99| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2) && OQS_CPU_has_extension(OQS_CPU_EXT_POPCNT) && OQS_CPU_has_extension(OQS_CPU_EXT_BMI1)) { ------------------ | Branch (57:6): [True: 99, False: 0] | Branch (57:49): [True: 99, False: 0] | Branch (57:94): [True: 99, False: 0] ------------------ 58| 99|#endif /* OQS_DIST_BUILD */ 59| 99| return (OQS_STATUS) PQCLEAN_MCELIECE6960119F_AVX2_crypto_kem_keypair(public_key, secret_key); 60| 99|#if defined(OQS_DIST_BUILD) 61| 99| } else { 62| 0| return (OQS_STATUS) PQCLEAN_MCELIECE6960119F_CLEAN_crypto_kem_keypair(public_key, secret_key); 63| 0| } 64| 99|#endif /* OQS_DIST_BUILD */ 65| |#else 66| | return (OQS_STATUS) PQCLEAN_MCELIECE6960119F_CLEAN_crypto_kem_keypair(public_key, secret_key); 67| |#endif 68| 99|} OQS_KEM_classic_mceliece_6960119f_encaps: 78| 99|OQS_API OQS_STATUS OQS_KEM_classic_mceliece_6960119f_encaps(uint8_t *ciphertext, uint8_t *shared_secret, const uint8_t *public_key) { 79| 99|#if defined(OQS_ENABLE_KEM_classic_mceliece_6960119f_avx2) 80| 99|#if defined(OQS_DIST_BUILD) 81| 99| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2) && OQS_CPU_has_extension(OQS_CPU_EXT_POPCNT) && OQS_CPU_has_extension(OQS_CPU_EXT_BMI1)) { ------------------ | Branch (81:6): [True: 99, False: 0] | Branch (81:49): [True: 99, False: 0] | Branch (81:94): [True: 99, False: 0] ------------------ 82| 99|#endif /* OQS_DIST_BUILD */ 83| 99| return (OQS_STATUS) PQCLEAN_MCELIECE6960119F_AVX2_crypto_kem_enc(ciphertext, shared_secret, public_key); 84| 99|#if defined(OQS_DIST_BUILD) 85| 99| } else { 86| 0| return (OQS_STATUS) PQCLEAN_MCELIECE6960119F_CLEAN_crypto_kem_enc(ciphertext, shared_secret, public_key); 87| 0| } 88| 99|#endif /* OQS_DIST_BUILD */ 89| |#else 90| | return (OQS_STATUS) PQCLEAN_MCELIECE6960119F_CLEAN_crypto_kem_enc(ciphertext, shared_secret, public_key); 91| |#endif 92| 99|} OQS_KEM_classic_mceliece_6960119f_decaps: 94| 99|OQS_API OQS_STATUS OQS_KEM_classic_mceliece_6960119f_decaps(uint8_t *shared_secret, const uint8_t *ciphertext, const uint8_t *secret_key) { 95| 99|#if defined(OQS_ENABLE_KEM_classic_mceliece_6960119f_avx2) 96| 99|#if defined(OQS_DIST_BUILD) 97| 99| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2) && OQS_CPU_has_extension(OQS_CPU_EXT_POPCNT) && OQS_CPU_has_extension(OQS_CPU_EXT_BMI1)) { ------------------ | Branch (97:6): [True: 99, False: 0] | Branch (97:49): [True: 99, False: 0] | Branch (97:94): [True: 99, False: 0] ------------------ 98| 99|#endif /* OQS_DIST_BUILD */ 99| 99| return (OQS_STATUS) PQCLEAN_MCELIECE6960119F_AVX2_crypto_kem_dec(shared_secret, ciphertext, secret_key); 100| 99|#if defined(OQS_DIST_BUILD) 101| 99| } else { 102| 0| return (OQS_STATUS) PQCLEAN_MCELIECE6960119F_CLEAN_crypto_kem_dec(shared_secret, ciphertext, secret_key); 103| 0| } 104| 99|#endif /* OQS_DIST_BUILD */ 105| |#else 106| | return (OQS_STATUS) PQCLEAN_MCELIECE6960119F_CLEAN_crypto_kem_dec(shared_secret, ciphertext, secret_key); 107| |#endif 108| 99|} OQS_KEM_classic_mceliece_8192128_new: 9| 91|OQS_KEM *OQS_KEM_classic_mceliece_8192128_new(void) { 10| | 11| 91| OQS_KEM *kem = OQS_MEM_calloc(1, sizeof(OQS_KEM)); 12| 91| if (kem == NULL) { ------------------ | Branch (12:6): [True: 0, False: 91] ------------------ 13| 0| return NULL; 14| 0| } 15| 91| kem->method_name = OQS_KEM_alg_classic_mceliece_8192128; ------------------ | | 58| 91|#define OQS_KEM_alg_classic_mceliece_8192128 "Classic-McEliece-8192128" ------------------ 16| 91| kem->alg_version = "SUPERCOP-20221025"; 17| | 18| 91| kem->claimed_nist_level = 5; 19| 91| kem->ind_cca = true; 20| | 21| 91| kem->length_public_key = OQS_KEM_classic_mceliece_8192128_length_public_key; ------------------ | | 129| 91|#define OQS_KEM_classic_mceliece_8192128_length_public_key 1357824 ------------------ 22| 91| kem->length_secret_key = OQS_KEM_classic_mceliece_8192128_length_secret_key; ------------------ | | 130| 91|#define OQS_KEM_classic_mceliece_8192128_length_secret_key 14120 ------------------ 23| 91| kem->length_ciphertext = OQS_KEM_classic_mceliece_8192128_length_ciphertext; ------------------ | | 131| 91|#define OQS_KEM_classic_mceliece_8192128_length_ciphertext 208 ------------------ 24| 91| kem->length_shared_secret = OQS_KEM_classic_mceliece_8192128_length_shared_secret; ------------------ | | 132| 91|#define OQS_KEM_classic_mceliece_8192128_length_shared_secret 32 ------------------ 25| 91| kem->length_keypair_seed = OQS_KEM_classic_mceliece_8192128_length_keypair_seed; ------------------ | | 133| 91|#define OQS_KEM_classic_mceliece_8192128_length_keypair_seed 0 ------------------ 26| 91| kem->length_encaps_seed = OQS_KEM_classic_mceliece_8192128_length_encaps_seed; ------------------ | | 134| 91|#define OQS_KEM_classic_mceliece_8192128_length_encaps_seed 0 ------------------ 27| | 28| 91| kem->keypair = OQS_KEM_classic_mceliece_8192128_keypair; 29| 91| kem->keypair_derand = OQS_KEM_classic_mceliece_8192128_keypair_derand; 30| 91| kem->encaps = OQS_KEM_classic_mceliece_8192128_encaps; 31| 91| kem->encaps_derand = OQS_KEM_classic_mceliece_8192128_encaps_derand; 32| 91| kem->decaps = OQS_KEM_classic_mceliece_8192128_decaps; 33| | 34| 91| return kem; 35| 91|} OQS_KEM_classic_mceliece_8192128_keypair: 54| 91|OQS_API OQS_STATUS OQS_KEM_classic_mceliece_8192128_keypair(uint8_t *public_key, uint8_t *secret_key) { 55| 91|#if defined(OQS_ENABLE_KEM_classic_mceliece_8192128_avx2) 56| 91|#if defined(OQS_DIST_BUILD) 57| 91| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2) && OQS_CPU_has_extension(OQS_CPU_EXT_POPCNT)) { ------------------ | Branch (57:6): [True: 91, False: 0] | Branch (57:49): [True: 91, False: 0] ------------------ 58| 91|#endif /* OQS_DIST_BUILD */ 59| 91| return (OQS_STATUS) PQCLEAN_MCELIECE8192128_AVX2_crypto_kem_keypair(public_key, secret_key); 60| 91|#if defined(OQS_DIST_BUILD) 61| 91| } else { 62| 0| return (OQS_STATUS) PQCLEAN_MCELIECE8192128_CLEAN_crypto_kem_keypair(public_key, secret_key); 63| 0| } 64| 91|#endif /* OQS_DIST_BUILD */ 65| |#else 66| | return (OQS_STATUS) PQCLEAN_MCELIECE8192128_CLEAN_crypto_kem_keypair(public_key, secret_key); 67| |#endif 68| 91|} OQS_KEM_classic_mceliece_8192128_encaps: 78| 91|OQS_API OQS_STATUS OQS_KEM_classic_mceliece_8192128_encaps(uint8_t *ciphertext, uint8_t *shared_secret, const uint8_t *public_key) { 79| 91|#if defined(OQS_ENABLE_KEM_classic_mceliece_8192128_avx2) 80| 91|#if defined(OQS_DIST_BUILD) 81| 91| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2) && OQS_CPU_has_extension(OQS_CPU_EXT_POPCNT)) { ------------------ | Branch (81:6): [True: 91, False: 0] | Branch (81:49): [True: 91, False: 0] ------------------ 82| 91|#endif /* OQS_DIST_BUILD */ 83| 91| return (OQS_STATUS) PQCLEAN_MCELIECE8192128_AVX2_crypto_kem_enc(ciphertext, shared_secret, public_key); 84| 91|#if defined(OQS_DIST_BUILD) 85| 91| } else { 86| 0| return (OQS_STATUS) PQCLEAN_MCELIECE8192128_CLEAN_crypto_kem_enc(ciphertext, shared_secret, public_key); 87| 0| } 88| 91|#endif /* OQS_DIST_BUILD */ 89| |#else 90| | return (OQS_STATUS) PQCLEAN_MCELIECE8192128_CLEAN_crypto_kem_enc(ciphertext, shared_secret, public_key); 91| |#endif 92| 91|} OQS_KEM_classic_mceliece_8192128_decaps: 94| 91|OQS_API OQS_STATUS OQS_KEM_classic_mceliece_8192128_decaps(uint8_t *shared_secret, const uint8_t *ciphertext, const uint8_t *secret_key) { 95| 91|#if defined(OQS_ENABLE_KEM_classic_mceliece_8192128_avx2) 96| 91|#if defined(OQS_DIST_BUILD) 97| 91| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2) && OQS_CPU_has_extension(OQS_CPU_EXT_POPCNT)) { ------------------ | Branch (97:6): [True: 91, False: 0] | Branch (97:49): [True: 91, False: 0] ------------------ 98| 91|#endif /* OQS_DIST_BUILD */ 99| 91| return (OQS_STATUS) PQCLEAN_MCELIECE8192128_AVX2_crypto_kem_dec(shared_secret, ciphertext, secret_key); 100| 91|#if defined(OQS_DIST_BUILD) 101| 91| } else { 102| 0| return (OQS_STATUS) PQCLEAN_MCELIECE8192128_CLEAN_crypto_kem_dec(shared_secret, ciphertext, secret_key); 103| 0| } 104| 91|#endif /* OQS_DIST_BUILD */ 105| |#else 106| | return (OQS_STATUS) PQCLEAN_MCELIECE8192128_CLEAN_crypto_kem_dec(shared_secret, ciphertext, secret_key); 107| |#endif 108| 91|} OQS_KEM_classic_mceliece_8192128f_new: 9| 69|OQS_KEM *OQS_KEM_classic_mceliece_8192128f_new(void) { 10| | 11| 69| OQS_KEM *kem = OQS_MEM_calloc(1, sizeof(OQS_KEM)); 12| 69| if (kem == NULL) { ------------------ | Branch (12:6): [True: 0, False: 69] ------------------ 13| 0| return NULL; 14| 0| } 15| 69| kem->method_name = OQS_KEM_alg_classic_mceliece_8192128f; ------------------ | | 60| 69|#define OQS_KEM_alg_classic_mceliece_8192128f "Classic-McEliece-8192128f" ------------------ 16| 69| kem->alg_version = "SUPERCOP-20221025"; 17| | 18| 69| kem->claimed_nist_level = 5; 19| 69| kem->ind_cca = true; 20| | 21| 69| kem->length_public_key = OQS_KEM_classic_mceliece_8192128f_length_public_key; ------------------ | | 144| 69|#define OQS_KEM_classic_mceliece_8192128f_length_public_key 1357824 ------------------ 22| 69| kem->length_secret_key = OQS_KEM_classic_mceliece_8192128f_length_secret_key; ------------------ | | 145| 69|#define OQS_KEM_classic_mceliece_8192128f_length_secret_key 14120 ------------------ 23| 69| kem->length_ciphertext = OQS_KEM_classic_mceliece_8192128f_length_ciphertext; ------------------ | | 146| 69|#define OQS_KEM_classic_mceliece_8192128f_length_ciphertext 208 ------------------ 24| 69| kem->length_shared_secret = OQS_KEM_classic_mceliece_8192128f_length_shared_secret; ------------------ | | 147| 69|#define OQS_KEM_classic_mceliece_8192128f_length_shared_secret 32 ------------------ 25| 69| kem->length_keypair_seed = OQS_KEM_classic_mceliece_8192128f_length_keypair_seed; ------------------ | | 148| 69|#define OQS_KEM_classic_mceliece_8192128f_length_keypair_seed 0 ------------------ 26| 69| kem->length_encaps_seed = OQS_KEM_classic_mceliece_8192128f_length_encaps_seed; ------------------ | | 149| 69|#define OQS_KEM_classic_mceliece_8192128f_length_encaps_seed 0 ------------------ 27| | 28| 69| kem->keypair = OQS_KEM_classic_mceliece_8192128f_keypair; 29| 69| kem->keypair_derand = OQS_KEM_classic_mceliece_8192128f_keypair_derand; 30| 69| kem->encaps = OQS_KEM_classic_mceliece_8192128f_encaps; 31| 69| kem->encaps_derand = OQS_KEM_classic_mceliece_8192128f_encaps_derand; 32| 69| kem->decaps = OQS_KEM_classic_mceliece_8192128f_decaps; 33| | 34| 69| return kem; 35| 69|} OQS_KEM_classic_mceliece_8192128f_keypair: 54| 69|OQS_API OQS_STATUS OQS_KEM_classic_mceliece_8192128f_keypair(uint8_t *public_key, uint8_t *secret_key) { 55| 69|#if defined(OQS_ENABLE_KEM_classic_mceliece_8192128f_avx2) 56| 69|#if defined(OQS_DIST_BUILD) 57| 69| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2) && OQS_CPU_has_extension(OQS_CPU_EXT_POPCNT) && OQS_CPU_has_extension(OQS_CPU_EXT_BMI1)) { ------------------ | Branch (57:6): [True: 69, False: 0] | Branch (57:49): [True: 69, False: 0] | Branch (57:94): [True: 69, False: 0] ------------------ 58| 69|#endif /* OQS_DIST_BUILD */ 59| 69| return (OQS_STATUS) PQCLEAN_MCELIECE8192128F_AVX2_crypto_kem_keypair(public_key, secret_key); 60| 69|#if defined(OQS_DIST_BUILD) 61| 69| } else { 62| 0| return (OQS_STATUS) PQCLEAN_MCELIECE8192128F_CLEAN_crypto_kem_keypair(public_key, secret_key); 63| 0| } 64| 69|#endif /* OQS_DIST_BUILD */ 65| |#else 66| | return (OQS_STATUS) PQCLEAN_MCELIECE8192128F_CLEAN_crypto_kem_keypair(public_key, secret_key); 67| |#endif 68| 69|} OQS_KEM_classic_mceliece_8192128f_encaps: 78| 69|OQS_API OQS_STATUS OQS_KEM_classic_mceliece_8192128f_encaps(uint8_t *ciphertext, uint8_t *shared_secret, const uint8_t *public_key) { 79| 69|#if defined(OQS_ENABLE_KEM_classic_mceliece_8192128f_avx2) 80| 69|#if defined(OQS_DIST_BUILD) 81| 69| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2) && OQS_CPU_has_extension(OQS_CPU_EXT_POPCNT) && OQS_CPU_has_extension(OQS_CPU_EXT_BMI1)) { ------------------ | Branch (81:6): [True: 69, False: 0] | Branch (81:49): [True: 69, False: 0] | Branch (81:94): [True: 69, False: 0] ------------------ 82| 69|#endif /* OQS_DIST_BUILD */ 83| 69| return (OQS_STATUS) PQCLEAN_MCELIECE8192128F_AVX2_crypto_kem_enc(ciphertext, shared_secret, public_key); 84| 69|#if defined(OQS_DIST_BUILD) 85| 69| } else { 86| 0| return (OQS_STATUS) PQCLEAN_MCELIECE8192128F_CLEAN_crypto_kem_enc(ciphertext, shared_secret, public_key); 87| 0| } 88| 69|#endif /* OQS_DIST_BUILD */ 89| |#else 90| | return (OQS_STATUS) PQCLEAN_MCELIECE8192128F_CLEAN_crypto_kem_enc(ciphertext, shared_secret, public_key); 91| |#endif 92| 69|} OQS_KEM_classic_mceliece_8192128f_decaps: 94| 69|OQS_API OQS_STATUS OQS_KEM_classic_mceliece_8192128f_decaps(uint8_t *shared_secret, const uint8_t *ciphertext, const uint8_t *secret_key) { 95| 69|#if defined(OQS_ENABLE_KEM_classic_mceliece_8192128f_avx2) 96| 69|#if defined(OQS_DIST_BUILD) 97| 69| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2) && OQS_CPU_has_extension(OQS_CPU_EXT_POPCNT) && OQS_CPU_has_extension(OQS_CPU_EXT_BMI1)) { ------------------ | Branch (97:6): [True: 69, False: 0] | Branch (97:49): [True: 69, False: 0] | Branch (97:94): [True: 69, False: 0] ------------------ 98| 69|#endif /* OQS_DIST_BUILD */ 99| 69| return (OQS_STATUS) PQCLEAN_MCELIECE8192128F_AVX2_crypto_kem_dec(shared_secret, ciphertext, secret_key); 100| 69|#if defined(OQS_DIST_BUILD) 101| 69| } else { 102| 0| return (OQS_STATUS) PQCLEAN_MCELIECE8192128F_CLEAN_crypto_kem_dec(shared_secret, ciphertext, secret_key); 103| 0| } 104| 69|#endif /* OQS_DIST_BUILD */ 105| |#else 106| | return (OQS_STATUS) PQCLEAN_MCELIECE8192128F_CLEAN_crypto_kem_dec(shared_secret, ciphertext, secret_key); 107| |#endif 108| 69|} PQCLEAN_MCELIECE348864_AVX2_load_bits: 168| 98|void load_bits(uint64_t out[][32], const unsigned char *bits) { 169| 98| int i, low, block = 0; 170| | 171| 98| uint64_t cond[64]; 172| | 173| | // 174| | 175| 686| for (low = 0; low <= 5; low++) { ------------------ | Branch (175:19): [True: 588, False: 98] ------------------ 176| 38.2k| for (i = 0; i < 64; i++) { ------------------ | Branch (176:21): [True: 37.6k, False: 588] ------------------ 177| 37.6k| cond[i] = load4(bits + block * 256 + i * 4); 178| 37.6k| } 179| 588| transpose_64x64(cond); 180| | 181| 19.4k| for (i = 0; i < 32; i++) { ------------------ | Branch (181:21): [True: 18.8k, False: 588] ------------------ 182| 18.8k| out[ block ][i] = cond[i]; 183| 18.8k| } 184| 588| block++; 185| 588| } 186| | 187| 686| for (low = 0; low <= 5; low++) { ------------------ | Branch (187:19): [True: 588, False: 98] ------------------ 188| 19.4k| for (i = 0; i < 32; i++) { ------------------ | Branch (188:21): [True: 18.8k, False: 588] ------------------ 189| 18.8k| out[ block ][i] = load8(bits + block * 256 + i * 8); 190| 18.8k| } 191| 588| block++; 192| 588| } 193| | 194| 588| for (low = 4; low >= 0; low--) { ------------------ | Branch (194:19): [True: 490, False: 98] ------------------ 195| 16.1k| for (i = 0; i < 32; i++) { ------------------ | Branch (195:21): [True: 15.6k, False: 490] ------------------ 196| 15.6k| out[ block ][i] = load8(bits + block * 256 + i * 8); 197| 15.6k| } 198| 490| block++; 199| 490| } 200| | 201| 686| for (low = 5; low >= 0; low--) { ------------------ | Branch (201:19): [True: 588, False: 98] ------------------ 202| 38.2k| for (i = 0; i < 64; i++) { ------------------ | Branch (202:21): [True: 37.6k, False: 588] ------------------ 203| 37.6k| cond[i] = load4(bits + block * 256 + i * 4); 204| 37.6k| } 205| 588| transpose_64x64(cond); 206| | 207| 19.4k| for (i = 0; i < 32; i++) { ------------------ | Branch (207:21): [True: 18.8k, False: 588] ------------------ 208| 18.8k| out[ block ][i] = cond[i]; 209| 18.8k| } 210| 588| block++; 211| 588| } 212| 98|} PQCLEAN_MCELIECE348864_AVX2_benes: 218| 196|void benes(uint64_t *r, uint64_t cond[][32], int rev) { 219| 196| int block, inc; 220| | 221| 196| uint64_t *bs = r; 222| | 223| | // 224| | 225| 196| if (rev == 0) { ------------------ | Branch (225:9): [True: 98, False: 98] ------------------ 226| 98| block = 0; 227| 98| inc = 1; 228| 98| } else { 229| 98| block = 22; 230| 98| inc = -1; 231| 98| } 232| | 233| 196| transpose_64x64(bs); 234| | 235| 196| layer_0(bs, cond[ block ]); 236| 196| block += inc; 237| 196| layer_1(bs, cond[ block ]); 238| 196| block += inc; 239| 196| layer_2(bs, cond[ block ]); 240| 196| block += inc; 241| 196| layer_3(bs, cond[ block ]); 242| 196| block += inc; 243| 196| layer_4(bs, cond[ block ]); 244| 196| block += inc; 245| 196| layer_5(bs, cond[ block ]); 246| 196| block += inc; 247| | 248| 196| transpose_64x64(bs); 249| | 250| 196| layer_0(bs, cond[ block ]); 251| 196| block += inc; 252| 196| layer_1(bs, cond[ block ]); 253| 196| block += inc; 254| 196| layer_2(bs, cond[ block ]); 255| 196| block += inc; 256| 196| layer_3(bs, cond[ block ]); 257| 196| block += inc; 258| 196| layer_4(bs, cond[ block ]); 259| 196| block += inc; 260| 196| layer_5(bs, cond[ block ]); 261| 196| block += inc; 262| 196| layer_4(bs, cond[ block ]); 263| 196| block += inc; 264| 196| layer_3(bs, cond[ block ]); 265| 196| block += inc; 266| 196| layer_2(bs, cond[ block ]); 267| 196| block += inc; 268| 196| layer_1(bs, cond[ block ]); 269| 196| block += inc; 270| 196| layer_0(bs, cond[ block ]); 271| 196| block += inc; 272| | 273| 196| transpose_64x64(bs); 274| | 275| 196| layer_5(bs, cond[ block ]); 276| 196| block += inc; 277| 196| layer_4(bs, cond[ block ]); 278| 196| block += inc; 279| 196| layer_3(bs, cond[ block ]); 280| 196| block += inc; 281| 196| layer_2(bs, cond[ block ]); 282| 196| block += inc; 283| 196| layer_1(bs, cond[ block ]); 284| 196| block += inc; 285| 196| layer_0(bs, cond[ block ]); 286| | 287| 196| transpose_64x64(bs); 288| 196|} benes.c:layer_0: 13| 7.60k|static void layer_0(uint64_t *bs, uint64_t *cond) { 14| 7.60k| int x; 15| 7.60k| uint64_t diff; 16| | 17| 251k| for (x = 0; x < (1 << 6); x += 2) { ------------------ | Branch (17:17): [True: 243k, False: 7.60k] ------------------ 18| 243k| diff = bs[ x ] ^ bs[ x + 1 ]; 19| 243k| diff &= *cond++; 20| 243k| bs[ x ] ^= diff; 21| 243k| bs[ x + 1 ] ^= diff; 22| 243k| } 23| 7.60k|} benes.c:layer_1: 25| 7.60k|static void layer_1(uint64_t *bs, const uint64_t *cond) { 26| 7.60k| int x; 27| 7.60k| uint64_t diff; 28| | 29| 129k| for (x = 0; x < (1 << 6); x += 4) { ------------------ | Branch (29:17): [True: 121k, False: 7.60k] ------------------ 30| 121k| diff = bs[ x + 0 ] ^ bs[ x + 2 ]; 31| 121k| diff &= cond[0]; 32| 121k| bs[ x + 0 ] ^= diff; 33| 121k| bs[ x + 2 ] ^= diff; 34| | 35| 121k| diff = bs[ x + 1 ] ^ bs[ x + 3 ]; 36| 121k| diff &= cond[1]; 37| 121k| bs[ x + 1 ] ^= diff; 38| 121k| bs[ x + 3 ] ^= diff; 39| | 40| 121k| cond += 2; 41| 121k| } 42| 7.60k|} benes.c:layer_2: 44| 7.60k|static void layer_2(uint64_t *bs, const uint64_t *cond) { 45| 7.60k| int x; 46| 7.60k| uint64_t diff; 47| | 48| 68.4k| for (x = 0; x < (1 << 6); x += 8) { ------------------ | Branch (48:17): [True: 60.8k, False: 7.60k] ------------------ 49| 60.8k| diff = bs[ x + 0 ] ^ bs[ x + 4 ]; 50| 60.8k| diff &= cond[0]; 51| 60.8k| bs[ x + 0 ] ^= diff; 52| 60.8k| bs[ x + 4 ] ^= diff; 53| | 54| 60.8k| diff = bs[ x + 1 ] ^ bs[ x + 5 ]; 55| 60.8k| diff &= cond[1]; 56| 60.8k| bs[ x + 1 ] ^= diff; 57| 60.8k| bs[ x + 5 ] ^= diff; 58| | 59| 60.8k| diff = bs[ x + 2 ] ^ bs[ x + 6 ]; 60| 60.8k| diff &= cond[2]; 61| 60.8k| bs[ x + 2 ] ^= diff; 62| 60.8k| bs[ x + 6 ] ^= diff; 63| | 64| 60.8k| diff = bs[ x + 3 ] ^ bs[ x + 7 ]; 65| 60.8k| diff &= cond[3]; 66| 60.8k| bs[ x + 3 ] ^= diff; 67| 60.8k| bs[ x + 7 ] ^= diff; 68| | 69| 60.8k| cond += 4; 70| 60.8k| } 71| 7.60k|} benes.c:layer_3: 73| 7.60k|static void layer_3(uint64_t *bs, const uint64_t *cond) { 74| 7.60k| int x, s; 75| 7.60k| uint64_t diff; 76| | 77| 38.0k| for (x = 0; x < (1 << 6); x += 16) { ------------------ | Branch (77:17): [True: 30.4k, False: 7.60k] ------------------ 78| 91.2k| for (s = x; s < x + 8; s += 4) { ------------------ | Branch (78:21): [True: 60.8k, False: 30.4k] ------------------ 79| 60.8k| diff = bs[ s + 0 ] ^ bs[ s + 8 ]; 80| 60.8k| diff &= cond[0]; 81| 60.8k| bs[ s + 0 ] ^= diff; 82| 60.8k| bs[ s + 8 ] ^= diff; 83| | 84| 60.8k| diff = bs[ s + 1 ] ^ bs[ s + 9 ]; 85| 60.8k| diff &= cond[1]; 86| 60.8k| bs[ s + 1 ] ^= diff; 87| 60.8k| bs[ s + 9 ] ^= diff; 88| | 89| 60.8k| diff = bs[ s + 2 ] ^ bs[ s + 10 ]; 90| 60.8k| diff &= cond[2]; 91| 60.8k| bs[ s + 2 ] ^= diff; 92| 60.8k| bs[ s + 10 ] ^= diff; 93| | 94| 60.8k| diff = bs[ s + 3 ] ^ bs[ s + 11 ]; 95| 60.8k| diff &= cond[3]; 96| 60.8k| bs[ s + 3 ] ^= diff; 97| 60.8k| bs[ s + 11 ] ^= diff; 98| | 99| 60.8k| cond += 4; 100| 60.8k| } 101| 30.4k| } 102| 7.60k|} benes.c:layer_4: 104| 7.60k|static void layer_4(uint64_t *bs, const uint64_t *cond) { 105| 7.60k| int x, s; 106| 7.60k| uint64_t diff; 107| | 108| 22.8k| for (x = 0; x < (1 << 6); x += 32) { ------------------ | Branch (108:17): [True: 15.2k, False: 7.60k] ------------------ 109| 76.0k| for (s = x; s < x + 16; s += 4) { ------------------ | Branch (109:21): [True: 60.8k, False: 15.2k] ------------------ 110| 60.8k| diff = bs[ s + 0 ] ^ bs[ s + 16 ]; 111| 60.8k| diff &= cond[0]; 112| 60.8k| bs[ s + 0 ] ^= diff; 113| 60.8k| bs[ s + 16 ] ^= diff; 114| | 115| 60.8k| diff = bs[ s + 1 ] ^ bs[ s + 17 ]; 116| 60.8k| diff &= cond[1]; 117| 60.8k| bs[ s + 1 ] ^= diff; 118| 60.8k| bs[ s + 17 ] ^= diff; 119| | 120| 60.8k| diff = bs[ s + 2 ] ^ bs[ s + 18 ]; 121| 60.8k| diff &= cond[2]; 122| 60.8k| bs[ s + 2 ] ^= diff; 123| 60.8k| bs[ s + 18 ] ^= diff; 124| | 125| 60.8k| diff = bs[ s + 3 ] ^ bs[ s + 19 ]; 126| 60.8k| diff &= cond[3]; 127| 60.8k| bs[ s + 3 ] ^= diff; 128| 60.8k| bs[ s + 19 ] ^= diff; 129| | 130| 60.8k| cond += 4; 131| 60.8k| } 132| 15.2k| } 133| 7.60k|} benes.c:layer_5: 135| 5.70k|static void layer_5(uint64_t *bs, const uint64_t *cond) { 136| 5.70k| int x, s; 137| 5.70k| uint64_t diff; 138| | 139| 11.4k| for (x = 0; x < (1 << 6); x += 64) { ------------------ | Branch (139:17): [True: 5.70k, False: 5.70k] ------------------ 140| 51.3k| for (s = x; s < x + 32; s += 4) { ------------------ | Branch (140:21): [True: 45.6k, False: 5.70k] ------------------ 141| 45.6k| diff = bs[ s + 0 ] ^ bs[ s + 32 ]; 142| 45.6k| diff &= cond[0]; 143| 45.6k| bs[ s + 0 ] ^= diff; 144| 45.6k| bs[ s + 32 ] ^= diff; 145| | 146| 45.6k| diff = bs[ s + 1 ] ^ bs[ s + 33 ]; 147| 45.6k| diff &= cond[1]; 148| 45.6k| bs[ s + 1 ] ^= diff; 149| 45.6k| bs[ s + 33 ] ^= diff; 150| | 151| 45.6k| diff = bs[ s + 2 ] ^ bs[ s + 34 ]; 152| 45.6k| diff &= cond[2]; 153| 45.6k| bs[ s + 2 ] ^= diff; 154| 45.6k| bs[ s + 34 ] ^= diff; 155| | 156| 45.6k| diff = bs[ s + 3 ] ^ bs[ s + 35 ]; 157| 45.6k| diff &= cond[3]; 158| 45.6k| bs[ s + 3 ] ^= diff; 159| 45.6k| bs[ s + 35 ] ^= diff; 160| | 161| 45.6k| cond += 4; 162| 45.6k| } 163| 5.70k| } 164| 5.70k|} PQCLEAN_MCELIECE348864_AVX2_bm: 140| 98|void bm(uint64_t out[ GFBITS ], vec128 in[ GFBITS ]) { 141| 98| uint16_t i; 142| 98| uint16_t N, L; 143| | 144| 98| uint64_t prod[ GFBITS ]; 145| 98| uint64_t in_tmp[ GFBITS ]; 146| | 147| 98| uint64_t db[ GFBITS ][ 2 ]; 148| 98| uint64_t BC_tmp[ GFBITS ][ 2 ]; 149| 98| uint64_t BC[ GFBITS ][ 2 ]; 150| | 151| 98| uint64_t mask, t; 152| | 153| 98| gf d, b, c0 = 1; 154| | 155| 98| gf coefs[SYS_T * 2]; 156| | 157| | // init 158| | 159| 98| BC[0][1] = 0; 160| 98| BC[0][0] = 1; 161| 98| BC[0][0] <<= 63; 162| | 163| 1.17k| for (i = 1; i < GFBITS; i++) { ------------------ | | 6| 1.17k|#define GFBITS 12 ------------------ | Branch (163:17): [True: 1.07k, False: 98] ------------------ 164| 1.07k| BC[i][0] = BC[i][1] = 0; 165| 1.07k| } 166| | 167| 98| b = 1; 168| 98| L = 0; 169| | 170| | // 171| | 172| 98| get_coefs(coefs, in); 173| | 174| 1.27k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 1.27k|#define GFBITS 12 ------------------ | Branch (174:17): [True: 1.17k, False: 98] ------------------ 175| 1.17k| in_tmp[i] = 0; 176| 1.17k| } 177| | 178| 12.6k| for (N = 0; N < SYS_T * 2; N++) { ------------------ | | 8| 12.6k|#define SYS_T 64 ------------------ | Branch (178:17): [True: 12.5k, False: 98] ------------------ 179| | // computing d 180| | 181| 12.5k| vec_mul_sp(prod, in_tmp, &BC[0][0]); 182| | 183| 12.5k| update_asm(in_tmp, coefs[N], 8); ------------------ | | 1| 12.5k|#define update_asm CRYPTO_NAMESPACE(update_asm) | | ------------------ | | | | 4| 12.5k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_AVX2_ ## fun | | ------------------ ------------------ 184| | 185| 12.5k| d = vec_reduce_asm(prod); ------------------ | | 3| 12.5k|#define vec_reduce_asm CRYPTO_NAMESPACE(vec_reduce_asm) | | ------------------ | | | | 4| 12.5k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_AVX2_ ## fun | | ------------------ ------------------ 186| | 187| 12.5k| t = gf_mul2(c0, coefs[N], b); ------------------ | | 13| 12.5k|#define gf_mul2 CRYPTO_NAMESPACE(gf_mul2) | | ------------------ | | | | 4| 12.5k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_AVX2_ ## fun | | ------------------ ------------------ 188| | 189| 12.5k| d ^= t & 0xFFFFFFFF; 190| | 191| | // 3 cases 192| | 193| 12.5k| mask = mask_nonzero(d) & mask_leq(L * 2, N); 194| | 195| 163k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 163k|#define GFBITS 12 ------------------ | Branch (195:21): [True: 150k, False: 12.5k] ------------------ 196| 150k| db[i][0] = (d >> i) & 1; 197| 150k| db[i][0] = -db[i][0]; 198| 150k| db[i][1] = (b >> i) & 1; 199| 150k| db[i][1] = -db[i][1]; 200| 150k| } 201| | 202| 12.5k| vec128_mul((vec128 *) BC_tmp, (vec128 *) db, (vec128 *) BC); 203| | 204| 12.5k| vec_cmov(BC, mask); 205| | 206| 12.5k| update_asm(BC, mask & c0, 16); ------------------ | | 1| 12.5k|#define update_asm CRYPTO_NAMESPACE(update_asm) | | ------------------ | | | | 4| 12.5k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_AVX2_ ## fun | | ------------------ ------------------ 207| | 208| 163k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 163k|#define GFBITS 12 ------------------ | Branch (208:21): [True: 150k, False: 12.5k] ------------------ 209| 150k| BC[i][1] = BC_tmp[i][0] ^ BC_tmp[i][1]; 210| 150k| } 211| | 212| 12.5k| c0 = t >> 32; 213| 12.5k| b = (d & mask) | (b & ~mask); 214| 12.5k| L = ((N + 1 - L) & mask) | (L & ~mask); 215| | 216| 12.5k| } 217| | 218| 98| c0 = gf_inv(c0); ------------------ | | 11| 98|#define gf_inv CRYPTO_NAMESPACE(gf_inv) | | ------------------ | | | | 4| 98|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_AVX2_ ## fun | | ------------------ ------------------ 219| | 220| 1.27k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 1.27k|#define GFBITS 12 ------------------ | Branch (220:17): [True: 1.17k, False: 98] ------------------ 221| 1.17k| out[i] = (c0 >> i) & 1; 222| 1.17k| out[i] = -out[i]; 223| 1.17k| } 224| | 225| 98| vec_mul_sp(out, out, &BC[0][0]); 226| 98|} bm.c:get_coefs: 72| 951|static inline void get_coefs(gf *out, vec128 *in) { 73| 951| int i, k; 74| | 75| 951| vec128 mask[4][2]; 76| 951| vec128 buf[16]; 77| | 78| 13.1k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 13.1k|#define GFBITS 12 ------------------ | Branch (78:18): [True: 12.1k, False: 951] ------------------ 79| 12.1k| buf[i] = in[i]; 80| 12.1k| } 81| 3.98k| for (i = GFBITS; i < 16; i++) { ------------------ | | 6| 951|#define GFBITS 12 ------------------ | Branch (81:22): [True: 3.03k, False: 951] ------------------ 82| 3.03k| buf[i] = vec128_setzero(); 83| 3.03k| } 84| | 85| 951| mask[0][0] = vec128_set1_16b(0x5555); 86| 951| mask[0][1] = vec128_set1_16b(0xAAAA); 87| 951| mask[1][0] = vec128_set1_16b(0x3333); 88| 951| mask[1][1] = vec128_set1_16b(0xCCCC); 89| 951| mask[2][0] = vec128_set1_16b(0x0F0F); 90| 951| mask[2][1] = vec128_set1_16b(0xF0F0); 91| 951| mask[3][0] = vec128_set1_16b(0x00FF); 92| 951| mask[3][1] = vec128_set1_16b(0xFF00); 93| | 94| 951| interleave(buf, 0, 8, mask[3], 3); 95| 951| interleave(buf, 1, 9, mask[3], 3); 96| 951| interleave(buf, 2, 10, mask[3], 3); 97| 951| interleave(buf, 3, 11, mask[3], 3); 98| 951| interleave(buf, 4, 12, mask[3], 3); 99| 951| interleave(buf, 5, 13, mask[3], 3); 100| 951| interleave(buf, 6, 14, mask[3], 3); 101| 951| interleave(buf, 7, 15, mask[3], 3); 102| | 103| 951| interleave(buf, 0, 4, mask[2], 2); 104| 951| interleave(buf, 1, 5, mask[2], 2); 105| 951| interleave(buf, 2, 6, mask[2], 2); 106| 951| interleave(buf, 3, 7, mask[2], 2); 107| 951| interleave(buf, 8, 12, mask[2], 2); 108| 951| interleave(buf, 9, 13, mask[2], 2); 109| 951| interleave(buf, 10, 14, mask[2], 2); 110| 951| interleave(buf, 11, 15, mask[2], 2); 111| | 112| 951| interleave(buf, 0, 2, mask[1], 1); 113| 951| interleave(buf, 1, 3, mask[1], 1); 114| 951| interleave(buf, 4, 6, mask[1], 1); 115| 951| interleave(buf, 5, 7, mask[1], 1); 116| 951| interleave(buf, 8, 10, mask[1], 1); 117| 951| interleave(buf, 9, 11, mask[1], 1); 118| 951| interleave(buf, 12, 14, mask[1], 1); 119| 951| interleave(buf, 13, 15, mask[1], 1); 120| | 121| 951| interleave(buf, 0, 1, mask[0], 0); 122| 951| interleave(buf, 2, 3, mask[0], 0); 123| 951| interleave(buf, 4, 5, mask[0], 0); 124| 951| interleave(buf, 6, 7, mask[0], 0); 125| 951| interleave(buf, 8, 9, mask[0], 0); 126| 951| interleave(buf, 10, 11, mask[0], 0); 127| 951| interleave(buf, 12, 13, mask[0], 0); 128| 951| interleave(buf, 14, 15, mask[0], 0); 129| | 130| 16.1k| for (i = 0; i < 16; i++) { ------------------ | Branch (130:17): [True: 15.2k, False: 951] ------------------ 131| 76.0k| for (k = 0; k < 4; k++) { ------------------ | Branch (131:21): [True: 60.8k, False: 15.2k] ------------------ 132| 60.8k| out[ (4 * 0 + k) * 16 + i ] = (vec128_extract(buf[i], 0) >> (k * 16)) & GFMASK; ------------------ | | 28| 60.8k|#define vec128_extract(a, i) ((uint64_t) _mm_extract_epi64((vec128) (a), (i))) ------------------ out[ (4 * 0 + k) * 16 + i ] = (vec128_extract(buf[i], 0) >> (k * 16)) & GFMASK; ------------------ | | 19| 60.8k|#define GFMASK ((1 << GFBITS) - 1) | | ------------------ | | | | 6| 60.8k|#define GFBITS 12 | | ------------------ ------------------ 133| 60.8k| out[ (4 * 1 + k) * 16 + i ] = (vec128_extract(buf[i], 1) >> (k * 16)) & GFMASK; ------------------ | | 28| 60.8k|#define vec128_extract(a, i) ((uint64_t) _mm_extract_epi64((vec128) (a), (i))) ------------------ out[ (4 * 1 + k) * 16 + i ] = (vec128_extract(buf[i], 1) >> (k * 16)) & GFMASK; ------------------ | | 19| 60.8k|#define GFMASK ((1 << GFBITS) - 1) | | ------------------ | | | | 6| 60.8k|#define GFBITS 12 | | ------------------ ------------------ 134| 60.8k| } 135| 15.2k| } 136| 951|} bm.c:interleave: 55| 30.4k|static inline void interleave(vec128 *in, int idx0, int idx1, vec128 *mask, int b) { 56| 30.4k| int s = 1 << b; 57| | 58| 30.4k| vec128 x, y; 59| | 60| 30.4k| x = vec128_or(vec128_and(in[idx0], mask[0]), 61| 30.4k| vec128_sll_2x(vec128_and(in[idx1], mask[0]), s)); ------------------ | | 46| 30.4k|#define vec128_sll_2x(a, s) ((vec128) _mm_slli_epi64((vec128) (a), (s))) ------------------ 62| | 63| 30.4k| y = vec128_or(vec128_srl_2x(vec128_and(in[idx0], mask[1]), s), ------------------ | | 47| 30.4k|#define vec128_srl_2x(a, s) ((vec128) _mm_srli_epi64((vec128) (a), (s))) ------------------ 64| 30.4k| vec128_and(in[idx1], mask[1])); 65| | 66| 30.4k| in[idx0] = x; 67| 30.4k| in[idx1] = y; 68| 30.4k|} bm.c:mask_nonzero: 26| 203k|static inline uint64_t mask_nonzero(gf a) { 27| 203k| uint64_t ret = a; 28| | 29| 203k| ret -= 1; 30| 203k| ret >>= 63; 31| 203k| ret -= 1; 32| | 33| 203k| return ret; 34| 203k|} bm.c:mask_leq: 36| 203k|static inline uint64_t mask_leq(uint16_t a, uint16_t b) { 37| 203k| uint64_t a_tmp = a; 38| 203k| uint64_t b_tmp = b; 39| 203k| uint64_t ret = b_tmp - a_tmp; 40| | 41| 203k| ret >>= 63; 42| 203k| ret -= 1; 43| | 44| 203k| return ret; 45| 203k|} bm.c:vec_cmov: 47| 23.1k|static inline void vec_cmov(uint64_t out[][2], uint64_t mask) { 48| 23.1k| int i; 49| | 50| 301k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 301k|#define GFBITS 12 ------------------ | Branch (50:17): [True: 278k, False: 23.1k] ------------------ 51| 278k| out[i][0] = (out[i][0] & ~mask) | (out[i][1] & mask); 52| 278k| } 53| 23.1k|} PQCLEAN_MCELIECE348864_AVX2_controlbitsfrompermutation: 205| 98|void controlbitsfrompermutation(unsigned char *out, const int16 *pi, long long w, long long n) { 206| 98| PQCLEAN_VLA(int32, temp, (size_t)(2 * n)); ------------------ | | 57| 98|# define PQCLEAN_VLA(__t,__x,__s) __t __x[__s] ------------------ 207| 98| PQCLEAN_VLA(int16, pi_test, (size_t)n); ------------------ | | 57| 98|# define PQCLEAN_VLA(__t,__x,__s) __t __x[__s] ------------------ 208| 98| int16 diff; 209| 98| int i; 210| 98| unsigned char *ptr; 211| | 212| 98| OQS_MEM_cleanse(temp, (size_t)n * 2); 213| 98| OQS_MEM_cleanse(pi_test, (size_t)n); 214| | 215| 98| while (1) { ------------------ | Branch (215:12): [True: 98, Folded] ------------------ 216| 98| OQS_MEM_cleanse(out, (size_t)((((2 * w - 1)*n / 2) + 7) / 8)); 217| 98| cbrecursion(out, 0, 1, pi, w, n, temp); 218| | 219| | // check for correctness 220| | 221| 401k| for (i = 0; i < n; i++) { ------------------ | Branch (221:21): [True: 401k, False: 98] ------------------ 222| 401k| pi_test[i] = (int16)i; 223| 401k| } 224| | 225| 98| ptr = out; 226| 1.27k| for (i = 0; i < w; i++) { ------------------ | Branch (226:21): [True: 1.17k, False: 98] ------------------ 227| 1.17k| layer(pi_test, ptr, i, (int32)n); 228| 1.17k| ptr += n >> 4; 229| 1.17k| } 230| | 231| 1.17k| for (i = (int)(w - 2); i >= 0; i--) { ------------------ | Branch (231:32): [True: 1.07k, False: 98] ------------------ 232| 1.07k| layer(pi_test, ptr, i, (int32)n); 233| 1.07k| ptr += n >> 4; 234| 1.07k| } 235| | 236| 98| diff = 0; 237| 401k| for (i = 0; i < n; i++) { ------------------ | Branch (237:21): [True: 401k, False: 98] ------------------ 238| 401k| diff |= pi[i] ^ pi_test[i]; 239| 401k| } 240| | 241| 98| diff = crypto_int16_nonzero_mask(diff); ------------------ | | 12| 98|#define crypto_int16_nonzero_mask CRYPTO_NAMESPACE(crypto_int16_nonzero_mask) | | ------------------ | | | | 4| 98|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_AVX2_ ## fun | | ------------------ ------------------ 242| 98| crypto_declassify(&diff, sizeof diff); 243| 98| if (diff == 0) { ------------------ | Branch (243:13): [True: 98, False: 0] ------------------ 244| 98| break; 245| 98| } 246| 98| } 247| 98|} PQCLEAN_MCELIECE348864_AVX2_crypto_int16_negative_mask: 3| 196|crypto_int16 crypto_int16_negative_mask(crypto_int16 crypto_int16_x) { 4| 196| return crypto_int16_x >> 15; 5| 196|} PQCLEAN_MCELIECE348864_AVX2_crypto_int16_nonzero_mask: 7| 98|crypto_int16 crypto_int16_nonzero_mask(crypto_int16 crypto_int16_x) { 8| 98| return crypto_int16_negative_mask(crypto_int16_x) | crypto_int16_negative_mask(-crypto_int16_x); ------------------ | | 10| 98|#define crypto_int16_negative_mask CRYPTO_NAMESPACE(crypto_int16_negative_mask) | | ------------------ | | | | 4| 98|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_AVX2_ ## fun | | ------------------ ------------------ return crypto_int16_negative_mask(crypto_int16_x) | crypto_int16_negative_mask(-crypto_int16_x); ------------------ | | 10| 98|#define crypto_int16_negative_mask CRYPTO_NAMESPACE(crypto_int16_negative_mask) | | ------------------ | | | | 4| 98|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_AVX2_ ## fun | | ------------------ ------------------ 9| 98|} PQCLEAN_MCELIECE348864_AVX2_crypto_int32_negative_mask: 3| 26.4M|crypto_int32 crypto_int32_negative_mask(crypto_int32 crypto_int32_x) { 4| 26.4M| return crypto_int32_x >> 31; 5| 26.4M|} PQCLEAN_MCELIECE348864_AVX2_crypto_int32_min: 37| 26.4M|crypto_int32 crypto_int32_min(crypto_int32 crypto_int32_x, crypto_int32 crypto_int32_y) { 38| 26.4M| crypto_int32 crypto_int32_xy = crypto_int32_y ^ crypto_int32_x; 39| 26.4M| crypto_int32 crypto_int32_z = crypto_int32_y - crypto_int32_x; 40| 26.4M| crypto_int32_z ^= crypto_int32_xy & (crypto_int32_z ^ crypto_int32_y); 41| 26.4M| crypto_int32_z = crypto_int32_negative_mask(crypto_int32_z); ------------------ | | 9| 26.4M|#define crypto_int32_negative_mask CRYPTO_NAMESPACE(crypto_int32_negative_mask) | | ------------------ | | | | 4| 26.4M|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_AVX2_ ## fun | | ------------------ ------------------ 42| 26.4M| crypto_int32_z &= crypto_int32_xy; 43| 26.4M| return crypto_int32_x ^ crypto_int32_z; 44| 26.4M|} PQCLEAN_MCELIECE348864_AVX2_crypto_uint16_signed_negative_mask: 3| 156k|crypto_uint16_signed crypto_uint16_signed_negative_mask(crypto_uint16_signed crypto_uint16_signed_x) { 4| 156k| return crypto_uint16_signed_x >> 15; 5| 156k|} PQCLEAN_MCELIECE348864_AVX2_crypto_uint16_nonzero_mask: 7| 67.2k|crypto_uint16 crypto_uint16_nonzero_mask(crypto_uint16 crypto_uint16_x) { 8| 67.2k| return crypto_uint16_signed_negative_mask(crypto_uint16_x) | crypto_uint16_signed_negative_mask(-crypto_uint16_x); ------------------ | | 11| 67.2k|#define crypto_uint16_signed_negative_mask CRYPTO_NAMESPACE(crypto_uint16_signed_negative_mask) | | ------------------ | | | | 4| 67.2k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_AVX2_ ## fun | | ------------------ ------------------ return crypto_uint16_signed_negative_mask(crypto_uint16_x) | crypto_uint16_signed_negative_mask(-crypto_uint16_x); ------------------ | | 11| 67.2k|#define crypto_uint16_signed_negative_mask CRYPTO_NAMESPACE(crypto_uint16_signed_negative_mask) | | ------------------ | | | | 4| 67.2k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_AVX2_ ## fun | | ------------------ ------------------ 9| 67.2k|} PQCLEAN_MCELIECE348864_AVX2_crypto_uint16_zero_mask: 11| 67.2k|crypto_uint16 crypto_uint16_zero_mask(crypto_uint16 crypto_uint16_x) { 12| 67.2k| return ~crypto_uint16_nonzero_mask(crypto_uint16_x); ------------------ | | 13| 67.2k|#define crypto_uint16_nonzero_mask CRYPTO_NAMESPACE(crypto_uint16_nonzero_mask) | | ------------------ | | | | 4| 67.2k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_AVX2_ ## fun | | ------------------ ------------------ 13| 67.2k|} PQCLEAN_MCELIECE348864_AVX2_crypto_uint16_smaller_mask: 24| 21.6k|crypto_uint16 crypto_uint16_smaller_mask(crypto_uint16 crypto_uint16_x, crypto_uint16 crypto_uint16_y) { 25| 21.6k| crypto_uint16 crypto_uint16_xy = crypto_uint16_x ^ crypto_uint16_y; 26| 21.6k| crypto_uint16 crypto_uint16_z = crypto_uint16_x - crypto_uint16_y; 27| 21.6k| crypto_uint16_z ^= crypto_uint16_xy & (crypto_uint16_z ^ crypto_uint16_x ^ (((crypto_uint16) 1) << 15)); 28| 21.6k| return crypto_uint16_signed_negative_mask(crypto_uint16_z); ------------------ | | 11| 21.6k|#define crypto_uint16_signed_negative_mask CRYPTO_NAMESPACE(crypto_uint16_signed_negative_mask) | | ------------------ | | | | 4| 21.6k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_AVX2_ ## fun | | ------------------ ------------------ 29| 21.6k|} PQCLEAN_MCELIECE348864_AVX2_crypto_uint32_signed_negative_mask: 3| 36.4k|crypto_uint32_signed crypto_uint32_signed_negative_mask(crypto_uint32_signed crypto_uint32_signed_x) { 4| 36.4k| return crypto_uint32_signed_x >> 31; 5| 36.4k|} PQCLEAN_MCELIECE348864_AVX2_crypto_uint32_nonzero_mask: 7| 18.2k|crypto_uint32 crypto_uint32_nonzero_mask(crypto_uint32 crypto_uint32_x) { 8| 18.2k| return crypto_uint32_signed_negative_mask(crypto_uint32_x) | crypto_uint32_signed_negative_mask(-crypto_uint32_x); ------------------ | | 11| 18.2k|#define crypto_uint32_signed_negative_mask CRYPTO_NAMESPACE(crypto_uint32_signed_negative_mask) | | ------------------ | | | | 4| 18.2k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_AVX2_ ## fun | | ------------------ ------------------ return crypto_uint32_signed_negative_mask(crypto_uint32_x) | crypto_uint32_signed_negative_mask(-crypto_uint32_x); ------------------ | | 11| 18.2k|#define crypto_uint32_signed_negative_mask CRYPTO_NAMESPACE(crypto_uint32_signed_negative_mask) | | ------------------ | | | | 4| 18.2k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_AVX2_ ## fun | | ------------------ ------------------ 9| 18.2k|} PQCLEAN_MCELIECE348864_AVX2_crypto_uint32_unequal_mask: 15| 18.2k|crypto_uint32 crypto_uint32_unequal_mask(crypto_uint32 crypto_uint32_x, crypto_uint32 crypto_uint32_y) { 16| 18.2k| crypto_uint32 crypto_uint32_xy = crypto_uint32_x ^ crypto_uint32_y; 17| 18.2k| return crypto_uint32_nonzero_mask(crypto_uint32_xy); ------------------ | | 13| 18.2k|#define crypto_uint32_nonzero_mask CRYPTO_NAMESPACE(crypto_uint32_nonzero_mask) | | ------------------ | | | | 4| 18.2k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_AVX2_ ## fun | | ------------------ ------------------ 18| 18.2k|} PQCLEAN_MCELIECE348864_AVX2_crypto_uint32_equal_mask: 20| 18.2k|crypto_uint32 crypto_uint32_equal_mask(crypto_uint32 crypto_uint32_x, crypto_uint32 crypto_uint32_y) { 21| 18.2k| return ~crypto_uint32_unequal_mask(crypto_uint32_x, crypto_uint32_y); ------------------ | | 17| 18.2k|#define crypto_uint32_unequal_mask CRYPTO_NAMESPACE(crypto_uint32_unequal_mask) | | ------------------ | | | | 4| 18.2k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_AVX2_ ## fun | | ------------------ ------------------ 22| 18.2k|} PQCLEAN_MCELIECE348864_AVX2_crypto_uint64_signed_negative_mask: 3| 10.0M|crypto_uint64_signed crypto_uint64_signed_negative_mask(crypto_uint64_signed crypto_uint64_signed_x) { 4| 10.0M| return crypto_uint64_signed_x >> 63; 5| 10.0M|} PQCLEAN_MCELIECE348864_AVX2_crypto_uint64_nonzero_mask: 7| 5.01M|crypto_uint64 crypto_uint64_nonzero_mask(crypto_uint64 crypto_uint64_x) { 8| 5.01M| return crypto_uint64_signed_negative_mask(crypto_uint64_x) | crypto_uint64_signed_negative_mask(-crypto_uint64_x); ------------------ | | 11| 5.01M|#define crypto_uint64_signed_negative_mask CRYPTO_NAMESPACE(crypto_uint64_signed_negative_mask) | | ------------------ | | | | 4| 5.01M|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_AVX2_ ## fun | | ------------------ ------------------ return crypto_uint64_signed_negative_mask(crypto_uint64_x) | crypto_uint64_signed_negative_mask(-crypto_uint64_x); ------------------ | | 11| 5.01M|#define crypto_uint64_signed_negative_mask CRYPTO_NAMESPACE(crypto_uint64_signed_negative_mask) | | ------------------ | | | | 4| 5.01M|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_AVX2_ ## fun | | ------------------ ------------------ 9| 5.01M|} PQCLEAN_MCELIECE348864_AVX2_crypto_uint64_zero_mask: 11| 783k|crypto_uint64 crypto_uint64_zero_mask(crypto_uint64 crypto_uint64_x) { 12| 783k| return ~crypto_uint64_nonzero_mask(crypto_uint64_x); ------------------ | | 13| 783k|#define crypto_uint64_nonzero_mask CRYPTO_NAMESPACE(crypto_uint64_nonzero_mask) | | ------------------ | | | | 4| 783k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_AVX2_ ## fun | | ------------------ ------------------ 13| 783k|} PQCLEAN_MCELIECE348864_AVX2_crypto_uint64_unequal_mask: 15| 4.23M|crypto_uint64 crypto_uint64_unequal_mask(crypto_uint64 crypto_uint64_x, crypto_uint64 crypto_uint64_y) { 16| 4.23M| crypto_uint64 crypto_uint64_xy = crypto_uint64_x ^ crypto_uint64_y; 17| 4.23M| return crypto_uint64_nonzero_mask(crypto_uint64_xy); ------------------ | | 13| 4.23M|#define crypto_uint64_nonzero_mask CRYPTO_NAMESPACE(crypto_uint64_nonzero_mask) | | ------------------ | | | | 4| 4.23M|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_AVX2_ ## fun | | ------------------ ------------------ 18| 4.23M|} PQCLEAN_MCELIECE348864_AVX2_crypto_uint64_equal_mask: 20| 4.23M|crypto_uint64 crypto_uint64_equal_mask(crypto_uint64 crypto_uint64_x, crypto_uint64 crypto_uint64_y) { 21| 4.23M| return ~crypto_uint64_unequal_mask(crypto_uint64_x, crypto_uint64_y); ------------------ | | 17| 4.23M|#define crypto_uint64_unequal_mask CRYPTO_NAMESPACE(crypto_uint64_unequal_mask) | | ------------------ | | | | 4| 4.23M|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_AVX2_ ## fun | | ------------------ ------------------ 22| 4.23M|} PQCLEAN_MCELIECE348864_AVX2_decrypt: 171| 98|int decrypt(unsigned char *e, const unsigned char *sk, const unsigned char *s) { 172| 98| int i; 173| | 174| 98| uint16_t check_synd; 175| 98| uint16_t check_weight; 176| | 177| 98| vec256 inv[ 16 ][ GFBITS ]; 178| 98| vec256 scaled[ 16 ][ GFBITS ]; 179| 98| vec256 eval[16][ GFBITS ]; 180| | 181| 98| vec128 error128[ 32 ]; 182| 98| vec256 error256[ 16 ]; 183| | 184| 98| vec128 s_priv[ GFBITS ]; 185| 98| vec128 s_priv_cmp[ GFBITS ]; 186| 98| uint64_t locator[ GFBITS ]; 187| | 188| 98| vec128 recv128[ 32 ]; 189| 98| vec256 recv256[ 16 ]; 190| 98| vec256 allone; 191| | 192| 98| uint64_t bits_int[23][32]; 193| | 194| | // Berlekamp decoder 195| | 196| 98| preprocess(recv128, s); 197| | 198| 98| load_bits(bits_int, sk + IRR_BYTES); ------------------ | | 10| 98|#define load_bits CRYPTO_NAMESPACE(load_bits) | | ------------------ | | | | 4| 98|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_AVX2_ ## fun | | ------------------ ------------------ load_bits(bits_int, sk + IRR_BYTES); ------------------ | | 11| 98|#define IRR_BYTES (SYS_T * 2) | | ------------------ | | | | 8| 98|#define SYS_T 64 | | ------------------ ------------------ 199| 98| benes((uint64_t *) recv128, bits_int, 1); ------------------ | | 9| 98|#define benes CRYPTO_NAMESPACE(benes) | | ------------------ | | | | 4| 98|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_AVX2_ ## fun | | ------------------ ------------------ 200| | 201| 98| reformat_128to256(recv256, recv128); 202| | 203| 98| scaling(scaled, inv, sk, recv256); 204| 98| fft_tr(s_priv, scaled); ------------------ | | 9| 98|#define fft_tr CRYPTO_NAMESPACE(fft_tr) | | ------------------ | | | | 4| 98|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_AVX2_ ## fun | | ------------------ ------------------ 205| 98| bm(locator, s_priv); ------------------ | | 10| 98|#define bm CRYPTO_NAMESPACE(bm) | | ------------------ | | | | 4| 98|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_AVX2_ ## fun | | ------------------ ------------------ 206| | 207| 98| fft(eval, locator); ------------------ | | 10| 98|#define fft CRYPTO_NAMESPACE(fft) | | ------------------ | | | | 4| 98|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_AVX2_ ## fun | | ------------------ ------------------ 208| | 209| | // reencryption and weight check 210| | 211| 98| allone = vec256_set1_16b(0xFFFF); 212| | 213| 1.66k| for (i = 0; i < 16; i++) { ------------------ | Branch (213:17): [True: 1.56k, False: 98] ------------------ 214| 1.56k| error256[i] = vec256_or_reduce(eval[i]); 215| 1.56k| error256[i] = vec256_xor(error256[i], allone); 216| 1.56k| } 217| | 218| 98| scaling_inv(scaled, inv, error256); 219| 98| fft_tr(s_priv_cmp, scaled); ------------------ | | 9| 98|#define fft_tr CRYPTO_NAMESPACE(fft_tr) | | ------------------ | | | | 4| 98|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_AVX2_ ## fun | | ------------------ ------------------ 220| | 221| 98| check_synd = synd_cmp(s_priv, s_priv_cmp); 222| | 223| | // 224| | 225| 98| reformat_256to128(error128, error256); 226| 98| benes((uint64_t *) error128, bits_int, 0); ------------------ | | 9| 98|#define benes CRYPTO_NAMESPACE(benes) | | ------------------ | | | | 4| 98|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_AVX2_ ## fun | | ------------------ ------------------ 227| | 228| 98| postprocess(e, error128); 229| | 230| 98| check_weight = weight_check(e, error128); 231| | 232| 98| return 1 - (check_synd & check_weight); 233| 98|} decrypt.c:preprocess: 57| 791|static void preprocess(vec128 *recv, const unsigned char *s) { 58| 791| int i; 59| 791| unsigned char r[ 512 ]; 60| | 61| 131k| for (i = 0; i < SYND_BYTES; i++) { ------------------ | | 17| 131k|#define SYND_BYTES ((PK_NROWS + 7)/8) | | ------------------ | | | | 13| 131k|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 131k|#define SYS_T 64 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 131k|#define GFBITS 12 | | | | ------------------ | | ------------------ ------------------ | Branch (61:17): [True: 130k, False: 791] ------------------ 62| 130k| r[i] = s[i]; 63| 130k| } 64| | 65| 587k| for (i = SYND_BYTES; i < 512; i++) { ------------------ | | 17| 791|#define SYND_BYTES ((PK_NROWS + 7)/8) | | ------------------ | | | | 13| 791|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 791|#define SYS_T 64 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 791|#define GFBITS 12 | | | | ------------------ | | ------------------ ------------------ | Branch (65:26): [True: 586k, False: 791] ------------------ 66| 586k| r[i] = 0; 67| 586k| } 68| | 69| 45.6k| for (i = 0; i < 32; i++) { ------------------ | Branch (69:17): [True: 44.8k, False: 791] ------------------ 70| 44.8k| recv[i] = load16(r + i * 16); 71| 44.8k| } 72| 791|} decrypt.c:reformat_128to256: 137| 951|static void reformat_128to256(vec256 *out, vec128 *in) { 138| 951| int i; 139| 951| uint64_t v[4]; 140| | 141| 28.4k| for (i = 0; i < 16; i++) { ------------------ | Branch (141:17): [True: 27.5k, False: 951] ------------------ 142| 27.5k| v[0] = vec128_extract(in[2 * i + 0], 0); ------------------ | | 28| 27.5k|#define vec128_extract(a, i) ((uint64_t) _mm_extract_epi64((vec128) (a), (i))) ------------------ 143| 27.5k| v[1] = vec128_extract(in[2 * i + 0], 1); ------------------ | | 28| 27.5k|#define vec128_extract(a, i) ((uint64_t) _mm_extract_epi64((vec128) (a), (i))) ------------------ 144| 27.5k| v[2] = vec128_extract(in[2 * i + 1], 0); ------------------ | | 28| 27.5k|#define vec128_extract(a, i) ((uint64_t) _mm_extract_epi64((vec128) (a), (i))) ------------------ 145| 27.5k| v[3] = vec128_extract(in[2 * i + 1], 1); ------------------ | | 28| 27.5k|#define vec128_extract(a, i) ((uint64_t) _mm_extract_epi64((vec128) (a), (i))) ------------------ 146| | 147| 27.5k| out[i] = vec256_set4x(v[0], v[1], v[2], v[3]); 148| 27.5k| } 149| 951|} decrypt.c:scaling: 16| 951|static void scaling(vec256 out[][GFBITS], vec256 inv[][GFBITS], const unsigned char *sk, vec256 *recv) { 17| 951| int i, j; 18| | 19| 951| uint64_t sk_int[ GFBITS ]; 20| 951| vec256 eval[16][ GFBITS ]; 21| 951| vec256 tmp[ GFBITS ]; 22| | 23| | // computing inverses 24| | 25| 951| irr_load(sk_int, sk); 26| | 27| 951| fft(eval, sk_int); ------------------ | | 10| 951|#define fft CRYPTO_NAMESPACE(fft) | | ------------------ | | | | 4| 951|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_AVX2_ ## fun | | ------------------ ------------------ 28| | 29| 28.4k| for (i = 0; i < 16; i++) { ------------------ | Branch (29:17): [True: 27.5k, False: 951] ------------------ 30| 27.5k| vec256_sq(eval[i], eval[i]); ------------------ | | 14| 27.5k|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 27.5k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_AVX2_ ## fun | | ------------------ ------------------ 31| 27.5k| } 32| | 33| 951| vec256_copy(inv[0], eval[0]); 34| | 35| 27.5k| for (i = 1; i < 16; i++) { ------------------ | Branch (35:17): [True: 26.5k, False: 951] ------------------ 36| 26.5k| vec256_mul(inv[i], inv[i - 1], eval[i]); 37| 26.5k| } 38| | 39| 951| vec256_inv(tmp, inv[15]); ------------------ | | 11| 951|#define vec256_inv CRYPTO_NAMESPACE(vec256_inv) | | ------------------ | | | | 4| 951|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_AVX2_ ## fun | | ------------------ ------------------ 40| | 41| 27.5k| for (i = 14; i >= 0; i--) { ------------------ | Branch (41:18): [True: 26.5k, False: 951] ------------------ 42| 26.5k| vec256_mul(inv[i + 1], tmp, inv[i]); 43| 26.5k| vec256_mul(tmp, tmp, eval[i + 1]); 44| 26.5k| } 45| | 46| 951| vec256_copy(inv[0], tmp); 47| | 48| | // 49| | 50| 28.4k| for (i = 0; i < 16; i++) { ------------------ | Branch (50:17): [True: 27.5k, False: 951] ------------------ 51| 382k| for (j = 0; j < GFBITS; j++) { ------------------ | | 6| 382k|#define GFBITS 12 ------------------ | Branch (51:21): [True: 355k, False: 27.5k] ------------------ 52| 355k| out[i][j] = vec256_and(inv[i][j], recv[i]); 53| 355k| } 54| 27.5k| } 55| 951|} decrypt.c:scaling_inv: 92| 951|static void scaling_inv(vec256 out[][GFBITS], vec256 inv[][GFBITS], vec256 *recv) { 93| 951| int i, j; 94| | 95| 28.4k| for (i = 0; i < 16; i++) { ------------------ | Branch (95:17): [True: 27.5k, False: 951] ------------------ 96| 382k| for (j = 0; j < GFBITS; j++) { ------------------ | | 6| 382k|#define GFBITS 12 ------------------ | Branch (96:21): [True: 355k, False: 27.5k] ------------------ 97| 355k| out[i][j] = vec256_and(inv[i][j], recv[i]); 98| 355k| } 99| 27.5k| } 100| 951|} decrypt.c:synd_cmp: 124| 951|static uint64_t synd_cmp(vec128 *s0, vec128 *s1) { 125| 951| int i; 126| 951| vec128 diff; 127| | 128| 951| diff = vec128_xor(s0[0], s1[0]); 129| | 130| 12.1k| for (i = 1; i < GFBITS; i++) { ------------------ | | 6| 12.1k|#define GFBITS 12 ------------------ | Branch (130:17): [True: 11.2k, False: 951] ------------------ 131| 11.2k| diff = vec128_or(diff, vec128_xor(s0[i], s1[i])); 132| 11.2k| } 133| | 134| 951| return vec128_testz(diff); 135| 951|} decrypt.c:reformat_256to128: 151| 951|static void reformat_256to128(vec128 *out, vec256 *in) { 152| 951| int i; 153| 951| uint64_t v[4]; 154| | 155| 28.4k| for (i = 0; i < 16; i++) { ------------------ | Branch (155:17): [True: 27.5k, False: 951] ------------------ 156| 27.5k| v[0] = vec256_extract(in[i], 0); ------------------ | | 39| 27.5k|#define vec256_extract(a,i) ((uint64_t) _mm256_extract_epi64((vec256) (a),(i))) ------------------ 157| 27.5k| v[1] = vec256_extract(in[i], 1); ------------------ | | 39| 27.5k|#define vec256_extract(a,i) ((uint64_t) _mm256_extract_epi64((vec256) (a),(i))) ------------------ 158| 27.5k| v[2] = vec256_extract(in[i], 2); ------------------ | | 39| 27.5k|#define vec256_extract(a,i) ((uint64_t) _mm256_extract_epi64((vec256) (a),(i))) ------------------ 159| 27.5k| v[3] = vec256_extract(in[i], 3); ------------------ | | 39| 27.5k|#define vec256_extract(a,i) ((uint64_t) _mm256_extract_epi64((vec256) (a),(i))) ------------------ 160| | 161| 27.5k| out[2 * i + 0] = vec128_set2x(v[0], v[1]); 162| 27.5k| out[2 * i + 1] = vec128_set2x(v[2], v[3]); 163| 27.5k| } 164| 951|} decrypt.c:postprocess: 74| 791|static void postprocess(unsigned char *e, vec128 *err) { 75| 791| int i; 76| 791| unsigned char error8[ (1 << GFBITS) / 8 ]; 77| 791| uint64_t v[2]; 78| | 79| 45.6k| for (i = 0; i < 32; i++) { ------------------ | Branch (79:17): [True: 44.8k, False: 791] ------------------ 80| 44.8k| v[0] = vec128_extract(err[i], 0); ------------------ | | 28| 44.8k|#define vec128_extract(a, i) ((uint64_t) _mm_extract_epi64((vec128) (a), (i))) ------------------ 81| 44.8k| v[1] = vec128_extract(err[i], 1); ------------------ | | 28| 44.8k|#define vec128_extract(a, i) ((uint64_t) _mm_extract_epi64((vec128) (a), (i))) ------------------ 82| | 83| 44.8k| store8(error8 + i * 16 + 0, v[0]); 84| 44.8k| store8(error8 + i * 16 + 8, v[1]); 85| 44.8k| } 86| | 87| 544k| for (i = 0; i < SYS_N / 8; i++) { ------------------ | | 7| 544k|#define SYS_N 3488 ------------------ | Branch (87:17): [True: 544k, False: 791] ------------------ 88| 544k| e[i] = error8[i]; 89| 544k| } 90| 791|} decrypt.c:weight_check: 102| 791|static int weight_check(unsigned char *e, vec128 *error) { 103| 791| int i; 104| 791| uint16_t w0 = 0; 105| 791| uint16_t w1 = 0; 106| 791| uint16_t check; 107| | 108| 45.6k| for (i = 0; i < 32; i++) { ------------------ | Branch (108:17): [True: 44.8k, False: 791] ------------------ 109| 44.8k| w0 += __builtin_popcountll( vec128_extract(error[i], 0) ); ------------------ | | 28| 44.8k|#define vec128_extract(a, i) ((uint64_t) _mm_extract_epi64((vec128) (a), (i))) ------------------ 110| 44.8k| w0 += __builtin_popcountll( vec128_extract(error[i], 1) ); ------------------ | | 28| 44.8k|#define vec128_extract(a, i) ((uint64_t) _mm_extract_epi64((vec128) (a), (i))) ------------------ 111| 44.8k| } 112| | 113| 544k| for (i = 0; i < SYS_N / 8; i++) { ------------------ | | 7| 544k|#define SYS_N 3488 ------------------ | Branch (113:17): [True: 544k, False: 791] ------------------ 114| 544k| w1 += __builtin_popcountll( e[i] ); 115| 544k| } 116| | 117| 791| check = (w0 ^ SYS_T) | (w1 ^ SYS_T); ------------------ | | 8| 791|#define SYS_T 64 ------------------ check = (w0 ^ SYS_T) | (w1 ^ SYS_T); ------------------ | | 8| 791|#define SYS_T 64 ------------------ 118| 791| check -= 1; 119| 791| check >>= 15; 120| | 121| 791| return check; 122| 791|} PQCLEAN_MCELIECE348864_AVX2_encrypt: 114| 98|void encrypt(unsigned char *s, const unsigned char *pk, unsigned char *e) { 115| 98| gen_e(e); 116| | 117| 98| syndrome_asm(s, pk, e); ------------------ | | 1| 98|#define syndrome_asm CRYPTO_NAMESPACE(syndrome_asm) | | ------------------ | | | | 4| 98|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_AVX2_ ## fun | | ------------------ ------------------ 118| 98|} PQCLEAN_MCELIECE348864_AVX2_fft: 171| 1.24k|void fft(vec256 out[][ GFBITS ], uint64_t *in) { 172| 1.24k| radix_conversions(in); 173| 1.24k| butterflies(out, in); 174| 1.24k|} fft.c:radix_conversions: 15| 1.51k|static void radix_conversions(uint64_t *in) { 16| 1.51k| int i, j, k; 17| | 18| 1.51k| const uint64_t mask[5][2] = { 19| 1.51k| {0x8888888888888888, 0x4444444444444444}, 20| 1.51k| {0xC0C0C0C0C0C0C0C0, 0x3030303030303030}, 21| 1.51k| {0xF000F000F000F000, 0x0F000F000F000F00}, 22| 1.51k| {0xFF000000FF000000, 0x00FF000000FF0000}, 23| 1.51k| {0xFFFF000000000000, 0x0000FFFF00000000} 24| 1.51k| }; 25| | 26| 1.51k| const uint64_t s[5][GFBITS] = { 27| 1.51k|#include "scalars.data" ------------------ | | 1| 1.51k|{ | | 2| 1.51k| 0XF3CFC030FC30F003, | | 3| 1.51k| 0X3FCF0F003C00C00C, | | 4| 1.51k| 0X30033CC300C0C03C, | | 5| 1.51k| 0XCCFF0F3C0F30F0C0, | | 6| 1.51k| 0X0300C03FF303C3F0, | | 7| 1.51k| 0X3FFF3C0FF0CCCCC0, | | 8| 1.51k| 0XF3FFF0C00F3C3CC0, | | 9| 1.51k| 0X3003333FFFC3C000, | | 10| 1.51k| 0X0FF30FFFC3FFF300, | | 11| 1.51k| 0XFFC0F300F0F0CC00, | | 12| 1.51k| 0XC0CFF3FCCC3CFC00, | | 13| 1.51k| 0XFC3C03F0F330C000, | | 14| 1.51k|}, { | | 15| 1.51k| 0X000F00000000F00F, | | 16| 1.51k| 0X00000F00F00000F0, | | 17| 1.51k| 0X0F00000F00000F00, | | 18| 1.51k| 0XF00F00F00F000000, | | 19| 1.51k| 0X00F00000000000F0, | | 20| 1.51k| 0X0000000F00000000, | | 21| 1.51k| 0XF00000000F00F000, | | 22| 1.51k| 0X00F00F00000F0000, | | 23| 1.51k| 0X0000F00000F00F00, | | 24| 1.51k| 0X000F00F00F00F000, | | 25| 1.51k| 0X00F00F0000000000, | | 26| 1.51k| 0X0000000000F00000, | | 27| 1.51k|}, { | | 28| 1.51k| 0X0000FF00FF0000FF, | | 29| 1.51k| 0X0000FF000000FF00, | | 30| 1.51k| 0XFF0000FF00FF0000, | | 31| 1.51k| 0XFFFF0000FF000000, | | 32| 1.51k| 0X00FF00FF00FF0000, | | 33| 1.51k| 0X0000FFFFFF000000, | | 34| 1.51k| 0X00FFFF00FF000000, | | 35| 1.51k| 0XFFFFFF0000FF0000, | | 36| 1.51k| 0XFFFF00FFFF00FF00, | | 37| 1.51k| 0X0000FF0000000000, | | 38| 1.51k| 0XFFFFFF00FF000000, | | 39| 1.51k| 0X00FF000000000000, | | 40| 1.51k|}, { | | 41| 1.51k| 0X000000000000FFFF, | | 42| 1.51k| 0X00000000FFFF0000, | | 43| 1.51k| 0X0000000000000000, | | 44| 1.51k| 0XFFFF000000000000, | | 45| 1.51k| 0X00000000FFFF0000, | | 46| 1.51k| 0X0000FFFF00000000, | | 47| 1.51k| 0X0000000000000000, | | 48| 1.51k| 0X00000000FFFF0000, | | 49| 1.51k| 0X0000FFFF00000000, | | 50| 1.51k| 0X0000000000000000, | | 51| 1.51k| 0X0000000000000000, | | 52| 1.51k| 0X0000000000000000, | | 53| 1.51k|}, { | | 54| 1.51k| 0X00000000FFFFFFFF, | | 55| 1.51k| 0XFFFFFFFF00000000, | | 56| 1.51k| 0XFFFFFFFF00000000, | | 57| 1.51k| 0X0000000000000000, | | 58| 1.51k| 0X0000000000000000, | | 59| 1.51k| 0XFFFFFFFF00000000, | | 60| 1.51k| 0X0000000000000000, | | 61| 1.51k| 0X0000000000000000, | | 62| 1.51k| 0XFFFFFFFF00000000, | | 63| 1.51k| 0X0000000000000000, | | 64| 1.51k| 0X0000000000000000, | | 65| 1.51k| 0X0000000000000000, | | 66| 1.51k|} ------------------ 28| 1.51k| }; 29| | 30| | // 31| | 32| 9.10k| for (j = 0; j <= 4; j++) { ------------------ | Branch (32:17): [True: 7.58k, False: 1.51k] ------------------ 33| 98.6k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 98.6k|#define GFBITS 12 ------------------ | Branch (33:21): [True: 91.0k, False: 7.58k] ------------------ 34| 364k| for (k = 4; k >= j; k--) { ------------------ | Branch (34:25): [True: 273k, False: 91.0k] ------------------ 35| 273k| in[i] ^= (in[i] & mask[k][0]) >> (1 << k); 36| 273k| in[i] ^= (in[i] & mask[k][1]) >> (1 << k); 37| 273k| } 38| 91.0k| } 39| | 40| 7.58k| vec_mul(in, in, s[j]); // scaling 41| 7.58k| } 42| 1.51k|} fft.c:butterflies: 46| 1.51k|static void butterflies(vec256 out[][ GFBITS ], const uint64_t *in) { 47| 1.51k| int i, j, k, s, b; 48| | 49| 1.51k| uint64_t t0, t1, t2, t3; 50| | 51| 1.51k| const vec256 consts[ 17 ][ GFBITS ] = { 52| 1.51k|#include "consts.data" ------------------ | | 1| 1.51k|{ | | 2| 1.51k| vec256_set4x(0xF00F0FF0F00F0FF0, 0xF00F0FF0F00F0FF0, 0xF00F0FF0F00F0FF0, 0xF00F0FF0F00F0FF0), | | 3| 1.51k| vec256_set4x(0xF0F00F0F0F0FF0F0, 0xF0F00F0F0F0FF0F0, 0xF0F00F0F0F0FF0F0, 0xF0F00F0F0F0FF0F0), | | 4| 1.51k| vec256_set4x(0x0FF00FF00FF00FF0, 0x0FF00FF00FF00FF0, 0x0FF00FF00FF00FF0, 0x0FF00FF00FF00FF0), | | 5| 1.51k| vec256_set4x(0xAA5555AAAA5555AA, 0xAA5555AAAA5555AA, 0xAA5555AAAA5555AA, 0xAA5555AAAA5555AA), | | 6| 1.51k| vec256_set4x(0xF00F0FF0F00F0FF0, 0xF00F0FF0F00F0FF0, 0xF00F0FF0F00F0FF0, 0xF00F0FF0F00F0FF0), | | 7| 1.51k| vec256_set4x(0x33CCCC33CC3333CC, 0x33CCCC33CC3333CC, 0x33CCCC33CC3333CC, 0x33CCCC33CC3333CC), | | 8| 1.51k| vec256_set4x(0xFFFF0000FFFF0000, 0xFFFF0000FFFF0000, 0xFFFF0000FFFF0000, 0xFFFF0000FFFF0000), | | 9| 1.51k| vec256_set4x(0xCC33CC3333CC33CC, 0xCC33CC3333CC33CC, 0xCC33CC3333CC33CC, 0xCC33CC3333CC33CC), | | 10| 1.51k| vec256_set4x(0x33CC33CC33CC33CC, 0x33CC33CC33CC33CC, 0x33CC33CC33CC33CC, 0x33CC33CC33CC33CC), | | 11| 1.51k| vec256_set4x(0x5A5A5A5A5A5A5A5A, 0x5A5A5A5A5A5A5A5A, 0x5A5A5A5A5A5A5A5A, 0x5A5A5A5A5A5A5A5A), | | 12| 1.51k| vec256_set4x(0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00), | | 13| 1.51k| vec256_set4x(0xF00F0FF0F00F0FF0, 0xF00F0FF0F00F0FF0, 0xF00F0FF0F00F0FF0, 0xF00F0FF0F00F0FF0), | | 14| 1.51k|}, { | | 15| 1.51k| vec256_set4x(0x3C3C3C3C3C3C3C3C, 0x3C3C3C3C3C3C3C3C, 0x3C3C3C3C3C3C3C3C, 0x3C3C3C3C3C3C3C3C), | | 16| 1.51k| vec256_set4x(0xF0F0F0F0F0F0F0F0, 0x0F0F0F0F0F0F0F0F, 0xF0F0F0F0F0F0F0F0, 0x0F0F0F0F0F0F0F0F), | | 17| 1.51k| vec256_set4x(0x5555AAAA5555AAAA, 0xAAAA5555AAAA5555, 0x5555AAAA5555AAAA, 0xAAAA5555AAAA5555), | | 18| 1.51k| vec256_set4x(0xCC3333CCCC3333CC, 0xCC3333CCCC3333CC, 0xCC3333CCCC3333CC, 0xCC3333CCCC3333CC), | | 19| 1.51k| vec256_set4x(0xC33CC33CC33CC33C, 0xC33CC33CC33CC33C, 0xC33CC33CC33CC33C, 0xC33CC33CC33CC33C), | | 20| 1.51k| vec256_set4x(0x55555555AAAAAAAA, 0x55555555AAAAAAAA, 0x55555555AAAAAAAA, 0x55555555AAAAAAAA), | | 21| 1.51k| vec256_set4x(0x33333333CCCCCCCC, 0x33333333CCCCCCCC, 0x33333333CCCCCCCC, 0x33333333CCCCCCCC), | | 22| 1.51k| vec256_set4x(0x00FF00FFFF00FF00, 0xFF00FF0000FF00FF, 0x00FF00FFFF00FF00, 0xFF00FF0000FF00FF), | | 23| 1.51k| vec256_set4x(0xF0F0F0F0F0F0F0F0, 0x0F0F0F0F0F0F0F0F, 0xF0F0F0F0F0F0F0F0, 0x0F0F0F0F0F0F0F0F), | | 24| 1.51k| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0x0000000000000000, 0x0000000000000000), | | 25| 1.51k| vec256_set4x(0x0000FFFFFFFF0000, 0x0000FFFFFFFF0000, 0x0000FFFFFFFF0000, 0x0000FFFFFFFF0000), | | 26| 1.51k| vec256_set4x(0xF0F00F0F0F0FF0F0, 0xF0F00F0F0F0FF0F0, 0xF0F00F0F0F0FF0F0, 0xF0F00F0F0F0FF0F0), | | 27| 1.51k|}, { | | 28| 1.51k| vec256_set4x(0xAA55AA5555AA55AA, 0x55AA55AAAA55AA55, 0xAA55AA5555AA55AA, 0x55AA55AAAA55AA55), | | 29| 1.51k| vec256_set4x(0xCC33CC3333CC33CC, 0xCC33CC3333CC33CC, 0x33CC33CCCC33CC33, 0x33CC33CCCC33CC33), | | 30| 1.51k| vec256_set4x(0x33CCCC33CC3333CC, 0xCC3333CC33CCCC33, 0xCC3333CC33CCCC33, 0x33CCCC33CC3333CC), | | 31| 1.51k| vec256_set4x(0x55555555AAAAAAAA, 0x55555555AAAAAAAA, 0x55555555AAAAAAAA, 0x55555555AAAAAAAA), | | 32| 1.51k| vec256_set4x(0xFF0000FF00FFFF00, 0xFF0000FF00FFFF00, 0x00FFFF00FF0000FF, 0x00FFFF00FF0000FF), | | 33| 1.51k| vec256_set4x(0x3CC33CC3C33CC33C, 0xC33CC33C3CC33CC3, 0x3CC33CC3C33CC33C, 0xC33CC33C3CC33CC3), | | 34| 1.51k| vec256_set4x(0x5555AAAA5555AAAA, 0xAAAA5555AAAA5555, 0x5555AAAA5555AAAA, 0xAAAA5555AAAA5555), | | 35| 1.51k| vec256_set4x(0x0FF00FF00FF00FF0, 0xF00FF00FF00FF00F, 0x0FF00FF00FF00FF0, 0xF00FF00FF00FF00F), | | 36| 1.51k| vec256_set4x(0xCCCC33333333CCCC, 0x3333CCCCCCCC3333, 0x3333CCCCCCCC3333, 0xCCCC33333333CCCC), | | 37| 1.51k| vec256_set4x(0xF0F0F0F0F0F0F0F0, 0x0F0F0F0F0F0F0F0F, 0xF0F0F0F0F0F0F0F0, 0x0F0F0F0F0F0F0F0F), | | 38| 1.51k| vec256_set4x(0x00FFFF0000FFFF00, 0xFF0000FFFF0000FF, 0x00FFFF0000FFFF00, 0xFF0000FFFF0000FF), | | 39| 1.51k| vec256_set4x(0xC33CC33CC33CC33C, 0xC33CC33CC33CC33C, 0xC33CC33CC33CC33C, 0xC33CC33CC33CC33C), | | 40| 1.51k|}, { | | 41| 1.51k| vec256_set4x(0x6699669999669966, 0x9966996666996699, 0x6699669999669966, 0x9966996666996699), | | 42| 1.51k| vec256_set4x(0x33CCCC33CC3333CC, 0x33CCCC33CC3333CC, 0x33CCCC33CC3333CC, 0x33CCCC33CC3333CC), | | 43| 1.51k| vec256_set4x(0xA5A5A5A55A5A5A5A, 0xA5A5A5A55A5A5A5A, 0x5A5A5A5AA5A5A5A5, 0x5A5A5A5AA5A5A5A5), | | 44| 1.51k| vec256_set4x(0x3C3CC3C3C3C33C3C, 0x3C3CC3C3C3C33C3C, 0xC3C33C3C3C3CC3C3, 0xC3C33C3C3C3CC3C3), | | 45| 1.51k| vec256_set4x(0xF00FF00F0FF00FF0, 0x0FF00FF0F00FF00F, 0x0FF00FF0F00FF00F, 0xF00FF00F0FF00FF0), | | 46| 1.51k| vec256_set4x(0x55AA55AA55AA55AA, 0xAA55AA55AA55AA55, 0xAA55AA55AA55AA55, 0x55AA55AA55AA55AA), | | 47| 1.51k| vec256_set4x(0x3C3CC3C3C3C33C3C, 0x3C3CC3C3C3C33C3C, 0xC3C33C3C3C3CC3C3, 0xC3C33C3C3C3CC3C3), | | 48| 1.51k| vec256_set4x(0x0F0F0F0FF0F0F0F0, 0xF0F0F0F00F0F0F0F, 0x0F0F0F0FF0F0F0F0, 0xF0F0F0F00F0F0F0F), | | 49| 1.51k| vec256_set4x(0x55AA55AA55AA55AA, 0xAA55AA55AA55AA55, 0xAA55AA55AA55AA55, 0x55AA55AA55AA55AA), | | 50| 1.51k| vec256_set4x(0x33CCCC33CC3333CC, 0xCC3333CC33CCCC33, 0x33CCCC33CC3333CC, 0xCC3333CC33CCCC33), | | 51| 1.51k| vec256_set4x(0xF0F0F0F0F0F0F0F0, 0x0F0F0F0F0F0F0F0F, 0xF0F0F0F0F0F0F0F0, 0x0F0F0F0F0F0F0F0F), | | 52| 1.51k| vec256_set4x(0xA55A5AA55AA5A55A, 0xA55A5AA55AA5A55A, 0xA55A5AA55AA5A55A, 0xA55A5AA55AA5A55A), | | 53| 1.51k|}, { | | 54| 1.51k| vec256_set4x(0x6699669999669966, 0x9966996666996699, 0x6699669999669966, 0x9966996666996699), | | 55| 1.51k| vec256_set4x(0xCC3333CC33CCCC33, 0xCC3333CC33CCCC33, 0xCC3333CC33CCCC33, 0xCC3333CC33CCCC33), | | 56| 1.51k| vec256_set4x(0x5A5A5A5AA5A5A5A5, 0x5A5A5A5AA5A5A5A5, 0xA5A5A5A55A5A5A5A, 0xA5A5A5A55A5A5A5A), | | 57| 1.51k| vec256_set4x(0x3C3CC3C3C3C33C3C, 0x3C3CC3C3C3C33C3C, 0xC3C33C3C3C3CC3C3, 0xC3C33C3C3C3CC3C3), | | 58| 1.51k| vec256_set4x(0x0FF00FF0F00FF00F, 0xF00FF00F0FF00FF0, 0xF00FF00F0FF00FF0, 0x0FF00FF0F00FF00F), | | 59| 1.51k| vec256_set4x(0x55AA55AA55AA55AA, 0xAA55AA55AA55AA55, 0xAA55AA55AA55AA55, 0x55AA55AA55AA55AA), | | 60| 1.51k| vec256_set4x(0x3C3CC3C3C3C33C3C, 0x3C3CC3C3C3C33C3C, 0xC3C33C3C3C3CC3C3, 0xC3C33C3C3C3CC3C3), | | 61| 1.51k| vec256_set4x(0x0F0F0F0FF0F0F0F0, 0xF0F0F0F00F0F0F0F, 0x0F0F0F0FF0F0F0F0, 0xF0F0F0F00F0F0F0F), | | 62| 1.51k| vec256_set4x(0x55AA55AA55AA55AA, 0xAA55AA55AA55AA55, 0xAA55AA55AA55AA55, 0x55AA55AA55AA55AA), | | 63| 1.51k| vec256_set4x(0x33CCCC33CC3333CC, 0xCC3333CC33CCCC33, 0x33CCCC33CC3333CC, 0xCC3333CC33CCCC33), | | 64| 1.51k| vec256_set4x(0xF0F0F0F0F0F0F0F0, 0x0F0F0F0F0F0F0F0F, 0xF0F0F0F0F0F0F0F0, 0x0F0F0F0F0F0F0F0F), | | 65| 1.51k| vec256_set4x(0xA55A5AA55AA5A55A, 0xA55A5AA55AA5A55A, 0xA55A5AA55AA5A55A, 0xA55A5AA55AA5A55A), | | 66| 1.51k|}, { | | 67| 1.51k| vec256_set4x(0x9669699696696996, 0x9669699696696996, 0x9669699696696996, 0x9669699696696996), | | 68| 1.51k| vec256_set4x(0x6996699669966996, 0x6996699669966996, 0x6996699669966996, 0x6996699669966996), | | 69| 1.51k| vec256_set4x(0x6996699669966996, 0x6996699669966996, 0x6996699669966996, 0x6996699669966996), | | 70| 1.51k| vec256_set4x(0x00FFFF0000FFFF00, 0x00FFFF0000FFFF00, 0xFF0000FFFF0000FF, 0xFF0000FFFF0000FF), | | 71| 1.51k| vec256_set4x(0xFF00FF00FF00FF00, 0x00FF00FF00FF00FF, 0x00FF00FF00FF00FF, 0xFF00FF00FF00FF00), | | 72| 1.51k| vec256_set4x(0xF00FF00F0FF00FF0, 0x0FF00FF0F00FF00F, 0x0FF00FF0F00FF00F, 0xF00FF00F0FF00FF0), | | 73| 1.51k| vec256_set4x(0xF0F00F0F0F0FF0F0, 0x0F0FF0F0F0F00F0F, 0x0F0FF0F0F0F00F0F, 0xF0F00F0F0F0FF0F0), | | 74| 1.51k| vec256_set4x(0xC33C3CC33CC3C33C, 0x3CC3C33CC33C3CC3, 0xC33C3CC33CC3C33C, 0x3CC3C33CC33C3CC3), | | 75| 1.51k| vec256_set4x(0xC33C3CC33CC3C33C, 0x3CC3C33CC33C3CC3, 0xC33C3CC33CC3C33C, 0x3CC3C33CC33C3CC3), | | 76| 1.51k| vec256_set4x(0xA55A5AA55AA5A55A, 0xA55A5AA55AA5A55A, 0xA55A5AA55AA5A55A, 0xA55A5AA55AA5A55A), | | 77| 1.51k| vec256_set4x(0xC33C3CC33CC3C33C, 0xC33C3CC33CC3C33C, 0xC33C3CC33CC3C33C, 0xC33C3CC33CC3C33C), | | 78| 1.51k| vec256_set4x(0x3CC3C33C3CC3C33C, 0x3CC3C33C3CC3C33C, 0x3CC3C33C3CC3C33C, 0x3CC3C33C3CC3C33C), | | 79| 1.51k|}, { | | 80| 1.51k| vec256_set4x(0x9669699696696996, 0x9669699696696996, 0x9669699696696996, 0x9669699696696996), | | 81| 1.51k| vec256_set4x(0x6996699669966996, 0x6996699669966996, 0x6996699669966996, 0x6996699669966996), | | 82| 1.51k| vec256_set4x(0x9669966996699669, 0x9669966996699669, 0x9669966996699669, 0x9669966996699669), | | 83| 1.51k| vec256_set4x(0xFF0000FFFF0000FF, 0xFF0000FFFF0000FF, 0x00FFFF0000FFFF00, 0x00FFFF0000FFFF00), | | 84| 1.51k| vec256_set4x(0x00FF00FF00FF00FF, 0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00, 0x00FF00FF00FF00FF), | | 85| 1.51k| vec256_set4x(0xF00FF00F0FF00FF0, 0x0FF00FF0F00FF00F, 0x0FF00FF0F00FF00F, 0xF00FF00F0FF00FF0), | | 86| 1.51k| vec256_set4x(0xF0F00F0F0F0FF0F0, 0x0F0FF0F0F0F00F0F, 0x0F0FF0F0F0F00F0F, 0xF0F00F0F0F0FF0F0), | | 87| 1.51k| vec256_set4x(0xC33C3CC33CC3C33C, 0x3CC3C33CC33C3CC3, 0xC33C3CC33CC3C33C, 0x3CC3C33CC33C3CC3), | | 88| 1.51k| vec256_set4x(0xC33C3CC33CC3C33C, 0x3CC3C33CC33C3CC3, 0xC33C3CC33CC3C33C, 0x3CC3C33CC33C3CC3), | | 89| 1.51k| vec256_set4x(0xA55A5AA55AA5A55A, 0xA55A5AA55AA5A55A, 0xA55A5AA55AA5A55A, 0xA55A5AA55AA5A55A), | | 90| 1.51k| vec256_set4x(0xC33C3CC33CC3C33C, 0xC33C3CC33CC3C33C, 0xC33C3CC33CC3C33C, 0xC33C3CC33CC3C33C), | | 91| 1.51k| vec256_set4x(0x3CC3C33C3CC3C33C, 0x3CC3C33C3CC3C33C, 0x3CC3C33C3CC3C33C, 0x3CC3C33C3CC3C33C), | | 92| 1.51k|}, { | | 93| 1.51k| vec256_set4x(0x9669699696696996, 0x9669699696696996, 0x9669699696696996, 0x9669699696696996), | | 94| 1.51k| vec256_set4x(0x9669966996699669, 0x9669966996699669, 0x9669966996699669, 0x9669966996699669), | | 95| 1.51k| vec256_set4x(0x9669966996699669, 0x9669966996699669, 0x9669966996699669, 0x9669966996699669), | | 96| 1.51k| vec256_set4x(0x00FFFF0000FFFF00, 0x00FFFF0000FFFF00, 0xFF0000FFFF0000FF, 0xFF0000FFFF0000FF), | | 97| 1.51k| vec256_set4x(0xFF00FF00FF00FF00, 0x00FF00FF00FF00FF, 0x00FF00FF00FF00FF, 0xFF00FF00FF00FF00), | | 98| 1.51k| vec256_set4x(0xF00FF00F0FF00FF0, 0x0FF00FF0F00FF00F, 0x0FF00FF0F00FF00F, 0xF00FF00F0FF00FF0), | | 99| 1.51k| vec256_set4x(0xF0F00F0F0F0FF0F0, 0x0F0FF0F0F0F00F0F, 0x0F0FF0F0F0F00F0F, 0xF0F00F0F0F0FF0F0), | | 100| 1.51k| vec256_set4x(0xC33C3CC33CC3C33C, 0x3CC3C33CC33C3CC3, 0xC33C3CC33CC3C33C, 0x3CC3C33CC33C3CC3), | | 101| 1.51k| vec256_set4x(0xC33C3CC33CC3C33C, 0x3CC3C33CC33C3CC3, 0xC33C3CC33CC3C33C, 0x3CC3C33CC33C3CC3), | | 102| 1.51k| vec256_set4x(0xA55A5AA55AA5A55A, 0xA55A5AA55AA5A55A, 0xA55A5AA55AA5A55A, 0xA55A5AA55AA5A55A), | | 103| 1.51k| vec256_set4x(0xC33C3CC33CC3C33C, 0xC33C3CC33CC3C33C, 0xC33C3CC33CC3C33C, 0xC33C3CC33CC3C33C), | | 104| 1.51k| vec256_set4x(0x3CC3C33C3CC3C33C, 0x3CC3C33C3CC3C33C, 0x3CC3C33C3CC3C33C, 0x3CC3C33C3CC3C33C), | | 105| 1.51k|}, { | | 106| 1.51k| vec256_set4x(0x9669699696696996, 0x9669699696696996, 0x9669699696696996, 0x9669699696696996), | | 107| 1.51k| vec256_set4x(0x9669966996699669, 0x9669966996699669, 0x9669966996699669, 0x9669966996699669), | | 108| 1.51k| vec256_set4x(0x6996699669966996, 0x6996699669966996, 0x6996699669966996, 0x6996699669966996), | | 109| 1.51k| vec256_set4x(0xFF0000FFFF0000FF, 0xFF0000FFFF0000FF, 0x00FFFF0000FFFF00, 0x00FFFF0000FFFF00), | | 110| 1.51k| vec256_set4x(0x00FF00FF00FF00FF, 0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00, 0x00FF00FF00FF00FF), | | 111| 1.51k| vec256_set4x(0xF00FF00F0FF00FF0, 0x0FF00FF0F00FF00F, 0x0FF00FF0F00FF00F, 0xF00FF00F0FF00FF0), | | 112| 1.51k| vec256_set4x(0xF0F00F0F0F0FF0F0, 0x0F0FF0F0F0F00F0F, 0x0F0FF0F0F0F00F0F, 0xF0F00F0F0F0FF0F0), | | 113| 1.51k| vec256_set4x(0xC33C3CC33CC3C33C, 0x3CC3C33CC33C3CC3, 0xC33C3CC33CC3C33C, 0x3CC3C33CC33C3CC3), | | 114| 1.51k| vec256_set4x(0xC33C3CC33CC3C33C, 0x3CC3C33CC33C3CC3, 0xC33C3CC33CC3C33C, 0x3CC3C33CC33C3CC3), | | 115| 1.51k| vec256_set4x(0xA55A5AA55AA5A55A, 0xA55A5AA55AA5A55A, 0xA55A5AA55AA5A55A, 0xA55A5AA55AA5A55A), | | 116| 1.51k| vec256_set4x(0xC33C3CC33CC3C33C, 0xC33C3CC33CC3C33C, 0xC33C3CC33CC3C33C, 0xC33C3CC33CC3C33C), | | 117| 1.51k| vec256_set4x(0x3CC3C33C3CC3C33C, 0x3CC3C33C3CC3C33C, 0x3CC3C33C3CC3C33C, 0x3CC3C33C3CC3C33C), | | 118| 1.51k|}, { | | 119| 1.51k| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0x0000000000000000, 0x0000000000000000), | | 120| 1.51k| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0x0000000000000000, 0x0000000000000000), | | 121| 1.51k| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0x0000000000000000, 0x0000000000000000), | | 122| 1.51k| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0x0000000000000000, 0x0000000000000000), | | 123| 1.51k| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF), | | 124| 1.51k| vec256_set4x(0x0000000000000000, 0xFFFFFFFFFFFFFFFF, 0x0000000000000000, 0xFFFFFFFFFFFFFFFF), | | 125| 1.51k| vec256_set4x(0xFFFFFFFF00000000, 0xFFFFFFFF00000000, 0xFFFFFFFF00000000, 0xFFFFFFFF00000000), | | 126| 1.51k| vec256_set4x(0xFFFF0000FFFF0000, 0xFFFF0000FFFF0000, 0xFFFF0000FFFF0000, 0xFFFF0000FFFF0000), | | 127| 1.51k| vec256_set4x(0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00), | | 128| 1.51k| vec256_set4x(0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0), | | 129| 1.51k| vec256_set4x(0xCCCCCCCCCCCCCCCC, 0xCCCCCCCCCCCCCCCC, 0xCCCCCCCCCCCCCCCC, 0xCCCCCCCCCCCCCCCC), | | 130| 1.51k| vec256_set4x(0xAAAAAAAAAAAAAAAA, 0xAAAAAAAAAAAAAAAA, 0xAAAAAAAAAAAAAAAA, 0xAAAAAAAAAAAAAAAA), | | 131| 1.51k|}, { | | 132| 1.51k| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0x0000000000000000, 0x0000000000000000), | | 133| 1.51k| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0x0000000000000000, 0x0000000000000000), | | 134| 1.51k| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0x0000000000000000, 0x0000000000000000), | | 135| 1.51k| vec256_set4x(0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF), | | 136| 1.51k| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF), | | 137| 1.51k| vec256_set4x(0x0000000000000000, 0xFFFFFFFFFFFFFFFF, 0x0000000000000000, 0xFFFFFFFFFFFFFFFF), | | 138| 1.51k| vec256_set4x(0xFFFFFFFF00000000, 0xFFFFFFFF00000000, 0xFFFFFFFF00000000, 0xFFFFFFFF00000000), | | 139| 1.51k| vec256_set4x(0xFFFF0000FFFF0000, 0xFFFF0000FFFF0000, 0xFFFF0000FFFF0000, 0xFFFF0000FFFF0000), | | 140| 1.51k| vec256_set4x(0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00), | | 141| 1.51k| vec256_set4x(0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0), | | 142| 1.51k| vec256_set4x(0xCCCCCCCCCCCCCCCC, 0xCCCCCCCCCCCCCCCC, 0xCCCCCCCCCCCCCCCC, 0xCCCCCCCCCCCCCCCC), | | 143| 1.51k| vec256_set4x(0xAAAAAAAAAAAAAAAA, 0xAAAAAAAAAAAAAAAA, 0xAAAAAAAAAAAAAAAA, 0xAAAAAAAAAAAAAAAA), | | 144| 1.51k|}, { | | 145| 1.51k| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0x0000000000000000, 0x0000000000000000), | | 146| 1.51k| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0x0000000000000000, 0x0000000000000000), | | 147| 1.51k| vec256_set4x(0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF), | | 148| 1.51k| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0x0000000000000000, 0x0000000000000000), | | 149| 1.51k| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF), | | 150| 1.51k| vec256_set4x(0x0000000000000000, 0xFFFFFFFFFFFFFFFF, 0x0000000000000000, 0xFFFFFFFFFFFFFFFF), | | 151| 1.51k| vec256_set4x(0xFFFFFFFF00000000, 0xFFFFFFFF00000000, 0xFFFFFFFF00000000, 0xFFFFFFFF00000000), | | 152| 1.51k| vec256_set4x(0xFFFF0000FFFF0000, 0xFFFF0000FFFF0000, 0xFFFF0000FFFF0000, 0xFFFF0000FFFF0000), | | 153| 1.51k| vec256_set4x(0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00), | | 154| 1.51k| vec256_set4x(0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0), | | 155| 1.51k| vec256_set4x(0xCCCCCCCCCCCCCCCC, 0xCCCCCCCCCCCCCCCC, 0xCCCCCCCCCCCCCCCC, 0xCCCCCCCCCCCCCCCC), | | 156| 1.51k| vec256_set4x(0xAAAAAAAAAAAAAAAA, 0xAAAAAAAAAAAAAAAA, 0xAAAAAAAAAAAAAAAA, 0xAAAAAAAAAAAAAAAA), | | 157| 1.51k|}, { | | 158| 1.51k| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0x0000000000000000, 0x0000000000000000), | | 159| 1.51k| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0x0000000000000000, 0x0000000000000000), | | 160| 1.51k| vec256_set4x(0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF), | | 161| 1.51k| vec256_set4x(0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF), | | 162| 1.51k| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF), | | 163| 1.51k| vec256_set4x(0x0000000000000000, 0xFFFFFFFFFFFFFFFF, 0x0000000000000000, 0xFFFFFFFFFFFFFFFF), | | 164| 1.51k| vec256_set4x(0xFFFFFFFF00000000, 0xFFFFFFFF00000000, 0xFFFFFFFF00000000, 0xFFFFFFFF00000000), | | 165| 1.51k| vec256_set4x(0xFFFF0000FFFF0000, 0xFFFF0000FFFF0000, 0xFFFF0000FFFF0000, 0xFFFF0000FFFF0000), | | 166| 1.51k| vec256_set4x(0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00), | | 167| 1.51k| vec256_set4x(0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0), | | 168| 1.51k| vec256_set4x(0xCCCCCCCCCCCCCCCC, 0xCCCCCCCCCCCCCCCC, 0xCCCCCCCCCCCCCCCC, 0xCCCCCCCCCCCCCCCC), | | 169| 1.51k| vec256_set4x(0xAAAAAAAAAAAAAAAA, 0xAAAAAAAAAAAAAAAA, 0xAAAAAAAAAAAAAAAA, 0xAAAAAAAAAAAAAAAA), | | 170| 1.51k|}, { | | 171| 1.51k| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0x0000000000000000, 0x0000000000000000), | | 172| 1.51k| vec256_set4x(0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF), | | 173| 1.51k| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0x0000000000000000, 0x0000000000000000), | | 174| 1.51k| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0x0000000000000000, 0x0000000000000000), | | 175| 1.51k| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF), | | 176| 1.51k| vec256_set4x(0x0000000000000000, 0xFFFFFFFFFFFFFFFF, 0x0000000000000000, 0xFFFFFFFFFFFFFFFF), | | 177| 1.51k| vec256_set4x(0xFFFFFFFF00000000, 0xFFFFFFFF00000000, 0xFFFFFFFF00000000, 0xFFFFFFFF00000000), | | 178| 1.51k| vec256_set4x(0xFFFF0000FFFF0000, 0xFFFF0000FFFF0000, 0xFFFF0000FFFF0000, 0xFFFF0000FFFF0000), | | 179| 1.51k| vec256_set4x(0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00), | | 180| 1.51k| vec256_set4x(0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0), | | 181| 1.51k| vec256_set4x(0xCCCCCCCCCCCCCCCC, 0xCCCCCCCCCCCCCCCC, 0xCCCCCCCCCCCCCCCC, 0xCCCCCCCCCCCCCCCC), | | 182| 1.51k| vec256_set4x(0xAAAAAAAAAAAAAAAA, 0xAAAAAAAAAAAAAAAA, 0xAAAAAAAAAAAAAAAA, 0xAAAAAAAAAAAAAAAA), | | 183| 1.51k|}, { | | 184| 1.51k| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0x0000000000000000, 0x0000000000000000), | | 185| 1.51k| vec256_set4x(0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF), | | 186| 1.51k| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0x0000000000000000, 0x0000000000000000), | | 187| 1.51k| vec256_set4x(0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF), | | 188| 1.51k| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF), | | 189| 1.51k| vec256_set4x(0x0000000000000000, 0xFFFFFFFFFFFFFFFF, 0x0000000000000000, 0xFFFFFFFFFFFFFFFF), | | 190| 1.51k| vec256_set4x(0xFFFFFFFF00000000, 0xFFFFFFFF00000000, 0xFFFFFFFF00000000, 0xFFFFFFFF00000000), | | 191| 1.51k| vec256_set4x(0xFFFF0000FFFF0000, 0xFFFF0000FFFF0000, 0xFFFF0000FFFF0000, 0xFFFF0000FFFF0000), | | 192| 1.51k| vec256_set4x(0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00), | | 193| 1.51k| vec256_set4x(0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0), | | 194| 1.51k| vec256_set4x(0xCCCCCCCCCCCCCCCC, 0xCCCCCCCCCCCCCCCC, 0xCCCCCCCCCCCCCCCC, 0xCCCCCCCCCCCCCCCC), | | 195| 1.51k| vec256_set4x(0xAAAAAAAAAAAAAAAA, 0xAAAAAAAAAAAAAAAA, 0xAAAAAAAAAAAAAAAA, 0xAAAAAAAAAAAAAAAA), | | 196| 1.51k|}, { | | 197| 1.51k| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0x0000000000000000, 0x0000000000000000), | | 198| 1.51k| vec256_set4x(0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF), | | 199| 1.51k| vec256_set4x(0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF), | | 200| 1.51k| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0x0000000000000000, 0x0000000000000000), | | 201| 1.51k| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF), | | 202| 1.51k| vec256_set4x(0x0000000000000000, 0xFFFFFFFFFFFFFFFF, 0x0000000000000000, 0xFFFFFFFFFFFFFFFF), | | 203| 1.51k| vec256_set4x(0xFFFFFFFF00000000, 0xFFFFFFFF00000000, 0xFFFFFFFF00000000, 0xFFFFFFFF00000000), | | 204| 1.51k| vec256_set4x(0xFFFF0000FFFF0000, 0xFFFF0000FFFF0000, 0xFFFF0000FFFF0000, 0xFFFF0000FFFF0000), | | 205| 1.51k| vec256_set4x(0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00), | | 206| 1.51k| vec256_set4x(0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0), | | 207| 1.51k| vec256_set4x(0xCCCCCCCCCCCCCCCC, 0xCCCCCCCCCCCCCCCC, 0xCCCCCCCCCCCCCCCC, 0xCCCCCCCCCCCCCCCC), | | 208| 1.51k| vec256_set4x(0xAAAAAAAAAAAAAAAA, 0xAAAAAAAAAAAAAAAA, 0xAAAAAAAAAAAAAAAA, 0xAAAAAAAAAAAAAAAA), | | 209| 1.51k|}, { | | 210| 1.51k| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0x0000000000000000, 0x0000000000000000), | | 211| 1.51k| vec256_set4x(0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF), | | 212| 1.51k| vec256_set4x(0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF), | | 213| 1.51k| vec256_set4x(0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF), | | 214| 1.51k| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF), | | 215| 1.51k| vec256_set4x(0x0000000000000000, 0xFFFFFFFFFFFFFFFF, 0x0000000000000000, 0xFFFFFFFFFFFFFFFF), | | 216| 1.51k| vec256_set4x(0xFFFFFFFF00000000, 0xFFFFFFFF00000000, 0xFFFFFFFF00000000, 0xFFFFFFFF00000000), | | 217| 1.51k| vec256_set4x(0xFFFF0000FFFF0000, 0xFFFF0000FFFF0000, 0xFFFF0000FFFF0000, 0xFFFF0000FFFF0000), | | 218| 1.51k| vec256_set4x(0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00), | | 219| 1.51k| vec256_set4x(0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0), | | 220| 1.51k| vec256_set4x(0xCCCCCCCCCCCCCCCC, 0xCCCCCCCCCCCCCCCC, 0xCCCCCCCCCCCCCCCC, 0xCCCCCCCCCCCCCCCC), | | 221| 1.51k| vec256_set4x(0xAAAAAAAAAAAAAAAA, 0xAAAAAAAAAAAAAAAA, 0xAAAAAAAAAAAAAAAA, 0xAAAAAAAAAAAAAAAA), | | 222| 1.51k|}, ------------------ 53| 1.51k| }; 54| | 55| 1.51k| uint64_t consts_ptr = 0; 56| | 57| 1.51k| const unsigned char reversal[64] = { 58| 1.51k| 0, 32, 16, 48, 8, 40, 24, 56, 59| 1.51k| 4, 36, 20, 52, 12, 44, 28, 60, 60| 1.51k| 2, 34, 18, 50, 10, 42, 26, 58, 61| 1.51k| 6, 38, 22, 54, 14, 46, 30, 62, 62| 1.51k| 1, 33, 17, 49, 9, 41, 25, 57, 63| 1.51k| 5, 37, 21, 53, 13, 45, 29, 61, 64| 1.51k| 3, 35, 19, 51, 11, 43, 27, 59, 65| 1.51k| 7, 39, 23, 55, 15, 47, 31, 63 66| 1.51k| }; 67| | 68| | // boradcast 69| | 70| 1.51k| vec256 tmp256[ GFBITS ]; 71| 1.51k| vec256 x[ GFBITS ], y[ GFBITS ]; 72| | 73| 13.6k| for (j = 0; j < 64; j += 8) { ------------------ | Branch (73:17): [True: 12.1k, False: 1.51k] ------------------ 74| 157k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 157k|#define GFBITS 12 ------------------ | Branch (74:21): [True: 145k, False: 12.1k] ------------------ 75| 145k| t0 = (in[i] >> reversal[j + 0]) & 1; 76| 145k| t0 = -t0; 77| 145k| t1 = (in[i] >> reversal[j + 2]) & 1; 78| 145k| t1 = -t1; 79| 145k| t2 = (in[i] >> reversal[j + 4]) & 1; 80| 145k| t2 = -t2; 81| 145k| t3 = (in[i] >> reversal[j + 6]) & 1; 82| 145k| t3 = -t3; 83| | 84| 145k| out[j / 4 + 0][i] = vec256_set4x(t0, t1, t2, t3); 85| | 86| 145k| t0 = (in[i] >> reversal[j + 1]) & 1; 87| 145k| t0 = -t0; 88| 145k| t1 = (in[i] >> reversal[j + 3]) & 1; 89| 145k| t1 = -t1; 90| 145k| t2 = (in[i] >> reversal[j + 5]) & 1; 91| 145k| t2 = -t2; 92| 145k| t3 = (in[i] >> reversal[j + 7]) & 1; 93| 145k| t3 = -t3; 94| | 95| 145k| out[j / 4 + 1][i] = vec256_set4x(t0, t1, t2, t3); 96| 145k| } 97| 12.1k| } 98| | 99| | // 100| | 101| 13.6k| for (i = 0; i < 16; i += 2) { ------------------ | Branch (101:17): [True: 12.1k, False: 1.51k] ------------------ 102| 12.1k| vec256_mul(tmp256, out[i + 1], consts[ 0 ]); 103| | 104| 157k| for (b = 0; b < GFBITS; b++) { ------------------ | | 6| 157k|#define GFBITS 12 ------------------ | Branch (104:21): [True: 145k, False: 12.1k] ------------------ 105| 145k| out[i + 0][b] ^= tmp256[b]; 106| 145k| } 107| 157k| for (b = 0; b < GFBITS; b++) { ------------------ | | 6| 157k|#define GFBITS 12 ------------------ | Branch (107:21): [True: 145k, False: 12.1k] ------------------ 108| 145k| out[i + 1][b] ^= out[i + 0][b]; 109| 145k| } 110| 12.1k| } 111| | 112| 13.6k| for (i = 0; i < 16; i += 2) { ------------------ | Branch (112:17): [True: 12.1k, False: 1.51k] ------------------ 113| 157k| for (b = 0; b < GFBITS; b++) { ------------------ | | 6| 157k|#define GFBITS 12 ------------------ | Branch (113:21): [True: 145k, False: 12.1k] ------------------ 114| 145k| x[b] = vec256_unpack_low_2x(out[i + 0][b], out[i + 1][b]); 115| 145k| } 116| 157k| for (b = 0; b < GFBITS; b++) { ------------------ | | 6| 157k|#define GFBITS 12 ------------------ | Branch (116:21): [True: 145k, False: 12.1k] ------------------ 117| 145k| y[b] = vec256_unpack_high_2x(out[i + 0][b], out[i + 1][b]); 118| 145k| } 119| | 120| 12.1k| vec256_mul(tmp256, y, consts[ 1 ]); 121| | 122| 157k| for (b = 0; b < GFBITS; b++) { ------------------ | | 6| 157k|#define GFBITS 12 ------------------ | Branch (122:21): [True: 145k, False: 12.1k] ------------------ 123| 145k| x[b] ^= tmp256[b]; 124| 145k| } 125| 157k| for (b = 0; b < GFBITS; b++) { ------------------ | | 6| 157k|#define GFBITS 12 ------------------ | Branch (125:21): [True: 145k, False: 12.1k] ------------------ 126| 145k| y[b] ^= x[b]; 127| 145k| } 128| | 129| 157k| for (b = 0; b < GFBITS; b++) { ------------------ | | 6| 157k|#define GFBITS 12 ------------------ | Branch (129:21): [True: 145k, False: 12.1k] ------------------ 130| 145k| out[i + 0][b] = vec256_unpack_low(x[b], y[b]); 131| 145k| } 132| 157k| for (b = 0; b < GFBITS; b++) { ------------------ | | 6| 157k|#define GFBITS 12 ------------------ | Branch (132:21): [True: 145k, False: 12.1k] ------------------ 133| 145k| out[i + 1][b] = vec256_unpack_high(x[b], y[b]); 134| 145k| } 135| 12.1k| } 136| | 137| 1.51k| consts_ptr = 2; 138| | 139| 7.58k| for (i = 0; i <= 3; i++) { ------------------ | Branch (139:17): [True: 6.06k, False: 1.51k] ------------------ 140| 6.06k| s = 1 << i; 141| | 142| 28.8k| for (j = 0; j < 16; j += 2 * s) { ------------------ | Branch (142:21): [True: 22.7k, False: 6.06k] ------------------ 143| 71.2k| for (k = j; k < j + s; k++) { ------------------ | Branch (143:25): [True: 48.5k, False: 22.7k] ------------------ 144| 48.5k| vec256_mul(tmp256, out[k + s], consts[ consts_ptr + (k - j) ]); 145| | 146| 631k| for (b = 0; b < GFBITS; b++) { ------------------ | | 6| 631k|#define GFBITS 12 ------------------ | Branch (146:29): [True: 582k, False: 48.5k] ------------------ 147| 582k| out[k][b] ^= tmp256[b]; 148| 582k| } 149| 631k| for (b = 0; b < GFBITS; b++) { ------------------ | | 6| 631k|#define GFBITS 12 ------------------ | Branch (149:29): [True: 582k, False: 48.5k] ------------------ 150| 582k| out[k + s][b] ^= out[k][b]; 151| 582k| } 152| 48.5k| } 153| 22.7k| } 154| | 155| 6.06k| consts_ptr += s; 156| 6.06k| } 157| | 158| | // adding the part contributed by x^64 159| | 160| 1.51k| vec256 powers[16][GFBITS] = { 161| 1.51k|#include "powers.data" ------------------ | | 1| 1.51k|{ | | 2| 1.51k| vec256_set4x(0x0F0F0F0FF0F0F0F0, 0x0F0F0F0FF0F0F0F0, 0x0F0F0F0FF0F0F0F0, 0x0F0F0F0FF0F0F0F0), | | 3| 1.51k| vec256_set4x(0xFFFF0000FFFF0000, 0xFFFF0000FFFF0000, 0x0000FFFF0000FFFF, 0x0000FFFF0000FFFF), | | 4| 1.51k| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0x0000000000000000, 0x0000000000000000), | | 5| 1.51k| vec256_set4x(0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0), | | 6| 1.51k| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF), | | 7| 1.51k| vec256_set4x(0x55AA55AA55AA55AA, 0xAA55AA55AA55AA55, 0x55AA55AA55AA55AA, 0xAA55AA55AA55AA55), | | 8| 1.51k| vec256_set4x(0x0F0F0F0FF0F0F0F0, 0x0F0F0F0FF0F0F0F0, 0x0F0F0F0FF0F0F0F0, 0x0F0F0F0FF0F0F0F0), | | 9| 1.51k| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF), | | 10| 1.51k| vec256_set4x(0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00), | | 11| 1.51k| vec256_set4x(0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0), | | 12| 1.51k| vec256_set4x(0x3333CCCC3333CCCC, 0x3333CCCC3333CCCC, 0x3333CCCC3333CCCC, 0x3333CCCC3333CCCC), | | 13| 1.51k| vec256_set4x(0xAAAAAAAAAAAAAAAA, 0xAAAAAAAAAAAAAAAA, 0xAAAAAAAAAAAAAAAA, 0xAAAAAAAAAAAAAAAA), | | 14| 1.51k|}, { | | 15| 1.51k| vec256_set4x(0xF0F0F0F00F0F0F0F, 0xF0F0F0F00F0F0F0F, 0xF0F0F0F00F0F0F0F, 0xF0F0F0F00F0F0F0F), | | 16| 1.51k| vec256_set4x(0xFFFF0000FFFF0000, 0xFFFF0000FFFF0000, 0x0000FFFF0000FFFF, 0x0000FFFF0000FFFF), | | 17| 1.51k| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0x0000000000000000, 0x0000000000000000), | | 18| 1.51k| vec256_set4x(0x0F0F0F0F0F0F0F0F, 0x0F0F0F0F0F0F0F0F, 0x0F0F0F0F0F0F0F0F, 0x0F0F0F0F0F0F0F0F), | | 19| 1.51k| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF), | | 20| 1.51k| vec256_set4x(0x55AA55AA55AA55AA, 0xAA55AA55AA55AA55, 0x55AA55AA55AA55AA, 0xAA55AA55AA55AA55), | | 21| 1.51k| vec256_set4x(0x0F0F0F0FF0F0F0F0, 0x0F0F0F0FF0F0F0F0, 0x0F0F0F0FF0F0F0F0, 0x0F0F0F0FF0F0F0F0), | | 22| 1.51k| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF), | | 23| 1.51k| vec256_set4x(0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00), | | 24| 1.51k| vec256_set4x(0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0), | | 25| 1.51k| vec256_set4x(0x3333CCCC3333CCCC, 0x3333CCCC3333CCCC, 0x3333CCCC3333CCCC, 0x3333CCCC3333CCCC), | | 26| 1.51k| vec256_set4x(0xAAAAAAAAAAAAAAAA, 0xAAAAAAAAAAAAAAAA, 0xAAAAAAAAAAAAAAAA, 0xAAAAAAAAAAAAAAAA), | | 27| 1.51k|}, { | | 28| 1.51k| vec256_set4x(0x0F0F0F0FF0F0F0F0, 0x0F0F0F0FF0F0F0F0, 0x0F0F0F0FF0F0F0F0, 0x0F0F0F0FF0F0F0F0), | | 29| 1.51k| vec256_set4x(0xFFFF0000FFFF0000, 0xFFFF0000FFFF0000, 0x0000FFFF0000FFFF, 0x0000FFFF0000FFFF), | | 30| 1.51k| vec256_set4x(0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF), | | 31| 1.51k| vec256_set4x(0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0), | | 32| 1.51k| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF), | | 33| 1.51k| vec256_set4x(0xAA55AA55AA55AA55, 0x55AA55AA55AA55AA, 0xAA55AA55AA55AA55, 0x55AA55AA55AA55AA), | | 34| 1.51k| vec256_set4x(0x0F0F0F0FF0F0F0F0, 0x0F0F0F0FF0F0F0F0, 0x0F0F0F0FF0F0F0F0, 0x0F0F0F0FF0F0F0F0), | | 35| 1.51k| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF), | | 36| 1.51k| vec256_set4x(0x00FF00FF00FF00FF, 0x00FF00FF00FF00FF, 0x00FF00FF00FF00FF, 0x00FF00FF00FF00FF), | | 37| 1.51k| vec256_set4x(0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0), | | 38| 1.51k| vec256_set4x(0x3333CCCC3333CCCC, 0x3333CCCC3333CCCC, 0x3333CCCC3333CCCC, 0x3333CCCC3333CCCC), | | 39| 1.51k| vec256_set4x(0x5555555555555555, 0x5555555555555555, 0x5555555555555555, 0x5555555555555555), | | 40| 1.51k|}, { | | 41| 1.51k| vec256_set4x(0xF0F0F0F00F0F0F0F, 0xF0F0F0F00F0F0F0F, 0xF0F0F0F00F0F0F0F, 0xF0F0F0F00F0F0F0F), | | 42| 1.51k| vec256_set4x(0xFFFF0000FFFF0000, 0xFFFF0000FFFF0000, 0x0000FFFF0000FFFF, 0x0000FFFF0000FFFF), | | 43| 1.51k| vec256_set4x(0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF), | | 44| 1.51k| vec256_set4x(0x0F0F0F0F0F0F0F0F, 0x0F0F0F0F0F0F0F0F, 0x0F0F0F0F0F0F0F0F, 0x0F0F0F0F0F0F0F0F), | | 45| 1.51k| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF), | | 46| 1.51k| vec256_set4x(0xAA55AA55AA55AA55, 0x55AA55AA55AA55AA, 0xAA55AA55AA55AA55, 0x55AA55AA55AA55AA), | | 47| 1.51k| vec256_set4x(0x0F0F0F0FF0F0F0F0, 0x0F0F0F0FF0F0F0F0, 0x0F0F0F0FF0F0F0F0, 0x0F0F0F0FF0F0F0F0), | | 48| 1.51k| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF), | | 49| 1.51k| vec256_set4x(0x00FF00FF00FF00FF, 0x00FF00FF00FF00FF, 0x00FF00FF00FF00FF, 0x00FF00FF00FF00FF), | | 50| 1.51k| vec256_set4x(0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0), | | 51| 1.51k| vec256_set4x(0x3333CCCC3333CCCC, 0x3333CCCC3333CCCC, 0x3333CCCC3333CCCC, 0x3333CCCC3333CCCC), | | 52| 1.51k| vec256_set4x(0x5555555555555555, 0x5555555555555555, 0x5555555555555555, 0x5555555555555555), | | 53| 1.51k|}, { | | 54| 1.51k| vec256_set4x(0x0F0F0F0FF0F0F0F0, 0x0F0F0F0FF0F0F0F0, 0x0F0F0F0FF0F0F0F0, 0x0F0F0F0FF0F0F0F0), | | 55| 1.51k| vec256_set4x(0xFFFF0000FFFF0000, 0xFFFF0000FFFF0000, 0x0000FFFF0000FFFF, 0x0000FFFF0000FFFF), | | 56| 1.51k| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0x0000000000000000, 0x0000000000000000), | | 57| 1.51k| vec256_set4x(0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0), | | 58| 1.51k| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF), | | 59| 1.51k| vec256_set4x(0x55AA55AA55AA55AA, 0xAA55AA55AA55AA55, 0x55AA55AA55AA55AA, 0xAA55AA55AA55AA55), | | 60| 1.51k| vec256_set4x(0x0F0F0F0FF0F0F0F0, 0x0F0F0F0FF0F0F0F0, 0x0F0F0F0FF0F0F0F0, 0x0F0F0F0FF0F0F0F0), | | 61| 1.51k| vec256_set4x(0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF, 0x0000000000000000, 0x0000000000000000), | | 62| 1.51k| vec256_set4x(0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00), | | 63| 1.51k| vec256_set4x(0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0), | | 64| 1.51k| vec256_set4x(0xCCCC3333CCCC3333, 0xCCCC3333CCCC3333, 0xCCCC3333CCCC3333, 0xCCCC3333CCCC3333), | | 65| 1.51k| vec256_set4x(0xAAAAAAAAAAAAAAAA, 0xAAAAAAAAAAAAAAAA, 0xAAAAAAAAAAAAAAAA, 0xAAAAAAAAAAAAAAAA), | | 66| 1.51k|}, { | | 67| 1.51k| vec256_set4x(0xF0F0F0F00F0F0F0F, 0xF0F0F0F00F0F0F0F, 0xF0F0F0F00F0F0F0F, 0xF0F0F0F00F0F0F0F), | | 68| 1.51k| vec256_set4x(0xFFFF0000FFFF0000, 0xFFFF0000FFFF0000, 0x0000FFFF0000FFFF, 0x0000FFFF0000FFFF), | | 69| 1.51k| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0x0000000000000000, 0x0000000000000000), | | 70| 1.51k| vec256_set4x(0x0F0F0F0F0F0F0F0F, 0x0F0F0F0F0F0F0F0F, 0x0F0F0F0F0F0F0F0F, 0x0F0F0F0F0F0F0F0F), | | 71| 1.51k| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF), | | 72| 1.51k| vec256_set4x(0x55AA55AA55AA55AA, 0xAA55AA55AA55AA55, 0x55AA55AA55AA55AA, 0xAA55AA55AA55AA55), | | 73| 1.51k| vec256_set4x(0x0F0F0F0FF0F0F0F0, 0x0F0F0F0FF0F0F0F0, 0x0F0F0F0FF0F0F0F0, 0x0F0F0F0FF0F0F0F0), | | 74| 1.51k| vec256_set4x(0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF, 0x0000000000000000, 0x0000000000000000), | | 75| 1.51k| vec256_set4x(0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00), | | 76| 1.51k| vec256_set4x(0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0), | | 77| 1.51k| vec256_set4x(0xCCCC3333CCCC3333, 0xCCCC3333CCCC3333, 0xCCCC3333CCCC3333, 0xCCCC3333CCCC3333), | | 78| 1.51k| vec256_set4x(0xAAAAAAAAAAAAAAAA, 0xAAAAAAAAAAAAAAAA, 0xAAAAAAAAAAAAAAAA, 0xAAAAAAAAAAAAAAAA), | | 79| 1.51k|}, { | | 80| 1.51k| vec256_set4x(0x0F0F0F0FF0F0F0F0, 0x0F0F0F0FF0F0F0F0, 0x0F0F0F0FF0F0F0F0, 0x0F0F0F0FF0F0F0F0), | | 81| 1.51k| vec256_set4x(0xFFFF0000FFFF0000, 0xFFFF0000FFFF0000, 0x0000FFFF0000FFFF, 0x0000FFFF0000FFFF), | | 82| 1.51k| vec256_set4x(0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF), | | 83| 1.51k| vec256_set4x(0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0), | | 84| 1.51k| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF), | | 85| 1.51k| vec256_set4x(0xAA55AA55AA55AA55, 0x55AA55AA55AA55AA, 0xAA55AA55AA55AA55, 0x55AA55AA55AA55AA), | | 86| 1.51k| vec256_set4x(0x0F0F0F0FF0F0F0F0, 0x0F0F0F0FF0F0F0F0, 0x0F0F0F0FF0F0F0F0, 0x0F0F0F0FF0F0F0F0), | | 87| 1.51k| vec256_set4x(0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF, 0x0000000000000000, 0x0000000000000000), | | 88| 1.51k| vec256_set4x(0x00FF00FF00FF00FF, 0x00FF00FF00FF00FF, 0x00FF00FF00FF00FF, 0x00FF00FF00FF00FF), | | 89| 1.51k| vec256_set4x(0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0), | | 90| 1.51k| vec256_set4x(0xCCCC3333CCCC3333, 0xCCCC3333CCCC3333, 0xCCCC3333CCCC3333, 0xCCCC3333CCCC3333), | | 91| 1.51k| vec256_set4x(0x5555555555555555, 0x5555555555555555, 0x5555555555555555, 0x5555555555555555), | | 92| 1.51k|}, { | | 93| 1.51k| vec256_set4x(0xF0F0F0F00F0F0F0F, 0xF0F0F0F00F0F0F0F, 0xF0F0F0F00F0F0F0F, 0xF0F0F0F00F0F0F0F), | | 94| 1.51k| vec256_set4x(0xFFFF0000FFFF0000, 0xFFFF0000FFFF0000, 0x0000FFFF0000FFFF, 0x0000FFFF0000FFFF), | | 95| 1.51k| vec256_set4x(0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF), | | 96| 1.51k| vec256_set4x(0x0F0F0F0F0F0F0F0F, 0x0F0F0F0F0F0F0F0F, 0x0F0F0F0F0F0F0F0F, 0x0F0F0F0F0F0F0F0F), | | 97| 1.51k| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF), | | 98| 1.51k| vec256_set4x(0xAA55AA55AA55AA55, 0x55AA55AA55AA55AA, 0xAA55AA55AA55AA55, 0x55AA55AA55AA55AA), | | 99| 1.51k| vec256_set4x(0x0F0F0F0FF0F0F0F0, 0x0F0F0F0FF0F0F0F0, 0x0F0F0F0FF0F0F0F0, 0x0F0F0F0FF0F0F0F0), | | 100| 1.51k| vec256_set4x(0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF, 0x0000000000000000, 0x0000000000000000), | | 101| 1.51k| vec256_set4x(0x00FF00FF00FF00FF, 0x00FF00FF00FF00FF, 0x00FF00FF00FF00FF, 0x00FF00FF00FF00FF), | | 102| 1.51k| vec256_set4x(0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0), | | 103| 1.51k| vec256_set4x(0xCCCC3333CCCC3333, 0xCCCC3333CCCC3333, 0xCCCC3333CCCC3333, 0xCCCC3333CCCC3333), | | 104| 1.51k| vec256_set4x(0x5555555555555555, 0x5555555555555555, 0x5555555555555555, 0x5555555555555555), | | 105| 1.51k|}, { | | 106| 1.51k| vec256_set4x(0xF0F0F0F00F0F0F0F, 0xF0F0F0F00F0F0F0F, 0xF0F0F0F00F0F0F0F, 0xF0F0F0F00F0F0F0F), | | 107| 1.51k| vec256_set4x(0xFFFF0000FFFF0000, 0xFFFF0000FFFF0000, 0x0000FFFF0000FFFF, 0x0000FFFF0000FFFF), | | 108| 1.51k| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0x0000000000000000, 0x0000000000000000), | | 109| 1.51k| vec256_set4x(0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0), | | 110| 1.51k| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF), | | 111| 1.51k| vec256_set4x(0x55AA55AA55AA55AA, 0xAA55AA55AA55AA55, 0x55AA55AA55AA55AA, 0xAA55AA55AA55AA55), | | 112| 1.51k| vec256_set4x(0x0F0F0F0FF0F0F0F0, 0x0F0F0F0FF0F0F0F0, 0x0F0F0F0FF0F0F0F0, 0x0F0F0F0FF0F0F0F0), | | 113| 1.51k| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF), | | 114| 1.51k| vec256_set4x(0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00), | | 115| 1.51k| vec256_set4x(0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0), | | 116| 1.51k| vec256_set4x(0x3333CCCC3333CCCC, 0x3333CCCC3333CCCC, 0x3333CCCC3333CCCC, 0x3333CCCC3333CCCC), | | 117| 1.51k| vec256_set4x(0xAAAAAAAAAAAAAAAA, 0xAAAAAAAAAAAAAAAA, 0xAAAAAAAAAAAAAAAA, 0xAAAAAAAAAAAAAAAA), | | 118| 1.51k|}, { | | 119| 1.51k| vec256_set4x(0x0F0F0F0FF0F0F0F0, 0x0F0F0F0FF0F0F0F0, 0x0F0F0F0FF0F0F0F0, 0x0F0F0F0FF0F0F0F0), | | 120| 1.51k| vec256_set4x(0xFFFF0000FFFF0000, 0xFFFF0000FFFF0000, 0x0000FFFF0000FFFF, 0x0000FFFF0000FFFF), | | 121| 1.51k| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0x0000000000000000, 0x0000000000000000), | | 122| 1.51k| vec256_set4x(0x0F0F0F0F0F0F0F0F, 0x0F0F0F0F0F0F0F0F, 0x0F0F0F0F0F0F0F0F, 0x0F0F0F0F0F0F0F0F), | | 123| 1.51k| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF), | | 124| 1.51k| vec256_set4x(0x55AA55AA55AA55AA, 0xAA55AA55AA55AA55, 0x55AA55AA55AA55AA, 0xAA55AA55AA55AA55), | | 125| 1.51k| vec256_set4x(0x0F0F0F0FF0F0F0F0, 0x0F0F0F0FF0F0F0F0, 0x0F0F0F0FF0F0F0F0, 0x0F0F0F0FF0F0F0F0), | | 126| 1.51k| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF), | | 127| 1.51k| vec256_set4x(0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00), | | 128| 1.51k| vec256_set4x(0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0), | | 129| 1.51k| vec256_set4x(0x3333CCCC3333CCCC, 0x3333CCCC3333CCCC, 0x3333CCCC3333CCCC, 0x3333CCCC3333CCCC), | | 130| 1.51k| vec256_set4x(0xAAAAAAAAAAAAAAAA, 0xAAAAAAAAAAAAAAAA, 0xAAAAAAAAAAAAAAAA, 0xAAAAAAAAAAAAAAAA), | | 131| 1.51k|}, { | | 132| 1.51k| vec256_set4x(0xF0F0F0F00F0F0F0F, 0xF0F0F0F00F0F0F0F, 0xF0F0F0F00F0F0F0F, 0xF0F0F0F00F0F0F0F), | | 133| 1.51k| vec256_set4x(0xFFFF0000FFFF0000, 0xFFFF0000FFFF0000, 0x0000FFFF0000FFFF, 0x0000FFFF0000FFFF), | | 134| 1.51k| vec256_set4x(0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF), | | 135| 1.51k| vec256_set4x(0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0), | | 136| 1.51k| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF), | | 137| 1.51k| vec256_set4x(0xAA55AA55AA55AA55, 0x55AA55AA55AA55AA, 0xAA55AA55AA55AA55, 0x55AA55AA55AA55AA), | | 138| 1.51k| vec256_set4x(0x0F0F0F0FF0F0F0F0, 0x0F0F0F0FF0F0F0F0, 0x0F0F0F0FF0F0F0F0, 0x0F0F0F0FF0F0F0F0), | | 139| 1.51k| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF), | | 140| 1.51k| vec256_set4x(0x00FF00FF00FF00FF, 0x00FF00FF00FF00FF, 0x00FF00FF00FF00FF, 0x00FF00FF00FF00FF), | | 141| 1.51k| vec256_set4x(0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0), | | 142| 1.51k| vec256_set4x(0x3333CCCC3333CCCC, 0x3333CCCC3333CCCC, 0x3333CCCC3333CCCC, 0x3333CCCC3333CCCC), | | 143| 1.51k| vec256_set4x(0x5555555555555555, 0x5555555555555555, 0x5555555555555555, 0x5555555555555555), | | 144| 1.51k|}, { | | 145| 1.51k| vec256_set4x(0x0F0F0F0FF0F0F0F0, 0x0F0F0F0FF0F0F0F0, 0x0F0F0F0FF0F0F0F0, 0x0F0F0F0FF0F0F0F0), | | 146| 1.51k| vec256_set4x(0xFFFF0000FFFF0000, 0xFFFF0000FFFF0000, 0x0000FFFF0000FFFF, 0x0000FFFF0000FFFF), | | 147| 1.51k| vec256_set4x(0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF), | | 148| 1.51k| vec256_set4x(0x0F0F0F0F0F0F0F0F, 0x0F0F0F0F0F0F0F0F, 0x0F0F0F0F0F0F0F0F, 0x0F0F0F0F0F0F0F0F), | | 149| 1.51k| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF), | | 150| 1.51k| vec256_set4x(0xAA55AA55AA55AA55, 0x55AA55AA55AA55AA, 0xAA55AA55AA55AA55, 0x55AA55AA55AA55AA), | | 151| 1.51k| vec256_set4x(0x0F0F0F0FF0F0F0F0, 0x0F0F0F0FF0F0F0F0, 0x0F0F0F0FF0F0F0F0, 0x0F0F0F0FF0F0F0F0), | | 152| 1.51k| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF), | | 153| 1.51k| vec256_set4x(0x00FF00FF00FF00FF, 0x00FF00FF00FF00FF, 0x00FF00FF00FF00FF, 0x00FF00FF00FF00FF), | | 154| 1.51k| vec256_set4x(0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0), | | 155| 1.51k| vec256_set4x(0x3333CCCC3333CCCC, 0x3333CCCC3333CCCC, 0x3333CCCC3333CCCC, 0x3333CCCC3333CCCC), | | 156| 1.51k| vec256_set4x(0x5555555555555555, 0x5555555555555555, 0x5555555555555555, 0x5555555555555555), | | 157| 1.51k|}, { | | 158| 1.51k| vec256_set4x(0xF0F0F0F00F0F0F0F, 0xF0F0F0F00F0F0F0F, 0xF0F0F0F00F0F0F0F, 0xF0F0F0F00F0F0F0F), | | 159| 1.51k| vec256_set4x(0xFFFF0000FFFF0000, 0xFFFF0000FFFF0000, 0x0000FFFF0000FFFF, 0x0000FFFF0000FFFF), | | 160| 1.51k| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0x0000000000000000, 0x0000000000000000), | | 161| 1.51k| vec256_set4x(0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0), | | 162| 1.51k| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF), | | 163| 1.51k| vec256_set4x(0x55AA55AA55AA55AA, 0xAA55AA55AA55AA55, 0x55AA55AA55AA55AA, 0xAA55AA55AA55AA55), | | 164| 1.51k| vec256_set4x(0x0F0F0F0FF0F0F0F0, 0x0F0F0F0FF0F0F0F0, 0x0F0F0F0FF0F0F0F0, 0x0F0F0F0FF0F0F0F0), | | 165| 1.51k| vec256_set4x(0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF, 0x0000000000000000, 0x0000000000000000), | | 166| 1.51k| vec256_set4x(0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00), | | 167| 1.51k| vec256_set4x(0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0), | | 168| 1.51k| vec256_set4x(0xCCCC3333CCCC3333, 0xCCCC3333CCCC3333, 0xCCCC3333CCCC3333, 0xCCCC3333CCCC3333), | | 169| 1.51k| vec256_set4x(0xAAAAAAAAAAAAAAAA, 0xAAAAAAAAAAAAAAAA, 0xAAAAAAAAAAAAAAAA, 0xAAAAAAAAAAAAAAAA), | | 170| 1.51k|}, { | | 171| 1.51k| vec256_set4x(0x0F0F0F0FF0F0F0F0, 0x0F0F0F0FF0F0F0F0, 0x0F0F0F0FF0F0F0F0, 0x0F0F0F0FF0F0F0F0), | | 172| 1.51k| vec256_set4x(0xFFFF0000FFFF0000, 0xFFFF0000FFFF0000, 0x0000FFFF0000FFFF, 0x0000FFFF0000FFFF), | | 173| 1.51k| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0x0000000000000000, 0x0000000000000000), | | 174| 1.51k| vec256_set4x(0x0F0F0F0F0F0F0F0F, 0x0F0F0F0F0F0F0F0F, 0x0F0F0F0F0F0F0F0F, 0x0F0F0F0F0F0F0F0F), | | 175| 1.51k| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF), | | 176| 1.51k| vec256_set4x(0x55AA55AA55AA55AA, 0xAA55AA55AA55AA55, 0x55AA55AA55AA55AA, 0xAA55AA55AA55AA55), | | 177| 1.51k| vec256_set4x(0x0F0F0F0FF0F0F0F0, 0x0F0F0F0FF0F0F0F0, 0x0F0F0F0FF0F0F0F0, 0x0F0F0F0FF0F0F0F0), | | 178| 1.51k| vec256_set4x(0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF, 0x0000000000000000, 0x0000000000000000), | | 179| 1.51k| vec256_set4x(0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00), | | 180| 1.51k| vec256_set4x(0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0), | | 181| 1.51k| vec256_set4x(0xCCCC3333CCCC3333, 0xCCCC3333CCCC3333, 0xCCCC3333CCCC3333, 0xCCCC3333CCCC3333), | | 182| 1.51k| vec256_set4x(0xAAAAAAAAAAAAAAAA, 0xAAAAAAAAAAAAAAAA, 0xAAAAAAAAAAAAAAAA, 0xAAAAAAAAAAAAAAAA), | | 183| 1.51k|}, { | | 184| 1.51k| vec256_set4x(0xF0F0F0F00F0F0F0F, 0xF0F0F0F00F0F0F0F, 0xF0F0F0F00F0F0F0F, 0xF0F0F0F00F0F0F0F), | | 185| 1.51k| vec256_set4x(0xFFFF0000FFFF0000, 0xFFFF0000FFFF0000, 0x0000FFFF0000FFFF, 0x0000FFFF0000FFFF), | | 186| 1.51k| vec256_set4x(0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF), | | 187| 1.51k| vec256_set4x(0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0), | | 188| 1.51k| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF), | | 189| 1.51k| vec256_set4x(0xAA55AA55AA55AA55, 0x55AA55AA55AA55AA, 0xAA55AA55AA55AA55, 0x55AA55AA55AA55AA), | | 190| 1.51k| vec256_set4x(0x0F0F0F0FF0F0F0F0, 0x0F0F0F0FF0F0F0F0, 0x0F0F0F0FF0F0F0F0, 0x0F0F0F0FF0F0F0F0), | | 191| 1.51k| vec256_set4x(0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF, 0x0000000000000000, 0x0000000000000000), | | 192| 1.51k| vec256_set4x(0x00FF00FF00FF00FF, 0x00FF00FF00FF00FF, 0x00FF00FF00FF00FF, 0x00FF00FF00FF00FF), | | 193| 1.51k| vec256_set4x(0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0), | | 194| 1.51k| vec256_set4x(0xCCCC3333CCCC3333, 0xCCCC3333CCCC3333, 0xCCCC3333CCCC3333, 0xCCCC3333CCCC3333), | | 195| 1.51k| vec256_set4x(0x5555555555555555, 0x5555555555555555, 0x5555555555555555, 0x5555555555555555), | | 196| 1.51k|}, { | | 197| 1.51k| vec256_set4x(0x0F0F0F0FF0F0F0F0, 0x0F0F0F0FF0F0F0F0, 0x0F0F0F0FF0F0F0F0, 0x0F0F0F0FF0F0F0F0), | | 198| 1.51k| vec256_set4x(0xFFFF0000FFFF0000, 0xFFFF0000FFFF0000, 0x0000FFFF0000FFFF, 0x0000FFFF0000FFFF), | | 199| 1.51k| vec256_set4x(0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF), | | 200| 1.51k| vec256_set4x(0x0F0F0F0F0F0F0F0F, 0x0F0F0F0F0F0F0F0F, 0x0F0F0F0F0F0F0F0F, 0x0F0F0F0F0F0F0F0F), | | 201| 1.51k| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF), | | 202| 1.51k| vec256_set4x(0xAA55AA55AA55AA55, 0x55AA55AA55AA55AA, 0xAA55AA55AA55AA55, 0x55AA55AA55AA55AA), | | 203| 1.51k| vec256_set4x(0x0F0F0F0FF0F0F0F0, 0x0F0F0F0FF0F0F0F0, 0x0F0F0F0FF0F0F0F0, 0x0F0F0F0FF0F0F0F0), | | 204| 1.51k| vec256_set4x(0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF, 0x0000000000000000, 0x0000000000000000), | | 205| 1.51k| vec256_set4x(0x00FF00FF00FF00FF, 0x00FF00FF00FF00FF, 0x00FF00FF00FF00FF, 0x00FF00FF00FF00FF), | | 206| 1.51k| vec256_set4x(0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0), | | 207| 1.51k| vec256_set4x(0xCCCC3333CCCC3333, 0xCCCC3333CCCC3333, 0xCCCC3333CCCC3333, 0xCCCC3333CCCC3333), | | 208| 1.51k| vec256_set4x(0x5555555555555555, 0x5555555555555555, 0x5555555555555555, 0x5555555555555555), | | 209| 1.51k|}, ------------------ 162| 1.51k| }; 163| | 164| 25.7k| for (i = 0; i < 16; i++) { ------------------ | Branch (164:17): [True: 24.2k, False: 1.51k] ------------------ 165| 315k| for (b = 0; b < GFBITS; b++) { ------------------ | | 6| 315k|#define GFBITS 12 ------------------ | Branch (165:21): [True: 291k, False: 24.2k] ------------------ 166| 291k| out[i][b] = vec256_xor(out[i][b], powers[i][b]); 167| 291k| } 168| 24.2k| } 169| 1.51k|} PQCLEAN_MCELIECE348864_AVX2_fft_tr: 354| 196|void fft_tr(vec128 out[GFBITS], vec256 in[][ GFBITS ]) { 355| 196| butterflies_tr(out, in); 356| 196| radix_conversions_tr(out); 357| 196|} fft_tr.c:butterflies_tr: 65| 362|static void butterflies_tr(vec128 out[ GFBITS ], vec256 in[][ GFBITS ]) { 66| 362| int i, j, k, s, b; 67| | 68| 362| uint64_t tmp[ GFBITS ]; 69| 362| uint64_t pre[6][ GFBITS ]; 70| 362| uint64_t out64[2][64]; 71| | 72| 362| vec256 p2[ 6 ]; 73| 362| vec256 buf[64]; 74| 362| vec256 x[ GFBITS ], y[ GFBITS ]; 75| 362| vec256 tmp256[ GFBITS ]; 76| | 77| 362| const vec256 consts[ 17 ][ GFBITS ] = { 78| 362|#include "consts.data" ------------------ | | 1| 362|{ | | 2| 362| vec256_set4x(0xF00F0FF0F00F0FF0, 0xF00F0FF0F00F0FF0, 0xF00F0FF0F00F0FF0, 0xF00F0FF0F00F0FF0), | | 3| 362| vec256_set4x(0xF0F00F0F0F0FF0F0, 0xF0F00F0F0F0FF0F0, 0xF0F00F0F0F0FF0F0, 0xF0F00F0F0F0FF0F0), | | 4| 362| vec256_set4x(0x0FF00FF00FF00FF0, 0x0FF00FF00FF00FF0, 0x0FF00FF00FF00FF0, 0x0FF00FF00FF00FF0), | | 5| 362| vec256_set4x(0xAA5555AAAA5555AA, 0xAA5555AAAA5555AA, 0xAA5555AAAA5555AA, 0xAA5555AAAA5555AA), | | 6| 362| vec256_set4x(0xF00F0FF0F00F0FF0, 0xF00F0FF0F00F0FF0, 0xF00F0FF0F00F0FF0, 0xF00F0FF0F00F0FF0), | | 7| 362| vec256_set4x(0x33CCCC33CC3333CC, 0x33CCCC33CC3333CC, 0x33CCCC33CC3333CC, 0x33CCCC33CC3333CC), | | 8| 362| vec256_set4x(0xFFFF0000FFFF0000, 0xFFFF0000FFFF0000, 0xFFFF0000FFFF0000, 0xFFFF0000FFFF0000), | | 9| 362| vec256_set4x(0xCC33CC3333CC33CC, 0xCC33CC3333CC33CC, 0xCC33CC3333CC33CC, 0xCC33CC3333CC33CC), | | 10| 362| vec256_set4x(0x33CC33CC33CC33CC, 0x33CC33CC33CC33CC, 0x33CC33CC33CC33CC, 0x33CC33CC33CC33CC), | | 11| 362| vec256_set4x(0x5A5A5A5A5A5A5A5A, 0x5A5A5A5A5A5A5A5A, 0x5A5A5A5A5A5A5A5A, 0x5A5A5A5A5A5A5A5A), | | 12| 362| vec256_set4x(0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00), | | 13| 362| vec256_set4x(0xF00F0FF0F00F0FF0, 0xF00F0FF0F00F0FF0, 0xF00F0FF0F00F0FF0, 0xF00F0FF0F00F0FF0), | | 14| 362|}, { | | 15| 362| vec256_set4x(0x3C3C3C3C3C3C3C3C, 0x3C3C3C3C3C3C3C3C, 0x3C3C3C3C3C3C3C3C, 0x3C3C3C3C3C3C3C3C), | | 16| 362| vec256_set4x(0xF0F0F0F0F0F0F0F0, 0x0F0F0F0F0F0F0F0F, 0xF0F0F0F0F0F0F0F0, 0x0F0F0F0F0F0F0F0F), | | 17| 362| vec256_set4x(0x5555AAAA5555AAAA, 0xAAAA5555AAAA5555, 0x5555AAAA5555AAAA, 0xAAAA5555AAAA5555), | | 18| 362| vec256_set4x(0xCC3333CCCC3333CC, 0xCC3333CCCC3333CC, 0xCC3333CCCC3333CC, 0xCC3333CCCC3333CC), | | 19| 362| vec256_set4x(0xC33CC33CC33CC33C, 0xC33CC33CC33CC33C, 0xC33CC33CC33CC33C, 0xC33CC33CC33CC33C), | | 20| 362| vec256_set4x(0x55555555AAAAAAAA, 0x55555555AAAAAAAA, 0x55555555AAAAAAAA, 0x55555555AAAAAAAA), | | 21| 362| vec256_set4x(0x33333333CCCCCCCC, 0x33333333CCCCCCCC, 0x33333333CCCCCCCC, 0x33333333CCCCCCCC), | | 22| 362| vec256_set4x(0x00FF00FFFF00FF00, 0xFF00FF0000FF00FF, 0x00FF00FFFF00FF00, 0xFF00FF0000FF00FF), | | 23| 362| vec256_set4x(0xF0F0F0F0F0F0F0F0, 0x0F0F0F0F0F0F0F0F, 0xF0F0F0F0F0F0F0F0, 0x0F0F0F0F0F0F0F0F), | | 24| 362| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0x0000000000000000, 0x0000000000000000), | | 25| 362| vec256_set4x(0x0000FFFFFFFF0000, 0x0000FFFFFFFF0000, 0x0000FFFFFFFF0000, 0x0000FFFFFFFF0000), | | 26| 362| vec256_set4x(0xF0F00F0F0F0FF0F0, 0xF0F00F0F0F0FF0F0, 0xF0F00F0F0F0FF0F0, 0xF0F00F0F0F0FF0F0), | | 27| 362|}, { | | 28| 362| vec256_set4x(0xAA55AA5555AA55AA, 0x55AA55AAAA55AA55, 0xAA55AA5555AA55AA, 0x55AA55AAAA55AA55), | | 29| 362| vec256_set4x(0xCC33CC3333CC33CC, 0xCC33CC3333CC33CC, 0x33CC33CCCC33CC33, 0x33CC33CCCC33CC33), | | 30| 362| vec256_set4x(0x33CCCC33CC3333CC, 0xCC3333CC33CCCC33, 0xCC3333CC33CCCC33, 0x33CCCC33CC3333CC), | | 31| 362| vec256_set4x(0x55555555AAAAAAAA, 0x55555555AAAAAAAA, 0x55555555AAAAAAAA, 0x55555555AAAAAAAA), | | 32| 362| vec256_set4x(0xFF0000FF00FFFF00, 0xFF0000FF00FFFF00, 0x00FFFF00FF0000FF, 0x00FFFF00FF0000FF), | | 33| 362| vec256_set4x(0x3CC33CC3C33CC33C, 0xC33CC33C3CC33CC3, 0x3CC33CC3C33CC33C, 0xC33CC33C3CC33CC3), | | 34| 362| vec256_set4x(0x5555AAAA5555AAAA, 0xAAAA5555AAAA5555, 0x5555AAAA5555AAAA, 0xAAAA5555AAAA5555), | | 35| 362| vec256_set4x(0x0FF00FF00FF00FF0, 0xF00FF00FF00FF00F, 0x0FF00FF00FF00FF0, 0xF00FF00FF00FF00F), | | 36| 362| vec256_set4x(0xCCCC33333333CCCC, 0x3333CCCCCCCC3333, 0x3333CCCCCCCC3333, 0xCCCC33333333CCCC), | | 37| 362| vec256_set4x(0xF0F0F0F0F0F0F0F0, 0x0F0F0F0F0F0F0F0F, 0xF0F0F0F0F0F0F0F0, 0x0F0F0F0F0F0F0F0F), | | 38| 362| vec256_set4x(0x00FFFF0000FFFF00, 0xFF0000FFFF0000FF, 0x00FFFF0000FFFF00, 0xFF0000FFFF0000FF), | | 39| 362| vec256_set4x(0xC33CC33CC33CC33C, 0xC33CC33CC33CC33C, 0xC33CC33CC33CC33C, 0xC33CC33CC33CC33C), | | 40| 362|}, { | | 41| 362| vec256_set4x(0x6699669999669966, 0x9966996666996699, 0x6699669999669966, 0x9966996666996699), | | 42| 362| vec256_set4x(0x33CCCC33CC3333CC, 0x33CCCC33CC3333CC, 0x33CCCC33CC3333CC, 0x33CCCC33CC3333CC), | | 43| 362| vec256_set4x(0xA5A5A5A55A5A5A5A, 0xA5A5A5A55A5A5A5A, 0x5A5A5A5AA5A5A5A5, 0x5A5A5A5AA5A5A5A5), | | 44| 362| vec256_set4x(0x3C3CC3C3C3C33C3C, 0x3C3CC3C3C3C33C3C, 0xC3C33C3C3C3CC3C3, 0xC3C33C3C3C3CC3C3), | | 45| 362| vec256_set4x(0xF00FF00F0FF00FF0, 0x0FF00FF0F00FF00F, 0x0FF00FF0F00FF00F, 0xF00FF00F0FF00FF0), | | 46| 362| vec256_set4x(0x55AA55AA55AA55AA, 0xAA55AA55AA55AA55, 0xAA55AA55AA55AA55, 0x55AA55AA55AA55AA), | | 47| 362| vec256_set4x(0x3C3CC3C3C3C33C3C, 0x3C3CC3C3C3C33C3C, 0xC3C33C3C3C3CC3C3, 0xC3C33C3C3C3CC3C3), | | 48| 362| vec256_set4x(0x0F0F0F0FF0F0F0F0, 0xF0F0F0F00F0F0F0F, 0x0F0F0F0FF0F0F0F0, 0xF0F0F0F00F0F0F0F), | | 49| 362| vec256_set4x(0x55AA55AA55AA55AA, 0xAA55AA55AA55AA55, 0xAA55AA55AA55AA55, 0x55AA55AA55AA55AA), | | 50| 362| vec256_set4x(0x33CCCC33CC3333CC, 0xCC3333CC33CCCC33, 0x33CCCC33CC3333CC, 0xCC3333CC33CCCC33), | | 51| 362| vec256_set4x(0xF0F0F0F0F0F0F0F0, 0x0F0F0F0F0F0F0F0F, 0xF0F0F0F0F0F0F0F0, 0x0F0F0F0F0F0F0F0F), | | 52| 362| vec256_set4x(0xA55A5AA55AA5A55A, 0xA55A5AA55AA5A55A, 0xA55A5AA55AA5A55A, 0xA55A5AA55AA5A55A), | | 53| 362|}, { | | 54| 362| vec256_set4x(0x6699669999669966, 0x9966996666996699, 0x6699669999669966, 0x9966996666996699), | | 55| 362| vec256_set4x(0xCC3333CC33CCCC33, 0xCC3333CC33CCCC33, 0xCC3333CC33CCCC33, 0xCC3333CC33CCCC33), | | 56| 362| vec256_set4x(0x5A5A5A5AA5A5A5A5, 0x5A5A5A5AA5A5A5A5, 0xA5A5A5A55A5A5A5A, 0xA5A5A5A55A5A5A5A), | | 57| 362| vec256_set4x(0x3C3CC3C3C3C33C3C, 0x3C3CC3C3C3C33C3C, 0xC3C33C3C3C3CC3C3, 0xC3C33C3C3C3CC3C3), | | 58| 362| vec256_set4x(0x0FF00FF0F00FF00F, 0xF00FF00F0FF00FF0, 0xF00FF00F0FF00FF0, 0x0FF00FF0F00FF00F), | | 59| 362| vec256_set4x(0x55AA55AA55AA55AA, 0xAA55AA55AA55AA55, 0xAA55AA55AA55AA55, 0x55AA55AA55AA55AA), | | 60| 362| vec256_set4x(0x3C3CC3C3C3C33C3C, 0x3C3CC3C3C3C33C3C, 0xC3C33C3C3C3CC3C3, 0xC3C33C3C3C3CC3C3), | | 61| 362| vec256_set4x(0x0F0F0F0FF0F0F0F0, 0xF0F0F0F00F0F0F0F, 0x0F0F0F0FF0F0F0F0, 0xF0F0F0F00F0F0F0F), | | 62| 362| vec256_set4x(0x55AA55AA55AA55AA, 0xAA55AA55AA55AA55, 0xAA55AA55AA55AA55, 0x55AA55AA55AA55AA), | | 63| 362| vec256_set4x(0x33CCCC33CC3333CC, 0xCC3333CC33CCCC33, 0x33CCCC33CC3333CC, 0xCC3333CC33CCCC33), | | 64| 362| vec256_set4x(0xF0F0F0F0F0F0F0F0, 0x0F0F0F0F0F0F0F0F, 0xF0F0F0F0F0F0F0F0, 0x0F0F0F0F0F0F0F0F), | | 65| 362| vec256_set4x(0xA55A5AA55AA5A55A, 0xA55A5AA55AA5A55A, 0xA55A5AA55AA5A55A, 0xA55A5AA55AA5A55A), | | 66| 362|}, { | | 67| 362| vec256_set4x(0x9669699696696996, 0x9669699696696996, 0x9669699696696996, 0x9669699696696996), | | 68| 362| vec256_set4x(0x6996699669966996, 0x6996699669966996, 0x6996699669966996, 0x6996699669966996), | | 69| 362| vec256_set4x(0x6996699669966996, 0x6996699669966996, 0x6996699669966996, 0x6996699669966996), | | 70| 362| vec256_set4x(0x00FFFF0000FFFF00, 0x00FFFF0000FFFF00, 0xFF0000FFFF0000FF, 0xFF0000FFFF0000FF), | | 71| 362| vec256_set4x(0xFF00FF00FF00FF00, 0x00FF00FF00FF00FF, 0x00FF00FF00FF00FF, 0xFF00FF00FF00FF00), | | 72| 362| vec256_set4x(0xF00FF00F0FF00FF0, 0x0FF00FF0F00FF00F, 0x0FF00FF0F00FF00F, 0xF00FF00F0FF00FF0), | | 73| 362| vec256_set4x(0xF0F00F0F0F0FF0F0, 0x0F0FF0F0F0F00F0F, 0x0F0FF0F0F0F00F0F, 0xF0F00F0F0F0FF0F0), | | 74| 362| vec256_set4x(0xC33C3CC33CC3C33C, 0x3CC3C33CC33C3CC3, 0xC33C3CC33CC3C33C, 0x3CC3C33CC33C3CC3), | | 75| 362| vec256_set4x(0xC33C3CC33CC3C33C, 0x3CC3C33CC33C3CC3, 0xC33C3CC33CC3C33C, 0x3CC3C33CC33C3CC3), | | 76| 362| vec256_set4x(0xA55A5AA55AA5A55A, 0xA55A5AA55AA5A55A, 0xA55A5AA55AA5A55A, 0xA55A5AA55AA5A55A), | | 77| 362| vec256_set4x(0xC33C3CC33CC3C33C, 0xC33C3CC33CC3C33C, 0xC33C3CC33CC3C33C, 0xC33C3CC33CC3C33C), | | 78| 362| vec256_set4x(0x3CC3C33C3CC3C33C, 0x3CC3C33C3CC3C33C, 0x3CC3C33C3CC3C33C, 0x3CC3C33C3CC3C33C), | | 79| 362|}, { | | 80| 362| vec256_set4x(0x9669699696696996, 0x9669699696696996, 0x9669699696696996, 0x9669699696696996), | | 81| 362| vec256_set4x(0x6996699669966996, 0x6996699669966996, 0x6996699669966996, 0x6996699669966996), | | 82| 362| vec256_set4x(0x9669966996699669, 0x9669966996699669, 0x9669966996699669, 0x9669966996699669), | | 83| 362| vec256_set4x(0xFF0000FFFF0000FF, 0xFF0000FFFF0000FF, 0x00FFFF0000FFFF00, 0x00FFFF0000FFFF00), | | 84| 362| vec256_set4x(0x00FF00FF00FF00FF, 0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00, 0x00FF00FF00FF00FF), | | 85| 362| vec256_set4x(0xF00FF00F0FF00FF0, 0x0FF00FF0F00FF00F, 0x0FF00FF0F00FF00F, 0xF00FF00F0FF00FF0), | | 86| 362| vec256_set4x(0xF0F00F0F0F0FF0F0, 0x0F0FF0F0F0F00F0F, 0x0F0FF0F0F0F00F0F, 0xF0F00F0F0F0FF0F0), | | 87| 362| vec256_set4x(0xC33C3CC33CC3C33C, 0x3CC3C33CC33C3CC3, 0xC33C3CC33CC3C33C, 0x3CC3C33CC33C3CC3), | | 88| 362| vec256_set4x(0xC33C3CC33CC3C33C, 0x3CC3C33CC33C3CC3, 0xC33C3CC33CC3C33C, 0x3CC3C33CC33C3CC3), | | 89| 362| vec256_set4x(0xA55A5AA55AA5A55A, 0xA55A5AA55AA5A55A, 0xA55A5AA55AA5A55A, 0xA55A5AA55AA5A55A), | | 90| 362| vec256_set4x(0xC33C3CC33CC3C33C, 0xC33C3CC33CC3C33C, 0xC33C3CC33CC3C33C, 0xC33C3CC33CC3C33C), | | 91| 362| vec256_set4x(0x3CC3C33C3CC3C33C, 0x3CC3C33C3CC3C33C, 0x3CC3C33C3CC3C33C, 0x3CC3C33C3CC3C33C), | | 92| 362|}, { | | 93| 362| vec256_set4x(0x9669699696696996, 0x9669699696696996, 0x9669699696696996, 0x9669699696696996), | | 94| 362| vec256_set4x(0x9669966996699669, 0x9669966996699669, 0x9669966996699669, 0x9669966996699669), | | 95| 362| vec256_set4x(0x9669966996699669, 0x9669966996699669, 0x9669966996699669, 0x9669966996699669), | | 96| 362| vec256_set4x(0x00FFFF0000FFFF00, 0x00FFFF0000FFFF00, 0xFF0000FFFF0000FF, 0xFF0000FFFF0000FF), | | 97| 362| vec256_set4x(0xFF00FF00FF00FF00, 0x00FF00FF00FF00FF, 0x00FF00FF00FF00FF, 0xFF00FF00FF00FF00), | | 98| 362| vec256_set4x(0xF00FF00F0FF00FF0, 0x0FF00FF0F00FF00F, 0x0FF00FF0F00FF00F, 0xF00FF00F0FF00FF0), | | 99| 362| vec256_set4x(0xF0F00F0F0F0FF0F0, 0x0F0FF0F0F0F00F0F, 0x0F0FF0F0F0F00F0F, 0xF0F00F0F0F0FF0F0), | | 100| 362| vec256_set4x(0xC33C3CC33CC3C33C, 0x3CC3C33CC33C3CC3, 0xC33C3CC33CC3C33C, 0x3CC3C33CC33C3CC3), | | 101| 362| vec256_set4x(0xC33C3CC33CC3C33C, 0x3CC3C33CC33C3CC3, 0xC33C3CC33CC3C33C, 0x3CC3C33CC33C3CC3), | | 102| 362| vec256_set4x(0xA55A5AA55AA5A55A, 0xA55A5AA55AA5A55A, 0xA55A5AA55AA5A55A, 0xA55A5AA55AA5A55A), | | 103| 362| vec256_set4x(0xC33C3CC33CC3C33C, 0xC33C3CC33CC3C33C, 0xC33C3CC33CC3C33C, 0xC33C3CC33CC3C33C), | | 104| 362| vec256_set4x(0x3CC3C33C3CC3C33C, 0x3CC3C33C3CC3C33C, 0x3CC3C33C3CC3C33C, 0x3CC3C33C3CC3C33C), | | 105| 362|}, { | | 106| 362| vec256_set4x(0x9669699696696996, 0x9669699696696996, 0x9669699696696996, 0x9669699696696996), | | 107| 362| vec256_set4x(0x9669966996699669, 0x9669966996699669, 0x9669966996699669, 0x9669966996699669), | | 108| 362| vec256_set4x(0x6996699669966996, 0x6996699669966996, 0x6996699669966996, 0x6996699669966996), | | 109| 362| vec256_set4x(0xFF0000FFFF0000FF, 0xFF0000FFFF0000FF, 0x00FFFF0000FFFF00, 0x00FFFF0000FFFF00), | | 110| 362| vec256_set4x(0x00FF00FF00FF00FF, 0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00, 0x00FF00FF00FF00FF), | | 111| 362| vec256_set4x(0xF00FF00F0FF00FF0, 0x0FF00FF0F00FF00F, 0x0FF00FF0F00FF00F, 0xF00FF00F0FF00FF0), | | 112| 362| vec256_set4x(0xF0F00F0F0F0FF0F0, 0x0F0FF0F0F0F00F0F, 0x0F0FF0F0F0F00F0F, 0xF0F00F0F0F0FF0F0), | | 113| 362| vec256_set4x(0xC33C3CC33CC3C33C, 0x3CC3C33CC33C3CC3, 0xC33C3CC33CC3C33C, 0x3CC3C33CC33C3CC3), | | 114| 362| vec256_set4x(0xC33C3CC33CC3C33C, 0x3CC3C33CC33C3CC3, 0xC33C3CC33CC3C33C, 0x3CC3C33CC33C3CC3), | | 115| 362| vec256_set4x(0xA55A5AA55AA5A55A, 0xA55A5AA55AA5A55A, 0xA55A5AA55AA5A55A, 0xA55A5AA55AA5A55A), | | 116| 362| vec256_set4x(0xC33C3CC33CC3C33C, 0xC33C3CC33CC3C33C, 0xC33C3CC33CC3C33C, 0xC33C3CC33CC3C33C), | | 117| 362| vec256_set4x(0x3CC3C33C3CC3C33C, 0x3CC3C33C3CC3C33C, 0x3CC3C33C3CC3C33C, 0x3CC3C33C3CC3C33C), | | 118| 362|}, { | | 119| 362| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0x0000000000000000, 0x0000000000000000), | | 120| 362| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0x0000000000000000, 0x0000000000000000), | | 121| 362| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0x0000000000000000, 0x0000000000000000), | | 122| 362| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0x0000000000000000, 0x0000000000000000), | | 123| 362| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF), | | 124| 362| vec256_set4x(0x0000000000000000, 0xFFFFFFFFFFFFFFFF, 0x0000000000000000, 0xFFFFFFFFFFFFFFFF), | | 125| 362| vec256_set4x(0xFFFFFFFF00000000, 0xFFFFFFFF00000000, 0xFFFFFFFF00000000, 0xFFFFFFFF00000000), | | 126| 362| vec256_set4x(0xFFFF0000FFFF0000, 0xFFFF0000FFFF0000, 0xFFFF0000FFFF0000, 0xFFFF0000FFFF0000), | | 127| 362| vec256_set4x(0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00), | | 128| 362| vec256_set4x(0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0), | | 129| 362| vec256_set4x(0xCCCCCCCCCCCCCCCC, 0xCCCCCCCCCCCCCCCC, 0xCCCCCCCCCCCCCCCC, 0xCCCCCCCCCCCCCCCC), | | 130| 362| vec256_set4x(0xAAAAAAAAAAAAAAAA, 0xAAAAAAAAAAAAAAAA, 0xAAAAAAAAAAAAAAAA, 0xAAAAAAAAAAAAAAAA), | | 131| 362|}, { | | 132| 362| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0x0000000000000000, 0x0000000000000000), | | 133| 362| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0x0000000000000000, 0x0000000000000000), | | 134| 362| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0x0000000000000000, 0x0000000000000000), | | 135| 362| vec256_set4x(0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF), | | 136| 362| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF), | | 137| 362| vec256_set4x(0x0000000000000000, 0xFFFFFFFFFFFFFFFF, 0x0000000000000000, 0xFFFFFFFFFFFFFFFF), | | 138| 362| vec256_set4x(0xFFFFFFFF00000000, 0xFFFFFFFF00000000, 0xFFFFFFFF00000000, 0xFFFFFFFF00000000), | | 139| 362| vec256_set4x(0xFFFF0000FFFF0000, 0xFFFF0000FFFF0000, 0xFFFF0000FFFF0000, 0xFFFF0000FFFF0000), | | 140| 362| vec256_set4x(0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00), | | 141| 362| vec256_set4x(0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0), | | 142| 362| vec256_set4x(0xCCCCCCCCCCCCCCCC, 0xCCCCCCCCCCCCCCCC, 0xCCCCCCCCCCCCCCCC, 0xCCCCCCCCCCCCCCCC), | | 143| 362| vec256_set4x(0xAAAAAAAAAAAAAAAA, 0xAAAAAAAAAAAAAAAA, 0xAAAAAAAAAAAAAAAA, 0xAAAAAAAAAAAAAAAA), | | 144| 362|}, { | | 145| 362| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0x0000000000000000, 0x0000000000000000), | | 146| 362| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0x0000000000000000, 0x0000000000000000), | | 147| 362| vec256_set4x(0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF), | | 148| 362| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0x0000000000000000, 0x0000000000000000), | | 149| 362| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF), | | 150| 362| vec256_set4x(0x0000000000000000, 0xFFFFFFFFFFFFFFFF, 0x0000000000000000, 0xFFFFFFFFFFFFFFFF), | | 151| 362| vec256_set4x(0xFFFFFFFF00000000, 0xFFFFFFFF00000000, 0xFFFFFFFF00000000, 0xFFFFFFFF00000000), | | 152| 362| vec256_set4x(0xFFFF0000FFFF0000, 0xFFFF0000FFFF0000, 0xFFFF0000FFFF0000, 0xFFFF0000FFFF0000), | | 153| 362| vec256_set4x(0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00), | | 154| 362| vec256_set4x(0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0), | | 155| 362| vec256_set4x(0xCCCCCCCCCCCCCCCC, 0xCCCCCCCCCCCCCCCC, 0xCCCCCCCCCCCCCCCC, 0xCCCCCCCCCCCCCCCC), | | 156| 362| vec256_set4x(0xAAAAAAAAAAAAAAAA, 0xAAAAAAAAAAAAAAAA, 0xAAAAAAAAAAAAAAAA, 0xAAAAAAAAAAAAAAAA), | | 157| 362|}, { | | 158| 362| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0x0000000000000000, 0x0000000000000000), | | 159| 362| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0x0000000000000000, 0x0000000000000000), | | 160| 362| vec256_set4x(0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF), | | 161| 362| vec256_set4x(0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF), | | 162| 362| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF), | | 163| 362| vec256_set4x(0x0000000000000000, 0xFFFFFFFFFFFFFFFF, 0x0000000000000000, 0xFFFFFFFFFFFFFFFF), | | 164| 362| vec256_set4x(0xFFFFFFFF00000000, 0xFFFFFFFF00000000, 0xFFFFFFFF00000000, 0xFFFFFFFF00000000), | | 165| 362| vec256_set4x(0xFFFF0000FFFF0000, 0xFFFF0000FFFF0000, 0xFFFF0000FFFF0000, 0xFFFF0000FFFF0000), | | 166| 362| vec256_set4x(0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00), | | 167| 362| vec256_set4x(0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0), | | 168| 362| vec256_set4x(0xCCCCCCCCCCCCCCCC, 0xCCCCCCCCCCCCCCCC, 0xCCCCCCCCCCCCCCCC, 0xCCCCCCCCCCCCCCCC), | | 169| 362| vec256_set4x(0xAAAAAAAAAAAAAAAA, 0xAAAAAAAAAAAAAAAA, 0xAAAAAAAAAAAAAAAA, 0xAAAAAAAAAAAAAAAA), | | 170| 362|}, { | | 171| 362| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0x0000000000000000, 0x0000000000000000), | | 172| 362| vec256_set4x(0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF), | | 173| 362| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0x0000000000000000, 0x0000000000000000), | | 174| 362| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0x0000000000000000, 0x0000000000000000), | | 175| 362| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF), | | 176| 362| vec256_set4x(0x0000000000000000, 0xFFFFFFFFFFFFFFFF, 0x0000000000000000, 0xFFFFFFFFFFFFFFFF), | | 177| 362| vec256_set4x(0xFFFFFFFF00000000, 0xFFFFFFFF00000000, 0xFFFFFFFF00000000, 0xFFFFFFFF00000000), | | 178| 362| vec256_set4x(0xFFFF0000FFFF0000, 0xFFFF0000FFFF0000, 0xFFFF0000FFFF0000, 0xFFFF0000FFFF0000), | | 179| 362| vec256_set4x(0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00), | | 180| 362| vec256_set4x(0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0), | | 181| 362| vec256_set4x(0xCCCCCCCCCCCCCCCC, 0xCCCCCCCCCCCCCCCC, 0xCCCCCCCCCCCCCCCC, 0xCCCCCCCCCCCCCCCC), | | 182| 362| vec256_set4x(0xAAAAAAAAAAAAAAAA, 0xAAAAAAAAAAAAAAAA, 0xAAAAAAAAAAAAAAAA, 0xAAAAAAAAAAAAAAAA), | | 183| 362|}, { | | 184| 362| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0x0000000000000000, 0x0000000000000000), | | 185| 362| vec256_set4x(0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF), | | 186| 362| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0x0000000000000000, 0x0000000000000000), | | 187| 362| vec256_set4x(0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF), | | 188| 362| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF), | | 189| 362| vec256_set4x(0x0000000000000000, 0xFFFFFFFFFFFFFFFF, 0x0000000000000000, 0xFFFFFFFFFFFFFFFF), | | 190| 362| vec256_set4x(0xFFFFFFFF00000000, 0xFFFFFFFF00000000, 0xFFFFFFFF00000000, 0xFFFFFFFF00000000), | | 191| 362| vec256_set4x(0xFFFF0000FFFF0000, 0xFFFF0000FFFF0000, 0xFFFF0000FFFF0000, 0xFFFF0000FFFF0000), | | 192| 362| vec256_set4x(0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00), | | 193| 362| vec256_set4x(0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0), | | 194| 362| vec256_set4x(0xCCCCCCCCCCCCCCCC, 0xCCCCCCCCCCCCCCCC, 0xCCCCCCCCCCCCCCCC, 0xCCCCCCCCCCCCCCCC), | | 195| 362| vec256_set4x(0xAAAAAAAAAAAAAAAA, 0xAAAAAAAAAAAAAAAA, 0xAAAAAAAAAAAAAAAA, 0xAAAAAAAAAAAAAAAA), | | 196| 362|}, { | | 197| 362| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0x0000000000000000, 0x0000000000000000), | | 198| 362| vec256_set4x(0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF), | | 199| 362| vec256_set4x(0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF), | | 200| 362| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0x0000000000000000, 0x0000000000000000), | | 201| 362| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF), | | 202| 362| vec256_set4x(0x0000000000000000, 0xFFFFFFFFFFFFFFFF, 0x0000000000000000, 0xFFFFFFFFFFFFFFFF), | | 203| 362| vec256_set4x(0xFFFFFFFF00000000, 0xFFFFFFFF00000000, 0xFFFFFFFF00000000, 0xFFFFFFFF00000000), | | 204| 362| vec256_set4x(0xFFFF0000FFFF0000, 0xFFFF0000FFFF0000, 0xFFFF0000FFFF0000, 0xFFFF0000FFFF0000), | | 205| 362| vec256_set4x(0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00), | | 206| 362| vec256_set4x(0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0), | | 207| 362| vec256_set4x(0xCCCCCCCCCCCCCCCC, 0xCCCCCCCCCCCCCCCC, 0xCCCCCCCCCCCCCCCC, 0xCCCCCCCCCCCCCCCC), | | 208| 362| vec256_set4x(0xAAAAAAAAAAAAAAAA, 0xAAAAAAAAAAAAAAAA, 0xAAAAAAAAAAAAAAAA, 0xAAAAAAAAAAAAAAAA), | | 209| 362|}, { | | 210| 362| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0x0000000000000000, 0x0000000000000000), | | 211| 362| vec256_set4x(0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF), | | 212| 362| vec256_set4x(0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF), | | 213| 362| vec256_set4x(0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF), | | 214| 362| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF), | | 215| 362| vec256_set4x(0x0000000000000000, 0xFFFFFFFFFFFFFFFF, 0x0000000000000000, 0xFFFFFFFFFFFFFFFF), | | 216| 362| vec256_set4x(0xFFFFFFFF00000000, 0xFFFFFFFF00000000, 0xFFFFFFFF00000000, 0xFFFFFFFF00000000), | | 217| 362| vec256_set4x(0xFFFF0000FFFF0000, 0xFFFF0000FFFF0000, 0xFFFF0000FFFF0000, 0xFFFF0000FFFF0000), | | 218| 362| vec256_set4x(0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00), | | 219| 362| vec256_set4x(0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0), | | 220| 362| vec256_set4x(0xCCCCCCCCCCCCCCCC, 0xCCCCCCCCCCCCCCCC, 0xCCCCCCCCCCCCCCCC, 0xCCCCCCCCCCCCCCCC), | | 221| 362| vec256_set4x(0xAAAAAAAAAAAAAAAA, 0xAAAAAAAAAAAAAAAA, 0xAAAAAAAAAAAAAAAA, 0xAAAAAAAAAAAAAAAA), | | 222| 362|}, ------------------ 79| 362| }; 80| | 81| 362| uint64_t consts_ptr = 17; 82| | 83| 362| const unsigned char reversal[64] = { 84| 362| 0, 32, 16, 48, 8, 40, 24, 56, 85| 362| 4, 36, 20, 52, 12, 44, 28, 60, 86| 362| 2, 34, 18, 50, 10, 42, 26, 58, 87| 362| 6, 38, 22, 54, 14, 46, 30, 62, 88| 362| 1, 33, 17, 49, 9, 41, 25, 57, 89| 362| 5, 37, 21, 53, 13, 45, 29, 61, 90| 362| 3, 35, 19, 51, 11, 43, 27, 59, 91| 362| 7, 39, 23, 55, 15, 47, 31, 63 92| 362| }; 93| | 94| 362| const uint16_t beta[6] = {8, 1300, 3408, 1354, 2341, 1154}; 95| | 96| | // butterflies 97| | 98| 1.81k| for (i = 3; i >= 0; i--) { ------------------ | Branch (98:17): [True: 1.44k, False: 362] ------------------ 99| 1.44k| s = 1 << i; 100| 1.44k| consts_ptr -= s; 101| | 102| 6.87k| for (j = 0; j < 16; j += 2 * s) { ------------------ | Branch (102:21): [True: 5.43k, False: 1.44k] ------------------ 103| 17.0k| for (k = j; k < j + s; k++) { ------------------ | Branch (103:25): [True: 11.5k, False: 5.43k] ------------------ 104| 150k| for (b = 0; b < GFBITS; b++) { ------------------ | | 6| 150k|#define GFBITS 12 ------------------ | Branch (104:29): [True: 139k, False: 11.5k] ------------------ 105| 139k| in[k][b] ^= in[k + s][b]; 106| 139k| } 107| 11.5k| vec256_mul(tmp256, in[k], consts[ consts_ptr + (k - j) ]); 108| 150k| for (b = 0; b < GFBITS; b++) { ------------------ | | 6| 150k|#define GFBITS 12 ------------------ | Branch (108:29): [True: 139k, False: 11.5k] ------------------ 109| 139k| in[k + s][b] ^= tmp256[b]; 110| 139k| } 111| 11.5k| } 112| 5.43k| } 113| 1.44k| } 114| | 115| 3.25k| for (i = 0; i < 16; i += 2) { ------------------ | Branch (115:17): [True: 2.89k, False: 362] ------------------ 116| 37.6k| for (b = 0; b < GFBITS; b++) { ------------------ | | 6| 37.6k|#define GFBITS 12 ------------------ | Branch (116:21): [True: 34.7k, False: 2.89k] ------------------ 117| 34.7k| x[b] = vec256_unpack_low(in[i + 0][b], in[i + 1][b]); 118| 34.7k| } 119| 37.6k| for (b = 0; b < GFBITS; b++) { ------------------ | | 6| 37.6k|#define GFBITS 12 ------------------ | Branch (119:21): [True: 34.7k, False: 2.89k] ------------------ 120| 34.7k| y[b] = vec256_unpack_high(in[i + 0][b], in[i + 1][b]); 121| 34.7k| } 122| | 123| 37.6k| for (b = 0; b < GFBITS; b++) { ------------------ | | 6| 37.6k|#define GFBITS 12 ------------------ | Branch (123:21): [True: 34.7k, False: 2.89k] ------------------ 124| 34.7k| x[b] ^= y[b]; 125| 34.7k| } 126| 2.89k| vec256_mul(tmp256, x, consts[ 1 ]); 127| 37.6k| for (b = 0; b < GFBITS; b++) { ------------------ | | 6| 37.6k|#define GFBITS 12 ------------------ | Branch (127:21): [True: 34.7k, False: 2.89k] ------------------ 128| 34.7k| y[b] ^= tmp256[b]; 129| 34.7k| } 130| | 131| 37.6k| for (b = 0; b < GFBITS; b++) { ------------------ | | 6| 37.6k|#define GFBITS 12 ------------------ | Branch (131:21): [True: 34.7k, False: 2.89k] ------------------ 132| 34.7k| in[i + 0][b] = vec256_unpack_low_2x(x[b], y[b]); 133| 34.7k| } 134| 37.6k| for (b = 0; b < GFBITS; b++) { ------------------ | | 6| 37.6k|#define GFBITS 12 ------------------ | Branch (134:21): [True: 34.7k, False: 2.89k] ------------------ 135| 34.7k| in[i + 1][b] = vec256_unpack_high_2x(x[b], y[b]); 136| 34.7k| } 137| 2.89k| } 138| | 139| 3.25k| for (i = 0; i < 16; i += 2) { ------------------ | Branch (139:17): [True: 2.89k, False: 362] ------------------ 140| 37.6k| for (b = 0; b < GFBITS; b++) { ------------------ | | 6| 37.6k|#define GFBITS 12 ------------------ | Branch (140:21): [True: 34.7k, False: 2.89k] ------------------ 141| 34.7k| in[i + 0][b] ^= in[i + 1][b]; 142| 34.7k| } 143| 2.89k| vec256_mul(tmp256, in[i + 0], consts[ 0 ]); 144| 37.6k| for (b = 0; b < GFBITS; b++) { ------------------ | | 6| 37.6k|#define GFBITS 12 ------------------ | Branch (144:21): [True: 34.7k, False: 2.89k] ------------------ 145| 34.7k| in[i + 1][b] ^= tmp256[b]; 146| 34.7k| } 147| 2.89k| } 148| | 149| | // transpose 150| | 151| 1.44k| for (i = 0; i < GFBITS; i += 4) { ------------------ | | 6| 1.44k|#define GFBITS 12 ------------------ | Branch (151:17): [True: 1.08k, False: 362] ------------------ 152| 9.77k| for (j = 0; j < 64; j += 8) { ------------------ | Branch (152:21): [True: 8.68k, False: 1.08k] ------------------ 153| 8.68k| buf[ reversal[j + 0] ] = vec256_set4x(vec256_extract(in[j / 4 + 0][i + 0], 0), ------------------ | | 39| 8.68k|#define vec256_extract(a,i) ((uint64_t) _mm256_extract_epi64((vec256) (a),(i))) ------------------ 154| 8.68k| vec256_extract(in[j / 4 + 0][i + 1], 0), ------------------ | | 39| 8.68k|#define vec256_extract(a,i) ((uint64_t) _mm256_extract_epi64((vec256) (a),(i))) ------------------ 155| 8.68k| vec256_extract(in[j / 4 + 0][i + 2], 0), ------------------ | | 39| 8.68k|#define vec256_extract(a,i) ((uint64_t) _mm256_extract_epi64((vec256) (a),(i))) ------------------ 156| 8.68k| vec256_extract(in[j / 4 + 0][i + 3], 0)); ------------------ | | 39| 8.68k|#define vec256_extract(a,i) ((uint64_t) _mm256_extract_epi64((vec256) (a),(i))) ------------------ 157| 8.68k| buf[ reversal[j + 1] ] = vec256_set4x(vec256_extract(in[j / 4 + 1][i + 0], 0), ------------------ | | 39| 8.68k|#define vec256_extract(a,i) ((uint64_t) _mm256_extract_epi64((vec256) (a),(i))) ------------------ 158| 8.68k| vec256_extract(in[j / 4 + 1][i + 1], 0), ------------------ | | 39| 8.68k|#define vec256_extract(a,i) ((uint64_t) _mm256_extract_epi64((vec256) (a),(i))) ------------------ 159| 8.68k| vec256_extract(in[j / 4 + 1][i + 2], 0), ------------------ | | 39| 8.68k|#define vec256_extract(a,i) ((uint64_t) _mm256_extract_epi64((vec256) (a),(i))) ------------------ 160| 8.68k| vec256_extract(in[j / 4 + 1][i + 3], 0)); ------------------ | | 39| 8.68k|#define vec256_extract(a,i) ((uint64_t) _mm256_extract_epi64((vec256) (a),(i))) ------------------ 161| 8.68k| buf[ reversal[j + 2] ] = vec256_set4x(vec256_extract(in[j / 4 + 0][i + 0], 1), ------------------ | | 39| 8.68k|#define vec256_extract(a,i) ((uint64_t) _mm256_extract_epi64((vec256) (a),(i))) ------------------ 162| 8.68k| vec256_extract(in[j / 4 + 0][i + 1], 1), ------------------ | | 39| 8.68k|#define vec256_extract(a,i) ((uint64_t) _mm256_extract_epi64((vec256) (a),(i))) ------------------ 163| 8.68k| vec256_extract(in[j / 4 + 0][i + 2], 1), ------------------ | | 39| 8.68k|#define vec256_extract(a,i) ((uint64_t) _mm256_extract_epi64((vec256) (a),(i))) ------------------ 164| 8.68k| vec256_extract(in[j / 4 + 0][i + 3], 1)); ------------------ | | 39| 8.68k|#define vec256_extract(a,i) ((uint64_t) _mm256_extract_epi64((vec256) (a),(i))) ------------------ 165| 8.68k| buf[ reversal[j + 3] ] = vec256_set4x(vec256_extract(in[j / 4 + 1][i + 0], 1), ------------------ | | 39| 8.68k|#define vec256_extract(a,i) ((uint64_t) _mm256_extract_epi64((vec256) (a),(i))) ------------------ 166| 8.68k| vec256_extract(in[j / 4 + 1][i + 1], 1), ------------------ | | 39| 8.68k|#define vec256_extract(a,i) ((uint64_t) _mm256_extract_epi64((vec256) (a),(i))) ------------------ 167| 8.68k| vec256_extract(in[j / 4 + 1][i + 2], 1), ------------------ | | 39| 8.68k|#define vec256_extract(a,i) ((uint64_t) _mm256_extract_epi64((vec256) (a),(i))) ------------------ 168| 8.68k| vec256_extract(in[j / 4 + 1][i + 3], 1)); ------------------ | | 39| 8.68k|#define vec256_extract(a,i) ((uint64_t) _mm256_extract_epi64((vec256) (a),(i))) ------------------ 169| 8.68k| buf[ reversal[j + 4] ] = vec256_set4x(vec256_extract(in[j / 4 + 0][i + 0], 2), ------------------ | | 39| 8.68k|#define vec256_extract(a,i) ((uint64_t) _mm256_extract_epi64((vec256) (a),(i))) ------------------ 170| 8.68k| vec256_extract(in[j / 4 + 0][i + 1], 2), ------------------ | | 39| 8.68k|#define vec256_extract(a,i) ((uint64_t) _mm256_extract_epi64((vec256) (a),(i))) ------------------ 171| 8.68k| vec256_extract(in[j / 4 + 0][i + 2], 2), ------------------ | | 39| 8.68k|#define vec256_extract(a,i) ((uint64_t) _mm256_extract_epi64((vec256) (a),(i))) ------------------ 172| 8.68k| vec256_extract(in[j / 4 + 0][i + 3], 2)); ------------------ | | 39| 8.68k|#define vec256_extract(a,i) ((uint64_t) _mm256_extract_epi64((vec256) (a),(i))) ------------------ 173| 8.68k| buf[ reversal[j + 5] ] = vec256_set4x(vec256_extract(in[j / 4 + 1][i + 0], 2), ------------------ | | 39| 8.68k|#define vec256_extract(a,i) ((uint64_t) _mm256_extract_epi64((vec256) (a),(i))) ------------------ 174| 8.68k| vec256_extract(in[j / 4 + 1][i + 1], 2), ------------------ | | 39| 8.68k|#define vec256_extract(a,i) ((uint64_t) _mm256_extract_epi64((vec256) (a),(i))) ------------------ 175| 8.68k| vec256_extract(in[j / 4 + 1][i + 2], 2), ------------------ | | 39| 8.68k|#define vec256_extract(a,i) ((uint64_t) _mm256_extract_epi64((vec256) (a),(i))) ------------------ 176| 8.68k| vec256_extract(in[j / 4 + 1][i + 3], 2)); ------------------ | | 39| 8.68k|#define vec256_extract(a,i) ((uint64_t) _mm256_extract_epi64((vec256) (a),(i))) ------------------ 177| 8.68k| buf[ reversal[j + 6] ] = vec256_set4x(vec256_extract(in[j / 4 + 0][i + 0], 3), ------------------ | | 39| 8.68k|#define vec256_extract(a,i) ((uint64_t) _mm256_extract_epi64((vec256) (a),(i))) ------------------ 178| 8.68k| vec256_extract(in[j / 4 + 0][i + 1], 3), ------------------ | | 39| 8.68k|#define vec256_extract(a,i) ((uint64_t) _mm256_extract_epi64((vec256) (a),(i))) ------------------ 179| 8.68k| vec256_extract(in[j / 4 + 0][i + 2], 3), ------------------ | | 39| 8.68k|#define vec256_extract(a,i) ((uint64_t) _mm256_extract_epi64((vec256) (a),(i))) ------------------ 180| 8.68k| vec256_extract(in[j / 4 + 0][i + 3], 3)); ------------------ | | 39| 8.68k|#define vec256_extract(a,i) ((uint64_t) _mm256_extract_epi64((vec256) (a),(i))) ------------------ 181| 8.68k| buf[ reversal[j + 7] ] = vec256_set4x(vec256_extract(in[j / 4 + 1][i + 0], 3), ------------------ | | 39| 8.68k|#define vec256_extract(a,i) ((uint64_t) _mm256_extract_epi64((vec256) (a),(i))) ------------------ 182| 8.68k| vec256_extract(in[j / 4 + 1][i + 1], 3), ------------------ | | 39| 8.68k|#define vec256_extract(a,i) ((uint64_t) _mm256_extract_epi64((vec256) (a),(i))) ------------------ 183| 8.68k| vec256_extract(in[j / 4 + 1][i + 2], 3), ------------------ | | 39| 8.68k|#define vec256_extract(a,i) ((uint64_t) _mm256_extract_epi64((vec256) (a),(i))) ------------------ 184| 8.68k| vec256_extract(in[j / 4 + 1][i + 3], 3)); ------------------ | | 39| 8.68k|#define vec256_extract(a,i) ((uint64_t) _mm256_extract_epi64((vec256) (a),(i))) ------------------ 185| 8.68k| } 186| | 187| 1.08k| transpose_64x256_sp(buf); 188| | 189| 1.08k| p2[0] = buf[32]; 190| 1.08k| buf[33] = vec256_xor(buf[33], buf[32]); 191| 1.08k| p2[1] = buf[33]; 192| 1.08k| buf[35] = vec256_xor(buf[35], buf[33]); 193| 1.08k| p2[0] = vec256_xor(p2[0], buf[35]); 194| 1.08k| buf[34] = vec256_xor(buf[34], buf[35]); 195| 1.08k| p2[2] = buf[34]; 196| 1.08k| buf[38] = vec256_xor(buf[38], buf[34]); 197| 1.08k| p2[0] = vec256_xor(p2[0], buf[38]); 198| 1.08k| buf[39] = vec256_xor(buf[39], buf[38]); 199| 1.08k| p2[1] = vec256_xor(p2[1], buf[39]); 200| 1.08k| buf[37] = vec256_xor(buf[37], buf[39]); 201| 1.08k| p2[0] = vec256_xor(p2[0], buf[37]); 202| 1.08k| buf[36] = vec256_xor(buf[36], buf[37]); 203| 1.08k| p2[3] = buf[36]; 204| 1.08k| buf[44] = vec256_xor(buf[44], buf[36]); 205| 1.08k| p2[0] = vec256_xor(p2[0], buf[44]); 206| 1.08k| buf[45] = vec256_xor(buf[45], buf[44]); 207| 1.08k| p2[1] = vec256_xor(p2[1], buf[45]); 208| 1.08k| buf[47] = vec256_xor(buf[47], buf[45]); 209| 1.08k| p2[0] = vec256_xor(p2[0], buf[47]); 210| 1.08k| buf[46] = vec256_xor(buf[46], buf[47]); 211| 1.08k| p2[2] = vec256_xor(p2[2], buf[46]); 212| 1.08k| buf[42] = vec256_xor(buf[42], buf[46]); 213| 1.08k| p2[0] = vec256_xor(p2[0], buf[42]); 214| 1.08k| buf[43] = vec256_xor(buf[43], buf[42]); 215| 1.08k| p2[1] = vec256_xor(p2[1], buf[43]); 216| 1.08k| buf[41] = vec256_xor(buf[41], buf[43]); 217| 1.08k| p2[0] = vec256_xor(p2[0], buf[41]); 218| 1.08k| buf[40] = vec256_xor(buf[40], buf[41]); 219| 1.08k| p2[4] = buf[40]; 220| 1.08k| buf[56] = vec256_xor(buf[56], buf[40]); 221| 1.08k| p2[0] = vec256_xor(p2[0], buf[56]); 222| 1.08k| buf[57] = vec256_xor(buf[57], buf[56]); 223| 1.08k| p2[1] = vec256_xor(p2[1], buf[57]); 224| 1.08k| buf[59] = vec256_xor(buf[59], buf[57]); 225| 1.08k| p2[0] = vec256_xor(p2[0], buf[59]); 226| 1.08k| buf[58] = vec256_xor(buf[58], buf[59]); 227| 1.08k| p2[2] = vec256_xor(p2[2], buf[58]); 228| 1.08k| buf[62] = vec256_xor(buf[62], buf[58]); 229| 1.08k| p2[0] = vec256_xor(p2[0], buf[62]); 230| 1.08k| buf[63] = vec256_xor(buf[63], buf[62]); 231| 1.08k| p2[1] = vec256_xor(p2[1], buf[63]); 232| 1.08k| buf[61] = vec256_xor(buf[61], buf[63]); 233| 1.08k| p2[0] = vec256_xor(p2[0], buf[61]); 234| 1.08k| buf[60] = vec256_xor(buf[60], buf[61]); 235| 1.08k| p2[3] = vec256_xor(p2[3], buf[60]); 236| 1.08k| buf[52] = vec256_xor(buf[52], buf[60]); 237| 1.08k| p2[0] = vec256_xor(p2[0], buf[52]); 238| 1.08k| buf[53] = vec256_xor(buf[53], buf[52]); 239| 1.08k| p2[1] = vec256_xor(p2[1], buf[53]); 240| 1.08k| buf[55] = vec256_xor(buf[55], buf[53]); 241| 1.08k| p2[0] = vec256_xor(p2[0], buf[55]); 242| 1.08k| buf[54] = vec256_xor(buf[54], buf[55]); 243| 1.08k| p2[2] = vec256_xor(p2[2], buf[54]); 244| 1.08k| buf[50] = vec256_xor(buf[50], buf[54]); 245| 1.08k| p2[0] = vec256_xor(p2[0], buf[50]); 246| 1.08k| buf[51] = vec256_xor(buf[51], buf[50]); 247| 1.08k| p2[1] = vec256_xor(p2[1], buf[51]); 248| 1.08k| buf[49] = vec256_xor(buf[49], buf[51]); 249| 1.08k| p2[0] = vec256_xor(p2[0], buf[49]); 250| 1.08k| buf[48] = vec256_xor(buf[48], buf[49]); 251| 1.08k| p2[5] = buf[48]; 252| 1.08k| buf[16] = vec256_xor(buf[16], buf[48]); 253| 1.08k| p2[0] = vec256_xor(p2[0], buf[16]); 254| 1.08k| buf[17] = vec256_xor(buf[17], buf[16]); 255| 1.08k| p2[1] = vec256_xor(p2[1], buf[17]); 256| 1.08k| buf[19] = vec256_xor(buf[19], buf[17]); 257| 1.08k| p2[0] = vec256_xor(p2[0], buf[19]); 258| 1.08k| buf[18] = vec256_xor(buf[18], buf[19]); 259| 1.08k| p2[2] = vec256_xor(p2[2], buf[18]); 260| 1.08k| buf[22] = vec256_xor(buf[22], buf[18]); 261| 1.08k| p2[0] = vec256_xor(p2[0], buf[22]); 262| 1.08k| buf[23] = vec256_xor(buf[23], buf[22]); 263| 1.08k| p2[1] = vec256_xor(p2[1], buf[23]); 264| 1.08k| buf[21] = vec256_xor(buf[21], buf[23]); 265| 1.08k| p2[0] = vec256_xor(p2[0], buf[21]); 266| 1.08k| buf[20] = vec256_xor(buf[20], buf[21]); 267| 1.08k| p2[3] = vec256_xor(p2[3], buf[20]); 268| 1.08k| buf[28] = vec256_xor(buf[28], buf[20]); 269| 1.08k| p2[0] = vec256_xor(p2[0], buf[28]); 270| 1.08k| buf[29] = vec256_xor(buf[29], buf[28]); 271| 1.08k| p2[1] = vec256_xor(p2[1], buf[29]); 272| 1.08k| buf[31] = vec256_xor(buf[31], buf[29]); 273| 1.08k| p2[0] = vec256_xor(p2[0], buf[31]); 274| 1.08k| buf[30] = vec256_xor(buf[30], buf[31]); 275| 1.08k| p2[2] = vec256_xor(p2[2], buf[30]); 276| 1.08k| buf[26] = vec256_xor(buf[26], buf[30]); 277| 1.08k| p2[0] = vec256_xor(p2[0], buf[26]); 278| 1.08k| buf[27] = vec256_xor(buf[27], buf[26]); 279| 1.08k| p2[1] = vec256_xor(p2[1], buf[27]); 280| 1.08k| buf[25] = vec256_xor(buf[25], buf[27]); 281| 1.08k| p2[0] = vec256_xor(p2[0], buf[25]); 282| 1.08k| buf[24] = vec256_xor(buf[24], buf[25]); 283| 1.08k| p2[4] = vec256_xor(p2[4], buf[24]); 284| 1.08k| buf[8] = vec256_xor(buf[8], buf[24]); 285| 1.08k| p2[0] = vec256_xor(p2[0], buf[8]); 286| 1.08k| buf[9] = vec256_xor(buf[9], buf[8]); 287| 1.08k| p2[1] = vec256_xor(p2[1], buf[9]); 288| 1.08k| buf[11] = vec256_xor(buf[11], buf[9]); 289| 1.08k| p2[0] = vec256_xor(p2[0], buf[11]); 290| 1.08k| buf[10] = vec256_xor(buf[10], buf[11]); 291| 1.08k| p2[2] = vec256_xor(p2[2], buf[10]); 292| 1.08k| buf[14] = vec256_xor(buf[14], buf[10]); 293| 1.08k| p2[0] = vec256_xor(p2[0], buf[14]); 294| 1.08k| buf[15] = vec256_xor(buf[15], buf[14]); 295| 1.08k| p2[1] = vec256_xor(p2[1], buf[15]); 296| 1.08k| buf[13] = vec256_xor(buf[13], buf[15]); 297| 1.08k| p2[0] = vec256_xor(p2[0], buf[13]); 298| 1.08k| buf[12] = vec256_xor(buf[12], buf[13]); 299| 1.08k| p2[3] = vec256_xor(p2[3], buf[12]); 300| 1.08k| buf[4] = vec256_xor(buf[4], buf[12]); 301| 1.08k| p2[0] = vec256_xor(p2[0], buf[4]); 302| 1.08k| buf[5] = vec256_xor(buf[5], buf[4]); 303| 1.08k| p2[1] = vec256_xor(p2[1], buf[5]); 304| 1.08k| buf[7] = vec256_xor(buf[7], buf[5]); 305| 1.08k| p2[0] = vec256_xor(p2[0], buf[7]); 306| 1.08k| buf[6] = vec256_xor(buf[6], buf[7]); 307| 1.08k| p2[2] = vec256_xor(p2[2], buf[6]); 308| 1.08k| buf[2] = vec256_xor(buf[2], buf[6]); 309| 1.08k| p2[0] = vec256_xor(p2[0], buf[2]); 310| 1.08k| buf[3] = vec256_xor(buf[3], buf[2]); 311| 1.08k| p2[1] = vec256_xor(p2[1], buf[3]); 312| 1.08k| buf[1] = vec256_xor(buf[1], buf[3]); 313| | 314| 1.08k| p2[0] = vec256_xor(p2[0], buf[1]); 315| 1.08k| buf[0] = vec256_xor(buf[0], buf[1]); 316| | 317| 7.60k| for (j = 0; j < 6; j++) { ------------------ | Branch (317:21): [True: 6.51k, False: 1.08k] ------------------ 318| 6.51k| pre[j][i + 0] = vec256_extract(p2[j], 0); ------------------ | | 39| 6.51k|#define vec256_extract(a,i) ((uint64_t) _mm256_extract_epi64((vec256) (a),(i))) ------------------ 319| 6.51k| pre[j][i + 1] = vec256_extract(p2[j], 1); ------------------ | | 39| 6.51k|#define vec256_extract(a,i) ((uint64_t) _mm256_extract_epi64((vec256) (a),(i))) ------------------ 320| 6.51k| pre[j][i + 2] = vec256_extract(p2[j], 2); ------------------ | | 39| 6.51k|#define vec256_extract(a,i) ((uint64_t) _mm256_extract_epi64((vec256) (a),(i))) ------------------ 321| 6.51k| pre[j][i + 3] = vec256_extract(p2[j], 3); ------------------ | | 39| 6.51k|#define vec256_extract(a,i) ((uint64_t) _mm256_extract_epi64((vec256) (a),(i))) ------------------ 322| 6.51k| } 323| | 324| 1.08k| out64[0][i + 0] = vec256_extract(buf[0], 0); ------------------ | | 39| 1.08k|#define vec256_extract(a,i) ((uint64_t) _mm256_extract_epi64((vec256) (a),(i))) ------------------ 325| 1.08k| out64[0][i + 1] = vec256_extract(buf[0], 1); ------------------ | | 39| 1.08k|#define vec256_extract(a,i) ((uint64_t) _mm256_extract_epi64((vec256) (a),(i))) ------------------ 326| 1.08k| out64[0][i + 2] = vec256_extract(buf[0], 2); ------------------ | | 39| 1.08k|#define vec256_extract(a,i) ((uint64_t) _mm256_extract_epi64((vec256) (a),(i))) ------------------ 327| 1.08k| out64[0][i + 3] = vec256_extract(buf[0], 3); ------------------ | | 39| 1.08k|#define vec256_extract(a,i) ((uint64_t) _mm256_extract_epi64((vec256) (a),(i))) ------------------ 328| 1.08k| } 329| | 330| | // 331| | 332| 4.70k| for (j = 0; j < GFBITS; j++) { ------------------ | | 6| 4.70k|#define GFBITS 12 ------------------ | Branch (332:17): [True: 4.34k, False: 362] ------------------ 333| 4.34k| tmp[j] = (beta[0] >> j) & 1; 334| 4.34k| tmp[j] = -tmp[j]; 335| 4.34k| } 336| | 337| 362| vec_mul(out64[1], pre[0], tmp); 338| | 339| 2.17k| for (i = 1; i < 6; i++) { ------------------ | Branch (339:17): [True: 1.81k, False: 362] ------------------ 340| 23.5k| for (j = 0; j < GFBITS; j++) { ------------------ | | 6| 23.5k|#define GFBITS 12 ------------------ | Branch (340:21): [True: 21.7k, False: 1.81k] ------------------ 341| 21.7k| tmp[j] = (beta[i] >> j) & 1; 342| 21.7k| tmp[j] = -tmp[j]; 343| 21.7k| } 344| | 345| 1.81k| vec_mul(tmp, pre[i], tmp); 346| 1.81k| vec_add(out64[1], out64[1], tmp); 347| 1.81k| } 348| | 349| 4.70k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 4.70k|#define GFBITS 12 ------------------ | Branch (349:17): [True: 4.34k, False: 362] ------------------ 350| 4.34k| out[i] = vec128_set2x(out64[0][i], out64[1][i]); 351| 4.34k| } 352| 362|} fft_tr.c:radix_conversions_tr: 16| 362|static void radix_conversions_tr(vec128 in[ GFBITS ]) { 17| 362| int i, j, k; 18| | 19| 362| const vec128 mask[10] = { 20| 362| vec128_set2x(0x2222222222222222, 0x2222222222222222), 21| 362| vec128_set2x(0x4444444444444444, 0x4444444444444444), 22| 362| vec128_set2x(0x0C0C0C0C0C0C0C0C, 0x0C0C0C0C0C0C0C0C), 23| 362| vec128_set2x(0x3030303030303030, 0x3030303030303030), 24| 362| vec128_set2x(0x00F000F000F000F0, 0x00F000F000F000F0), 25| 362| vec128_set2x(0x0F000F000F000F00, 0x0F000F000F000F00), 26| 362| vec128_set2x(0x0000FF000000FF00, 0x0000FF000000FF00), 27| 362| vec128_set2x(0x00FF000000FF0000, 0x00FF000000FF0000), 28| 362| vec128_set2x(0x00000000FFFF0000, 0x00000000FFFF0000), 29| 362| vec128_set2x(0x0000FFFF00000000, 0x0000FFFF00000000) 30| 362| }; 31| | 32| 362| const vec128 s[5][GFBITS] = { 33| 362|#include "scalars_2x.data" ------------------ | | 1| 362|{ | | 2| 362| vec128_set2x(0xf3cfc030fc30f003, 0x000c03c0c3c0330c), | | 3| 362| vec128_set2x(0x3fcf0f003c00c00c, 0xf330cffcc00f33c0), | | 4| 362| vec128_set2x(0x30033cc300c0c03c, 0xccf330f00f3c0333), | | 5| 362| vec128_set2x(0xccff0f3c0f30f0c0, 0xff03fff3ff0cf0c0), | | 6| 362| vec128_set2x(0x0300c03ff303c3f0, 0x3cc3fcf00fcc303c), | | 7| 362| vec128_set2x(0x3fff3c0ff0ccccc0, 0x0f000c0fc30303f3), | | 8| 362| vec128_set2x(0xf3fff0c00f3c3cc0, 0xcf0fc3ff333ccf3c), | | 9| 362| vec128_set2x(0x3003333fffc3c000, 0x003f3fc3c0ff333f), | | 10| 362| vec128_set2x(0x0ff30fffc3fff300, 0x3cc3f0f3cf0ff00f), | | 11| 362| vec128_set2x(0xffc0f300f0f0cc00, 0xf3f33cc03fc30cc0), | | 12| 362| vec128_set2x(0xc0cff3fccc3cfc00, 0x3cc330cfc333f33f), | | 13| 362| vec128_set2x(0xfc3c03f0f330c000, 0x3cc0303ff3c3fffc), | | 14| 362|}, { | | 15| 362| vec128_set2x(0x000f00000000f00f, 0x0f00f00f00000000), | | 16| 362| vec128_set2x(0x00000f00f00000f0, 0xf00000000000f000), | | 17| 362| vec128_set2x(0x0f00000f00000f00, 0x00000f00000000f0), | | 18| 362| vec128_set2x(0xf00f00f00f000000, 0x0f00f00000f00000), | | 19| 362| vec128_set2x(0x00f00000000000f0, 0x000f00000f00f00f), | | 20| 362| vec128_set2x(0x0000000f00000000, 0x00f00f00f00f0000), | | 21| 362| vec128_set2x(0xf00000000f00f000, 0x0f00f00000000000), | | 22| 362| vec128_set2x(0x00f00f00000f0000, 0x000000000f000000), | | 23| 362| vec128_set2x(0x0000f00000f00f00, 0x00f00000000f00f0), | | 24| 362| vec128_set2x(0x000f00f00f00f000, 0x0000f00f00000f00), | | 25| 362| vec128_set2x(0x00f00f0000000000, 0xf00000f00000f00f), | | 26| 362| vec128_set2x(0x0000000000f00000, 0x00000f00f00f00f0), | | 27| 362|}, { | | 28| 362| vec128_set2x(0x0000ff00ff0000ff, 0xff00ffffff000000), | | 29| 362| vec128_set2x(0x0000ff000000ff00, 0xff0000ffff000000), | | 30| 362| vec128_set2x(0xff0000ff00ff0000, 0xffff00ffff000000), | | 31| 362| vec128_set2x(0xffff0000ff000000, 0xff00ffffffffff00), | | 32| 362| vec128_set2x(0x00ff00ff00ff0000, 0x00000000ff00ff00), | | 33| 362| vec128_set2x(0x0000ffffff000000, 0xffffffff00ff0000), | | 34| 362| vec128_set2x(0x00ffff00ff000000, 0x00ffffff00ff0000), | | 35| 362| vec128_set2x(0xffffff0000ff0000, 0xffff00ffff00ffff), | | 36| 362| vec128_set2x(0xffff00ffff00ff00, 0xffff0000ffffffff), | | 37| 362| vec128_set2x(0x0000ff0000000000, 0xff00000000ff0000), | | 38| 362| vec128_set2x(0xffffff00ff000000, 0x000000ff00ff00ff), | | 39| 362| vec128_set2x(0x00ff000000000000, 0x00ff00ff00ffff00), | | 40| 362|}, { | | 41| 362| vec128_set2x(0x000000000000ffff, 0x0000000000000000), | | 42| 362| vec128_set2x(0x00000000ffff0000, 0xffff000000000000), | | 43| 362| vec128_set2x(0x0000000000000000, 0x0000000000000000), | | 44| 362| vec128_set2x(0xffff000000000000, 0x0000000000000000), | | 45| 362| vec128_set2x(0x00000000ffff0000, 0xffff00000000ffff), | | 46| 362| vec128_set2x(0x0000ffff00000000, 0x0000000000000000), | | 47| 362| vec128_set2x(0x0000000000000000, 0x0000ffff00000000), | | 48| 362| vec128_set2x(0x00000000ffff0000, 0xffff00000000ffff), | | 49| 362| vec128_set2x(0x0000ffff00000000, 0x00000000ffff0000), | | 50| 362| vec128_set2x(0x0000000000000000, 0x0000000000000000), | | 51| 362| vec128_set2x(0x0000000000000000, 0xffff00000000ffff), | | 52| 362| vec128_set2x(0x0000000000000000, 0x00000000ffff0000), | | 53| 362|}, { | | 54| 362| vec128_set2x(0x00000000ffffffff, 0x0000000000000000), | | 55| 362| vec128_set2x(0xffffffff00000000, 0x0000000000000000), | | 56| 362| vec128_set2x(0xffffffff00000000, 0x00000000ffffffff), | | 57| 362| vec128_set2x(0x0000000000000000, 0xffffffff00000000), | | 58| 362| vec128_set2x(0x0000000000000000, 0xffffffff00000000), | | 59| 362| vec128_set2x(0xffffffff00000000, 0x0000000000000000), | | 60| 362| vec128_set2x(0x0000000000000000, 0xffffffff00000000), | | 61| 362| vec128_set2x(0x0000000000000000, 0xffffffffffffffff), | | 62| 362| vec128_set2x(0xffffffff00000000, 0xffffffff00000000), | | 63| 362| vec128_set2x(0x0000000000000000, 0x0000000000000000), | | 64| 362| vec128_set2x(0x0000000000000000, 0xffffffffffffffff), | | 65| 362| vec128_set2x(0x0000000000000000, 0xffffffff00000000), | | 66| 362|}, ------------------ 34| 362| }; 35| | 36| 362| uint64_t v0, v1; 37| | 38| | // 39| | 40| 2.53k| for (j = 5; j >= 0; j--) { ------------------ | Branch (40:17): [True: 2.17k, False: 362] ------------------ 41| | 42| 2.17k| if (j < 5) { ------------------ | Branch (42:13): [True: 1.81k, False: 362] ------------------ 43| 1.81k| vec128_mul(in, in, s[j]); 44| 1.81k| } 45| | 46| 28.2k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 28.2k|#define GFBITS 12 ------------------ | Branch (46:21): [True: 26.0k, False: 2.17k] ------------------ 47| 91.2k| for (k = j; k <= 4; k++) { ------------------ | Branch (47:25): [True: 65.1k, False: 26.0k] ------------------ 48| 65.1k| in[i] ^= vec128_sll_2x(in[i] & mask[2 * k + 0], 1 << k); ------------------ | | 46| 65.1k|#define vec128_sll_2x(a, s) ((vec128) _mm_slli_epi64((vec128) (a), (s))) ------------------ 49| 65.1k| in[i] ^= vec128_sll_2x(in[i] & mask[2 * k + 1], 1 << k); ------------------ | | 46| 65.1k|#define vec128_sll_2x(a, s) ((vec128) _mm_slli_epi64((vec128) (a), (s))) ------------------ 50| 65.1k| } 51| 26.0k| } 52| | 53| 28.2k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 28.2k|#define GFBITS 12 ------------------ | Branch (53:21): [True: 26.0k, False: 2.17k] ------------------ 54| 26.0k| v0 = vec128_extract(in[i], 0); ------------------ | | 28| 26.0k|#define vec128_extract(a, i) ((uint64_t) _mm_extract_epi64((vec128) (a), (i))) ------------------ 55| 26.0k| v1 = vec128_extract(in[i], 1); ------------------ | | 28| 26.0k|#define vec128_extract(a, i) ((uint64_t) _mm_extract_epi64((vec128) (a), (i))) ------------------ 56| | 57| 26.0k| v1 ^= v0 >> 32; 58| 26.0k| v1 ^= v1 << 32; 59| | 60| 26.0k| in[i] = vec128_set2x(v0, v1); 61| 26.0k| } 62| 2.17k| } 63| 362|} PQCLEAN_MCELIECE348864_AVX2_gf_mul: 22| 4.63M|gf gf_mul(gf in0, gf in1) { 23| 4.63M| int i; 24| | 25| 4.63M| uint32_t tmp; 26| 4.63M| uint32_t t0; 27| 4.63M| uint32_t t1; 28| 4.63M| uint32_t t; 29| | 30| 4.63M| t0 = in0; 31| 4.63M| t1 = in1; 32| | 33| 4.63M| tmp = t0 * (t1 & 1); 34| | 35| 55.6M| for (i = 1; i < GFBITS; i++) { ------------------ | | 6| 55.6M|#define GFBITS 12 ------------------ | Branch (35:17): [True: 51.0M, False: 4.63M] ------------------ 36| 51.0M| tmp ^= (t0 * (t1 & (1 << i))); 37| 51.0M| } 38| | 39| 4.63M| t = tmp & 0x7FC000; 40| 4.63M| tmp ^= t >> 9; 41| 4.63M| tmp ^= t >> 12; 42| | 43| 4.63M| t = tmp & 0x3000; 44| 4.63M| tmp ^= t >> 9; 45| 4.63M| tmp ^= t >> 12; 46| | 47| 4.63M| return tmp & ((1 << GFBITS) - 1); ------------------ | | 6| 4.63M|#define GFBITS 12 ------------------ 48| 4.63M|} PQCLEAN_MCELIECE348864_AVX2_gf_inv: 74| 67.2k|gf gf_inv(gf in) { 75| 67.2k| gf tmp_11; 76| 67.2k| gf tmp_1111; 77| | 78| 67.2k| gf out = in; 79| | 80| 67.2k| out = gf_sq(out); 81| 67.2k| tmp_11 = gf_mul(out, in); // 11 ------------------ | | 14| 67.2k|#define gf_mul CRYPTO_NAMESPACE(gf_mul) | | ------------------ | | | | 4| 67.2k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_AVX2_ ## fun | | ------------------ ------------------ 82| | 83| 67.2k| out = gf_sq(tmp_11); 84| 67.2k| out = gf_sq(out); 85| 67.2k| tmp_1111 = gf_mul(out, tmp_11); // 1111 ------------------ | | 14| 67.2k|#define gf_mul CRYPTO_NAMESPACE(gf_mul) | | ------------------ | | | | 4| 67.2k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_AVX2_ ## fun | | ------------------ ------------------ 86| | 87| 67.2k| out = gf_sq(tmp_1111); 88| 67.2k| out = gf_sq(out); 89| 67.2k| out = gf_sq(out); 90| 67.2k| out = gf_sq(out); 91| 67.2k| out = gf_mul(out, tmp_1111); // 11111111 ------------------ | | 14| 67.2k|#define gf_mul CRYPTO_NAMESPACE(gf_mul) | | ------------------ | | | | 4| 67.2k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_AVX2_ ## fun | | ------------------ ------------------ 92| | 93| 67.2k| out = gf_sq(out); 94| 67.2k| out = gf_sq(out); 95| 67.2k| out = gf_mul(out, tmp_11); // 1111111111 ------------------ | | 14| 67.2k|#define gf_mul CRYPTO_NAMESPACE(gf_mul) | | ------------------ | | | | 4| 67.2k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_AVX2_ ## fun | | ------------------ ------------------ 96| | 97| 67.2k| out = gf_sq(out); 98| 67.2k| out = gf_mul(out, in); // 11111111111 ------------------ | | 14| 67.2k|#define gf_mul CRYPTO_NAMESPACE(gf_mul) | | ------------------ | | | | 4| 67.2k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_AVX2_ ## fun | | ------------------ ------------------ 99| | 100| 67.2k| return gf_sq(out); // 111111111110 101| 67.2k|} bm.c:PQCLEAN_MCELIECE348864_AVX2_gf_mul2: 32| 12.5k|static inline uint64_t gf_mul2(gf a, gf b0, gf b1) { 33| 12.5k| int i; 34| | 35| 12.5k| uint64_t tmp = 0; 36| 12.5k| uint64_t t0; 37| 12.5k| uint64_t t1; 38| 12.5k| uint64_t t; 39| 12.5k| uint64_t mask = 0x0000000100000001; 40| | 41| 12.5k| t0 = a; 42| 12.5k| t1 = b1; 43| 12.5k| t1 = (t1 << 32) | b0; 44| | 45| 163k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 163k|#define GFBITS 12 ------------------ | Branch (45:17): [True: 150k, False: 12.5k] ------------------ 46| 150k| tmp ^= t0 * (t1 & mask); 47| 150k| mask += mask; 48| 150k| } 49| | 50| | // 51| | 52| 12.5k| t = tmp & 0x007FC000007FC000; 53| 12.5k| tmp ^= (t >> 9) ^ (t >> 12); 54| | 55| 12.5k| t = tmp & 0x0000300000003000; 56| 12.5k| tmp ^= (t >> 9) ^ (t >> 12); 57| | 58| 12.5k| return tmp & 0x00000FFF00000FFF; 59| 12.5k|} pk_gen.c:PQCLEAN_MCELIECE348864_AVX2_int32_sort: 21| 98|static void int32_sort(int32_t *x, long long n) { 22| 98| long long top, p, q, r, i; 23| | 24| 98| if (n < 2) { ------------------ | Branch (24:9): [True: 0, False: 98] ------------------ 25| 0| return; 26| 0| } 27| 98| top = 1; 28| 980| while (top < n - top) { ------------------ | Branch (28:12): [True: 882, False: 98] ------------------ 29| 882| top += top; 30| 882| } 31| | 32| 1.07k| for (p = top; p > 0; p >>= 1) { ------------------ | Branch (32:19): [True: 980, False: 98] ------------------ 33| 653k| for (i = 0; i < n - p; ++i) { ------------------ | Branch (33:21): [True: 652k, False: 980] ------------------ 34| 652k| if (!(i & p)) { ------------------ | Branch (34:17): [True: 351k, False: 301k] ------------------ 35| 351k| int32_MINMAX(x[i], x[i + p]); ------------------ | | 11| 351k| do { \ | | 12| 351k| int32_t ab = (b) ^ (a); \ | | 13| 351k| int32_t c = (b) - (a); \ | | 14| 351k| c ^= ab & ((c) ^ (b)); \ | | 15| 351k| c >>= 31; \ | | 16| 351k| c &= ab; \ | | 17| 351k| (a) ^= c; \ | | 18| 351k| (b) ^= c; \ | | 19| 351k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 351k] | | ------------------ ------------------ 36| 351k| } 37| 652k| } 38| 980| i = 0; 39| 5.39k| for (q = top; q > p; q >>= 1) { ------------------ | Branch (39:23): [True: 4.41k, False: 980] ------------------ 40| 581k| for (; i < n - q; ++i) { ------------------ | Branch (40:20): [True: 577k, False: 4.41k] ------------------ 41| 577k| if (!(i & p)) { ------------------ | Branch (41:21): [True: 301k, False: 276k] ------------------ 42| 301k| int32_t a = x[i + p]; 43| 1.60M| for (r = q; r > p; r >>= 1) { ------------------ | Branch (43:33): [True: 1.30M, False: 301k] ------------------ 44| 1.30M| int32_MINMAX(a, x[i + r]); ------------------ | | 11| 1.30M| do { \ | | 12| 1.30M| int32_t ab = (b) ^ (a); \ | | 13| 1.30M| int32_t c = (b) - (a); \ | | 14| 1.30M| c ^= ab & ((c) ^ (b)); \ | | 15| 1.30M| c >>= 31; \ | | 16| 1.30M| c &= ab; \ | | 17| 1.30M| (a) ^= c; \ | | 18| 1.30M| (b) ^= c; \ | | 19| 1.30M| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 1.30M] | | ------------------ ------------------ 45| 1.30M| } 46| 301k| x[i + p] = a; 47| 301k| } 48| 577k| } 49| 4.41k| } 50| 980| } 51| 98|} controlbits.c:PQCLEAN_MCELIECE348864_AVX2_int32_sort: 21| 1.60M|static void int32_sort(int32_t *x, long long n) { 22| 1.60M| long long top, p, q, r, i; 23| | 24| 1.60M| if (n < 2) { ------------------ | Branch (24:9): [True: 0, False: 1.60M] ------------------ 25| 0| return; 26| 0| } 27| 1.60M| top = 1; 28| 5.60M| while (top < n - top) { ------------------ | Branch (28:12): [True: 4.00M, False: 1.60M] ------------------ 29| 4.00M| top += top; 30| 4.00M| } 31| | 32| 7.21M| for (p = top; p > 0; p >>= 1) { ------------------ | Branch (32:19): [True: 5.60M, False: 1.60M] ------------------ 33| 591M| for (i = 0; i < n - p; ++i) { ------------------ | Branch (33:21): [True: 585M, False: 5.60M] ------------------ 34| 585M| if (!(i & p)) { ------------------ | Branch (34:17): [True: 330M, False: 254M] ------------------ 35| 330M| int32_MINMAX(x[i], x[i + p]); ------------------ | | 11| 330M| do { \ | | 12| 330M| int32_t ab = (b) ^ (a); \ | | 13| 330M| int32_t c = (b) - (a); \ | | 14| 330M| c ^= ab & ((c) ^ (b)); \ | | 15| 330M| c >>= 31; \ | | 16| 330M| c &= ab; \ | | 17| 330M| (a) ^= c; \ | | 18| 330M| (b) ^= c; \ | | 19| 330M| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 330M] | | ------------------ ------------------ 36| 330M| } 37| 585M| } 38| 5.60M| i = 0; 39| 15.1M| for (q = top; q > p; q >>= 1) { ------------------ | Branch (39:23): [True: 9.50M, False: 5.60M] ------------------ 40| 519M| for (; i < n - q; ++i) { ------------------ | Branch (40:20): [True: 509M, False: 9.50M] ------------------ 41| 509M| if (!(i & p)) { ------------------ | Branch (41:21): [True: 254M, False: 254M] ------------------ 42| 254M| int32_t a = x[i + p]; 43| 1.41G| for (r = q; r > p; r >>= 1) { ------------------ | Branch (43:33): [True: 1.15G, False: 254M] ------------------ 44| 1.15G| int32_MINMAX(a, x[i + r]); ------------------ | | 11| 1.15G| do { \ | | 12| 1.15G| int32_t ab = (b) ^ (a); \ | | 13| 1.15G| int32_t c = (b) - (a); \ | | 14| 1.15G| c ^= ab & ((c) ^ (b)); \ | | 15| 1.15G| c >>= 31; \ | | 16| 1.15G| c &= ab; \ | | 17| 1.15G| (a) ^= c; \ | | 18| 1.15G| (b) ^= c; \ | | 19| 1.15G| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 1.15G] | | ------------------ ------------------ 45| 1.15G| } 46| 254M| x[i + p] = a; 47| 254M| } 48| 509M| } 49| 9.50M| } 50| 5.60M| } 51| 1.60M|} encrypt.c:PQCLEAN_MCELIECE348864_AVX2_int32_sort: 21| 289|static void int32_sort(int32_t *x, long long n) { 22| 289| long long top, p, q, r, i; 23| | 24| 289| if (n < 2) { ------------------ | Branch (24:9): [True: 0, False: 289] ------------------ 25| 0| return; 26| 0| } 27| 289| top = 1; 28| 1.73k| while (top < n - top) { ------------------ | Branch (28:12): [True: 1.44k, False: 289] ------------------ 29| 1.44k| top += top; 30| 1.44k| } 31| | 32| 2.02k| for (p = top; p > 0; p >>= 1) { ------------------ | Branch (32:19): [True: 1.73k, False: 289] ------------------ 33| 94.5k| for (i = 0; i < n - p; ++i) { ------------------ | Branch (33:21): [True: 92.7k, False: 1.73k] ------------------ 34| 92.7k| if (!(i & p)) { ------------------ | Branch (34:17): [True: 55.4k, False: 37.2k] ------------------ 35| 55.4k| int32_MINMAX(x[i], x[i + p]); ------------------ | | 11| 55.4k| do { \ | | 12| 55.4k| int32_t ab = (b) ^ (a); \ | | 13| 55.4k| int32_t c = (b) - (a); \ | | 14| 55.4k| c ^= ab & ((c) ^ (b)); \ | | 15| 55.4k| c >>= 31; \ | | 16| 55.4k| c &= ab; \ | | 17| 55.4k| (a) ^= c; \ | | 18| 55.4k| (b) ^= c; \ | | 19| 55.4k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 55.4k] | | ------------------ ------------------ 36| 55.4k| } 37| 92.7k| } 38| 1.73k| i = 0; 39| 6.06k| for (q = top; q > p; q >>= 1) { ------------------ | Branch (39:23): [True: 4.33k, False: 1.73k] ------------------ 40| 78.8k| for (; i < n - q; ++i) { ------------------ | Branch (40:20): [True: 74.5k, False: 4.33k] ------------------ 41| 74.5k| if (!(i & p)) { ------------------ | Branch (41:21): [True: 37.2k, False: 37.2k] ------------------ 42| 37.2k| int32_t a = x[i + p]; 43| 138k| for (r = q; r > p; r >>= 1) { ------------------ | Branch (43:33): [True: 101k, False: 37.2k] ------------------ 44| 101k| int32_MINMAX(a, x[i + r]); ------------------ | | 11| 101k| do { \ | | 12| 101k| int32_t ab = (b) ^ (a); \ | | 13| 101k| int32_t c = (b) - (a); \ | | 14| 101k| c ^= ab & ((c) ^ (b)); \ | | 15| 101k| c >>= 31; \ | | 16| 101k| c &= ab; \ | | 17| 101k| (a) ^= c; \ | | 18| 101k| (b) ^= c; \ | | 19| 101k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 101k] | | ------------------ ------------------ 45| 101k| } 46| 37.2k| x[i + p] = a; 47| 37.2k| } 48| 74.5k| } 49| 4.33k| } 50| 1.73k| } 51| 289|} PQCLEAN_MCELIECE348864_AVX2_crypto_kem_enc: 22| 98|) { 23| 98| unsigned char e[ SYS_N / 8 ]; 24| 98| unsigned char one_ec[ 1 + SYS_N / 8 + SYND_BYTES ] = {1}; 25| | 26| | // 27| | 28| 98| encrypt(c, pk, e); ------------------ | | 9| 98|#define encrypt CRYPTO_NAMESPACE(encrypt) | | ------------------ | | | | 4| 98|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_AVX2_ ## fun | | ------------------ ------------------ 29| | 30| 98| memcpy(one_ec + 1, e, SYS_N / 8); ------------------ | | 7| 98|#define SYS_N 3488 ------------------ 31| 98| memcpy(one_ec + 1 + SYS_N / 8, c, SYND_BYTES); ------------------ | | 7| 98|#define SYS_N 3488 ------------------ memcpy(one_ec + 1 + SYS_N / 8, c, SYND_BYTES); ------------------ | | 17| 98|#define SYND_BYTES ((PK_NROWS + 7)/8) | | ------------------ | | | | 13| 98|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 98|#define SYS_T 64 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 98|#define GFBITS 12 | | | | ------------------ | | ------------------ ------------------ 32| | 33| 98| crypto_hash_32b(key, one_ec, sizeof(one_ec)); ------------------ | | 7| 98| shake256(out, 32, in, inlen) | | ------------------ | | | | 12| 98|#define shake256 OQS_SHA3_shake256 | | ------------------ ------------------ 34| | 35| 98| return 0; 36| 98|} PQCLEAN_MCELIECE348864_AVX2_crypto_kem_dec: 42| 98|) { 43| 98| int i; 44| | 45| 98| unsigned char ret_decrypt = 0; 46| | 47| 98| uint16_t m; 48| | 49| 98| unsigned char e[ SYS_N / 8 ]; 50| 98| unsigned char preimage[ 1 + SYS_N / 8 + SYND_BYTES ]; 51| 98| unsigned char *x = preimage; 52| 98| const unsigned char *s = sk + 40 + IRR_BYTES + COND_BYTES; ------------------ | | 11| 98|#define IRR_BYTES (SYS_T * 2) | | ------------------ | | | | 8| 98|#define SYS_T 64 | | ------------------ ------------------ const unsigned char *s = sk + 40 + IRR_BYTES + COND_BYTES; ------------------ | | 10| 98|#define COND_BYTES ((1 << (GFBITS-4))*(2*GFBITS - 1)) | | ------------------ | | | | 6| 98|#define GFBITS 12 | | ------------------ | | #define COND_BYTES ((1 << (GFBITS-4))*(2*GFBITS - 1)) | | ------------------ | | | | 6| 98|#define GFBITS 12 | | ------------------ ------------------ 53| | 54| | // 55| | 56| 98| ret_decrypt = (unsigned char)decrypt(e, sk + 40, c); ------------------ | | 9| 98|#define decrypt CRYPTO_NAMESPACE(decrypt) | | ------------------ | | | | 4| 98|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_AVX2_ ## fun | | ------------------ ------------------ 57| | 58| 98| m = ret_decrypt; 59| 98| m -= 1; 60| 98| m >>= 8; 61| | 62| 98| *x++ = m & 1; 63| 42.8k| for (i = 0; i < SYS_N / 8; i++) { ------------------ | | 7| 42.8k|#define SYS_N 3488 ------------------ | Branch (63:17): [True: 42.7k, False: 98] ------------------ 64| 42.7k| *x++ = (~m & s[i]) | (m & e[i]); 65| 42.7k| } 66| | 67| 9.50k| for (i = 0; i < SYND_BYTES; i++) { ------------------ | | 17| 9.50k|#define SYND_BYTES ((PK_NROWS + 7)/8) | | ------------------ | | | | 13| 9.50k|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 9.50k|#define SYS_T 64 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 9.50k|#define GFBITS 12 | | | | ------------------ | | ------------------ ------------------ | Branch (67:17): [True: 9.40k, False: 98] ------------------ 68| 9.40k| *x++ = c[i]; 69| 9.40k| } 70| | 71| 98| crypto_hash_32b(key, preimage, sizeof(preimage)); ------------------ | | 7| 98| shake256(out, 32, in, inlen) | | ------------------ | | | | 12| 98|#define shake256 OQS_SHA3_shake256 | | ------------------ ------------------ 72| | 73| 98| return 0; 74| 98|} PQCLEAN_MCELIECE348864_AVX2_crypto_kem_keypair: 80| 98|) { 81| 98| int i; 82| 98| unsigned char seed[ 33 ] = {64}; 83| 98| unsigned char r[ SYS_N / 8 + (1 << GFBITS)*sizeof(uint32_t) + SYS_T * 2 + 32 ]; 84| 98| unsigned char *rp, *skp; 85| | 86| 98| gf f[ SYS_T ]; // element in GF(2^mt) 87| 98| gf irr[ SYS_T ]; // Goppa polynomial 88| 98| uint32_t perm[ 1 << GFBITS ]; // random permutation as 32-bit integers 89| 98| int16_t pi[ 1 << GFBITS ]; // random permutation 90| | 91| 98| randombytes(seed + 1, 32); ------------------ | | 8| 98|#define randombytes OQS_randombytes ------------------ 92| | 93| 1.05k| while (1) { ------------------ | Branch (93:12): [True: 1.05k, Folded] ------------------ 94| 1.05k| rp = &r[ sizeof(r) - 32 ]; 95| 1.05k| skp = sk; 96| | 97| | // expanding and updating the seed 98| | 99| 1.05k| shake(r, sizeof(r), seed, 33); ------------------ | | 10| 1.05k| shake256(out, outlen, in, inlen) | | ------------------ | | | | 12| 1.05k|#define shake256 OQS_SHA3_shake256 | | ------------------ ------------------ 100| 1.05k| memcpy(skp, seed + 1, 32); 101| 1.05k| skp += 32 + 8; 102| 1.05k| memcpy(seed + 1, &r[ sizeof(r) - 32 ], 32); 103| | 104| | // generating irreducible polynomial 105| | 106| 1.05k| rp -= sizeof(f); 107| | 108| 68.2k| for (i = 0; i < SYS_T; i++) { ------------------ | | 8| 68.2k|#define SYS_T 64 ------------------ | Branch (108:21): [True: 67.2k, False: 1.05k] ------------------ 109| 67.2k| f[i] = load_gf(rp + i * 2); 110| 67.2k| } 111| | 112| 1.05k| if (genpoly_gen(irr, f)) { ------------------ | | 9| 1.05k|#define genpoly_gen CRYPTO_NAMESPACE(genpoly_gen) | | ------------------ | | | | 4| 1.05k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_AVX2_ ## fun | | ------------------ ------------------ | Branch (112:13): [True: 0, False: 1.05k] ------------------ 113| 0| continue; 114| 0| } 115| | 116| 68.2k| for (i = 0; i < SYS_T; i++) { ------------------ | | 8| 68.2k|#define SYS_T 64 ------------------ | Branch (116:21): [True: 67.2k, False: 1.05k] ------------------ 117| 67.2k| store_gf(skp + i * 2, irr[i]); 118| 67.2k| } 119| | 120| 1.05k| skp += IRR_BYTES; ------------------ | | 11| 1.05k|#define IRR_BYTES (SYS_T * 2) | | ------------------ | | | | 8| 1.05k|#define SYS_T 64 | | ------------------ ------------------ 121| | 122| | // generating permutation 123| | 124| 1.05k| rp -= sizeof(perm); 125| | 126| 4.30M| for (i = 0; i < (1 << GFBITS); i++) { ------------------ | | 6| 4.30M|#define GFBITS 12 ------------------ | Branch (126:21): [True: 4.30M, False: 1.05k] ------------------ 127| 4.30M| perm[i] = load4(rp + i * 4); 128| 4.30M| } 129| | 130| 1.05k| if (pk_gen(pk, skp - IRR_BYTES, perm, pi)) { ------------------ | | 9| 1.05k|#define pk_gen CRYPTO_NAMESPACE(pk_gen) | | ------------------ | | | | 4| 1.05k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_AVX2_ ## fun | | ------------------ ------------------ if (pk_gen(pk, skp - IRR_BYTES, perm, pi)) { ------------------ | | 11| 1.05k|#define IRR_BYTES (SYS_T * 2) | | ------------------ | | | | 8| 1.05k|#define SYS_T 64 | | ------------------ ------------------ | Branch (130:13): [True: 952, False: 98] ------------------ 131| 952| continue; 132| 952| } 133| | 134| 98| controlbitsfrompermutation(skp, pi, GFBITS, 1 << GFBITS); ------------------ | | 10| 98|#define controlbitsfrompermutation CRYPTO_NAMESPACE(controlbitsfrompermutation) | | ------------------ | | | | 4| 98|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_AVX2_ ## fun | | ------------------ ------------------ controlbitsfrompermutation(skp, pi, GFBITS, 1 << GFBITS); ------------------ | | 6| 98|#define GFBITS 12 ------------------ controlbitsfrompermutation(skp, pi, GFBITS, 1 << GFBITS); ------------------ | | 6| 98|#define GFBITS 12 ------------------ 135| 98| skp += COND_BYTES; ------------------ | | 10| 98|#define COND_BYTES ((1 << (GFBITS-4))*(2*GFBITS - 1)) | | ------------------ | | | | 6| 98|#define GFBITS 12 | | ------------------ | | #define COND_BYTES ((1 << (GFBITS-4))*(2*GFBITS - 1)) | | ------------------ | | | | 6| 98|#define GFBITS 12 | | ------------------ ------------------ 136| | 137| | // storing the random string s 138| | 139| 98| rp -= SYS_N / 8; ------------------ | | 7| 98|#define SYS_N 3488 ------------------ 140| 98| memcpy(skp, rp, SYS_N / 8); ------------------ | | 7| 98|#define SYS_N 3488 ------------------ 141| | 142| | // storing positions of the 32 pivots 143| | 144| 98| store8(sk + 32, 0xFFFFFFFF); 145| | 146| 98| break; 147| 1.05k| } 148| | 149| 98| return 0; 150| 98|} PQCLEAN_MCELIECE348864_AVX2_pk_gen: 198| 1.05k|int pk_gen(unsigned char *pk, const unsigned char *irr, const uint32_t *perm, int16_t *pi) { 199| 1.05k|#define nBlocks_I ((PK_NROWS + 255) / 256) 200| | 201| 1.05k| int i, j, k, b; 202| 1.05k| int row, c; 203| | 204| 1.05k| union { 205| 1.05k| uint64_t w[ PK_NROWS ][ nBlocks_I * 4 ]; 206| 1.05k| vec256 v[ PK_NROWS ][ nBlocks_I ]; 207| 1.05k| } mat; 208| | 209| 1.05k| union { 210| 1.05k| uint64_t w[ PK_NROWS ][ par_width * 4 ]; 211| 1.05k| vec256 v[ PK_NROWS ][ par_width ]; 212| 1.05k| } par; 213| | 214| 1.05k| uint16_t m; 215| 1.05k| vec256 mm; 216| | 217| 1.05k| uint64_t sk_int[ GFBITS ]; 218| | 219| 1.05k| vec256 consts[ 16 ][ GFBITS ]; 220| 1.05k| vec256 eval[ 16 ][ GFBITS ]; 221| 1.05k| vec256 prod[ 16 ][ GFBITS ]; 222| 1.05k| vec256 tmp[ GFBITS ]; 223| | 224| 1.05k| uint64_t list[1 << GFBITS]; 225| 1.05k| uint64_t one = 1; 226| 1.05k| uint64_t t; 227| | 228| 1.05k| uint16_t ind[ PK_NROWS ]; 229| 1.05k| uint16_t ind_inv[ PK_NROWS ]; 230| | 231| | // compute the inverses 232| | 233| 1.05k| irr_load(sk_int, irr); 234| | 235| 1.05k| fft(eval, sk_int); ------------------ | | 10| 1.05k|#define fft CRYPTO_NAMESPACE(fft) | | ------------------ | | | | 4| 1.05k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_AVX2_ ## fun | | ------------------ ------------------ 236| | 237| 1.05k| vec256_copy(prod[0], eval[0]); 238| | 239| 16.8k| for (i = 1; i < 16; i++) { ------------------ | Branch (239:17): [True: 15.7k, False: 1.05k] ------------------ 240| 15.7k| vec256_mul(prod[i], prod[i - 1], eval[i]); 241| 15.7k| } 242| | 243| 1.05k| vec256_inv(tmp, prod[15]); ------------------ | | 11| 1.05k|#define vec256_inv CRYPTO_NAMESPACE(vec256_inv) | | ------------------ | | | | 4| 1.05k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_AVX2_ ## fun | | ------------------ ------------------ 244| | 245| 16.8k| for (i = 14; i >= 0; i--) { ------------------ | Branch (245:18): [True: 15.7k, False: 1.05k] ------------------ 246| 15.7k| vec256_mul(prod[i + 1], prod[i], tmp); 247| 15.7k| vec256_mul(tmp, tmp, eval[i + 1]); 248| 15.7k| } 249| | 250| 1.05k| vec256_copy(prod[0], tmp); 251| | 252| | // fill matrix 253| | 254| 1.05k| de_bitslicing(list, prod); 255| | 256| 4.30M| for (i = 0; i < (1 << GFBITS); i++) { ------------------ | | 6| 4.30M|#define GFBITS 12 ------------------ | Branch (256:17): [True: 4.30M, False: 1.05k] ------------------ 257| 4.30M| list[i] <<= GFBITS; ------------------ | | 6| 4.30M|#define GFBITS 12 ------------------ 258| 4.30M| list[i] |= i; 259| 4.30M| list[i] |= ((uint64_t) perm[i]) << 31; 260| 4.30M| } 261| | 262| 1.05k| uint64_sort(list, 1 << GFBITS); ------------------ | | 6| 1.05k|#define GFBITS 12 ------------------ 263| | 264| 4.23M| for (i = 1; i < (1 << GFBITS); i++) { ------------------ | | 6| 4.23M|#define GFBITS 12 ------------------ | Branch (264:17): [True: 4.23M, False: 1.02k] ------------------ 265| 4.23M| if (uint64_is_equal_declassify(list[i - 1] >> 31, list[i] >> 31)) { ------------------ | Branch (265:13): [True: 28, False: 4.23M] ------------------ 266| 28| return -1; 267| 28| } 268| 4.23M| } 269| | 270| 1.02k| to_bitslicing_2x(consts, prod, list); 271| | 272| 4.18M| for (i = 0; i < (1 << GFBITS); i++) { ------------------ | | 6| 4.18M|#define GFBITS 12 ------------------ | Branch (272:17): [True: 4.18M, False: 1.02k] ------------------ 273| 4.18M| pi[i] = list[i] & GFMASK; ------------------ | | 19| 4.18M|#define GFMASK ((1 << GFBITS) - 1) | | ------------------ | | | | 6| 4.18M|#define GFBITS 12 | | ------------------ ------------------ 274| 4.18M| } 275| | 276| 4.08k| for (j = 0; j < nBlocks_I; j++) { ------------------ | | 199| 4.08k|#define nBlocks_I ((PK_NROWS + 255) / 256) | | ------------------ | | | | 13| 4.08k|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 4.08k|#define SYS_T 64 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 4.08k|#define GFBITS 12 | | | | ------------------ | | ------------------ ------------------ | Branch (276:17): [True: 3.06k, False: 1.02k] ------------------ 277| 39.8k| for (k = 0; k < GFBITS; k++) { ------------------ | | 6| 39.8k|#define GFBITS 12 ------------------ | Branch (277:21): [True: 36.7k, False: 3.06k] ------------------ 278| 36.7k| mat.v[ k ][ j ] = prod[ j ][ k ]; 279| 36.7k| } 280| 3.06k| } 281| | 282| 65.4k| for (i = 1; i < SYS_T; i++) { ------------------ | | 8| 65.4k|#define SYS_T 64 ------------------ | Branch (282:17): [True: 64.3k, False: 1.02k] ------------------ 283| 257k| for (j = 0; j < nBlocks_I; j++) { ------------------ | | 199| 257k|#define nBlocks_I ((PK_NROWS + 255) / 256) | | ------------------ | | | | 13| 257k|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 257k|#define SYS_T 64 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 257k|#define GFBITS 12 | | | | ------------------ | | ------------------ ------------------ | Branch (283:21): [True: 193k, False: 64.3k] ------------------ 284| 193k| vec256_mul(prod[j], prod[j], consts[j]); 285| | 286| 2.51M| for (k = 0; k < GFBITS; k++) { ------------------ | | 6| 2.51M|#define GFBITS 12 ------------------ | Branch (286:25): [True: 2.31M, False: 193k] ------------------ 287| 2.31M| mat.v[ i * GFBITS + k ][ j ] = prod[ j ][ k ]; ------------------ | | 6| 2.31M|#define GFBITS 12 ------------------ 288| 2.31M| } 289| 193k| } 290| 64.3k| } 291| | 292| | // gaussian elimination to obtain L, U, and P such that LP M = U 293| | // L and U are stored in the space of M 294| | // P is stored in ind 295| | 296| 785k| for (i = 0; i < PK_NROWS; i++) { ------------------ | | 13| 785k|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 785k|#define SYS_T 64 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 785k|#define GFBITS 12 | | ------------------ ------------------ | Branch (296:17): [True: 784k, False: 1.02k] ------------------ 297| 784k| ind_inv[i] = ind[ i ] = i; 298| 784k| } 299| | 300| 783k| for (row = 0; row < PK_NROWS; row++) { ------------------ | | 13| 783k|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 783k|#define SYS_T 64 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 783k|#define GFBITS 12 | | ------------------ ------------------ | Branch (300:19): [True: 783k, False: 98] ------------------ 301| 783k| i = row >> 6; 302| 783k| j = row & 63; 303| | 304| 301M| for (k = row + 1; k < PK_NROWS; k++) { ------------------ | | 13| 301M|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 301M|#define SYS_T 64 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 301M|#define GFBITS 12 | | ------------------ ------------------ | Branch (304:27): [True: 301M, False: 783k] ------------------ 305| 301M| extract_01_masks(&m, mat.w[ row ], mat.w[ k ], row); 306| 301M| uint16_cswap(&ind[row], &ind[k], m); 307| | 308| 301M| mm = vec256_set1_16b(m); 309| 1.20G| for (c = 0; c < nBlocks_I; c++) { ------------------ | | 199| 1.20G|#define nBlocks_I ((PK_NROWS + 255) / 256) | | ------------------ | | | | 13| 1.20G|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 1.20G|#define SYS_T 64 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 1.20G|#define GFBITS 12 | | | | ------------------ | | ------------------ ------------------ | Branch (309:25): [True: 903M, False: 301M] ------------------ 310| 903M| vec256_cswap(&mat.v[ row ][ c ], &mat.v[ k ][ c ], mm); 311| 903M| } 312| 301M| } 313| | 314| 783k| if ( uint64_is_zero_declassify((mat.w[ row ][ i ] >> j) & 1) ) { // return if not systematic ------------------ | Branch (314:14): [True: 924, False: 782k] ------------------ 315| 924| return -1; 316| 924| } 317| | 318| 301M| for (k = row + 1; k < PK_NROWS; k++) { ------------------ | | 13| 301M|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 301M|#define SYS_T 64 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 301M|#define GFBITS 12 | | ------------------ ------------------ | Branch (318:27): [True: 301M, False: 782k] ------------------ 319| 301M| t = mat.w[ k ][ i ] & (one << j); 320| 301M| mm = extract_mask256(mat.w[k], row); 321| | 322| 1.20G| for (c = 0; c < nBlocks_I; c++) { ------------------ | | 199| 1.20G|#define nBlocks_I ((PK_NROWS + 255) / 256) | | ------------------ | | | | 13| 1.20G|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 1.20G|#define SYS_T 64 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 1.20G|#define GFBITS 12 | | | | ------------------ | | ------------------ ------------------ | Branch (322:25): [True: 903M, False: 301M] ------------------ 323| 903M| mat.v[ k ][ c ] ^= mat.v[ row ][ c ] & mm; 324| 903M| } 325| | 326| 301M| mat.w[ k ][ i ] |= t; 327| 301M| } 328| 782k| } 329| | 330| | // apply M^-1 to the remaining columns 331| | 332| 98| composeinv(PK_NROWS, ind_inv, ind_inv, ind); ------------------ | | 13| 98|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 98|#define SYS_T 64 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 98|#define GFBITS 12 | | ------------------ ------------------ 333| | 334| 1.27k| for (k = 0; k < GFBITS; k++) { ------------------ | | 6| 1.27k|#define GFBITS 12 ------------------ | Branch (334:17): [True: 1.17k, False: 98] ------------------ 335| 14.1k| for (b = 0; b < par_width; b++) { ------------------ | | 29| 14.1k|#define par_width 11 ------------------ | Branch (335:21): [True: 12.9k, False: 1.17k] ------------------ 336| 12.9k| par.v[ k ][ b ] = prod[nBlocks_I + b][ k ]; ------------------ | | 199| 12.9k|#define nBlocks_I ((PK_NROWS + 255) / 256) | | ------------------ | | | | 13| 12.9k|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 12.9k|#define SYS_T 64 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 12.9k|#define GFBITS 12 | | | | ------------------ | | ------------------ ------------------ 337| 12.9k| } 338| 1.17k| } 339| | 340| 6.27k| for (i = 1; i < SYS_T; i++) { ------------------ | | 8| 6.27k|#define SYS_T 64 ------------------ | Branch (340:17): [True: 6.17k, False: 98] ------------------ 341| 74.0k| for (b = 0; b < par_width; b++) { ------------------ | | 29| 74.0k|#define par_width 11 ------------------ | Branch (341:21): [True: 67.9k, False: 6.17k] ------------------ 342| 67.9k| vec256_mul(prod[nBlocks_I + b], prod[nBlocks_I + b], consts[nBlocks_I + b]); ------------------ | | 199| 67.9k|#define nBlocks_I ((PK_NROWS + 255) / 256) | | ------------------ | | | | 13| 67.9k|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 67.9k|#define SYS_T 64 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 67.9k|#define GFBITS 12 | | | | ------------------ | | ------------------ ------------------ vec256_mul(prod[nBlocks_I + b], prod[nBlocks_I + b], consts[nBlocks_I + b]); ------------------ | | 199| 67.9k|#define nBlocks_I ((PK_NROWS + 255) / 256) | | ------------------ | | | | 13| 67.9k|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 67.9k|#define SYS_T 64 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 67.9k|#define GFBITS 12 | | | | ------------------ | | ------------------ ------------------ vec256_mul(prod[nBlocks_I + b], prod[nBlocks_I + b], consts[nBlocks_I + b]); ------------------ | | 199| 67.9k|#define nBlocks_I ((PK_NROWS + 255) / 256) | | ------------------ | | | | 13| 67.9k|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 67.9k|#define SYS_T 64 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 67.9k|#define GFBITS 12 | | | | ------------------ | | ------------------ ------------------ 343| 67.9k| } 344| | 345| 80.2k| for (k = 0; k < GFBITS; k++) { ------------------ | | 6| 80.2k|#define GFBITS 12 ------------------ | Branch (345:21): [True: 74.0k, False: 6.17k] ------------------ 346| 889k| for (b = 0; b < par_width; b++) { ------------------ | | 29| 889k|#define par_width 11 ------------------ | Branch (346:25): [True: 814k, False: 74.0k] ------------------ 347| 814k| par.v[ i * GFBITS + k ][ b ] = prod[nBlocks_I + b][ k ]; ------------------ | | 6| 814k|#define GFBITS 12 ------------------ par.v[ i * GFBITS + k ][ b ] = prod[nBlocks_I + b][ k ]; ------------------ | | 199| 814k|#define nBlocks_I ((PK_NROWS + 255) / 256) | | ------------------ | | | | 13| 814k|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 814k|#define SYS_T 64 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 814k|#define GFBITS 12 | | | | ------------------ | | ------------------ ------------------ 348| 814k| } 349| 74.0k| } 350| 6.17k| } 351| | 352| | // apply P 353| | 354| 75.3k| for (i = 0; i < PK_NROWS; i++) { ------------------ | | 13| 75.3k|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 75.3k|#define SYS_T 64 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 75.3k|#define GFBITS 12 | | ------------------ ------------------ | Branch (354:17): [True: 75.2k, False: 98] ------------------ 355| 75.2k| ind[i] = ind_inv[i]; 356| 75.2k| } 357| | 358| 98| sort_rows((1 << GFBITS) / 4, PK_NROWS, ind, par.v, 0); ------------------ | | 6| 98|#define GFBITS 12 ------------------ sort_rows((1 << GFBITS) / 4, PK_NROWS, ind, par.v, 0); ------------------ | | 13| 98|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 98|#define SYS_T 64 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 98|#define GFBITS 12 | | ------------------ ------------------ 359| | 360| | // apply L 361| | 362| 75.3k| for (row = PK_NROWS - 1; row >= 0; row--) { ------------------ | | 13| 98|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 98|#define SYS_T 64 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 98|#define GFBITS 12 | | ------------------ ------------------ | Branch (362:30): [True: 75.2k, False: 98] ------------------ 363| 28.9M| for (i = row - 1; i >= 0; i--) { ------------------ | Branch (363:27): [True: 28.8M, False: 75.2k] ------------------ 364| 28.8M| mm = extract_mask256(mat.w[row], i); 365| | 366| 346M| for (k = 0; k < par_width; k++) { ------------------ | | 29| 346M|#define par_width 11 ------------------ | Branch (366:25): [True: 317M, False: 28.8M] ------------------ 367| 317M| par.v[ row ][ k ] ^= par.v[ i ][ k ] & mm; 368| 317M| } 369| 28.8M| } 370| 75.2k| } 371| | 372| | // apply U^-1 373| | 374| 75.3k| for (row = PK_NROWS - 1; row >= 0; row--) { ------------------ | | 13| 98|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 98|#define SYS_T 64 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 98|#define GFBITS 12 | | ------------------ ------------------ | Branch (374:30): [True: 75.2k, False: 98] ------------------ 375| 28.9M| for (i = PK_NROWS - 1; i > row; i--) { ------------------ | | 13| 75.2k|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 75.2k|#define SYS_T 64 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 75.2k|#define GFBITS 12 | | ------------------ ------------------ | Branch (375:32): [True: 28.8M, False: 75.2k] ------------------ 376| 28.8M| mm = extract_mask256(mat.w[row], i); 377| | 378| 346M| for (k = 0; k < par_width; k++) { ------------------ | | 29| 346M|#define par_width 11 ------------------ | Branch (378:25): [True: 317M, False: 28.8M] ------------------ 379| 317M| par.v[ row ][ k ] ^= par.v[ i ][ k ] & mm; 380| 317M| } 381| 28.8M| } 382| 75.2k| } 383| | 384| 75.3k| for (row = 0; row < PK_NROWS; row++) { ------------------ | | 13| 75.3k|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 75.3k|#define SYS_T 64 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 75.3k|#define GFBITS 12 | | ------------------ ------------------ | Branch (384:19): [True: 75.2k, False: 98] ------------------ 385| 3.23M| for (k = 0; k < 42; k++) { ------------------ | Branch (385:21): [True: 3.16M, False: 75.2k] ------------------ 386| 3.16M| store8(pk + PK_ROW_BYTES * row + k * 8, par.w[row][k]); ------------------ | | 15| 3.16M|#define PK_ROW_BYTES ((PK_NCOLS + 7)/8) | | ------------------ | | | | 14| 3.16M|#define PK_NCOLS (SYS_N - PK_NROWS) | | | | ------------------ | | | | | | 7| 3.16M|#define SYS_N 3488 | | | | ------------------ | | | | #define PK_NCOLS (SYS_N - PK_NROWS) | | | | ------------------ | | | | | | 13| 3.16M|#define PK_NROWS (SYS_T*GFBITS) | | | | | | ------------------ | | | | | | | | 8| 3.16M|#define SYS_T 64 | | | | | | ------------------ | | | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | | | ------------------ | | | | | | | | 6| 3.16M|#define GFBITS 12 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 387| 3.16M| } 388| | 389| 75.2k| store_i(pk + PK_ROW_BYTES * row + k * 8, par.w[row][k], 4); ------------------ | | 15| 75.2k|#define PK_ROW_BYTES ((PK_NCOLS + 7)/8) | | ------------------ | | | | 14| 75.2k|#define PK_NCOLS (SYS_N - PK_NROWS) | | | | ------------------ | | | | | | 7| 75.2k|#define SYS_N 3488 | | | | ------------------ | | | | #define PK_NCOLS (SYS_N - PK_NROWS) | | | | ------------------ | | | | | | 13| 75.2k|#define PK_NROWS (SYS_T*GFBITS) | | | | | | ------------------ | | | | | | | | 8| 75.2k|#define SYS_T 64 | | | | | | ------------------ | | | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | | | ------------------ | | | | | | | | 6| 75.2k|#define GFBITS 12 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 390| 75.2k| } 391| | 392| | // 393| | 394| 98| return 0; 395| 1.02k|} pk_gen.c:de_bitslicing: 117| 5.56k|static void de_bitslicing(uint64_t *out, vec256 in[][GFBITS]) { 118| 5.56k| int i, j, r; 119| 5.56k| uint64_t u = 0; 120| | 121| 40.8M| for (i = 0; i < (1 << GFBITS); i++) { ------------------ | | 6| 40.8M|#define GFBITS 12 ------------------ | Branch (121:17): [True: 40.8M, False: 5.56k] ------------------ 122| 40.8M| out[i] = 0 ; 123| 40.8M| } 124| | 125| 165k| for (i = 0; i < 16; i++) { ------------------ | Branch (125:17): [True: 159k, False: 5.56k] ------------------ 126| 2.21M| for (j = GFBITS - 1; j >= 0; j--) { ------------------ | | 6| 159k|#define GFBITS 12 ------------------ | Branch (126:30): [True: 2.05M, False: 159k] ------------------ 127| 2.05M| u = vec256_extract(in[i][j], 0); ------------------ | | 39| 2.05M|#define vec256_extract(a,i) ((uint64_t) _mm256_extract_epi64((vec256) (a),(i))) ------------------ 128| 133M| for (r = 0; r < 64; r++) { ------------------ | Branch (128:25): [True: 131M, False: 2.05M] ------------------ 129| 131M| out[i * 256 + 0 * 64 + r] <<= 1; 130| 131M| out[i * 256 + 0 * 64 + r] |= (u >> r) & 1; 131| 131M| } 132| 2.05M| u = vec256_extract(in[i][j], 1); ------------------ | | 39| 2.05M|#define vec256_extract(a,i) ((uint64_t) _mm256_extract_epi64((vec256) (a),(i))) ------------------ 133| 133M| for (r = 0; r < 64; r++) { ------------------ | Branch (133:25): [True: 131M, False: 2.05M] ------------------ 134| 131M| out[i * 256 + 1 * 64 + r] <<= 1; 135| 131M| out[i * 256 + 1 * 64 + r] |= (u >> r) & 1; 136| 131M| } 137| 2.05M| u = vec256_extract(in[i][j], 2); ------------------ | | 39| 2.05M|#define vec256_extract(a,i) ((uint64_t) _mm256_extract_epi64((vec256) (a),(i))) ------------------ 138| 133M| for (r = 0; r < 64; r++) { ------------------ | Branch (138:25): [True: 131M, False: 2.05M] ------------------ 139| 131M| out[i * 256 + 2 * 64 + r] <<= 1; 140| 131M| out[i * 256 + 2 * 64 + r] |= (u >> r) & 1; 141| 131M| } 142| 2.05M| u = vec256_extract(in[i][j], 3); ------------------ | | 39| 2.05M|#define vec256_extract(a,i) ((uint64_t) _mm256_extract_epi64((vec256) (a),(i))) ------------------ 143| 133M| for (r = 0; r < 64; r++) { ------------------ | Branch (143:25): [True: 131M, False: 2.05M] ------------------ 144| 131M| out[i * 256 + 3 * 64 + r] <<= 1; 145| 131M| out[i * 256 + 3 * 64 + r] |= (u >> r) & 1; 146| 131M| } 147| 2.05M| } 148| 159k| } 149| 5.56k|} pk_gen.c:to_bitslicing_2x: 152| 5.27k|static void to_bitslicing_2x(vec256 out0[][GFBITS], vec256 out1[][GFBITS], const uint64_t *in) { 153| 5.27k| int i, j, k, r; 154| 5.27k| uint64_t u[2][4] = {{0}}; 155| | 156| 156k| for (i = 0; i < 16; i++) { ------------------ | Branch (156:17): [True: 151k, False: 5.27k] ------------------ 157| 2.09M| for (j = GFBITS - 1; j >= 0; j--) { ------------------ | | 6| 151k|#define GFBITS 12 ------------------ | Branch (157:30): [True: 1.94M, False: 151k] ------------------ 158| 9.74M| for (k = 0; k < 4; k++) { ------------------ | Branch (158:25): [True: 7.79M, False: 1.94M] ------------------ 159| 506M| for (r = 63; r >= 0; r--) { ------------------ | Branch (159:30): [True: 498M, False: 7.79M] ------------------ 160| 498M| u[0][k] <<= 1; 161| 498M| u[0][k] |= (in[i * 256 + k * 64 + r] >> (GFBITS - 1 - j)) & 1; ------------------ | | 6| 498M|#define GFBITS 12 ------------------ 162| | 163| 498M| u[1][k] <<= 1; 164| 498M| u[1][k] |= (in[i * 256 + k * 64 + r] >> (j + GFBITS)) & 1; ------------------ | | 6| 498M|#define GFBITS 12 ------------------ 165| 498M| } 166| 7.79M| } 167| | 168| 1.94M| out0[i][j] = vec256_set4x(u[0][0], u[0][1], u[0][2], u[0][3]); 169| 1.94M| out1[i][j] = vec256_set4x(u[1][0], u[1][1], u[1][2], u[1][3]); 170| 1.94M| } 171| 151k| } 172| 5.27k|} pk_gen.c:extract_01_masks: 33| 5.16G|static inline void extract_01_masks(uint16_t *m, const uint64_t *x, const uint64_t *y, int i) { 34| 5.16G| *m = (((~x[ i >> 6 ]) & y[ i >> 6 ]) >> (i & 63)) & 1; 35| 5.16G| *m = -(*m); 36| 5.16G|} pk_gen.c:uint16_cswap: 49| 5.24G|static inline void uint16_cswap(uint16_t *x, uint16_t *y, uint16_t m) { 50| 5.24G| uint16_t d; 51| | 52| 5.24G| d = *x ^ *y; 53| 5.24G| d &= m; 54| 5.24G| *x ^= d; 55| 5.24G| *y ^= d; 56| 5.24G|} pk_gen.c:vec256_cswap: 59| 33.8G|static inline void vec256_cswap(vec256 *x, vec256 *y, vec256 m) { 60| 33.8G| vec256 d; 61| | 62| 33.8G| d = *x ^ *y; 63| 33.8G| d &= m; 64| 33.8G| *x ^= d; 65| 33.8G| *y ^= d; 66| 33.8G|} pk_gen.c:extract_mask256: 39| 9.45G|static inline vec256 extract_mask256(const uint64_t v[], int i) { 40| 9.45G| uint32_t mask; 41| | 42| 9.45G| mask = (v[ i >> 6 ] >> (i & 63)) & 1; 43| 9.45G| mask = -mask; 44| | 45| 9.45G| return vec256_set1_32b(mask); 46| 9.45G|} pk_gen.c:composeinv: 176| 951|static void composeinv(int n, uint16_t y[n], const uint16_t x[n], const uint16_t pi[n]) { 177| 951| int i; 178| 951| int32_t t[n]; 179| | 180| 1.31M| for (i = 0; i < n; ++i) { ------------------ | Branch (180:17): [True: 1.31M, False: 951] ------------------ 181| 1.31M| t[i] = pi[i]; 182| 1.31M| t[i] <<= 16; 183| 1.31M| t[i] |= x[i]; 184| 1.31M| } 185| | 186| 951| int32_sort(t, n); ------------------ | | 6| 951|#define int32_sort CRYPTO_NAMESPACE(int32_sort) | | ------------------ | | | | 4| 951|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_AVX2_ ## fun | | ------------------ ------------------ 187| | 188| 1.31M| for (i = 0; i < n; ++i) { ------------------ | Branch (188:17): [True: 1.31M, False: 951] ------------------ 189| 1.31M| y[i] = t[i] & 0xFFFF; 190| 1.31M| } 191| 951|} pk_gen.c:sort_rows: 107| 7.50M|static void sort_rows(int n, int bound, uint16_t *x, vec256 (*mat)[par_width], int off) { 108| 7.50M| if (n <= 1) { ------------------ | Branch (108:9): [True: 3.75M, False: 3.75M] ------------------ 109| 3.75M| return; 110| 3.75M| } 111| 3.75M| sort_rows(n / 2, bound, x, mat, off); 112| 3.75M| sort_rows(n / 2, bound, x, mat, off + n / 2); 113| 3.75M| merge_rows(n / 2, bound, x, mat, off, 1); 114| 3.75M|} pk_gen.c:merge_rows: 89| 37.3M|static void merge_rows(int n, int bound, uint16_t *x, vec256 (*mat)[par_width], int off, int step) { 90| 37.3M| int i; 91| | 92| 37.3M| if (n == 1) { ------------------ | Branch (92:9): [True: 20.5M, False: 16.8M] ------------------ 93| 20.5M| if (off + step < bound) { ------------------ | Branch (93:13): [True: 14.4M, False: 6.10M] ------------------ 94| 14.4M| minmax_rows(x, mat, off, off + step); 95| 14.4M| } 96| 20.5M| } else { 97| 16.8M| merge_rows(n / 2, bound, x, mat, off, step * 2); 98| 16.8M| merge_rows(n / 2, bound, x, mat, off + step, step * 2); 99| | 100| 80.7M| for (i = 1; i < 2 * n - 1 && off + (i + 1) * step < bound; i += 2) { ------------------ | Branch (100:21): [True: 69.0M, False: 11.6M] | Branch (100:38): [True: 63.9M, False: 5.16M] ------------------ 101| 63.9M| minmax_rows(x, mat, off + i * step, off + (i + 1)*step); 102| 63.9M| } 103| 16.8M| } 104| 37.3M|} pk_gen.c:minmax_rows: 70| 78.3M|static inline void minmax_rows(uint16_t *x, vec256 (*mat)[par_width], int i0, int i1) { 71| 78.3M| int i; 72| 78.3M| uint16_t m; 73| 78.3M| vec256 mm; 74| | 75| 78.3M| m = x[i1] - x[i0]; 76| 78.3M| m >>= 15; 77| 78.3M| m = -m; 78| 78.3M| mm = vec256_set1_16b(m); 79| | 80| 78.3M| uint16_cswap(&x[i0], &x[i1], m); 81| | 82| 801M| for (i = 0; i < par_width; i++) { ------------------ | | 29| 801M|#define par_width 11 ------------------ | Branch (82:17): [True: 723M, False: 78.3M] ------------------ 83| 723M| vec256_cswap(&mat[i0][i], &mat[i1][i], mm); 84| 723M| } 85| 78.3M|} PQCLEAN_MCELIECE348864_AVX2_genpoly_gen: 55| 1.05k|int genpoly_gen(gf *out, gf *f) { 56| 1.05k| int i, j, k; 57| | 58| 1.05k| gf t, inv; 59| | 60| 1.05k| vec v[ GFBITS ], buf[ GFBITS ][ 64 ], mat[ 64 ][ GFBITS ], mask; 61| | 62| | // fill matrix 63| | 64| 1.05k| buf[0][0] = 1; 65| 12.6k| for (i = 1; i < GFBITS; i++) { ------------------ | | 6| 12.6k|#define GFBITS 12 ------------------ | Branch (65:17): [True: 11.5k, False: 1.05k] ------------------ 66| 11.5k| buf[i][0] = 0; 67| 11.5k| } 68| | 69| 13.6k| for (j = 0; j < GFBITS; j++) { ------------------ | | 6| 13.6k|#define GFBITS 12 ------------------ | Branch (69:17): [True: 12.6k, False: 1.05k] ------------------ 70| 819k| for (i = SYS_T - 1; i >= 0; i--) { ------------------ | | 8| 12.6k|#define SYS_T 64 ------------------ | Branch (70:29): [True: 806k, False: 12.6k] ------------------ 71| 806k| v[j] <<= 1; 72| 806k| v[j] |= (f[i] >> j) & 1; 73| 806k| } 74| 12.6k| } 75| | 76| 13.6k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 13.6k|#define GFBITS 12 ------------------ | Branch (76:17): [True: 12.6k, False: 1.05k] ------------------ 77| 12.6k| buf[i][1] = v[i]; 78| 12.6k| } 79| | 80| 67.2k| for (k = 2; k <= SYS_T; k++) { ------------------ | | 8| 67.2k|#define SYS_T 64 ------------------ | Branch (80:17): [True: 66.1k, False: 1.05k] ------------------ 81| 66.1k| vec_GF_mul(v, v, f); ------------------ | | 6| 66.1k|#define vec_GF_mul CRYPTO_NAMESPACE(vec_GF_mul) | | ------------------ | | | | 4| 66.1k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_AVX2_ ## fun | | ------------------ ------------------ 82| | 83| 66.1k| if (k < SYS_T) { ------------------ | | 8| 66.1k|#define SYS_T 64 ------------------ | Branch (83:13): [True: 65.1k, False: 1.05k] ------------------ 84| 846k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 846k|#define GFBITS 12 ------------------ | Branch (84:25): [True: 781k, False: 65.1k] ------------------ 85| 781k| buf[i][k] = v[i]; 86| 781k| } 87| 65.1k| } else { 88| 68.2k| for (i = 0; i < SYS_T; i++) { ------------------ | | 8| 68.2k|#define SYS_T 64 ------------------ | Branch (88:25): [True: 67.2k, False: 1.05k] ------------------ 89| 67.2k| out[i] = extract_gf(v, i); 90| 67.2k| } 91| 1.05k| } 92| 66.1k| } 93| | 94| 13.6k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 13.6k|#define GFBITS 12 ------------------ | Branch (94:17): [True: 12.6k, False: 1.05k] ------------------ 95| 12.6k| transpose_64x64(buf[i]); 96| 12.6k| } 97| | 98| 68.2k| for (j = 0; j < SYS_T; j++) { ------------------ | | 8| 68.2k|#define SYS_T 64 ------------------ | Branch (98:17): [True: 67.2k, False: 1.05k] ------------------ 99| 873k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 873k|#define GFBITS 12 ------------------ | Branch (99:21): [True: 806k, False: 67.2k] ------------------ 100| 806k| mat[j][i] = buf[i][j]; 101| 806k| } 102| 67.2k| } 103| | 104| | // gaussian 105| | 106| 68.2k| for (i = 0; i < SYS_T; i++) { ------------------ | | 8| 68.2k|#define SYS_T 64 ------------------ | Branch (106:17): [True: 67.2k, False: 1.05k] ------------------ 107| 2.18M| for (j = i + 1; j < SYS_T; j++) { ------------------ | | 8| 2.18M|#define SYS_T 64 ------------------ | Branch (107:25): [True: 2.11M, False: 67.2k] ------------------ 108| 2.11M| mask = extract_bit(mat[i], i); 109| 2.11M| mask -= 1; 110| | 111| 27.5M| for (k = 0; k < GFBITS; k++) { ------------------ | | 6| 27.5M|#define GFBITS 12 ------------------ | Branch (111:25): [True: 25.4M, False: 2.11M] ------------------ 112| 25.4M| mat[i][k] ^= mat[j][k] & mask; 113| 25.4M| } 114| | 115| 2.11M| out[i] ^= out[j] & mask; 116| 2.11M| } 117| | 118| | // 119| | 120| 67.2k| t = extract_gf(mat[i], i); 121| | 122| 67.2k| if (gf_is_zero_declassify(t)) { ------------------ | Branch (122:13): [True: 0, False: 67.2k] ------------------ 123| 0| return -1; // return if not systematic 124| 0| } 125| | 126| | // 127| | 128| 67.2k| inv = gf_inv(t); ------------------ | | 11| 67.2k|#define gf_inv CRYPTO_NAMESPACE(gf_inv) | | ------------------ | | | | 4| 67.2k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_AVX2_ ## fun | | ------------------ ------------------ 129| 67.2k| vec_mul_gf(mat[i], mat[i], inv); 130| | 131| 67.2k| out[i] = gf_mul(out[i], inv); ------------------ | | 14| 67.2k|#define gf_mul CRYPTO_NAMESPACE(gf_mul) | | ------------------ | | | | 4| 67.2k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_AVX2_ ## fun | | ------------------ ------------------ 132| | 133| 4.36M| for (j = 0; j < SYS_T; j++) { ------------------ | | 8| 4.36M|#define SYS_T 64 ------------------ | Branch (133:21): [True: 4.30M, False: 67.2k] ------------------ 134| 4.30M| if (j != i) { ------------------ | Branch (134:17): [True: 4.23M, False: 67.2k] ------------------ 135| 4.23M| t = extract_gf(mat[j], i); 136| | 137| 4.23M| vec_mul_gf(v, mat[i], t); 138| 4.23M| vec_add(mat[j], mat[j], v); 139| | 140| 4.23M| out[j] ^= gf_mul(out[i], t); ------------------ | | 14| 4.23M|#define gf_mul CRYPTO_NAMESPACE(gf_mul) | | ------------------ | | | | 4| 4.23M|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_AVX2_ ## fun | | ------------------ ------------------ 141| 4.23M| } 142| 4.30M| } 143| 67.2k| } 144| | 145| 1.05k| return 0; 146| 1.05k|} sk_gen.c:extract_gf: 26| 65.9M|static inline gf extract_gf(const vec v[GFBITS], int idx) { 27| 65.9M| int i; 28| 65.9M| gf ret; 29| | 30| 65.9M| ret = 0; 31| 918M| for (i = GFBITS - 1; i >= 0; i--) { ------------------ | | 6| 65.9M|#define GFBITS 12 ------------------ | Branch (31:26): [True: 852M, False: 65.9M] ------------------ 32| 852M| ret <<= 1; 33| 852M| ret |= (v[i] >> idx) & 1; 34| 852M| } 35| | 36| 65.9M| return ret; 37| 65.9M|} sk_gen.c:extract_bit: 40| 32.3M|static inline vec extract_bit(const vec v[GFBITS], int idx) { 41| 32.3M| int i; 42| 32.3M| vec ret; 43| | 44| 32.3M| ret = 0; 45| 450M| for (i = GFBITS - 1; i >= 0; i--) { ------------------ | | 6| 32.3M|#define GFBITS 12 ------------------ | Branch (45:26): [True: 418M, False: 32.3M] ------------------ 46| 418M| ret |= v[i]; 47| 418M| } 48| | 49| 32.3M| return (ret >> idx) & 1; 50| 32.3M|} sk_gen.c:transpose_64x64: 19| 242k|static inline void transpose_64x64(uint64_t *in) { 20| 242k| transpose_64x64_asm(in); ------------------ | | 11| 242k|#define transpose_64x64_asm CRYPTO_NAMESPACE(transpose_64x64_asm) | | ------------------ | | | | 4| 242k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_AVX2_ ## fun | | ------------------ ------------------ 21| 242k|} fft_tr.c:transpose_64x256_sp: 25| 11.8k|static inline void transpose_64x256_sp(vec256 *in) { 26| 11.8k| transpose_64x256_sp_asm(in); ------------------ | | 10| 11.8k|#define transpose_64x256_sp_asm CRYPTO_NAMESPACE(transpose_64x256_sp_asm) | | ------------------ | | | | 4| 11.8k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_AVX2_ ## fun | | ------------------ ------------------ 27| 11.8k|} benes.c:transpose_64x64: 19| 3.62k|static inline void transpose_64x64(uint64_t *in) { 20| 3.62k| transpose_64x64_asm(in); ------------------ | | 11| 3.62k|#define transpose_64x64_asm CRYPTO_NAMESPACE(transpose_64x64_asm) | | ------------------ | | | | 4| 3.62k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_AVX2_ ## fun | | ------------------ ------------------ 21| 3.62k|} operations.c:load_gf: 27| 587k|static inline uint16_t load_gf(const unsigned char *src) { 28| 587k| uint16_t a; 29| | 30| 587k| a = src[1]; 31| 587k| a <<= 8; 32| 587k| a |= src[0]; 33| | 34| 587k| return a & GFMASK; ------------------ | | 19| 587k|#define GFMASK ((1 << GFBITS) - 1) | | ------------------ | | | | 6| 587k|#define GFBITS 12 | | ------------------ ------------------ 35| 587k|} operations.c:store_gf: 22| 587k|static inline void store_gf(unsigned char *dest, gf a) { 23| 587k| dest[0] = a & 0xFF; 24| 587k| dest[1] = a >> 8; 25| 587k|} operations.c:load4: 37| 40.8M|static inline uint32_t load4(const unsigned char *src) { 38| 40.8M| uint32_t a; 39| | 40| 40.8M| a = src[3]; 41| 40.8M| a <<= 8; 42| 40.8M| a |= src[2]; 43| 40.8M| a <<= 8; 44| 40.8M| a |= src[1]; 45| 40.8M| a <<= 8; 46| 40.8M| a |= src[0]; 47| | 48| 40.8M| return a; 49| 40.8M|} operations.c:store8: 73| 951|static inline void store8(unsigned char *out, uint64_t in) { 74| 951| out[0] = (in >> 0x00) & 0xFF; 75| 951| out[1] = (in >> 0x08) & 0xFF; 76| 951| out[2] = (in >> 0x10) & 0xFF; 77| 951| out[3] = (in >> 0x18) & 0xFF; 78| 951| out[4] = (in >> 0x20) & 0xFF; 79| 951| out[5] = (in >> 0x28) & 0xFF; 80| 951| out[6] = (in >> 0x30) & 0xFF; 81| 951| out[7] = (in >> 0x38) & 0xFF; 82| 951|} pk_gen.c:irr_load: 51| 1.15k|static inline void irr_load(uint64_t *out, const unsigned char *in) { 52| 1.15k| int i, j; 53| 1.15k| uint16_t irr[ SYS_T + 1 ]; 54| | 55| 75.0k| for (i = 0; i < SYS_T; i++) { ------------------ | | 8| 75.0k|#define SYS_T 64 ------------------ | Branch (55:17): [True: 73.9k, False: 1.15k] ------------------ 56| 73.9k| irr[i] = load_gf(in + i * 2); 57| 73.9k| } 58| | 59| 1.15k| irr[ SYS_T ] = 1; ------------------ | | 8| 1.15k|#define SYS_T 64 ------------------ 60| | 61| 15.0k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 15.0k|#define GFBITS 12 ------------------ | Branch (61:17): [True: 13.8k, False: 1.15k] ------------------ 62| 13.8k| out[i] = 0; 63| 13.8k| } 64| | 65| 76.2k| for (i = SYS_T; i >= 0; i--) { ------------------ | | 8| 1.15k|#define SYS_T 64 ------------------ | Branch (65:21): [True: 75.0k, False: 1.15k] ------------------ 66| 975k| for (j = 0; j < GFBITS; j++) { ------------------ | | 6| 975k|#define GFBITS 12 ------------------ | Branch (66:21): [True: 900k, False: 75.0k] ------------------ 67| 900k| out[j] <<= 1; 68| 900k| out[j] |= (irr[i] >> j) & 1; 69| 900k| } 70| 75.0k| } 71| 1.15k|} pk_gen.c:load_gf: 27| 587k|static inline uint16_t load_gf(const unsigned char *src) { 28| 587k| uint16_t a; 29| | 30| 587k| a = src[1]; 31| 587k| a <<= 8; 32| 587k| a |= src[0]; 33| | 34| 587k| return a & GFMASK; ------------------ | | 19| 587k|#define GFMASK ((1 << GFBITS) - 1) | | ------------------ | | | | 6| 587k|#define GFBITS 12 | | ------------------ ------------------ 35| 587k|} pk_gen.c:store8: 73| 99.2M|static inline void store8(unsigned char *out, uint64_t in) { 74| 99.2M| out[0] = (in >> 0x00) & 0xFF; 75| 99.2M| out[1] = (in >> 0x08) & 0xFF; 76| 99.2M| out[2] = (in >> 0x10) & 0xFF; 77| 99.2M| out[3] = (in >> 0x18) & 0xFF; 78| 99.2M| out[4] = (in >> 0x20) & 0xFF; 79| 99.2M| out[5] = (in >> 0x28) & 0xFF; 80| 99.2M| out[6] = (in >> 0x30) & 0xFF; 81| 99.2M| out[7] = (in >> 0x38) & 0xFF; 82| 99.2M|} pk_gen.c:store_i: 14| 1.04M|static inline void store_i(unsigned char *out, uint64_t in, int i) { 15| 1.04M| int j; 16| | 17| 5.55M| for (j = 0; j < i; j++) { ------------------ | Branch (17:17): [True: 4.50M, False: 1.04M] ------------------ 18| 4.50M| out[j] = (in >> (j * 8)) & 0xFF; 19| 4.50M| } 20| 1.04M|} decrypt.c:load16: 105| 46.9k|static inline vec128 load16(const unsigned char *in) { 106| 46.9k| return vec128_set2x( load8(in), load8(in + 8) ); 107| 46.9k|} decrypt.c:load8: 84| 93.8k|static inline uint64_t load8(const unsigned char *in) { 85| 93.8k| int i; 86| 93.8k| uint64_t ret = in[7]; 87| | 88| 750k| for (i = 6; i >= 0; i--) { ------------------ | Branch (88:17): [True: 656k, False: 93.8k] ------------------ 89| 656k| ret <<= 8; 90| 656k| ret |= in[i]; 91| 656k| } 92| | 93| 93.8k| return ret; 94| 93.8k|} decrypt.c:irr_load: 51| 181|static inline void irr_load(uint64_t *out, const unsigned char *in) { 52| 181| int i, j; 53| 181| uint16_t irr[ SYS_T + 1 ]; 54| | 55| 11.7k| for (i = 0; i < SYS_T; i++) { ------------------ | | 8| 11.7k|#define SYS_T 64 ------------------ | Branch (55:17): [True: 11.5k, False: 181] ------------------ 56| 11.5k| irr[i] = load_gf(in + i * 2); 57| 11.5k| } 58| | 59| 181| irr[ SYS_T ] = 1; ------------------ | | 8| 181|#define SYS_T 64 ------------------ 60| | 61| 2.35k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 2.35k|#define GFBITS 12 ------------------ | Branch (61:17): [True: 2.17k, False: 181] ------------------ 62| 2.17k| out[i] = 0; 63| 2.17k| } 64| | 65| 11.9k| for (i = SYS_T; i >= 0; i--) { ------------------ | | 8| 181|#define SYS_T 64 ------------------ | Branch (65:21): [True: 11.7k, False: 181] ------------------ 66| 152k| for (j = 0; j < GFBITS; j++) { ------------------ | | 6| 152k|#define GFBITS 12 ------------------ | Branch (66:21): [True: 141k, False: 11.7k] ------------------ 67| 141k| out[j] <<= 1; 68| 141k| out[j] |= (irr[i] >> j) & 1; 69| 141k| } 70| 11.7k| } 71| 181|} decrypt.c:load_gf: 27| 101k|static inline uint16_t load_gf(const unsigned char *src) { 28| 101k| uint16_t a; 29| | 30| 101k| a = src[1]; 31| 101k| a <<= 8; 32| 101k| a |= src[0]; 33| | 34| 101k| return a & GFMASK; ------------------ | | 19| 101k|#define GFMASK ((1 << GFBITS) - 1) | | ------------------ | | | | 6| 101k|#define GFBITS 12 | | ------------------ ------------------ 35| 101k|} decrypt.c:store8: 73| 110k|static inline void store8(unsigned char *out, uint64_t in) { 74| 110k| out[0] = (in >> 0x00) & 0xFF; 75| 110k| out[1] = (in >> 0x08) & 0xFF; 76| 110k| out[2] = (in >> 0x10) & 0xFF; 77| 110k| out[3] = (in >> 0x18) & 0xFF; 78| 110k| out[4] = (in >> 0x20) & 0xFF; 79| 110k| out[5] = (in >> 0x28) & 0xFF; 80| 110k| out[6] = (in >> 0x30) & 0xFF; 81| 110k| out[7] = (in >> 0x38) & 0xFF; 82| 110k|} encrypt.c:load_gf: 27| 995k|static inline uint16_t load_gf(const unsigned char *src) { 28| 995k| uint16_t a; 29| | 30| 995k| a = src[1]; 31| 995k| a <<= 8; 32| 995k| a |= src[0]; 33| | 34| 995k| return a & GFMASK; ------------------ | | 19| 995k|#define GFMASK ((1 << GFBITS) - 1) | | ------------------ | | | | 6| 995k|#define GFBITS 12 | | ------------------ ------------------ 35| 995k|} encrypt.c:store8: 73| 88.1k|static inline void store8(unsigned char *out, uint64_t in) { 74| 88.1k| out[0] = (in >> 0x00) & 0xFF; 75| 88.1k| out[1] = (in >> 0x08) & 0xFF; 76| 88.1k| out[2] = (in >> 0x10) & 0xFF; 77| 88.1k| out[3] = (in >> 0x18) & 0xFF; 78| 88.1k| out[4] = (in >> 0x20) & 0xFF; 79| 88.1k| out[5] = (in >> 0x28) & 0xFF; 80| 88.1k| out[6] = (in >> 0x30) & 0xFF; 81| 88.1k| out[7] = (in >> 0x38) & 0xFF; 82| 88.1k|} benes.c:load4: 37| 139k|static inline uint32_t load4(const unsigned char *src) { 38| 139k| uint32_t a; 39| | 40| 139k| a = src[3]; 41| 139k| a <<= 8; 42| 139k| a |= src[2]; 43| 139k| a <<= 8; 44| 139k| a |= src[1]; 45| 139k| a <<= 8; 46| 139k| a |= src[0]; 47| | 48| 139k| return a; 49| 139k|} benes.c:load8: 84| 1.29M|static inline uint64_t load8(const unsigned char *in) { 85| 1.29M| int i; 86| 1.29M| uint64_t ret = in[7]; 87| | 88| 10.3M| for (i = 6; i >= 0; i--) { ------------------ | Branch (88:17): [True: 9.06M, False: 1.29M] ------------------ 89| 9.06M| ret <<= 8; 90| 9.06M| ret |= in[i]; 91| 9.06M| } 92| | 93| 1.29M| return ret; 94| 1.29M|} PQCLEAN_MCELIECE348864_AVX2_vec_GF_mul: 6| 66.1k|void vec_GF_mul(vec out[ GFBITS ], vec v[ GFBITS ], gf a[ SYS_T ]) { 7| 66.1k| int i, j; 8| 66.1k| vec buf[GFBITS][2], prod[GFBITS], tmp[GFBITS]; 9| | 10| 66.1k| const vec allone = -1; 11| | 12| | // polynomial multiplication 13| | 14| 859k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 859k|#define GFBITS 12 ------------------ | Branch (14:17): [True: 793k, False: 66.1k] ------------------ 15| 793k| buf[i][0] = 0; 16| 793k| buf[i][1] = 0; 17| 793k| } 18| | 19| 4.29M| for (i = SYS_T - 1; i >= 0; i--) { ------------------ | | 8| 66.1k|#define SYS_T 64 ------------------ | Branch (19:25): [True: 4.23M, False: 66.1k] ------------------ 20| 55.0M| for (j = 0; j < GFBITS; j++) { ------------------ | | 6| 55.0M|#define GFBITS 12 ------------------ | Branch (20:21): [True: 50.8M, False: 4.23M] ------------------ 21| 50.8M| buf[j][1] <<= 1; 22| 50.8M| buf[j][1] |= buf[j][0] >> 63; 23| 50.8M| buf[j][0] <<= 1; 24| 50.8M| } 25| | 26| 4.23M| vec_mul_gf(prod, v, a[i]); 27| | 28| 55.0M| for (j = 0; j < GFBITS; j++) { ------------------ | | 6| 55.0M|#define GFBITS 12 ------------------ | Branch (28:21): [True: 50.8M, False: 4.23M] ------------------ 29| 50.8M| buf[j][0] ^= prod[j]; 30| 50.8M| } 31| 4.23M| } 32| | 33| | // reduction modulo y^64 + y^3 + y + z 34| | 35| 859k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 859k|#define GFBITS 12 ------------------ | Branch (35:17): [True: 793k, False: 66.1k] ------------------ 36| 793k| prod[i] = buf[i][1] & (allone << 3); 37| 793k| } 38| | 39| 66.1k| vec_mul_gf(tmp, prod, 2); 40| | 41| 859k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 859k|#define GFBITS 12 ------------------ | Branch (41:17): [True: 793k, False: 66.1k] ------------------ 42| 793k| buf[i][1] ^= prod[i] >> (SYS_T - 3); ------------------ | | 8| 793k|#define SYS_T 64 ------------------ 43| 793k| buf[i][0] ^= prod[i] << (64 - (SYS_T - 3)); ------------------ | | 8| 793k|#define SYS_T 64 ------------------ 44| 793k| buf[i][1] ^= prod[i] >> (SYS_T - 1); ------------------ | | 8| 793k|#define SYS_T 64 ------------------ 45| 793k| buf[i][0] ^= prod[i] << (64 - (SYS_T - 1)); ------------------ | | 8| 793k|#define SYS_T 64 ------------------ 46| 793k| buf[i][0] ^= tmp[i]; 47| 793k| } 48| | 49| | // 50| | 51| 859k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 859k|#define GFBITS 12 ------------------ | Branch (51:17): [True: 793k, False: 66.1k] ------------------ 52| 793k| prod[i] = buf[i][1] & 0x7; 53| 793k| } 54| | 55| 66.1k| vec_mul_gf(tmp, prod, 2); 56| | 57| 859k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 859k|#define GFBITS 12 ------------------ | Branch (57:17): [True: 793k, False: 66.1k] ------------------ 58| 793k| buf[i][0] ^= prod[i] << (64 - (SYS_T - 3)); ------------------ | | 8| 793k|#define SYS_T 64 ------------------ 59| 793k| buf[i][0] ^= prod[i] << (64 - (SYS_T - 1)); ------------------ | | 8| 793k|#define SYS_T 64 ------------------ 60| 793k| buf[i][0] ^= tmp[i]; 61| 793k| } 62| | 63| | // 64| | 65| 859k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 859k|#define GFBITS 12 ------------------ | Branch (65:17): [True: 793k, False: 66.1k] ------------------ 66| 793k| out[i] = buf[i][0]; 67| 793k| } 68| 66.1k|} sk_gen.c:vec_mul_gf: 37| 4.73M|static inline void vec_mul_gf(vec out[ GFBITS ], vec v[ GFBITS ], gf a) { 38| 4.73M| int i; 39| | 40| 4.73M| vec bits[GFBITS]; 41| | 42| 61.5M| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 61.5M|#define GFBITS 12 ------------------ | Branch (42:17): [True: 56.7M, False: 4.73M] ------------------ 43| 56.7M| bits[i] = -((a >> i) & 1); 44| 56.7M| } 45| | 46| 4.73M| vec_mul_asm(out, v, bits); ------------------ | | 7| 4.73M|#define vec_mul_asm CRYPTO_NAMESPACE(vec_mul_asm) | | ------------------ | | | | 4| 4.73M|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_AVX2_ ## fun | | ------------------ ------------------ 47| 4.73M|} sk_gen.c:vec_add: 29| 4.65M|static inline void vec_add(vec *h, const vec *f, const vec *g) { 30| 4.65M| int b; 31| | 32| 60.5M| for (b = 0; b < GFBITS; b++) { ------------------ | | 6| 60.5M|#define GFBITS 12 ------------------ | Branch (32:17): [True: 55.8M, False: 4.65M] ------------------ 33| 55.8M| h[b] = f[b] ^ g[b]; 34| 55.8M| } 35| 4.65M|} vec.c:vec_mul_gf: 37| 4.80M|static inline void vec_mul_gf(vec out[ GFBITS ], vec v[ GFBITS ], gf a) { 38| 4.80M| int i; 39| | 40| 4.80M| vec bits[GFBITS]; 41| | 42| 62.4M| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 62.4M|#define GFBITS 12 ------------------ | Branch (42:17): [True: 57.6M, False: 4.80M] ------------------ 43| 57.6M| bits[i] = -((a >> i) & 1); 44| 57.6M| } 45| | 46| 4.80M| vec_mul_asm(out, v, bits); ------------------ | | 7| 4.80M|#define vec_mul_asm CRYPTO_NAMESPACE(vec_mul_asm) | | ------------------ | | | | 4| 4.80M|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_AVX2_ ## fun | | ------------------ ------------------ 47| 4.80M|} fft.c:vec_mul: 19| 7.58k|static inline void vec_mul(vec *h, const vec *f, const vec *g) { 20| 7.58k| vec_mul_asm(h, f, g); ------------------ | | 7| 7.58k|#define vec_mul_asm CRYPTO_NAMESPACE(vec_mul_asm) | | ------------------ | | | | 4| 7.58k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_AVX2_ ## fun | | ------------------ ------------------ 21| 7.58k|} fft_tr.c:vec_mul: 19| 2.17k|static inline void vec_mul(vec *h, const vec *f, const vec *g) { 20| 2.17k| vec_mul_asm(h, f, g); ------------------ | | 7| 2.17k|#define vec_mul_asm CRYPTO_NAMESPACE(vec_mul_asm) | | ------------------ | | | | 4| 2.17k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_AVX2_ ## fun | | ------------------ ------------------ 21| 2.17k|} fft_tr.c:vec_add: 29| 1.81k|static inline void vec_add(vec *h, const vec *f, const vec *g) { 30| 1.81k| int b; 31| | 32| 23.5k| for (b = 0; b < GFBITS; b++) { ------------------ | | 6| 23.5k|#define GFBITS 12 ------------------ | Branch (32:17): [True: 21.7k, False: 1.81k] ------------------ 33| 21.7k| h[b] = f[b] ^ g[b]; 34| 21.7k| } 35| 1.81k|} bm.c:vec_mul_sp: 25| 23.3k|static inline void vec_mul_sp(vec *h, const vec *f, const vec *g) { 26| 23.3k| vec_mul_sp_asm(h, f, g); ------------------ | | 8| 23.3k|#define vec_mul_sp_asm CRYPTO_NAMESPACE(vec_mul_sp_asm) | | ------------------ | | | | 4| 23.3k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_AVX2_ ## fun | | ------------------ ------------------ 27| 23.3k|} decrypt.c:vec128_set2x: 49| 111k|static inline vec128 vec128_set2x(uint64_t a0, uint64_t a1) { 50| 111k| return _mm_set_epi64x(a1, a0); 51| 111k|} decrypt.c:vec128_xor: 38| 2.17k|static inline vec128 vec128_xor(vec128 a, vec128 b) { 39| 2.17k| return _mm_xor_si128(a, b); 40| 2.17k|} decrypt.c:vec128_or: 42| 1.99k|static inline vec128 vec128_or(vec128 a, vec128 b) { 43| 1.99k| return _mm_or_si128(a, b); 44| 1.99k|} decrypt.c:vec128_testz: 30| 181|static inline int vec128_testz(vec128 a) { 31| 181| return _mm_testz_si128(a, a); 32| 181|} fft_tr.c:vec128_set2x: 49| 55.7k|static inline vec128 vec128_set2x(uint64_t a0, uint64_t a1) { 50| 55.7k| return _mm_set_epi64x(a1, a0); 51| 55.7k|} fft_tr.c:vec128_mul: 96| 11.0k|static inline void vec128_mul(vec128 *h, vec128 *f, const vec128 *g) { 97| 11.0k| vec128_mul_asm(h, f, g, 16); ------------------ | | 10| 11.0k|#define vec128_mul_asm CRYPTO_NAMESPACE(vec128_mul_asm) | | ------------------ | | | | 4| 11.0k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_AVX2_ ## fun | | ------------------ ------------------ 98| 11.0k|} bm.c:vec128_setzero: 24| 20.3k|static inline vec128 vec128_setzero(void) { 25| 20.3k| return _mm_setzero_si128(); 26| 20.3k|} bm.c:vec128_set1_16b: 20| 362k|static inline vec128 vec128_set1_16b(uint16_t a) { 21| 362k| return _mm_set1_epi16(a); 22| 362k|} bm.c:vec128_or: 42| 2.35M|static inline vec128 vec128_or(vec128 a, vec128 b) { 43| 2.35M| return _mm_or_si128(a, b); 44| 2.35M|} bm.c:vec128_and: 34| 4.71M|static inline vec128 vec128_and(vec128 a, vec128 b) { 35| 4.71M| return _mm_and_si128(a, b); 36| 4.71M|} bm.c:vec128_mul: 96| 23.1k|static inline void vec128_mul(vec128 *h, vec128 *f, const vec128 *g) { 97| 23.1k| vec128_mul_asm(h, f, g, 16); ------------------ | | 10| 23.1k|#define vec128_mul_asm CRYPTO_NAMESPACE(vec128_mul_asm) | | ------------------ | | | | 4| 23.1k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_AVX2_ ## fun | | ------------------ ------------------ 98| 23.1k|} PQCLEAN_MCELIECE348864_AVX2_vec256_sq: 9| 14.1k|void vec256_sq(vec256 *out, vec256 *in) { 10| 14.1k| int i; 11| 14.1k| vec256 result[GFBITS]; 12| | 13| 14.1k| result[0] = in[0] ^ in[6]; 14| 14.1k| result[1] = in[11]; 15| 14.1k| result[2] = in[1] ^ in[7]; 16| 14.1k| result[3] = in[6]; 17| 14.1k| result[4] = in[2] ^ in[11] ^ in[8]; 18| 14.1k| result[5] = in[7]; 19| 14.1k| result[6] = in[3] ^ in[9]; 20| 14.1k| result[7] = in[8]; 21| 14.1k| result[8] = in[4] ^ in[10]; 22| 14.1k| result[9] = in[9]; 23| 14.1k| result[10] = in[5] ^ in[11]; 24| 14.1k| result[11] = in[10]; 25| | 26| 184k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 184k|#define GFBITS 12 ------------------ | Branch (26:17): [True: 170k, False: 14.1k] ------------------ 27| 170k| out[i] = result[i]; 28| 170k| } 29| 14.1k|} PQCLEAN_MCELIECE348864_AVX2_vec256_inv: 32| 1.14k|void vec256_inv(vec256 *out, vec256 *in) { 33| 1.14k| vec256 tmp_11[ GFBITS ]; 34| 1.14k| vec256 tmp_1111[ GFBITS ]; 35| | 36| 1.14k| vec256_copy(out, in); 37| | 38| 1.14k| vec256_sq(out, out); ------------------ | | 14| 1.14k|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 1.14k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_AVX2_ ## fun | | ------------------ ------------------ 39| 1.14k| vec256_mul(tmp_11, out, in); // ^11 40| | 41| 1.14k| vec256_sq(out, tmp_11); ------------------ | | 14| 1.14k|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 1.14k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_AVX2_ ## fun | | ------------------ ------------------ 42| 1.14k| vec256_sq(out, out); ------------------ | | 14| 1.14k|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 1.14k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_AVX2_ ## fun | | ------------------ ------------------ 43| 1.14k| vec256_mul(tmp_1111, out, tmp_11); // ^1111 44| | 45| 1.14k| vec256_sq(out, tmp_1111); ------------------ | | 14| 1.14k|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 1.14k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_AVX2_ ## fun | | ------------------ ------------------ 46| 1.14k| vec256_sq(out, out); ------------------ | | 14| 1.14k|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 1.14k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_AVX2_ ## fun | | ------------------ ------------------ 47| 1.14k| vec256_sq(out, out); ------------------ | | 14| 1.14k|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 1.14k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_AVX2_ ## fun | | ------------------ ------------------ 48| 1.14k| vec256_sq(out, out); ------------------ | | 14| 1.14k|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 1.14k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_AVX2_ ## fun | | ------------------ ------------------ 49| 1.14k| vec256_mul(out, out, tmp_1111); // ^11111111 50| | 51| 1.14k| vec256_sq(out, out); ------------------ | | 14| 1.14k|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 1.14k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_AVX2_ ## fun | | ------------------ ------------------ 52| 1.14k| vec256_sq(out, out); ------------------ | | 14| 1.14k|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 1.14k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_AVX2_ ## fun | | ------------------ ------------------ 53| 1.14k| vec256_mul(out, out, tmp_11); // ^1111111111 54| 1.14k| vec256_sq(out, out); ------------------ | | 14| 1.14k|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 1.14k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_AVX2_ ## fun | | ------------------ ------------------ 55| 1.14k| vec256_mul(out, out, in); // ^11111111111 56| | 57| 1.14k| vec256_sq(out, out); // ^111111111110 ------------------ | | 14| 1.14k|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 1.14k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_AVX2_ ## fun | | ------------------ ------------------ 58| 1.14k|} pk_gen.c:vec256_copy: 88| 11.1k|static inline void vec256_copy(vec256 *dest, vec256 *src) { 89| 11.1k| int i; 90| | 91| 153k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 153k|#define GFBITS 12 ------------------ | Branch (91:17): [True: 142k, False: 11.1k] ------------------ 92| 142k| dest[i] = src[i]; 93| 142k| } 94| 11.1k|} pk_gen.c:vec256_mul: 99| 5.82M|static inline void vec256_mul(vec256 *h, vec256 *f, const vec256 *g) { 100| 5.82M| vec256_mul_asm(h, f, g); ------------------ | | 13| 5.82M|#define vec256_mul_asm CRYPTO_NAMESPACE(vec256_mul_asm) | | ------------------ | | | | 4| 5.82M|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_AVX2_ ## fun | | ------------------ ------------------ 101| 5.82M|} pk_gen.c:vec256_set4x: 34| 3.89M|static inline vec256 vec256_set4x(uint64_t a0, uint64_t a1, uint64_t a2, uint64_t a3) { 35| 3.89M| return _mm256_set_epi64x(a3, a2, a1, a0); 36| 3.89M|} pk_gen.c:vec256_set1_16b: 22| 5.24G|static inline vec256 vec256_set1_16b(uint16_t a) { 23| 5.24G| return _mm256_set1_epi16(a); 24| 5.24G|} pk_gen.c:vec256_set1_32b: 26| 9.45G|static inline vec256 vec256_set1_32b(uint64_t a) { 27| 9.45G| return _mm256_set1_epi32(a); 28| 9.45G|} vec256.c:vec256_copy: 88| 6.51k|static inline void vec256_copy(vec256 *dest, vec256 *src) { 89| 6.51k| int i; 90| | 91| 89.8k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 89.8k|#define GFBITS 12 ------------------ | Branch (91:17): [True: 83.3k, False: 6.51k] ------------------ 92| 83.3k| dest[i] = src[i]; 93| 83.3k| } 94| 6.51k|} vec256.c:vec256_mul: 99| 27.3k|static inline void vec256_mul(vec256 *h, vec256 *f, const vec256 *g) { 100| 27.3k| vec256_mul_asm(h, f, g); ------------------ | | 13| 27.3k|#define vec256_mul_asm CRYPTO_NAMESPACE(vec256_mul_asm) | | ------------------ | | | | 4| 27.3k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_AVX2_ ## fun | | ------------------ ------------------ 101| 27.3k|} decrypt.c:vec256_set4x: 34| 27.5k|static inline vec256 vec256_set4x(uint64_t a0, uint64_t a1, uint64_t a2, uint64_t a3) { 35| 27.5k| return _mm256_set_epi64x(a3, a2, a1, a0); 36| 27.5k|} decrypt.c:vec256_copy: 88| 1.90k|static inline void vec256_copy(vec256 *dest, vec256 *src) { 89| 1.90k| int i; 90| | 91| 26.2k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 26.2k|#define GFBITS 12 ------------------ | Branch (91:17): [True: 24.3k, False: 1.90k] ------------------ 92| 24.3k| dest[i] = src[i]; 93| 24.3k| } 94| 1.90k|} decrypt.c:vec256_mul: 99| 79.7k|static inline void vec256_mul(vec256 *h, vec256 *f, const vec256 *g) { 100| 79.7k| vec256_mul_asm(h, f, g); ------------------ | | 13| 79.7k|#define vec256_mul_asm CRYPTO_NAMESPACE(vec256_mul_asm) | | ------------------ | | | | 4| 79.7k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_AVX2_ ## fun | | ------------------ ------------------ 101| 79.7k|} decrypt.c:vec256_and: 45| 710k|static inline vec256 vec256_and(vec256 a, vec256 b) { 46| 710k| return _mm256_and_si256(a, b); 47| 710k|} decrypt.c:vec256_set1_16b: 22| 951|static inline vec256 vec256_set1_16b(uint16_t a) { 23| 951| return _mm256_set1_epi16(a); 24| 951|} decrypt.c:vec256_or_reduce: 76| 27.5k|static inline vec256 vec256_or_reduce(vec256 *a) { 77| 27.5k| int i; 78| 27.5k| vec256 ret; 79| | 80| 27.5k| ret = a[0]; 81| 355k| for (i = 1; i < GFBITS; i++) { ------------------ | | 6| 355k|#define GFBITS 12 ------------------ | Branch (81:17): [True: 327k, False: 27.5k] ------------------ 82| 327k| ret = vec256_or(ret, a[i]); 83| 327k| } 84| | 85| 27.5k| return ret; 86| 27.5k|} decrypt.c:vec256_or: 53| 336k|static inline vec256 vec256_or(vec256 a, vec256 b) { 54| 336k| return _mm256_or_si256(a, b); 55| 336k|} decrypt.c:vec256_xor: 49| 37.5k|static inline vec256 vec256_xor(vec256 a, vec256 b) { 50| 37.5k| return _mm256_xor_si256(a, b); 51| 37.5k|} fft.c:vec256_set4x: 34| 4.53M|static inline vec256 vec256_set4x(uint64_t a0, uint64_t a1, uint64_t a2, uint64_t a3) { 35| 4.53M| return _mm256_set_epi64x(a3, a2, a1, a0); 36| 4.53M|} fft.c:vec256_mul: 99| 72.8k|static inline void vec256_mul(vec256 *h, vec256 *f, const vec256 *g) { 100| 72.8k| vec256_mul_asm(h, f, g); ------------------ | | 13| 72.8k|#define vec256_mul_asm CRYPTO_NAMESPACE(vec256_mul_asm) | | ------------------ | | | | 4| 72.8k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_AVX2_ ## fun | | ------------------ ------------------ 101| 72.8k|} fft.c:vec256_unpack_low_2x: 68| 145k|static inline vec256 vec256_unpack_low_2x(vec256 a, vec256 b) { 69| 145k| return _mm256_unpacklo_epi64 (a, b); 70| 145k|} fft.c:vec256_unpack_high_2x: 72| 145k|static inline vec256 vec256_unpack_high_2x(vec256 a, vec256 b) { 73| 145k| return _mm256_unpackhi_epi64 (a, b); 74| 145k|} fft.c:vec256_unpack_low: 60| 3.95M|static inline vec256 vec256_unpack_low(vec256 a, vec256 b) { 61| | return _mm256_permute2x128_si256 (a, b, 0x20); 62| 3.95M|} fft.c:vec256_unpack_high: 64| 3.76M|static inline vec256 vec256_unpack_high(vec256 a, vec256 b) { 65| | return _mm256_permute2x128_si256 (a, b, 0x31); 66| 3.76M|} fft.c:vec256_xor: 49| 4.00M|static inline vec256 vec256_xor(vec256 a, vec256 b) { 50| 4.00M| return _mm256_xor_si256(a, b); 51| 4.00M|} fft_tr.c:vec256_set4x: 34| 1.23M|static inline vec256 vec256_set4x(uint64_t a0, uint64_t a1, uint64_t a2, uint64_t a3) { 35| 1.23M| return _mm256_set_epi64x(a3, a2, a1, a0); 36| 1.23M|} fft_tr.c:vec256_mul: 99| 26.6k|static inline void vec256_mul(vec256 *h, vec256 *f, const vec256 *g) { 100| 26.6k| vec256_mul_asm(h, f, g); ------------------ | | 13| 26.6k|#define vec256_mul_asm CRYPTO_NAMESPACE(vec256_mul_asm) | | ------------------ | | | | 4| 26.6k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_AVX2_ ## fun | | ------------------ ------------------ 101| 26.6k|} fft_tr.c:vec256_unpack_low: 60| 675k|static inline vec256 vec256_unpack_low(vec256 a, vec256 b) { 61| | return _mm256_permute2x128_si256 (a, b, 0x20); 62| 675k|} fft_tr.c:vec256_unpack_high: 64| 675k|static inline vec256 vec256_unpack_high(vec256 a, vec256 b) { 65| | return _mm256_permute2x128_si256 (a, b, 0x31); 66| 675k|} fft_tr.c:vec256_unpack_low_2x: 68| 675k|static inline vec256 vec256_unpack_low_2x(vec256 a, vec256 b) { 69| 675k| return _mm256_unpacklo_epi64 (a, b); 70| 675k|} fft_tr.c:vec256_unpack_high_2x: 72| 675k|static inline vec256 vec256_unpack_high_2x(vec256 a, vec256 b) { 73| 675k| return _mm256_unpackhi_epi64 (a, b); 74| 675k|} fft_tr.c:vec256_xor: 49| 2.02M|static inline vec256 vec256_xor(vec256 a, vec256 b) { 50| 2.02M| return _mm256_xor_si256(a, b); 51| 2.02M|} controlbits.c:cbrecursion: 22| 7.04M|static void cbrecursion(unsigned char *out, long long pos, long long step, const int16 *pi, long long w, long long n, int32 *temp) { 23| 7.04M|#define A temp 24| 7.04M|#define B (temp+n) 25| 7.04M|#define q ((int16 *) (temp+n+n/4)) 26| | /* q can start anywhere between temp+n and temp+n/2 */ 27| | 28| 7.04M| long long x, y, i, j, k; 29| | 30| 7.04M| if (w == 1) { ------------------ | Branch (30:9): [True: 3.52M, False: 3.52M] ------------------ 31| 3.52M| out[pos >> 3] ^= pi[0] << (pos & 7); 32| 3.52M| return; 33| 3.52M| } 34| | 35| 87.3M| for (x = 0; x < n; ++x) { ------------------ | Branch (35:17): [True: 83.8M, False: 3.52M] ------------------ 36| 83.8M| A[x] = ((pi[x] ^ 1) << 16) | pi[x ^ 1]; ------------------ | | 23| 83.8M|#define A temp ------------------ 37| 83.8M| } 38| 3.52M| int32_sort(A, n); /* A = (id<<16)+pibar */ ------------------ | | 6| 3.52M|#define int32_sort CRYPTO_NAMESPACE(int32_sort) | | ------------------ | | | | 4| 3.52M|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_CLEAN_ ## fun | | ------------------ ------------------ int32_sort(A, n); /* A = (id<<16)+pibar */ ------------------ | | 23| 3.52M|#define A temp ------------------ 39| | 40| 87.3M| for (x = 0; x < n; ++x) { ------------------ | Branch (40:17): [True: 83.8M, False: 3.52M] ------------------ 41| 83.8M| int32 Ax = A[x]; ------------------ | | 23| 83.8M|#define A temp ------------------ 42| 83.8M| int32 px = Ax & 0xffff; 43| 83.8M| int32 cx = int32_min(px, (int32)x); ------------------ | | 13| 83.8M|#define int32_min crypto_int32_min | | ------------------ | | | | 23| 83.8M|#define crypto_int32_min CRYPTO_NAMESPACE(crypto_int32_min) | | | | ------------------ | | | | | | 4| 83.8M|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_CLEAN_ ## fun | | | | ------------------ | | ------------------ ------------------ 44| 83.8M| B[x] = ((px) << 16) | cx; ------------------ | | 24| 83.8M|#define B (temp+n) ------------------ 45| 83.8M| } 46| | /* B = (p<<16)+c */ 47| | 48| 87.3M| for (x = 0; x < n; ++x) { ------------------ | Branch (48:17): [True: 83.8M, False: 3.52M] ------------------ 49| 83.8M| A[x] = (int32)((((uint32_t)A[x]) << 16) | x); /* A = (pibar<<16)+id */ ------------------ | | 23| 83.8M|#define A temp ------------------ A[x] = (int32)((((uint32_t)A[x]) << 16) | x); /* A = (pibar<<16)+id */ ------------------ | | 23| 83.8M|#define A temp ------------------ 50| 83.8M| } 51| 3.52M| int32_sort(A, n); /* A = (id<<16)+pibar^-1 */ ------------------ | | 6| 3.52M|#define int32_sort CRYPTO_NAMESPACE(int32_sort) | | ------------------ | | | | 4| 3.52M|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_CLEAN_ ## fun | | ------------------ ------------------ int32_sort(A, n); /* A = (id<<16)+pibar^-1 */ ------------------ | | 23| 3.52M|#define A temp ------------------ 52| | 53| 87.3M| for (x = 0; x < n; ++x) { ------------------ | Branch (53:17): [True: 83.8M, False: 3.52M] ------------------ 54| 83.8M| A[x] = (((uint32_t)A[x]) << 16) + (B[x] >> 16); /* A = (pibar^(-1)<<16)+pibar */ ------------------ | | 23| 83.8M|#define A temp ------------------ A[x] = (((uint32_t)A[x]) << 16) + (B[x] >> 16); /* A = (pibar^(-1)<<16)+pibar */ ------------------ | | 23| 83.8M|#define A temp ------------------ A[x] = (((uint32_t)A[x]) << 16) + (B[x] >> 16); /* A = (pibar^(-1)<<16)+pibar */ ------------------ | | 24| 83.8M|#define B (temp+n) ------------------ 55| 83.8M| } 56| 3.52M| int32_sort(A, n); /* A = (id<<16)+pibar^2 */ ------------------ | | 6| 3.52M|#define int32_sort CRYPTO_NAMESPACE(int32_sort) | | ------------------ | | | | 4| 3.52M|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_CLEAN_ ## fun | | ------------------ ------------------ int32_sort(A, n); /* A = (id<<16)+pibar^2 */ ------------------ | | 23| 3.52M|#define A temp ------------------ 57| | 58| 3.52M| if (w <= 10) { ------------------ | Branch (58:9): [True: 3.51M, False: 5.93k] ------------------ 59| 66.9M| for (x = 0; x < n; ++x) { ------------------ | Branch (59:21): [True: 63.4M, False: 3.51M] ------------------ 60| 63.4M| B[x] = ((A[x] & 0xffff) << 10) | (B[x] & 0x3ff); ------------------ | | 24| 63.4M|#define B (temp+n) ------------------ B[x] = ((A[x] & 0xffff) << 10) | (B[x] & 0x3ff); ------------------ | | 23| 63.4M|#define A temp ------------------ B[x] = ((A[x] & 0xffff) << 10) | (B[x] & 0x3ff); ------------------ | | 24| 63.4M|#define B (temp+n) ------------------ 61| 63.4M| } 62| | 63| 6.97M| for (i = 1; i < w - 1; ++i) { ------------------ | Branch (63:21): [True: 3.45M, False: 3.51M] ------------------ 64| | /* B = (p<<10)+c */ 65| | 66| 257M| for (x = 0; x < n; ++x) { ------------------ | Branch (66:25): [True: 253M, False: 3.45M] ------------------ 67| 253M| A[x] = (int32)(((B[x] & ~0x3ff) << 6) | x); /* A = (p<<16)+id */ ------------------ | | 23| 253M|#define A temp ------------------ A[x] = (int32)(((B[x] & ~0x3ff) << 6) | x); /* A = (p<<16)+id */ ------------------ | | 24| 253M|#define B (temp+n) ------------------ 68| 253M| } 69| 3.45M| int32_sort(A, n); /* A = (id<<16)+p^{-1} */ ------------------ | | 6| 3.45M|#define int32_sort CRYPTO_NAMESPACE(int32_sort) | | ------------------ | | | | 4| 3.45M|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_CLEAN_ ## fun | | ------------------ ------------------ int32_sort(A, n); /* A = (id<<16)+p^{-1} */ ------------------ | | 23| 3.45M|#define A temp ------------------ 70| | 71| 257M| for (x = 0; x < n; ++x) { ------------------ | Branch (71:25): [True: 253M, False: 3.45M] ------------------ 72| 253M| A[x] = ((uint32_t)A[x] << 20) | B[x]; ------------------ | | 23| 253M|#define A temp ------------------ A[x] = ((uint32_t)A[x] << 20) | B[x]; ------------------ | | 23| 253M|#define A temp ------------------ A[x] = ((uint32_t)A[x] << 20) | B[x]; ------------------ | | 24| 253M|#define B (temp+n) ------------------ 73| 253M| } /* A = (p^{-1}<<20)+(p<<10)+c */ 74| 3.45M| int32_sort(A, n); /* A = (id<<20)+(pp<<10)+cp */ ------------------ | | 6| 3.45M|#define int32_sort CRYPTO_NAMESPACE(int32_sort) | | ------------------ | | | | 4| 3.45M|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_CLEAN_ ## fun | | ------------------ ------------------ int32_sort(A, n); /* A = (id<<20)+(pp<<10)+cp */ ------------------ | | 23| 3.45M|#define A temp ------------------ 75| | 76| 257M| for (x = 0; x < n; ++x) { ------------------ | Branch (76:25): [True: 253M, False: 3.45M] ------------------ 77| 253M| int32 ppcpx = A[x] & 0xfffff; ------------------ | | 23| 253M|#define A temp ------------------ 78| 253M| int32 ppcx = (A[x] & 0xffc00) | (B[x] & 0x3ff); ------------------ | | 23| 253M|#define A temp ------------------ int32 ppcx = (A[x] & 0xffc00) | (B[x] & 0x3ff); ------------------ | | 24| 253M|#define B (temp+n) ------------------ 79| 253M| B[x] = int32_min(ppcx, ppcpx); ------------------ | | 24| 253M|#define B (temp+n) ------------------ B[x] = int32_min(ppcx, ppcpx); ------------------ | | 13| 253M|#define int32_min crypto_int32_min | | ------------------ | | | | 23| 253M|#define crypto_int32_min CRYPTO_NAMESPACE(crypto_int32_min) | | | | ------------------ | | | | | | 4| 253M|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_CLEAN_ ## fun | | | | ------------------ | | ------------------ ------------------ 80| 253M| } 81| 3.45M| } 82| 66.9M| for (x = 0; x < n; ++x) { ------------------ | Branch (82:21): [True: 63.4M, False: 3.51M] ------------------ 83| 63.4M| B[x] &= 0x3ff; ------------------ | | 24| 63.4M|#define B (temp+n) ------------------ 84| 63.4M| } 85| 3.51M| } else { 86| 20.4M| for (x = 0; x < n; ++x) { ------------------ | Branch (86:21): [True: 20.4M, False: 5.93k] ------------------ 87| 20.4M| B[x] = (((uint32_t)A[x]) << 16) | (B[x] & 0xffff); ------------------ | | 24| 20.4M|#define B (temp+n) ------------------ B[x] = (((uint32_t)A[x]) << 16) | (B[x] & 0xffff); ------------------ | | 23| 20.4M|#define A temp ------------------ B[x] = (((uint32_t)A[x]) << 16) | (B[x] & 0xffff); ------------------ | | 24| 20.4M|#define B (temp+n) ------------------ 88| 20.4M| } 89| | 90| 62.5k| for (i = 1; i < w - 1; ++i) { ------------------ | Branch (90:21): [True: 56.6k, False: 5.93k] ------------------ 91| | /* B = (p<<16)+c */ 92| | 93| 203M| for (x = 0; x < n; ++x) { ------------------ | Branch (93:25): [True: 203M, False: 56.6k] ------------------ 94| 203M| A[x] = (int32)((B[x] & ~0xffff) | x); ------------------ | | 23| 203M|#define A temp ------------------ A[x] = (int32)((B[x] & ~0xffff) | x); ------------------ | | 24| 203M|#define B (temp+n) ------------------ 95| 203M| } 96| 56.6k| int32_sort(A, n); /* A = (id<<16)+p^(-1) */ ------------------ | | 6| 56.6k|#define int32_sort CRYPTO_NAMESPACE(int32_sort) | | ------------------ | | | | 4| 56.6k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_CLEAN_ ## fun | | ------------------ ------------------ int32_sort(A, n); /* A = (id<<16)+p^(-1) */ ------------------ | | 23| 56.6k|#define A temp ------------------ 97| | 98| 203M| for (x = 0; x < n; ++x) { ------------------ | Branch (98:25): [True: 203M, False: 56.6k] ------------------ 99| 203M| A[x] = (((uint32_t)A[x]) << 16) | (B[x] & 0xffff); ------------------ | | 23| 203M|#define A temp ------------------ A[x] = (((uint32_t)A[x]) << 16) | (B[x] & 0xffff); ------------------ | | 23| 203M|#define A temp ------------------ A[x] = (((uint32_t)A[x]) << 16) | (B[x] & 0xffff); ------------------ | | 24| 203M|#define B (temp+n) ------------------ 100| 203M| } 101| | /* A = p^(-1)<<16+c */ 102| | 103| 56.6k| if (i < w - 2) { ------------------ | Branch (103:17): [True: 50.7k, False: 5.93k] ------------------ 104| 182M| for (x = 0; x < n; ++x) { ------------------ | Branch (104:29): [True: 182M, False: 50.7k] ------------------ 105| 182M| B[x] = (A[x] & ~0xffff) | (B[x] >> 16); ------------------ | | 24| 182M|#define B (temp+n) ------------------ B[x] = (A[x] & ~0xffff) | (B[x] >> 16); ------------------ | | 23| 182M|#define A temp ------------------ B[x] = (A[x] & ~0xffff) | (B[x] >> 16); ------------------ | | 24| 182M|#define B (temp+n) ------------------ 106| 182M| } 107| | /* B = (p^(-1)<<16)+p */ 108| 50.7k| int32_sort(B, n); /* B = (id<<16)+p^(-2) */ ------------------ | | 6| 50.7k|#define int32_sort CRYPTO_NAMESPACE(int32_sort) | | ------------------ | | | | 4| 50.7k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_CLEAN_ ## fun | | ------------------ ------------------ int32_sort(B, n); /* B = (id<<16)+p^(-2) */ ------------------ | | 24| 50.7k|#define B (temp+n) ------------------ 109| 182M| for (x = 0; x < n; ++x) { ------------------ | Branch (109:29): [True: 182M, False: 50.7k] ------------------ 110| 182M| B[x] = (((uint32_t)B[x]) << 16) | (A[x] & 0xffff); ------------------ | | 24| 182M|#define B (temp+n) ------------------ B[x] = (((uint32_t)B[x]) << 16) | (A[x] & 0xffff); ------------------ | | 24| 182M|#define B (temp+n) ------------------ B[x] = (((uint32_t)B[x]) << 16) | (A[x] & 0xffff); ------------------ | | 23| 182M|#define A temp ------------------ 111| 182M| } 112| | /* B = (p^(-2)<<16)+c */ 113| 50.7k| } 114| | 115| 56.6k| int32_sort(A, n); ------------------ | | 6| 56.6k|#define int32_sort CRYPTO_NAMESPACE(int32_sort) | | ------------------ | | | | 4| 56.6k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_CLEAN_ ## fun | | ------------------ ------------------ int32_sort(A, n); ------------------ | | 23| 56.6k|#define A temp ------------------ 116| | /* A = id<<16+cp */ 117| 203M| for (x = 0; x < n; ++x) { ------------------ | Branch (117:25): [True: 203M, False: 56.6k] ------------------ 118| 203M| int32 cpx = (B[x] & ~0xffff) | (A[x] & 0xffff); ------------------ | | 24| 203M|#define B (temp+n) ------------------ int32 cpx = (B[x] & ~0xffff) | (A[x] & 0xffff); ------------------ | | 23| 203M|#define A temp ------------------ 119| 203M| B[x] = int32_min(B[x], cpx); ------------------ | | 24| 203M|#define B (temp+n) ------------------ B[x] = int32_min(B[x], cpx); ------------------ | | 13| 203M|#define int32_min crypto_int32_min | | ------------------ | | | | 23| 203M|#define crypto_int32_min CRYPTO_NAMESPACE(crypto_int32_min) | | | | ------------------ | | | | | | 4| 203M|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_CLEAN_ ## fun | | | | ------------------ | | ------------------ ------------------ B[x] = int32_min(B[x], cpx); ------------------ | | 24| 203M|#define B (temp+n) ------------------ 120| 203M| } 121| 56.6k| } 122| 20.4M| for (x = 0; x < n; ++x) { ------------------ | Branch (122:21): [True: 20.4M, False: 5.93k] ------------------ 123| 20.4M| B[x] &= 0xffff; ------------------ | | 24| 20.4M|#define B (temp+n) ------------------ 124| 20.4M| } 125| 5.93k| } 126| | 127| 87.3M| for (x = 0; x < n; ++x) { ------------------ | Branch (127:17): [True: 83.8M, False: 3.52M] ------------------ 128| 83.8M| A[x] = (int32)((((int32)pi[x]) << 16) + x); ------------------ | | 23| 83.8M|#define A temp ------------------ 129| 83.8M| } 130| 3.52M| int32_sort(A, n); /* A = (id<<16)+pi^(-1) */ ------------------ | | 6| 3.52M|#define int32_sort CRYPTO_NAMESPACE(int32_sort) | | ------------------ | | | | 4| 3.52M|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_CLEAN_ ## fun | | ------------------ ------------------ int32_sort(A, n); /* A = (id<<16)+pi^(-1) */ ------------------ | | 23| 3.52M|#define A temp ------------------ 131| | 132| 45.4M| for (j = 0; j < n / 2; ++j) { ------------------ | Branch (132:17): [True: 41.9M, False: 3.52M] ------------------ 133| 41.9M| x = 2 * j; 134| 41.9M| int32 fj = B[x] & 1; /* f[j] */ ------------------ | | 24| 41.9M|#define B (temp+n) ------------------ 135| 41.9M| int32 Fx = (int32)(x + fj); /* F[x] */ 136| 41.9M| int32 Fx1 = Fx ^ 1; /* F[x+1] */ 137| | 138| 41.9M| out[pos >> 3] ^= fj << (pos & 7); 139| 41.9M| pos += step; 140| | 141| 41.9M| B[x] = ((uint32_t)A[x] << 16) | Fx; ------------------ | | 24| 41.9M|#define B (temp+n) ------------------ B[x] = ((uint32_t)A[x] << 16) | Fx; ------------------ | | 23| 41.9M|#define A temp ------------------ 142| 41.9M| B[x + 1] = ((uint32_t)A[x + 1] << 16) | Fx1; ------------------ | | 24| 41.9M|#define B (temp+n) ------------------ B[x + 1] = ((uint32_t)A[x + 1] << 16) | Fx1; ------------------ | | 23| 41.9M|#define A temp ------------------ 143| 41.9M| } 144| | /* B = (pi^(-1)<<16)+F */ 145| | 146| 3.52M| int32_sort(B, n); /* B = (id<<16)+F(pi) */ ------------------ | | 6| 3.52M|#define int32_sort CRYPTO_NAMESPACE(int32_sort) | | ------------------ | | | | 4| 3.52M|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_CLEAN_ ## fun | | ------------------ ------------------ int32_sort(B, n); /* B = (id<<16)+F(pi) */ ------------------ | | 24| 3.52M|#define B (temp+n) ------------------ 147| | 148| 3.52M| pos += (2 * w - 3) * step * (n / 2); 149| | 150| 45.4M| for (k = 0; k < n / 2; ++k) { ------------------ | Branch (150:17): [True: 41.9M, False: 3.52M] ------------------ 151| 41.9M| y = 2 * k; 152| 41.9M| int32 lk = B[y] & 1; /* l[k] */ ------------------ | | 24| 41.9M|#define B (temp+n) ------------------ 153| 41.9M| int32 Ly = (int32)(y + lk); /* L[y] */ 154| 41.9M| int32 Ly1 = Ly ^ 1; /* L[y+1] */ 155| | 156| 41.9M| out[pos >> 3] ^= lk << (pos & 7); 157| 41.9M| pos += step; 158| | 159| 41.9M| A[y] = (Ly << 16) | (B[y] & 0xffff); ------------------ | | 23| 41.9M|#define A temp ------------------ A[y] = (Ly << 16) | (B[y] & 0xffff); ------------------ | | 24| 41.9M|#define B (temp+n) ------------------ 160| 41.9M| A[y + 1] = (Ly1 << 16) | (B[y + 1] & 0xffff); ------------------ | | 23| 41.9M|#define A temp ------------------ A[y + 1] = (Ly1 << 16) | (B[y + 1] & 0xffff); ------------------ | | 24| 41.9M|#define B (temp+n) ------------------ 161| 41.9M| } 162| | /* A = (L<<16)+F(pi) */ 163| | 164| 3.52M| int32_sort(A, n); /* A = (id<<16)+F(pi(L)) = (id<<16)+M */ ------------------ | | 6| 3.52M|#define int32_sort CRYPTO_NAMESPACE(int32_sort) | | ------------------ | | | | 4| 3.52M|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_CLEAN_ ## fun | | ------------------ ------------------ int32_sort(A, n); /* A = (id<<16)+F(pi(L)) = (id<<16)+M */ ------------------ | | 23| 3.52M|#define A temp ------------------ 165| | 166| 3.52M| pos -= (2 * w - 2) * step * (n / 2); 167| | 168| 45.4M| for (j = 0; j < n / 2; ++j) { ------------------ | Branch (168:17): [True: 41.9M, False: 3.52M] ------------------ 169| 41.9M| q[j] = (A[2 * j] & 0xffff) >> 1; ------------------ | | 25| 41.9M|#define q ((int16 *) (temp+n+n/4)) ------------------ q[j] = (A[2 * j] & 0xffff) >> 1; ------------------ | | 23| 41.9M|#define A temp ------------------ 170| 41.9M| q[j + n / 2] = (A[2 * j + 1] & 0xffff) >> 1; ------------------ | | 25| 41.9M|#define q ((int16 *) (temp+n+n/4)) ------------------ q[j + n / 2] = (A[2 * j + 1] & 0xffff) >> 1; ------------------ | | 23| 41.9M|#define A temp ------------------ 171| 41.9M| } 172| | 173| 3.52M| cbrecursion(out, pos, step * 2, q, w - 1, n / 2, temp); ------------------ | | 25| 3.52M|#define q ((int16 *) (temp+n+n/4)) ------------------ 174| 3.52M| cbrecursion(out, pos + step, step * 2, q + n / 2, w - 1, n / 2, temp); ------------------ | | 25| 3.52M|#define q ((int16 *) (temp+n+n/4)) ------------------ 175| 3.52M|} controlbits.c:layer: 182| 23.4k|static void layer(int16_t *p, const unsigned char *cb, int s, int n) { 183| 23.4k| int i, j; 184| 23.4k| int stride = 1 << (uint8_t)(s & 0x1F); 185| 23.4k| int index = 0; 186| 23.4k| int16_t d, m; 187| | 188| 14.1M| for (i = 0; i < n; i += stride * 2) { ------------------ | Branch (188:17): [True: 14.0M, False: 23.4k] ------------------ 189| 101M| for (j = 0; j < stride; j++) { ------------------ | Branch (189:21): [True: 87.3M, False: 14.0M] ------------------ 190| 87.3M| d = p[ i + j ] ^ p[ i + j + stride ]; 191| 87.3M| m = (cb[ index >> 3 ] >> (index & 7)) & 1; 192| 87.3M| m = -m; 193| 87.3M| d &= m; 194| 87.3M| p[ i + j ] ^= d; 195| 87.3M| p[ i + j + stride ] ^= d; 196| 87.3M| index++; 197| 87.3M| } 198| 14.0M| } 199| 23.4k|} encrypt.c:uint16_is_smaller_declassify: 22| 605k|static inline crypto_uint16 uint16_is_smaller_declassify(uint16_t t, uint16_t u) { 23| 605k| crypto_uint16 mask = crypto_uint16_smaller_mask(t, u); ------------------ | | 21| 605k|#define crypto_uint16_smaller_mask CRYPTO_NAMESPACE(crypto_uint16_smaller_mask) | | ------------------ | | | | 4| 605k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_CLEAN_ ## fun | | ------------------ ------------------ 24| 605k| crypto_declassify(&mask, sizeof mask); 25| 605k| return mask; 26| 605k|} encrypt.c:uint32_is_equal_declassify: 28| 532k|static inline crypto_uint32 uint32_is_equal_declassify(uint32_t t, uint32_t u) { 29| 532k| crypto_uint32 mask = crypto_uint32_equal_mask(t, u); ------------------ | | 19| 532k|#define crypto_uint32_equal_mask CRYPTO_NAMESPACE(crypto_uint32_equal_mask) | | ------------------ | | | | 4| 532k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_CLEAN_ ## fun | | ------------------ ------------------ 30| 532k| crypto_declassify(&mask, sizeof mask); 31| 532k| return mask; 32| 532k|} gf.c:gf_sq: 52| 815k|static inline gf gf_sq(gf in) { 53| 815k| const uint32_t B[] = {0x55555555, 0x33333333, 0x0F0F0F0F, 0x00FF00FF}; 54| | 55| 815k| uint32_t x = in; 56| 815k| uint32_t t; 57| | 58| 815k| x = (x | (x << 8)) & B[3]; 59| 815k| x = (x | (x << 4)) & B[2]; 60| 815k| x = (x | (x << 2)) & B[1]; 61| 815k| x = (x | (x << 1)) & B[0]; 62| | 63| 815k| t = x & 0x7FC000; 64| 815k| x ^= t >> 9; 65| 815k| x ^= t >> 12; 66| | 67| 815k| t = x & 0x3000; 68| 815k| x ^= t >> 9; 69| 815k| x ^= t >> 12; 70| | 71| 815k| return x & ((1 << GFBITS) - 1); ------------------ | | 6| 815k|#define GFBITS 12 ------------------ 72| 815k|} pk_gen.c:uint64_is_equal_declassify: 20| 39.7M|static crypto_uint64 uint64_is_equal_declassify(uint64_t t, uint64_t u) { 21| 39.7M| crypto_uint64 mask = crypto_uint64_equal_mask(t, u); ------------------ | | 19| 39.7M|#define crypto_uint64_equal_mask CRYPTO_NAMESPACE(crypto_uint64_equal_mask) | | ------------------ | | | | 4| 39.7M|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_CLEAN_ ## fun | | ------------------ ------------------ 22| 39.7M| crypto_declassify(&mask, sizeof mask); 23| 39.7M| return mask; 24| 39.7M|} pk_gen.c:uint64_is_zero_declassify: 26| 7.17M|static crypto_uint64 uint64_is_zero_declassify(uint64_t t) { 27| 7.17M| crypto_uint64 mask = crypto_uint64_zero_mask(t); ------------------ | | 15| 7.17M|#define crypto_uint64_zero_mask CRYPTO_NAMESPACE(crypto_uint64_zero_mask) | | ------------------ | | | | 4| 7.17M|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_CLEAN_ ## fun | | ------------------ ------------------ 28| 7.17M| crypto_declassify(&mask, sizeof mask); 29| 7.17M| return mask; 30| 7.17M|} sk_gen.c:gf_is_zero_declassify: 15| 587k|static inline crypto_uint16 gf_is_zero_declassify(gf t) { 16| 587k| crypto_uint16 mask = crypto_uint16_zero_mask(t); ------------------ | | 15| 587k|#define crypto_uint16_zero_mask CRYPTO_NAMESPACE(crypto_uint16_zero_mask) | | ------------------ | | | | 4| 587k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_CLEAN_ ## fun | | ------------------ ------------------ 17| 587k| crypto_declassify(&mask, sizeof mask); 18| 587k| return mask; 19| 587k|} pk_gen.c:uint64_sort: 20| 5.56k|static void uint64_sort(uint64_t *x, long long n) { 21| 5.56k| long long top, p, q, r, i; 22| | 23| 5.56k| if (n < 2) { ------------------ | Branch (23:9): [True: 0, False: 5.56k] ------------------ 24| 0| return; 25| 0| } 26| 5.56k| top = 1; 27| 71.1k| while (top < n - top) { ------------------ | Branch (27:12): [True: 65.5k, False: 5.56k] ------------------ 28| 65.5k| top += top; 29| 65.5k| } 30| | 31| 76.6k| for (p = top; p > 0; p >>= 1) { ------------------ | Branch (31:19): [True: 71.1k, False: 5.56k] ------------------ 32| 485M| for (i = 0; i < n - p; ++i) { ------------------ | Branch (32:21): [True: 485M, False: 71.1k] ------------------ 33| 485M| if (!(i & p)) { ------------------ | Branch (33:17): [True: 262M, False: 222M] ------------------ 34| 262M| uint64_MINMAX(x[i], x[i + p]); ------------------ | | 11| 262M| do { \ | | 12| 262M| uint64_t c = (b) - (a); \ | | 13| 262M| c >>= 63; \ | | 14| 262M| c = -c; \ | | 15| 262M| c &= (a) ^ (b); \ | | 16| 262M| (a) ^= c; \ | | 17| 262M| (b) ^= c; \ | | 18| 262M| } while(0) | | ------------------ | | | Branch (18:13): [Folded, False: 262M] | | ------------------ ------------------ 35| 262M| } 36| 485M| } 37| 71.1k| i = 0; 38| 490k| for (q = top; q > p; q >>= 1) { ------------------ | Branch (38:23): [True: 419k, False: 71.1k] ------------------ 39| 444M| for (; i < n - q; ++i) { ------------------ | Branch (39:20): [True: 444M, False: 419k] ------------------ 40| 444M| if (!(i & p)) { ------------------ | Branch (40:21): [True: 222M, False: 222M] ------------------ 41| 222M| uint64_t a = x[i + p]; 42| 1.56G| for (r = q; r > p; r >>= 1) { ------------------ | Branch (42:33): [True: 1.34G, False: 222M] ------------------ 43| 1.34G| uint64_MINMAX(a, x[i + r]); ------------------ | | 11| 1.34G| do { \ | | 12| 1.34G| uint64_t c = (b) - (a); \ | | 13| 1.34G| c >>= 63; \ | | 14| 1.34G| c = -c; \ | | 15| 1.34G| c &= (a) ^ (b); \ | | 16| 1.34G| (a) ^= c; \ | | 17| 1.34G| (b) ^= c; \ | | 18| 1.34G| } while(0) | | ------------------ | | | Branch (18:13): [Folded, False: 1.34G] | | ------------------ ------------------ 44| 1.34G| } 45| 222M| x[i + p] = a; 46| 222M| } 47| 444M| } 48| 419k| } 49| 71.1k| } 50| 5.56k|} PQCLEAN_MCELIECE348864F_AVX2_load_bits: 168| 83|void load_bits(uint64_t out[][32], const unsigned char *bits) { 169| 83| int i, low, block = 0; 170| | 171| 83| uint64_t cond[64]; 172| | 173| | // 174| | 175| 581| for (low = 0; low <= 5; low++) { ------------------ | Branch (175:19): [True: 498, False: 83] ------------------ 176| 32.3k| for (i = 0; i < 64; i++) { ------------------ | Branch (176:21): [True: 31.8k, False: 498] ------------------ 177| 31.8k| cond[i] = load4(bits + block * 256 + i * 4); 178| 31.8k| } 179| 498| transpose_64x64(cond); 180| | 181| 16.4k| for (i = 0; i < 32; i++) { ------------------ | Branch (181:21): [True: 15.9k, False: 498] ------------------ 182| 15.9k| out[ block ][i] = cond[i]; 183| 15.9k| } 184| 498| block++; 185| 498| } 186| | 187| 581| for (low = 0; low <= 5; low++) { ------------------ | Branch (187:19): [True: 498, False: 83] ------------------ 188| 16.4k| for (i = 0; i < 32; i++) { ------------------ | Branch (188:21): [True: 15.9k, False: 498] ------------------ 189| 15.9k| out[ block ][i] = load8(bits + block * 256 + i * 8); 190| 15.9k| } 191| 498| block++; 192| 498| } 193| | 194| 498| for (low = 4; low >= 0; low--) { ------------------ | Branch (194:19): [True: 415, False: 83] ------------------ 195| 13.6k| for (i = 0; i < 32; i++) { ------------------ | Branch (195:21): [True: 13.2k, False: 415] ------------------ 196| 13.2k| out[ block ][i] = load8(bits + block * 256 + i * 8); 197| 13.2k| } 198| 415| block++; 199| 415| } 200| | 201| 581| for (low = 5; low >= 0; low--) { ------------------ | Branch (201:19): [True: 498, False: 83] ------------------ 202| 32.3k| for (i = 0; i < 64; i++) { ------------------ | Branch (202:21): [True: 31.8k, False: 498] ------------------ 203| 31.8k| cond[i] = load4(bits + block * 256 + i * 4); 204| 31.8k| } 205| 498| transpose_64x64(cond); 206| | 207| 16.4k| for (i = 0; i < 32; i++) { ------------------ | Branch (207:21): [True: 15.9k, False: 498] ------------------ 208| 15.9k| out[ block ][i] = cond[i]; 209| 15.9k| } 210| 498| block++; 211| 498| } 212| 83|} PQCLEAN_MCELIECE348864F_AVX2_benes: 218| 166|void benes(uint64_t *r, uint64_t cond[][32], int rev) { 219| 166| int block, inc; 220| | 221| 166| uint64_t *bs = r; 222| | 223| | // 224| | 225| 166| if (rev == 0) { ------------------ | Branch (225:9): [True: 83, False: 83] ------------------ 226| 83| block = 0; 227| 83| inc = 1; 228| 83| } else { 229| 83| block = 22; 230| 83| inc = -1; 231| 83| } 232| | 233| 166| transpose_64x64(bs); 234| | 235| 166| layer_0(bs, cond[ block ]); 236| 166| block += inc; 237| 166| layer_1(bs, cond[ block ]); 238| 166| block += inc; 239| 166| layer_2(bs, cond[ block ]); 240| 166| block += inc; 241| 166| layer_3(bs, cond[ block ]); 242| 166| block += inc; 243| 166| layer_4(bs, cond[ block ]); 244| 166| block += inc; 245| 166| layer_5(bs, cond[ block ]); 246| 166| block += inc; 247| | 248| 166| transpose_64x64(bs); 249| | 250| 166| layer_0(bs, cond[ block ]); 251| 166| block += inc; 252| 166| layer_1(bs, cond[ block ]); 253| 166| block += inc; 254| 166| layer_2(bs, cond[ block ]); 255| 166| block += inc; 256| 166| layer_3(bs, cond[ block ]); 257| 166| block += inc; 258| 166| layer_4(bs, cond[ block ]); 259| 166| block += inc; 260| 166| layer_5(bs, cond[ block ]); 261| 166| block += inc; 262| 166| layer_4(bs, cond[ block ]); 263| 166| block += inc; 264| 166| layer_3(bs, cond[ block ]); 265| 166| block += inc; 266| 166| layer_2(bs, cond[ block ]); 267| 166| block += inc; 268| 166| layer_1(bs, cond[ block ]); 269| 166| block += inc; 270| 166| layer_0(bs, cond[ block ]); 271| 166| block += inc; 272| | 273| 166| transpose_64x64(bs); 274| | 275| 166| layer_5(bs, cond[ block ]); 276| 166| block += inc; 277| 166| layer_4(bs, cond[ block ]); 278| 166| block += inc; 279| 166| layer_3(bs, cond[ block ]); 280| 166| block += inc; 281| 166| layer_2(bs, cond[ block ]); 282| 166| block += inc; 283| 166| layer_1(bs, cond[ block ]); 284| 166| block += inc; 285| 166| layer_0(bs, cond[ block ]); 286| | 287| 166| transpose_64x64(bs); 288| 166|} PQCLEAN_MCELIECE348864F_AVX2_bm: 140| 83|void bm(uint64_t out[ GFBITS ], vec128 in[ GFBITS ]) { 141| 83| uint16_t i; 142| 83| uint16_t N, L; 143| | 144| 83| uint64_t prod[ GFBITS ]; 145| 83| uint64_t in_tmp[ GFBITS ]; 146| | 147| 83| uint64_t db[ GFBITS ][ 2 ]; 148| 83| uint64_t BC_tmp[ GFBITS ][ 2 ]; 149| 83| uint64_t BC[ GFBITS ][ 2 ]; 150| | 151| 83| uint64_t mask, t; 152| | 153| 83| gf d, b, c0 = 1; 154| | 155| 83| gf coefs[SYS_T * 2]; 156| | 157| | // init 158| | 159| 83| BC[0][1] = 0; 160| 83| BC[0][0] = 1; 161| 83| BC[0][0] <<= 63; 162| | 163| 996| for (i = 1; i < GFBITS; i++) { ------------------ | | 6| 996|#define GFBITS 12 ------------------ | Branch (163:17): [True: 913, False: 83] ------------------ 164| 913| BC[i][0] = BC[i][1] = 0; 165| 913| } 166| | 167| 83| b = 1; 168| 83| L = 0; 169| | 170| | // 171| | 172| 83| get_coefs(coefs, in); 173| | 174| 1.07k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 1.07k|#define GFBITS 12 ------------------ | Branch (174:17): [True: 996, False: 83] ------------------ 175| 996| in_tmp[i] = 0; 176| 996| } 177| | 178| 10.7k| for (N = 0; N < SYS_T * 2; N++) { ------------------ | | 8| 10.7k|#define SYS_T 64 ------------------ | Branch (178:17): [True: 10.6k, False: 83] ------------------ 179| | // computing d 180| | 181| 10.6k| vec_mul_sp(prod, in_tmp, &BC[0][0]); 182| | 183| 10.6k| update_asm(in_tmp, coefs[N], 8); ------------------ | | 1| 10.6k|#define update_asm CRYPTO_NAMESPACE(update_asm) | | ------------------ | | | | 4| 10.6k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864F_AVX2_ ## fun | | ------------------ ------------------ 184| | 185| 10.6k| d = vec_reduce_asm(prod); ------------------ | | 3| 10.6k|#define vec_reduce_asm CRYPTO_NAMESPACE(vec_reduce_asm) | | ------------------ | | | | 4| 10.6k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864F_AVX2_ ## fun | | ------------------ ------------------ 186| | 187| 10.6k| t = gf_mul2(c0, coefs[N], b); ------------------ | | 13| 10.6k|#define gf_mul2 CRYPTO_NAMESPACE(gf_mul2) | | ------------------ | | | | 4| 10.6k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864F_AVX2_ ## fun | | ------------------ ------------------ 188| | 189| 10.6k| d ^= t & 0xFFFFFFFF; 190| | 191| | // 3 cases 192| | 193| 10.6k| mask = mask_nonzero(d) & mask_leq(L * 2, N); 194| | 195| 138k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 138k|#define GFBITS 12 ------------------ | Branch (195:21): [True: 127k, False: 10.6k] ------------------ 196| 127k| db[i][0] = (d >> i) & 1; 197| 127k| db[i][0] = -db[i][0]; 198| 127k| db[i][1] = (b >> i) & 1; 199| 127k| db[i][1] = -db[i][1]; 200| 127k| } 201| | 202| 10.6k| vec128_mul((vec128 *) BC_tmp, (vec128 *) db, (vec128 *) BC); 203| | 204| 10.6k| vec_cmov(BC, mask); 205| | 206| 10.6k| update_asm(BC, mask & c0, 16); ------------------ | | 1| 10.6k|#define update_asm CRYPTO_NAMESPACE(update_asm) | | ------------------ | | | | 4| 10.6k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864F_AVX2_ ## fun | | ------------------ ------------------ 207| | 208| 138k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 138k|#define GFBITS 12 ------------------ | Branch (208:21): [True: 127k, False: 10.6k] ------------------ 209| 127k| BC[i][1] = BC_tmp[i][0] ^ BC_tmp[i][1]; 210| 127k| } 211| | 212| 10.6k| c0 = t >> 32; 213| 10.6k| b = (d & mask) | (b & ~mask); 214| 10.6k| L = ((N + 1 - L) & mask) | (L & ~mask); 215| | 216| 10.6k| } 217| | 218| 83| c0 = gf_inv(c0); ------------------ | | 11| 83|#define gf_inv CRYPTO_NAMESPACE(gf_inv) | | ------------------ | | | | 4| 83|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864F_AVX2_ ## fun | | ------------------ ------------------ 219| | 220| 1.07k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 1.07k|#define GFBITS 12 ------------------ | Branch (220:17): [True: 996, False: 83] ------------------ 221| 996| out[i] = (c0 >> i) & 1; 222| 996| out[i] = -out[i]; 223| 996| } 224| | 225| 83| vec_mul_sp(out, out, &BC[0][0]); 226| 83|} PQCLEAN_MCELIECE348864F_AVX2_controlbitsfrompermutation: 205| 83|void controlbitsfrompermutation(unsigned char *out, const int16 *pi, long long w, long long n) { 206| 83| PQCLEAN_VLA(int32, temp, (size_t)(2 * n)); ------------------ | | 57| 83|# define PQCLEAN_VLA(__t,__x,__s) __t __x[__s] ------------------ 207| 83| PQCLEAN_VLA(int16, pi_test, (size_t)n); ------------------ | | 57| 83|# define PQCLEAN_VLA(__t,__x,__s) __t __x[__s] ------------------ 208| 83| int16 diff; 209| 83| int i; 210| 83| unsigned char *ptr; 211| | 212| 83| OQS_MEM_cleanse(temp, (size_t)n * 2); 213| 83| OQS_MEM_cleanse(pi_test, (size_t)n); 214| | 215| 83| while (1) { ------------------ | Branch (215:12): [True: 83, Folded] ------------------ 216| 83| OQS_MEM_cleanse(out, (size_t)((((2 * w - 1)*n / 2) + 7) / 8)); 217| 83| cbrecursion(out, 0, 1, pi, w, n, temp); 218| | 219| | // check for correctness 220| | 221| 340k| for (i = 0; i < n; i++) { ------------------ | Branch (221:21): [True: 339k, False: 83] ------------------ 222| 339k| pi_test[i] = (int16)i; 223| 339k| } 224| | 225| 83| ptr = out; 226| 1.07k| for (i = 0; i < w; i++) { ------------------ | Branch (226:21): [True: 996, False: 83] ------------------ 227| 996| layer(pi_test, ptr, i, (int32)n); 228| 996| ptr += n >> 4; 229| 996| } 230| | 231| 996| for (i = (int)(w - 2); i >= 0; i--) { ------------------ | Branch (231:32): [True: 913, False: 83] ------------------ 232| 913| layer(pi_test, ptr, i, (int32)n); 233| 913| ptr += n >> 4; 234| 913| } 235| | 236| 83| diff = 0; 237| 340k| for (i = 0; i < n; i++) { ------------------ | Branch (237:21): [True: 339k, False: 83] ------------------ 238| 339k| diff |= pi[i] ^ pi_test[i]; 239| 339k| } 240| | 241| 83| diff = crypto_int16_nonzero_mask(diff); ------------------ | | 12| 83|#define crypto_int16_nonzero_mask CRYPTO_NAMESPACE(crypto_int16_nonzero_mask) | | ------------------ | | | | 4| 83|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864F_AVX2_ ## fun | | ------------------ ------------------ 242| 83| crypto_declassify(&diff, sizeof diff); 243| 83| if (diff == 0) { ------------------ | Branch (243:13): [True: 83, False: 0] ------------------ 244| 83| break; 245| 83| } 246| 83| } 247| 83|} PQCLEAN_MCELIECE348864F_AVX2_crypto_int16_negative_mask: 3| 166|crypto_int16 crypto_int16_negative_mask(crypto_int16 crypto_int16_x) { 4| 166| return crypto_int16_x >> 15; 5| 166|} PQCLEAN_MCELIECE348864F_AVX2_crypto_int16_nonzero_mask: 7| 83|crypto_int16 crypto_int16_nonzero_mask(crypto_int16 crypto_int16_x) { 8| 83| return crypto_int16_negative_mask(crypto_int16_x) | crypto_int16_negative_mask(-crypto_int16_x); ------------------ | | 10| 83|#define crypto_int16_negative_mask CRYPTO_NAMESPACE(crypto_int16_negative_mask) | | ------------------ | | | | 4| 83|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864F_AVX2_ ## fun | | ------------------ ------------------ return crypto_int16_negative_mask(crypto_int16_x) | crypto_int16_negative_mask(-crypto_int16_x); ------------------ | | 10| 83|#define crypto_int16_negative_mask CRYPTO_NAMESPACE(crypto_int16_negative_mask) | | ------------------ | | | | 4| 83|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864F_AVX2_ ## fun | | ------------------ ------------------ 9| 83|} PQCLEAN_MCELIECE348864F_AVX2_crypto_int32_negative_mask: 3| 22.4M|crypto_int32 crypto_int32_negative_mask(crypto_int32 crypto_int32_x) { 4| 22.4M| return crypto_int32_x >> 31; 5| 22.4M|} PQCLEAN_MCELIECE348864F_AVX2_crypto_int32_min: 37| 22.4M|crypto_int32 crypto_int32_min(crypto_int32 crypto_int32_x, crypto_int32 crypto_int32_y) { 38| 22.4M| crypto_int32 crypto_int32_xy = crypto_int32_y ^ crypto_int32_x; 39| 22.4M| crypto_int32 crypto_int32_z = crypto_int32_y - crypto_int32_x; 40| 22.4M| crypto_int32_z ^= crypto_int32_xy & (crypto_int32_z ^ crypto_int32_y); 41| 22.4M| crypto_int32_z = crypto_int32_negative_mask(crypto_int32_z); ------------------ | | 9| 22.4M|#define crypto_int32_negative_mask CRYPTO_NAMESPACE(crypto_int32_negative_mask) | | ------------------ | | | | 4| 22.4M|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864F_AVX2_ ## fun | | ------------------ ------------------ 42| 22.4M| crypto_int32_z &= crypto_int32_xy; 43| 22.4M| return crypto_int32_x ^ crypto_int32_z; 44| 22.4M|} PQCLEAN_MCELIECE348864F_AVX2_crypto_uint16_signed_negative_mask: 3| 35.2k|crypto_uint16_signed crypto_uint16_signed_negative_mask(crypto_uint16_signed crypto_uint16_signed_x) { 4| 35.2k| return crypto_uint16_signed_x >> 15; 5| 35.2k|} PQCLEAN_MCELIECE348864F_AVX2_crypto_uint16_nonzero_mask: 7| 6.72k|crypto_uint16 crypto_uint16_nonzero_mask(crypto_uint16 crypto_uint16_x) { 8| 6.72k| return crypto_uint16_signed_negative_mask(crypto_uint16_x) | crypto_uint16_signed_negative_mask(-crypto_uint16_x); ------------------ | | 11| 6.72k|#define crypto_uint16_signed_negative_mask CRYPTO_NAMESPACE(crypto_uint16_signed_negative_mask) | | ------------------ | | | | 4| 6.72k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864F_AVX2_ ## fun | | ------------------ ------------------ return crypto_uint16_signed_negative_mask(crypto_uint16_x) | crypto_uint16_signed_negative_mask(-crypto_uint16_x); ------------------ | | 11| 6.72k|#define crypto_uint16_signed_negative_mask CRYPTO_NAMESPACE(crypto_uint16_signed_negative_mask) | | ------------------ | | | | 4| 6.72k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864F_AVX2_ ## fun | | ------------------ ------------------ 9| 6.72k|} PQCLEAN_MCELIECE348864F_AVX2_crypto_uint16_zero_mask: 11| 6.72k|crypto_uint16 crypto_uint16_zero_mask(crypto_uint16 crypto_uint16_x) { 12| 6.72k| return ~crypto_uint16_nonzero_mask(crypto_uint16_x); ------------------ | | 13| 6.72k|#define crypto_uint16_nonzero_mask CRYPTO_NAMESPACE(crypto_uint16_nonzero_mask) | | ------------------ | | | | 4| 6.72k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864F_AVX2_ ## fun | | ------------------ ------------------ 13| 6.72k|} PQCLEAN_MCELIECE348864F_AVX2_crypto_uint16_smaller_mask: 24| 21.7k|crypto_uint16 crypto_uint16_smaller_mask(crypto_uint16 crypto_uint16_x, crypto_uint16 crypto_uint16_y) { 25| 21.7k| crypto_uint16 crypto_uint16_xy = crypto_uint16_x ^ crypto_uint16_y; 26| 21.7k| crypto_uint16 crypto_uint16_z = crypto_uint16_x - crypto_uint16_y; 27| 21.7k| crypto_uint16_z ^= crypto_uint16_xy & (crypto_uint16_z ^ crypto_uint16_x ^ (((crypto_uint16) 1) << 15)); 28| 21.7k| return crypto_uint16_signed_negative_mask(crypto_uint16_z); ------------------ | | 11| 21.7k|#define crypto_uint16_signed_negative_mask CRYPTO_NAMESPACE(crypto_uint16_signed_negative_mask) | | ------------------ | | | | 4| 21.7k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864F_AVX2_ ## fun | | ------------------ ------------------ 29| 21.7k|} PQCLEAN_MCELIECE348864F_AVX2_crypto_uint32_signed_negative_mask: 3| 36.6k|crypto_uint32_signed crypto_uint32_signed_negative_mask(crypto_uint32_signed crypto_uint32_signed_x) { 4| 36.6k| return crypto_uint32_signed_x >> 31; 5| 36.6k|} PQCLEAN_MCELIECE348864F_AVX2_crypto_uint32_nonzero_mask: 7| 18.3k|crypto_uint32 crypto_uint32_nonzero_mask(crypto_uint32 crypto_uint32_x) { 8| 18.3k| return crypto_uint32_signed_negative_mask(crypto_uint32_x) | crypto_uint32_signed_negative_mask(-crypto_uint32_x); ------------------ | | 11| 18.3k|#define crypto_uint32_signed_negative_mask CRYPTO_NAMESPACE(crypto_uint32_signed_negative_mask) | | ------------------ | | | | 4| 18.3k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864F_AVX2_ ## fun | | ------------------ ------------------ return crypto_uint32_signed_negative_mask(crypto_uint32_x) | crypto_uint32_signed_negative_mask(-crypto_uint32_x); ------------------ | | 11| 18.3k|#define crypto_uint32_signed_negative_mask CRYPTO_NAMESPACE(crypto_uint32_signed_negative_mask) | | ------------------ | | | | 4| 18.3k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864F_AVX2_ ## fun | | ------------------ ------------------ 9| 18.3k|} PQCLEAN_MCELIECE348864F_AVX2_crypto_uint32_unequal_mask: 15| 18.3k|crypto_uint32 crypto_uint32_unequal_mask(crypto_uint32 crypto_uint32_x, crypto_uint32 crypto_uint32_y) { 16| 18.3k| crypto_uint32 crypto_uint32_xy = crypto_uint32_x ^ crypto_uint32_y; 17| 18.3k| return crypto_uint32_nonzero_mask(crypto_uint32_xy); ------------------ | | 13| 18.3k|#define crypto_uint32_nonzero_mask CRYPTO_NAMESPACE(crypto_uint32_nonzero_mask) | | ------------------ | | | | 4| 18.3k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864F_AVX2_ ## fun | | ------------------ ------------------ 18| 18.3k|} PQCLEAN_MCELIECE348864F_AVX2_crypto_uint32_equal_mask: 20| 18.3k|crypto_uint32 crypto_uint32_equal_mask(crypto_uint32 crypto_uint32_x, crypto_uint32 crypto_uint32_y) { 21| 18.3k| return ~crypto_uint32_unequal_mask(crypto_uint32_x, crypto_uint32_y); ------------------ | | 17| 18.3k|#define crypto_uint32_unequal_mask CRYPTO_NAMESPACE(crypto_uint32_unequal_mask) | | ------------------ | | | | 4| 18.3k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864F_AVX2_ ## fun | | ------------------ ------------------ 22| 18.3k|} PQCLEAN_MCELIECE348864F_AVX2_crypto_uint64_signed_negative_mask: 3| 879k|crypto_uint64_signed crypto_uint64_signed_negative_mask(crypto_uint64_signed crypto_uint64_signed_x) { 4| 879k| return crypto_uint64_signed_x >> 63; 5| 879k|} PQCLEAN_MCELIECE348864F_AVX2_crypto_uint64_nonzero_mask: 7| 439k|crypto_uint64 crypto_uint64_nonzero_mask(crypto_uint64 crypto_uint64_x) { 8| 439k| return crypto_uint64_signed_negative_mask(crypto_uint64_x) | crypto_uint64_signed_negative_mask(-crypto_uint64_x); ------------------ | | 11| 439k|#define crypto_uint64_signed_negative_mask CRYPTO_NAMESPACE(crypto_uint64_signed_negative_mask) | | ------------------ | | | | 4| 439k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864F_AVX2_ ## fun | | ------------------ ------------------ return crypto_uint64_signed_negative_mask(crypto_uint64_x) | crypto_uint64_signed_negative_mask(-crypto_uint64_x); ------------------ | | 11| 439k|#define crypto_uint64_signed_negative_mask CRYPTO_NAMESPACE(crypto_uint64_signed_negative_mask) | | ------------------ | | | | 4| 439k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864F_AVX2_ ## fun | | ------------------ ------------------ 9| 439k|} PQCLEAN_MCELIECE348864F_AVX2_crypto_uint64_zero_mask: 11| 66.4k|crypto_uint64 crypto_uint64_zero_mask(crypto_uint64 crypto_uint64_x) { 12| 66.4k| return ~crypto_uint64_nonzero_mask(crypto_uint64_x); ------------------ | | 13| 66.4k|#define crypto_uint64_nonzero_mask CRYPTO_NAMESPACE(crypto_uint64_nonzero_mask) | | ------------------ | | | | 4| 66.4k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864F_AVX2_ ## fun | | ------------------ ------------------ 13| 66.4k|} PQCLEAN_MCELIECE348864F_AVX2_crypto_uint64_unequal_mask: 15| 373k|crypto_uint64 crypto_uint64_unequal_mask(crypto_uint64 crypto_uint64_x, crypto_uint64 crypto_uint64_y) { 16| 373k| crypto_uint64 crypto_uint64_xy = crypto_uint64_x ^ crypto_uint64_y; 17| 373k| return crypto_uint64_nonzero_mask(crypto_uint64_xy); ------------------ | | 13| 373k|#define crypto_uint64_nonzero_mask CRYPTO_NAMESPACE(crypto_uint64_nonzero_mask) | | ------------------ | | | | 4| 373k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864F_AVX2_ ## fun | | ------------------ ------------------ 18| 373k|} PQCLEAN_MCELIECE348864F_AVX2_crypto_uint64_equal_mask: 20| 373k|crypto_uint64 crypto_uint64_equal_mask(crypto_uint64 crypto_uint64_x, crypto_uint64 crypto_uint64_y) { 21| 373k| return ~crypto_uint64_unequal_mask(crypto_uint64_x, crypto_uint64_y); ------------------ | | 17| 373k|#define crypto_uint64_unequal_mask CRYPTO_NAMESPACE(crypto_uint64_unequal_mask) | | ------------------ | | | | 4| 373k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864F_AVX2_ ## fun | | ------------------ ------------------ 22| 373k|} PQCLEAN_MCELIECE348864F_AVX2_decrypt: 171| 83|int decrypt(unsigned char *e, const unsigned char *sk, const unsigned char *s) { 172| 83| int i; 173| | 174| 83| uint16_t check_synd; 175| 83| uint16_t check_weight; 176| | 177| 83| vec256 inv[ 16 ][ GFBITS ]; 178| 83| vec256 scaled[ 16 ][ GFBITS ]; 179| 83| vec256 eval[16][ GFBITS ]; 180| | 181| 83| vec128 error128[ 32 ]; 182| 83| vec256 error256[ 16 ]; 183| | 184| 83| vec128 s_priv[ GFBITS ]; 185| 83| vec128 s_priv_cmp[ GFBITS ]; 186| 83| uint64_t locator[ GFBITS ]; 187| | 188| 83| vec128 recv128[ 32 ]; 189| 83| vec256 recv256[ 16 ]; 190| 83| vec256 allone; 191| | 192| 83| uint64_t bits_int[23][32]; 193| | 194| | // Berlekamp decoder 195| | 196| 83| preprocess(recv128, s); 197| | 198| 83| load_bits(bits_int, sk + IRR_BYTES); ------------------ | | 10| 83|#define load_bits CRYPTO_NAMESPACE(load_bits) | | ------------------ | | | | 4| 83|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864F_AVX2_ ## fun | | ------------------ ------------------ load_bits(bits_int, sk + IRR_BYTES); ------------------ | | 11| 83|#define IRR_BYTES (SYS_T * 2) | | ------------------ | | | | 8| 83|#define SYS_T 64 | | ------------------ ------------------ 199| 83| benes((uint64_t *) recv128, bits_int, 1); ------------------ | | 9| 83|#define benes CRYPTO_NAMESPACE(benes) | | ------------------ | | | | 4| 83|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864F_AVX2_ ## fun | | ------------------ ------------------ 200| | 201| 83| reformat_128to256(recv256, recv128); 202| | 203| 83| scaling(scaled, inv, sk, recv256); 204| 83| fft_tr(s_priv, scaled); ------------------ | | 9| 83|#define fft_tr CRYPTO_NAMESPACE(fft_tr) | | ------------------ | | | | 4| 83|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864F_AVX2_ ## fun | | ------------------ ------------------ 205| 83| bm(locator, s_priv); ------------------ | | 10| 83|#define bm CRYPTO_NAMESPACE(bm) | | ------------------ | | | | 4| 83|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864F_AVX2_ ## fun | | ------------------ ------------------ 206| | 207| 83| fft(eval, locator); ------------------ | | 10| 83|#define fft CRYPTO_NAMESPACE(fft) | | ------------------ | | | | 4| 83|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864F_AVX2_ ## fun | | ------------------ ------------------ 208| | 209| | // reencryption and weight check 210| | 211| 83| allone = vec256_set1_16b(0xFFFF); 212| | 213| 1.41k| for (i = 0; i < 16; i++) { ------------------ | Branch (213:17): [True: 1.32k, False: 83] ------------------ 214| 1.32k| error256[i] = vec256_or_reduce(eval[i]); 215| 1.32k| error256[i] = vec256_xor(error256[i], allone); 216| 1.32k| } 217| | 218| 83| scaling_inv(scaled, inv, error256); 219| 83| fft_tr(s_priv_cmp, scaled); ------------------ | | 9| 83|#define fft_tr CRYPTO_NAMESPACE(fft_tr) | | ------------------ | | | | 4| 83|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864F_AVX2_ ## fun | | ------------------ ------------------ 220| | 221| 83| check_synd = synd_cmp(s_priv, s_priv_cmp); 222| | 223| | // 224| | 225| 83| reformat_256to128(error128, error256); 226| 83| benes((uint64_t *) error128, bits_int, 0); ------------------ | | 9| 83|#define benes CRYPTO_NAMESPACE(benes) | | ------------------ | | | | 4| 83|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864F_AVX2_ ## fun | | ------------------ ------------------ 227| | 228| 83| postprocess(e, error128); 229| | 230| 83| check_weight = weight_check(e, error128); 231| | 232| 83| return 1 - (check_synd & check_weight); 233| 83|} PQCLEAN_MCELIECE348864F_AVX2_encrypt: 114| 83|void encrypt(unsigned char *s, const unsigned char *pk, unsigned char *e) { 115| 83| gen_e(e); 116| | 117| 83| syndrome_asm(s, pk, e); ------------------ | | 1| 83|#define syndrome_asm CRYPTO_NAMESPACE(syndrome_asm) | | ------------------ | | | | 4| 83|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864F_AVX2_ ## fun | | ------------------ ------------------ 118| 83|} PQCLEAN_MCELIECE348864F_AVX2_fft: 171| 271|void fft(vec256 out[][ GFBITS ], uint64_t *in) { 172| 271| radix_conversions(in); 173| 271| butterflies(out, in); 174| 271|} PQCLEAN_MCELIECE348864F_AVX2_fft_tr: 354| 166|void fft_tr(vec128 out[GFBITS], vec256 in[][ GFBITS ]) { 355| 166| butterflies_tr(out, in); 356| 166| radix_conversions_tr(out); 357| 166|} PQCLEAN_MCELIECE348864F_AVX2_gf_mul: 22| 464k|gf gf_mul(gf in0, gf in1) { 23| 464k| int i; 24| | 25| 464k| uint32_t tmp; 26| 464k| uint32_t t0; 27| 464k| uint32_t t1; 28| 464k| uint32_t t; 29| | 30| 464k| t0 = in0; 31| 464k| t1 = in1; 32| | 33| 464k| tmp = t0 * (t1 & 1); 34| | 35| 5.56M| for (i = 1; i < GFBITS; i++) { ------------------ | | 6| 5.56M|#define GFBITS 12 ------------------ | Branch (35:17): [True: 5.10M, False: 464k] ------------------ 36| 5.10M| tmp ^= (t0 * (t1 & (1 << i))); 37| 5.10M| } 38| | 39| 464k| t = tmp & 0x7FC000; 40| 464k| tmp ^= t >> 9; 41| 464k| tmp ^= t >> 12; 42| | 43| 464k| t = tmp & 0x3000; 44| 464k| tmp ^= t >> 9; 45| 464k| tmp ^= t >> 12; 46| | 47| 464k| return tmp & ((1 << GFBITS) - 1); ------------------ | | 6| 464k|#define GFBITS 12 ------------------ 48| 464k|} PQCLEAN_MCELIECE348864F_AVX2_gf_inv: 74| 6.80k|gf gf_inv(gf in) { 75| 6.80k| gf tmp_11; 76| 6.80k| gf tmp_1111; 77| | 78| 6.80k| gf out = in; 79| | 80| 6.80k| out = gf_sq(out); 81| 6.80k| tmp_11 = gf_mul(out, in); // 11 ------------------ | | 14| 6.80k|#define gf_mul CRYPTO_NAMESPACE(gf_mul) | | ------------------ | | | | 4| 6.80k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864F_AVX2_ ## fun | | ------------------ ------------------ 82| | 83| 6.80k| out = gf_sq(tmp_11); 84| 6.80k| out = gf_sq(out); 85| 6.80k| tmp_1111 = gf_mul(out, tmp_11); // 1111 ------------------ | | 14| 6.80k|#define gf_mul CRYPTO_NAMESPACE(gf_mul) | | ------------------ | | | | 4| 6.80k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864F_AVX2_ ## fun | | ------------------ ------------------ 86| | 87| 6.80k| out = gf_sq(tmp_1111); 88| 6.80k| out = gf_sq(out); 89| 6.80k| out = gf_sq(out); 90| 6.80k| out = gf_sq(out); 91| 6.80k| out = gf_mul(out, tmp_1111); // 11111111 ------------------ | | 14| 6.80k|#define gf_mul CRYPTO_NAMESPACE(gf_mul) | | ------------------ | | | | 4| 6.80k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864F_AVX2_ ## fun | | ------------------ ------------------ 92| | 93| 6.80k| out = gf_sq(out); 94| 6.80k| out = gf_sq(out); 95| 6.80k| out = gf_mul(out, tmp_11); // 1111111111 ------------------ | | 14| 6.80k|#define gf_mul CRYPTO_NAMESPACE(gf_mul) | | ------------------ | | | | 4| 6.80k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864F_AVX2_ ## fun | | ------------------ ------------------ 96| | 97| 6.80k| out = gf_sq(out); 98| 6.80k| out = gf_mul(out, in); // 11111111111 ------------------ | | 14| 6.80k|#define gf_mul CRYPTO_NAMESPACE(gf_mul) | | ------------------ | | | | 4| 6.80k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864F_AVX2_ ## fun | | ------------------ ------------------ 99| | 100| 6.80k| return gf_sq(out); // 111111111110 101| 6.80k|} bm.c:PQCLEAN_MCELIECE348864F_AVX2_gf_mul2: 32| 10.6k|static inline uint64_t gf_mul2(gf a, gf b0, gf b1) { 33| 10.6k| int i; 34| | 35| 10.6k| uint64_t tmp = 0; 36| 10.6k| uint64_t t0; 37| 10.6k| uint64_t t1; 38| 10.6k| uint64_t t; 39| 10.6k| uint64_t mask = 0x0000000100000001; 40| | 41| 10.6k| t0 = a; 42| 10.6k| t1 = b1; 43| 10.6k| t1 = (t1 << 32) | b0; 44| | 45| 138k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 138k|#define GFBITS 12 ------------------ | Branch (45:17): [True: 127k, False: 10.6k] ------------------ 46| 127k| tmp ^= t0 * (t1 & mask); 47| 127k| mask += mask; 48| 127k| } 49| | 50| | // 51| | 52| 10.6k| t = tmp & 0x007FC000007FC000; 53| 10.6k| tmp ^= (t >> 9) ^ (t >> 12); 54| | 55| 10.6k| t = tmp & 0x0000300000003000; 56| 10.6k| tmp ^= (t >> 9) ^ (t >> 12); 57| | 58| 10.6k| return tmp & 0x00000FFF00000FFF; 59| 10.6k|} pk_gen.c:PQCLEAN_MCELIECE348864F_AVX2_int32_sort: 21| 83|static void int32_sort(int32_t *x, long long n) { 22| 83| long long top, p, q, r, i; 23| | 24| 83| if (n < 2) { ------------------ | Branch (24:9): [True: 0, False: 83] ------------------ 25| 0| return; 26| 0| } 27| 83| top = 1; 28| 830| while (top < n - top) { ------------------ | Branch (28:12): [True: 747, False: 83] ------------------ 29| 747| top += top; 30| 747| } 31| | 32| 913| for (p = top; p > 0; p >>= 1) { ------------------ | Branch (32:19): [True: 830, False: 83] ------------------ 33| 553k| for (i = 0; i < n - p; ++i) { ------------------ | Branch (33:21): [True: 552k, False: 830] ------------------ 34| 552k| if (!(i & p)) { ------------------ | Branch (34:17): [True: 297k, False: 255k] ------------------ 35| 297k| int32_MINMAX(x[i], x[i + p]); ------------------ | | 11| 297k| do { \ | | 12| 297k| int32_t ab = (b) ^ (a); \ | | 13| 297k| int32_t c = (b) - (a); \ | | 14| 297k| c ^= ab & ((c) ^ (b)); \ | | 15| 297k| c >>= 31; \ | | 16| 297k| c &= ab; \ | | 17| 297k| (a) ^= c; \ | | 18| 297k| (b) ^= c; \ | | 19| 297k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 297k] | | ------------------ ------------------ 36| 297k| } 37| 552k| } 38| 830| i = 0; 39| 4.56k| for (q = top; q > p; q >>= 1) { ------------------ | Branch (39:23): [True: 3.73k, False: 830] ------------------ 40| 492k| for (; i < n - q; ++i) { ------------------ | Branch (40:20): [True: 488k, False: 3.73k] ------------------ 41| 488k| if (!(i & p)) { ------------------ | Branch (41:21): [True: 255k, False: 233k] ------------------ 42| 255k| int32_t a = x[i + p]; 43| 1.35M| for (r = q; r > p; r >>= 1) { ------------------ | Branch (43:33): [True: 1.10M, False: 255k] ------------------ 44| 1.10M| int32_MINMAX(a, x[i + r]); ------------------ | | 11| 1.10M| do { \ | | 12| 1.10M| int32_t ab = (b) ^ (a); \ | | 13| 1.10M| int32_t c = (b) - (a); \ | | 14| 1.10M| c ^= ab & ((c) ^ (b)); \ | | 15| 1.10M| c >>= 31; \ | | 16| 1.10M| c &= ab; \ | | 17| 1.10M| (a) ^= c; \ | | 18| 1.10M| (b) ^= c; \ | | 19| 1.10M| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 1.10M] | | ------------------ ------------------ 45| 1.10M| } 46| 255k| x[i + p] = a; 47| 255k| } 48| 488k| } 49| 3.73k| } 50| 830| } 51| 83|} controlbits.c:PQCLEAN_MCELIECE348864F_AVX2_int32_sort: 21| 1.35M|static void int32_sort(int32_t *x, long long n) { 22| 1.35M| long long top, p, q, r, i; 23| | 24| 1.35M| if (n < 2) { ------------------ | Branch (24:9): [True: 0, False: 1.35M] ------------------ 25| 0| return; 26| 0| } 27| 1.35M| top = 1; 28| 4.74M| while (top < n - top) { ------------------ | Branch (28:12): [True: 3.38M, False: 1.35M] ------------------ 29| 3.38M| top += top; 30| 3.38M| } 31| | 32| 6.10M| for (p = top; p > 0; p >>= 1) { ------------------ | Branch (32:19): [True: 4.74M, False: 1.35M] ------------------ 33| 500M| for (i = 0; i < n - p; ++i) { ------------------ | Branch (33:21): [True: 496M, False: 4.74M] ------------------ 34| 496M| if (!(i & p)) { ------------------ | Branch (34:17): [True: 280M, False: 215M] ------------------ 35| 280M| int32_MINMAX(x[i], x[i + p]); ------------------ | | 11| 280M| do { \ | | 12| 280M| int32_t ab = (b) ^ (a); \ | | 13| 280M| int32_t c = (b) - (a); \ | | 14| 280M| c ^= ab & ((c) ^ (b)); \ | | 15| 280M| c >>= 31; \ | | 16| 280M| c &= ab; \ | | 17| 280M| (a) ^= c; \ | | 18| 280M| (b) ^= c; \ | | 19| 280M| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 280M] | | ------------------ ------------------ 36| 280M| } 37| 496M| } 38| 4.74M| i = 0; 39| 12.7M| for (q = top; q > p; q >>= 1) { ------------------ | Branch (39:23): [True: 8.04M, False: 4.74M] ------------------ 40| 439M| for (; i < n - q; ++i) { ------------------ | Branch (40:20): [True: 431M, False: 8.04M] ------------------ 41| 431M| if (!(i & p)) { ------------------ | Branch (41:21): [True: 215M, False: 215M] ------------------ 42| 215M| int32_t a = x[i + p]; 43| 1.19G| for (r = q; r > p; r >>= 1) { ------------------ | Branch (43:33): [True: 980M, False: 215M] ------------------ 44| 980M| int32_MINMAX(a, x[i + r]); ------------------ | | 11| 980M| do { \ | | 12| 980M| int32_t ab = (b) ^ (a); \ | | 13| 980M| int32_t c = (b) - (a); \ | | 14| 980M| c ^= ab & ((c) ^ (b)); \ | | 15| 980M| c >>= 31; \ | | 16| 980M| c &= ab; \ | | 17| 980M| (a) ^= c; \ | | 18| 980M| (b) ^= c; \ | | 19| 980M| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 980M] | | ------------------ ------------------ 45| 980M| } 46| 215M| x[i + p] = a; 47| 215M| } 48| 431M| } 49| 8.04M| } 50| 4.74M| } 51| 1.35M|} encrypt.c:PQCLEAN_MCELIECE348864F_AVX2_int32_sort: 21| 291|static void int32_sort(int32_t *x, long long n) { 22| 291| long long top, p, q, r, i; 23| | 24| 291| if (n < 2) { ------------------ | Branch (24:9): [True: 0, False: 291] ------------------ 25| 0| return; 26| 0| } 27| 291| top = 1; 28| 1.74k| while (top < n - top) { ------------------ | Branch (28:12): [True: 1.45k, False: 291] ------------------ 29| 1.45k| top += top; 30| 1.45k| } 31| | 32| 2.03k| for (p = top; p > 0; p >>= 1) { ------------------ | Branch (32:19): [True: 1.74k, False: 291] ------------------ 33| 95.1k| for (i = 0; i < n - p; ++i) { ------------------ | Branch (33:21): [True: 93.4k, False: 1.74k] ------------------ 34| 93.4k| if (!(i & p)) { ------------------ | Branch (34:17): [True: 55.8k, False: 37.5k] ------------------ 35| 55.8k| int32_MINMAX(x[i], x[i + p]); ------------------ | | 11| 55.8k| do { \ | | 12| 55.8k| int32_t ab = (b) ^ (a); \ | | 13| 55.8k| int32_t c = (b) - (a); \ | | 14| 55.8k| c ^= ab & ((c) ^ (b)); \ | | 15| 55.8k| c >>= 31; \ | | 16| 55.8k| c &= ab; \ | | 17| 55.8k| (a) ^= c; \ | | 18| 55.8k| (b) ^= c; \ | | 19| 55.8k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 55.8k] | | ------------------ ------------------ 36| 55.8k| } 37| 93.4k| } 38| 1.74k| i = 0; 39| 6.11k| for (q = top; q > p; q >>= 1) { ------------------ | Branch (39:23): [True: 4.36k, False: 1.74k] ------------------ 40| 79.4k| for (; i < n - q; ++i) { ------------------ | Branch (40:20): [True: 75.0k, False: 4.36k] ------------------ 41| 75.0k| if (!(i & p)) { ------------------ | Branch (41:21): [True: 37.5k, False: 37.5k] ------------------ 42| 37.5k| int32_t a = x[i + p]; 43| 139k| for (r = q; r > p; r >>= 1) { ------------------ | Branch (43:33): [True: 102k, False: 37.5k] ------------------ 44| 102k| int32_MINMAX(a, x[i + r]); ------------------ | | 11| 102k| do { \ | | 12| 102k| int32_t ab = (b) ^ (a); \ | | 13| 102k| int32_t c = (b) - (a); \ | | 14| 102k| c ^= ab & ((c) ^ (b)); \ | | 15| 102k| c >>= 31; \ | | 16| 102k| c &= ab; \ | | 17| 102k| (a) ^= c; \ | | 18| 102k| (b) ^= c; \ | | 19| 102k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 102k] | | ------------------ ------------------ 45| 102k| } 46| 37.5k| x[i + p] = a; 47| 37.5k| } 48| 75.0k| } 49| 4.36k| } 50| 1.74k| } 51| 291|} PQCLEAN_MCELIECE348864F_AVX2_crypto_kem_enc: 22| 83|) { 23| 83| unsigned char e[ SYS_N / 8 ]; 24| 83| unsigned char one_ec[ 1 + SYS_N / 8 + SYND_BYTES ] = {1}; 25| | 26| | // 27| | 28| 83| encrypt(c, pk, e); ------------------ | | 9| 83|#define encrypt CRYPTO_NAMESPACE(encrypt) | | ------------------ | | | | 4| 83|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864F_AVX2_ ## fun | | ------------------ ------------------ 29| | 30| 83| memcpy(one_ec + 1, e, SYS_N / 8); ------------------ | | 7| 83|#define SYS_N 3488 ------------------ 31| 83| memcpy(one_ec + 1 + SYS_N / 8, c, SYND_BYTES); ------------------ | | 7| 83|#define SYS_N 3488 ------------------ memcpy(one_ec + 1 + SYS_N / 8, c, SYND_BYTES); ------------------ | | 17| 83|#define SYND_BYTES ((PK_NROWS + 7)/8) | | ------------------ | | | | 13| 83|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 83|#define SYS_T 64 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 83|#define GFBITS 12 | | | | ------------------ | | ------------------ ------------------ 32| | 33| 83| crypto_hash_32b(key, one_ec, sizeof(one_ec)); ------------------ | | 7| 83| shake256(out, 32, in, inlen) | | ------------------ | | | | 12| 83|#define shake256 OQS_SHA3_shake256 | | ------------------ ------------------ 34| | 35| 83| return 0; 36| 83|} PQCLEAN_MCELIECE348864F_AVX2_crypto_kem_dec: 42| 83|) { 43| 83| int i; 44| | 45| 83| unsigned char ret_decrypt = 0; 46| | 47| 83| uint16_t m; 48| | 49| 83| unsigned char e[ SYS_N / 8 ]; 50| 83| unsigned char preimage[ 1 + SYS_N / 8 + SYND_BYTES ]; 51| 83| unsigned char *x = preimage; 52| 83| const unsigned char *s = sk + 40 + IRR_BYTES + COND_BYTES; ------------------ | | 11| 83|#define IRR_BYTES (SYS_T * 2) | | ------------------ | | | | 8| 83|#define SYS_T 64 | | ------------------ ------------------ const unsigned char *s = sk + 40 + IRR_BYTES + COND_BYTES; ------------------ | | 10| 83|#define COND_BYTES ((1 << (GFBITS-4))*(2*GFBITS - 1)) | | ------------------ | | | | 6| 83|#define GFBITS 12 | | ------------------ | | #define COND_BYTES ((1 << (GFBITS-4))*(2*GFBITS - 1)) | | ------------------ | | | | 6| 83|#define GFBITS 12 | | ------------------ ------------------ 53| | 54| | // 55| | 56| 83| ret_decrypt = (unsigned char)decrypt(e, sk + 40, c); ------------------ | | 9| 83|#define decrypt CRYPTO_NAMESPACE(decrypt) | | ------------------ | | | | 4| 83|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864F_AVX2_ ## fun | | ------------------ ------------------ 57| | 58| 83| m = ret_decrypt; 59| 83| m -= 1; 60| 83| m >>= 8; 61| | 62| 83| *x++ = m & 1; 63| 36.2k| for (i = 0; i < SYS_N / 8; i++) { ------------------ | | 7| 36.2k|#define SYS_N 3488 ------------------ | Branch (63:17): [True: 36.1k, False: 83] ------------------ 64| 36.1k| *x++ = (~m & s[i]) | (m & e[i]); 65| 36.1k| } 66| | 67| 8.05k| for (i = 0; i < SYND_BYTES; i++) { ------------------ | | 17| 8.05k|#define SYND_BYTES ((PK_NROWS + 7)/8) | | ------------------ | | | | 13| 8.05k|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 8.05k|#define SYS_T 64 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 8.05k|#define GFBITS 12 | | | | ------------------ | | ------------------ ------------------ | Branch (67:17): [True: 7.96k, False: 83] ------------------ 68| 7.96k| *x++ = c[i]; 69| 7.96k| } 70| | 71| 83| crypto_hash_32b(key, preimage, sizeof(preimage)); ------------------ | | 7| 83| shake256(out, 32, in, inlen) | | ------------------ | | | | 12| 83|#define shake256 OQS_SHA3_shake256 | | ------------------ ------------------ 72| | 73| 83| return 0; 74| 83|} PQCLEAN_MCELIECE348864F_AVX2_crypto_kem_keypair: 80| 83|) { 81| 83| int i; 82| 83| unsigned char seed[ 33 ] = {64}; 83| 83| unsigned char r[ SYS_N / 8 + (1 << GFBITS)*sizeof(uint32_t) + SYS_T * 2 + 32 ]; 84| 83| unsigned char *rp, *skp; 85| 83| uint64_t pivots; 86| | 87| 83| gf f[ SYS_T ]; // element in GF(2^mt) 88| 83| gf irr[ SYS_T ]; // Goppa polynomial 89| 83| uint32_t perm[ 1 << GFBITS ]; // random permutation as 32-bit integers 90| 83| int16_t pi[ 1 << GFBITS ]; // random permutation 91| | 92| 83| randombytes(seed + 1, 32); ------------------ | | 8| 83|#define randombytes OQS_randombytes ------------------ 93| | 94| 105| while (1) { ------------------ | Branch (94:12): [True: 105, Folded] ------------------ 95| 105| rp = &r[ sizeof(r) - 32 ]; 96| 105| skp = sk; 97| | 98| | // expanding and updating the seed 99| | 100| 105| shake(r, sizeof(r), seed, 33); ------------------ | | 10| 105| shake256(out, outlen, in, inlen) | | ------------------ | | | | 12| 105|#define shake256 OQS_SHA3_shake256 | | ------------------ ------------------ 101| 105| memcpy(skp, seed + 1, 32); 102| 105| skp += 32 + 8; 103| 105| memcpy(seed + 1, &r[ sizeof(r) - 32 ], 32); 104| | 105| | // generating irreducible polynomial 106| | 107| 105| rp -= sizeof(f); 108| | 109| 6.82k| for (i = 0; i < SYS_T; i++) { ------------------ | | 8| 6.82k|#define SYS_T 64 ------------------ | Branch (109:21): [True: 6.72k, False: 105] ------------------ 110| 6.72k| f[i] = load_gf(rp + i * 2); 111| 6.72k| } 112| | 113| 105| if (genpoly_gen(irr, f)) { ------------------ | | 9| 105|#define genpoly_gen CRYPTO_NAMESPACE(genpoly_gen) | | ------------------ | | | | 4| 105|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864F_AVX2_ ## fun | | ------------------ ------------------ | Branch (113:13): [True: 0, False: 105] ------------------ 114| 0| continue; 115| 0| } 116| | 117| 6.82k| for (i = 0; i < SYS_T; i++) { ------------------ | | 8| 6.82k|#define SYS_T 64 ------------------ | Branch (117:21): [True: 6.72k, False: 105] ------------------ 118| 6.72k| store_gf(skp + i * 2, irr[i]); 119| 6.72k| } 120| | 121| 105| skp += IRR_BYTES; ------------------ | | 11| 105|#define IRR_BYTES (SYS_T * 2) | | ------------------ | | | | 8| 105|#define SYS_T 64 | | ------------------ ------------------ 122| | 123| | // generating permutation 124| | 125| 105| rp -= sizeof(perm); 126| | 127| 430k| for (i = 0; i < (1 << GFBITS); i++) { ------------------ | | 6| 430k|#define GFBITS 12 ------------------ | Branch (127:21): [True: 430k, False: 105] ------------------ 128| 430k| perm[i] = load4(rp + i * 4); 129| 430k| } 130| | 131| 105| if (pk_gen(pk, skp - IRR_BYTES, perm, pi, &pivots)) { ------------------ | | 9| 105|#define pk_gen CRYPTO_NAMESPACE(pk_gen) | | ------------------ | | | | 4| 105|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864F_AVX2_ ## fun | | ------------------ ------------------ if (pk_gen(pk, skp - IRR_BYTES, perm, pi, &pivots)) { ------------------ | | 11| 105|#define IRR_BYTES (SYS_T * 2) | | ------------------ | | | | 8| 105|#define SYS_T 64 | | ------------------ ------------------ | Branch (131:13): [True: 22, False: 83] ------------------ 132| 22| continue; 133| 22| } 134| | 135| 83| controlbitsfrompermutation(skp, pi, GFBITS, 1 << GFBITS); ------------------ | | 10| 83|#define controlbitsfrompermutation CRYPTO_NAMESPACE(controlbitsfrompermutation) | | ------------------ | | | | 4| 83|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864F_AVX2_ ## fun | | ------------------ ------------------ controlbitsfrompermutation(skp, pi, GFBITS, 1 << GFBITS); ------------------ | | 6| 83|#define GFBITS 12 ------------------ controlbitsfrompermutation(skp, pi, GFBITS, 1 << GFBITS); ------------------ | | 6| 83|#define GFBITS 12 ------------------ 136| 83| skp += COND_BYTES; ------------------ | | 10| 83|#define COND_BYTES ((1 << (GFBITS-4))*(2*GFBITS - 1)) | | ------------------ | | | | 6| 83|#define GFBITS 12 | | ------------------ | | #define COND_BYTES ((1 << (GFBITS-4))*(2*GFBITS - 1)) | | ------------------ | | | | 6| 83|#define GFBITS 12 | | ------------------ ------------------ 137| | 138| | // storing the random string s 139| | 140| 83| rp -= SYS_N / 8; ------------------ | | 7| 83|#define SYS_N 3488 ------------------ 141| 83| memcpy(skp, rp, SYS_N / 8); ------------------ | | 7| 83|#define SYS_N 3488 ------------------ 142| | 143| | // storing positions of the 32 pivots 144| | 145| 83| store8(sk + 32, pivots); 146| | 147| 83| break; 148| 105| } 149| | 150| 83| return 0; 151| 83|} PQCLEAN_MCELIECE348864F_AVX2_pk_gen: 316| 105|int pk_gen(unsigned char *pk, const unsigned char *irr, const uint32_t *perm, int16_t *pi, uint64_t *pivots) { 317| 105| int i, j, k, b; 318| 105| int row, c; 319| | 320| 105| union { 321| 105| uint64_t w[ PK_NROWS ][ (nBlocks_I + 1) * 4 ]; 322| 105| vec256 v[ PK_NROWS ][ nBlocks_I + 1 ]; 323| 105| } mat; 324| | 325| 105| union { 326| 105| uint64_t w[ PK_NROWS ][ par_width * 4 ]; 327| 105| vec256 v[ PK_NROWS ][ par_width ]; 328| 105| } par; 329| | 330| 105| uint16_t m; 331| 105| vec256 mm; 332| | 333| 105| uint64_t sk_int[ GFBITS ]; 334| | 335| 105| vec256 consts[ 16 ][ GFBITS ]; 336| 105| vec256 eval[ 16 ][ GFBITS ]; 337| 105| vec256 prod[ 16 ][ GFBITS ]; 338| 105| vec256 tmp[ GFBITS ]; 339| | 340| 105| uint64_t list[1 << GFBITS]; 341| 105| uint64_t one = 1; 342| 105| uint64_t t; 343| | 344| 105| uint16_t ind[ PK_NROWS ]; 345| 105| uint16_t ind_inv[ PK_NROWS ]; 346| | 347| | // compute the inverses 348| | 349| 105| irr_load(sk_int, irr); 350| | 351| 105| fft(eval, sk_int); ------------------ | | 10| 105|#define fft CRYPTO_NAMESPACE(fft) | | ------------------ | | | | 4| 105|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864F_AVX2_ ## fun | | ------------------ ------------------ 352| | 353| 105| vec256_copy(prod[0], eval[0]); 354| | 355| 1.68k| for (i = 1; i < 16; i++) { ------------------ | Branch (355:17): [True: 1.57k, False: 105] ------------------ 356| 1.57k| vec256_mul(prod[i], prod[i - 1], eval[i]); 357| 1.57k| } 358| | 359| 105| vec256_inv(tmp, prod[15]); ------------------ | | 11| 105|#define vec256_inv CRYPTO_NAMESPACE(vec256_inv) | | ------------------ | | | | 4| 105|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864F_AVX2_ ## fun | | ------------------ ------------------ 360| | 361| 1.68k| for (i = 14; i >= 0; i--) { ------------------ | Branch (361:18): [True: 1.57k, False: 105] ------------------ 362| 1.57k| vec256_mul(prod[i + 1], prod[i], tmp); 363| 1.57k| vec256_mul(tmp, tmp, eval[i + 1]); 364| 1.57k| } 365| | 366| 105| vec256_copy(prod[0], tmp); 367| | 368| | // fill matrix 369| | 370| 105| de_bitslicing(list, prod); 371| | 372| 430k| for (i = 0; i < (1 << GFBITS); i++) { ------------------ | | 6| 430k|#define GFBITS 12 ------------------ | Branch (372:17): [True: 430k, False: 105] ------------------ 373| 430k| list[i] <<= GFBITS; ------------------ | | 6| 430k|#define GFBITS 12 ------------------ 374| 430k| list[i] |= i; 375| 430k| list[i] |= ((uint64_t) perm[i]) << 31; 376| 430k| } 377| | 378| 105| uint64_sort(list, 1 << GFBITS); ------------------ | | 6| 105|#define GFBITS 12 ------------------ 379| | 380| 373k| for (i = 1; i < (1 << GFBITS); i++) { ------------------ | | 6| 373k|#define GFBITS 12 ------------------ | Branch (380:17): [True: 373k, False: 83] ------------------ 381| 373k| if (uint64_is_equal_declassify(list[i - 1] >> 31, list[i] >> 31)) { ------------------ | Branch (381:13): [True: 22, False: 373k] ------------------ 382| 22| return -1; 383| 22| } 384| 373k| } 385| | 386| 83| to_bitslicing_2x(consts, prod, list); 387| | 388| 340k| for (i = 0; i < (1 << GFBITS); i++) { ------------------ | | 6| 340k|#define GFBITS 12 ------------------ | Branch (388:17): [True: 339k, False: 83] ------------------ 389| 339k| pi[i] = list[i] & GFMASK; ------------------ | | 19| 339k|#define GFMASK ((1 << GFBITS) - 1) | | ------------------ | | | | 6| 339k|#define GFBITS 12 | | ------------------ ------------------ 390| 339k| } 391| | 392| 415| for (j = 0; j < nBlocks_I + 1; j++) { ------------------ | | 33| 415|#define nBlocks_I ((PK_NROWS + 255) / 256) | | ------------------ | | | | 13| 415|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 415|#define SYS_T 64 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 415|#define GFBITS 12 | | | | ------------------ | | ------------------ ------------------ | Branch (392:17): [True: 332, False: 83] ------------------ 393| 4.31k| for (k = 0; k < GFBITS; k++) { ------------------ | | 6| 4.31k|#define GFBITS 12 ------------------ | Branch (393:21): [True: 3.98k, False: 332] ------------------ 394| 3.98k| mat.v[ k ][ j ] = prod[ j ][ k ]; 395| 3.98k| } 396| 332| } 397| | 398| 5.31k| for (i = 1; i < SYS_T; i++) { ------------------ | | 8| 5.31k|#define SYS_T 64 ------------------ | Branch (398:17): [True: 5.22k, False: 83] ------------------ 399| 26.1k| for (j = 0; j < nBlocks_I + 1; j++) { ------------------ | | 33| 26.1k|#define nBlocks_I ((PK_NROWS + 255) / 256) | | ------------------ | | | | 13| 26.1k|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 26.1k|#define SYS_T 64 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 26.1k|#define GFBITS 12 | | | | ------------------ | | ------------------ ------------------ | Branch (399:21): [True: 20.9k, False: 5.22k] ------------------ 400| 20.9k| vec256_mul(prod[j], prod[j], consts[j]); 401| | 402| 271k| for (k = 0; k < GFBITS; k++) { ------------------ | | 6| 271k|#define GFBITS 12 ------------------ | Branch (402:25): [True: 250k, False: 20.9k] ------------------ 403| 250k| mat.v[ i * GFBITS + k ][ j ] = prod[ j ][ k ]; ------------------ | | 6| 250k|#define GFBITS 12 ------------------ 404| 250k| } 405| 20.9k| } 406| 5.22k| } 407| | 408| | // Gaussian elimination + column swaps to obtain L, U, and P such that LP M = U 409| | // L and U are stored in the space of M 410| | // P is stored in ind 411| | 412| 63.8k| for (i = 0; i < PK_NROWS; i++) { ------------------ | | 13| 63.8k|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 63.8k|#define SYS_T 64 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 63.8k|#define GFBITS 12 | | ------------------ ------------------ | Branch (412:17): [True: 63.7k, False: 83] ------------------ 413| 63.7k| ind_inv[i] = ind[ i ] = i; 414| 63.7k| } 415| | 416| 63.8k| for (row = 0; row < PK_NROWS; row++) { ------------------ | | 13| 63.8k|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 63.8k|#define SYS_T 64 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 63.8k|#define GFBITS 12 | | ------------------ ------------------ | Branch (416:19): [True: 63.7k, False: 83] ------------------ 417| 63.7k| i = row >> 6; 418| 63.7k| j = row & 63; 419| | 420| 63.7k| if (row == PK_NROWS - 32) { ------------------ | | 13| 63.7k|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 63.7k|#define SYS_T 64 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 63.7k|#define GFBITS 12 | | ------------------ ------------------ | Branch (420:13): [True: 83, False: 63.6k] ------------------ 421| 83| if (mov_columns(mat.w, pi, pivots)) { ------------------ | Branch (421:17): [True: 0, False: 83] ------------------ 422| 0| return -1; 423| 0| } 424| 83| } 425| | 426| 24.5M| for (k = row + 1; k < PK_NROWS; k++) { ------------------ | | 13| 24.5M|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 24.5M|#define SYS_T 64 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 24.5M|#define GFBITS 12 | | ------------------ ------------------ | Branch (426:27): [True: 24.4M, False: 63.7k] ------------------ 427| 24.4M| extract_01_masks(&m, mat.w[ row ], mat.w[ k ], row); 428| 24.4M| uint16_cswap(&ind[row], &ind[k], m); 429| | 430| 24.4M| mm = vec256_set1_16b(m); 431| 122M| for (c = 0; c < nBlocks_I + 1; c++) { ------------------ | | 33| 122M|#define nBlocks_I ((PK_NROWS + 255) / 256) | | ------------------ | | | | 13| 122M|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 122M|#define SYS_T 64 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 122M|#define GFBITS 12 | | | | ------------------ | | ------------------ ------------------ | Branch (431:25): [True: 97.7M, False: 24.4M] ------------------ 432| 97.7M| vec256_cswap(&mat.v[ row ][ c ], &mat.v[ k ][ c ], mm); 433| 97.7M| } 434| 24.4M| } 435| | 436| 63.7k| if ( uint64_is_zero_declassify((mat.w[ row ][ i ] >> j) & 1) ) { // return if not systematic ------------------ | Branch (436:14): [True: 0, False: 63.7k] ------------------ 437| 0| return -1; 438| 0| } 439| | 440| 24.5M| for (k = row + 1; k < PK_NROWS; k++) { ------------------ | | 13| 24.5M|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 24.5M|#define SYS_T 64 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 24.5M|#define GFBITS 12 | | ------------------ ------------------ | Branch (440:27): [True: 24.4M, False: 63.7k] ------------------ 441| 24.4M| t = mat.w[ k ][ i ] & (one << j); 442| 24.4M| mm = extract_mask256(mat.w[k], row); 443| | 444| 122M| for (c = 0; c < nBlocks_I + 1; c++) { ------------------ | | 33| 122M|#define nBlocks_I ((PK_NROWS + 255) / 256) | | ------------------ | | | | 13| 122M|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 122M|#define SYS_T 64 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 122M|#define GFBITS 12 | | | | ------------------ | | ------------------ ------------------ | Branch (444:25): [True: 97.7M, False: 24.4M] ------------------ 445| 97.7M| mat.v[ k ][ c ] ^= mat.v[ row ][ c ] & mm; 446| 97.7M| } 447| | 448| 24.4M| mat.w[ k ][ i ] |= t; 449| 24.4M| } 450| 63.7k| } 451| | 452| | // apply M^-1 to the remaining columns 453| | 454| 83| composeinv(PK_NROWS, ind_inv, ind_inv, ind); ------------------ | | 13| 83|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 83|#define SYS_T 64 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 83|#define GFBITS 12 | | ------------------ ------------------ 455| | 456| 1.07k| for (k = 0; k < GFBITS; k++) { ------------------ | | 6| 1.07k|#define GFBITS 12 ------------------ | Branch (456:17): [True: 996, False: 83] ------------------ 457| 10.9k| for (b = 1; b < par_width; b++) { ------------------ | | 34| 10.9k|#define par_width 11 ------------------ | Branch (457:21): [True: 9.96k, False: 996] ------------------ 458| 9.96k| par.v[ k ][ b ] = prod[nBlocks_I + b][ k ]; ------------------ | | 33| 9.96k|#define nBlocks_I ((PK_NROWS + 255) / 256) | | ------------------ | | | | 13| 9.96k|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 9.96k|#define SYS_T 64 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 9.96k|#define GFBITS 12 | | | | ------------------ | | ------------------ ------------------ 459| 9.96k| } 460| 996| } 461| | 462| 5.31k| for (i = 1; i < SYS_T; i++) { ------------------ | | 8| 5.31k|#define SYS_T 64 ------------------ | Branch (462:17): [True: 5.22k, False: 83] ------------------ 463| 57.5k| for (b = 1; b < par_width; b++) { ------------------ | | 34| 57.5k|#define par_width 11 ------------------ | Branch (463:21): [True: 52.2k, False: 5.22k] ------------------ 464| 52.2k| vec256_mul(prod[nBlocks_I + b], prod[nBlocks_I + b], consts[nBlocks_I + b]); ------------------ | | 33| 52.2k|#define nBlocks_I ((PK_NROWS + 255) / 256) | | ------------------ | | | | 13| 52.2k|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 52.2k|#define SYS_T 64 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 52.2k|#define GFBITS 12 | | | | ------------------ | | ------------------ ------------------ vec256_mul(prod[nBlocks_I + b], prod[nBlocks_I + b], consts[nBlocks_I + b]); ------------------ | | 33| 52.2k|#define nBlocks_I ((PK_NROWS + 255) / 256) | | ------------------ | | | | 13| 52.2k|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 52.2k|#define SYS_T 64 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 52.2k|#define GFBITS 12 | | | | ------------------ | | ------------------ ------------------ vec256_mul(prod[nBlocks_I + b], prod[nBlocks_I + b], consts[nBlocks_I + b]); ------------------ | | 33| 52.2k|#define nBlocks_I ((PK_NROWS + 255) / 256) | | ------------------ | | | | 13| 52.2k|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 52.2k|#define SYS_T 64 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 52.2k|#define GFBITS 12 | | | | ------------------ | | ------------------ ------------------ 465| 52.2k| } 466| | 467| 67.9k| for (k = 0; k < GFBITS; k++) { ------------------ | | 6| 67.9k|#define GFBITS 12 ------------------ | Branch (467:21): [True: 62.7k, False: 5.22k] ------------------ 468| 690k| for (b = 1; b < par_width; b++) { ------------------ | | 34| 690k|#define par_width 11 ------------------ | Branch (468:25): [True: 627k, False: 62.7k] ------------------ 469| 627k| par.v[ i * GFBITS + k ][ b ] = prod[nBlocks_I + b][ k ]; ------------------ | | 6| 627k|#define GFBITS 12 ------------------ par.v[ i * GFBITS + k ][ b ] = prod[nBlocks_I + b][ k ]; ------------------ | | 33| 627k|#define nBlocks_I ((PK_NROWS + 255) / 256) | | ------------------ | | | | 13| 627k|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 627k|#define SYS_T 64 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 627k|#define GFBITS 12 | | | | ------------------ | | ------------------ ------------------ 470| 627k| } 471| 62.7k| } 472| 5.22k| } 473| | 474| | // apply P 475| | 476| 63.8k| for (i = 0; i < PK_NROWS; i++) { ------------------ | | 13| 63.8k|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 63.8k|#define SYS_T 64 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 63.8k|#define GFBITS 12 | | ------------------ ------------------ | Branch (476:17): [True: 63.7k, False: 83] ------------------ 477| 63.7k| ind[i] = ind_inv[i]; 478| 63.7k| } 479| | 480| 83| sort_rows((1 << GFBITS) / 4, PK_NROWS, ind, par.v, 0); ------------------ | | 6| 83|#define GFBITS 12 ------------------ sort_rows((1 << GFBITS) / 4, PK_NROWS, ind, par.v, 0); ------------------ | | 13| 83|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 83|#define SYS_T 64 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 83|#define GFBITS 12 | | ------------------ ------------------ 481| | 482| | // apply L 483| | 484| 63.8k| for (row = PK_NROWS - 1; row >= 0; row--) { ------------------ | | 13| 83|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 83|#define SYS_T 64 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 83|#define GFBITS 12 | | ------------------ ------------------ | Branch (484:30): [True: 63.7k, False: 83] ------------------ 485| 24.5M| for (i = row - 1; i >= 0; i--) { ------------------ | Branch (485:27): [True: 24.4M, False: 63.7k] ------------------ 486| 24.4M| mm = extract_mask256(mat.w[row], i); 487| | 488| 268M| for (k = 1; k < par_width; k++) { ------------------ | | 34| 268M|#define par_width 11 ------------------ | Branch (488:25): [True: 244M, False: 24.4M] ------------------ 489| 244M| par.v[ row ][ k ] ^= par.v[ i ][ k ] & mm; 490| 244M| } 491| 24.4M| } 492| 63.7k| } 493| | 494| | // apply U^-1 495| | 496| 63.8k| for (i = 0; i < PK_NROWS; i++) { ------------------ | | 13| 63.8k|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 63.8k|#define SYS_T 64 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 63.8k|#define GFBITS 12 | | ------------------ ------------------ | Branch (496:17): [True: 63.7k, False: 83] ------------------ 497| 63.7k| par.v[i][0] = mat.v[i][nBlocks_I]; ------------------ | | 33| 63.7k|#define nBlocks_I ((PK_NROWS + 255) / 256) | | ------------------ | | | | 13| 63.7k|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 63.7k|#define SYS_T 64 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 63.7k|#define GFBITS 12 | | | | ------------------ | | ------------------ ------------------ 498| 63.7k| } 499| | 500| 63.8k| for (row = PK_NROWS - 1; row >= 0; row--) { ------------------ | | 13| 83|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 83|#define SYS_T 64 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 83|#define GFBITS 12 | | ------------------ ------------------ | Branch (500:30): [True: 63.7k, False: 83] ------------------ 501| 24.5M| for (i = PK_NROWS - 1; i > row; i--) { ------------------ | | 13| 63.7k|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 63.7k|#define SYS_T 64 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 63.7k|#define GFBITS 12 | | ------------------ ------------------ | Branch (501:32): [True: 24.4M, False: 63.7k] ------------------ 502| 24.4M| mm = extract_mask256(mat.w[row], i); 503| | 504| 293M| for (k = 0; k < par_width; k++) { ------------------ | | 34| 293M|#define par_width 11 ------------------ | Branch (504:25): [True: 268M, False: 24.4M] ------------------ 505| 268M| par.v[ row ][ k ] ^= par.v[ i ][ k ] & mm; 506| 268M| } 507| 24.4M| } 508| 63.7k| } 509| | 510| 63.8k| for (row = 0; row < PK_NROWS; row++) { ------------------ | | 13| 63.8k|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 63.8k|#define SYS_T 64 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 63.8k|#define GFBITS 12 | | ------------------ ------------------ | Branch (510:19): [True: 63.7k, False: 83] ------------------ 511| 2.74M| for (k = 0; k < 42; k++) { ------------------ | Branch (511:21): [True: 2.67M, False: 63.7k] ------------------ 512| 2.67M| store8(pk + PK_ROW_BYTES * row + k * 8, par.w[row][k]); ------------------ | | 15| 2.67M|#define PK_ROW_BYTES ((PK_NCOLS + 7)/8) | | ------------------ | | | | 14| 2.67M|#define PK_NCOLS (SYS_N - PK_NROWS) | | | | ------------------ | | | | | | 7| 2.67M|#define SYS_N 3488 | | | | ------------------ | | | | #define PK_NCOLS (SYS_N - PK_NROWS) | | | | ------------------ | | | | | | 13| 2.67M|#define PK_NROWS (SYS_T*GFBITS) | | | | | | ------------------ | | | | | | | | 8| 2.67M|#define SYS_T 64 | | | | | | ------------------ | | | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | | | ------------------ | | | | | | | | 6| 2.67M|#define GFBITS 12 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 513| 2.67M| } 514| | 515| 63.7k| store_i(pk + PK_ROW_BYTES * row + k * 8, par.w[row][k], 4); ------------------ | | 15| 63.7k|#define PK_ROW_BYTES ((PK_NCOLS + 7)/8) | | ------------------ | | | | 14| 63.7k|#define PK_NCOLS (SYS_N - PK_NROWS) | | | | ------------------ | | | | | | 7| 63.7k|#define SYS_N 3488 | | | | ------------------ | | | | #define PK_NCOLS (SYS_N - PK_NROWS) | | | | ------------------ | | | | | | 13| 63.7k|#define PK_NROWS (SYS_T*GFBITS) | | | | | | ------------------ | | | | | | | | 8| 63.7k|#define SYS_T 64 | | | | | | ------------------ | | | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | | | ------------------ | | | | | | | | 6| 63.7k|#define GFBITS 12 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 516| 63.7k| } 517| | 518| | // 519| | 520| 83| return 0; 521| 83|} pk_gen.c:int16_cswap: 79| 655k|static inline void int16_cswap(int16_t *x, int16_t *y, uint16_t m) { 80| 655k| int16_t d; 81| | 82| 655k| d = *x ^ *y; 83| 655k| d &= m; 84| 655k| *x ^= d; 85| 655k| *y ^= d; 86| 655k|} PQCLEAN_MCELIECE348864F_AVX2_genpoly_gen: 55| 105|int genpoly_gen(gf *out, gf *f) { 56| 105| int i, j, k; 57| | 58| 105| gf t, inv; 59| | 60| 105| vec v[ GFBITS ], buf[ GFBITS ][ 64 ], mat[ 64 ][ GFBITS ], mask; 61| | 62| | // fill matrix 63| | 64| 105| buf[0][0] = 1; 65| 1.26k| for (i = 1; i < GFBITS; i++) { ------------------ | | 6| 1.26k|#define GFBITS 12 ------------------ | Branch (65:17): [True: 1.15k, False: 105] ------------------ 66| 1.15k| buf[i][0] = 0; 67| 1.15k| } 68| | 69| 1.36k| for (j = 0; j < GFBITS; j++) { ------------------ | | 6| 1.36k|#define GFBITS 12 ------------------ | Branch (69:17): [True: 1.26k, False: 105] ------------------ 70| 81.9k| for (i = SYS_T - 1; i >= 0; i--) { ------------------ | | 8| 1.26k|#define SYS_T 64 ------------------ | Branch (70:29): [True: 80.6k, False: 1.26k] ------------------ 71| 80.6k| v[j] <<= 1; 72| 80.6k| v[j] |= (f[i] >> j) & 1; 73| 80.6k| } 74| 1.26k| } 75| | 76| 1.36k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 1.36k|#define GFBITS 12 ------------------ | Branch (76:17): [True: 1.26k, False: 105] ------------------ 77| 1.26k| buf[i][1] = v[i]; 78| 1.26k| } 79| | 80| 6.72k| for (k = 2; k <= SYS_T; k++) { ------------------ | | 8| 6.72k|#define SYS_T 64 ------------------ | Branch (80:17): [True: 6.61k, False: 105] ------------------ 81| 6.61k| vec_GF_mul(v, v, f); ------------------ | | 6| 6.61k|#define vec_GF_mul CRYPTO_NAMESPACE(vec_GF_mul) | | ------------------ | | | | 4| 6.61k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864F_AVX2_ ## fun | | ------------------ ------------------ 82| | 83| 6.61k| if (k < SYS_T) { ------------------ | | 8| 6.61k|#define SYS_T 64 ------------------ | Branch (83:13): [True: 6.51k, False: 105] ------------------ 84| 84.6k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 84.6k|#define GFBITS 12 ------------------ | Branch (84:25): [True: 78.1k, False: 6.51k] ------------------ 85| 78.1k| buf[i][k] = v[i]; 86| 78.1k| } 87| 6.51k| } else { 88| 6.82k| for (i = 0; i < SYS_T; i++) { ------------------ | | 8| 6.82k|#define SYS_T 64 ------------------ | Branch (88:25): [True: 6.72k, False: 105] ------------------ 89| 6.72k| out[i] = extract_gf(v, i); 90| 6.72k| } 91| 105| } 92| 6.61k| } 93| | 94| 1.36k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 1.36k|#define GFBITS 12 ------------------ | Branch (94:17): [True: 1.26k, False: 105] ------------------ 95| 1.26k| transpose_64x64(buf[i]); 96| 1.26k| } 97| | 98| 6.82k| for (j = 0; j < SYS_T; j++) { ------------------ | | 8| 6.82k|#define SYS_T 64 ------------------ | Branch (98:17): [True: 6.72k, False: 105] ------------------ 99| 87.3k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 87.3k|#define GFBITS 12 ------------------ | Branch (99:21): [True: 80.6k, False: 6.72k] ------------------ 100| 80.6k| mat[j][i] = buf[i][j]; 101| 80.6k| } 102| 6.72k| } 103| | 104| | // gaussian 105| | 106| 6.82k| for (i = 0; i < SYS_T; i++) { ------------------ | | 8| 6.82k|#define SYS_T 64 ------------------ | Branch (106:17): [True: 6.72k, False: 105] ------------------ 107| 218k| for (j = i + 1; j < SYS_T; j++) { ------------------ | | 8| 218k|#define SYS_T 64 ------------------ | Branch (107:25): [True: 211k, False: 6.72k] ------------------ 108| 211k| mask = extract_bit(mat[i], i); 109| 211k| mask -= 1; 110| | 111| 2.75M| for (k = 0; k < GFBITS; k++) { ------------------ | | 6| 2.75M|#define GFBITS 12 ------------------ | Branch (111:25): [True: 2.54M, False: 211k] ------------------ 112| 2.54M| mat[i][k] ^= mat[j][k] & mask; 113| 2.54M| } 114| | 115| 211k| out[i] ^= out[j] & mask; 116| 211k| } 117| | 118| | // 119| | 120| 6.72k| t = extract_gf(mat[i], i); 121| | 122| 6.72k| if (gf_is_zero_declassify(t)) { ------------------ | Branch (122:13): [True: 0, False: 6.72k] ------------------ 123| 0| return -1; // return if not systematic 124| 0| } 125| | 126| | // 127| | 128| 6.72k| inv = gf_inv(t); ------------------ | | 11| 6.72k|#define gf_inv CRYPTO_NAMESPACE(gf_inv) | | ------------------ | | | | 4| 6.72k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864F_AVX2_ ## fun | | ------------------ ------------------ 129| 6.72k| vec_mul_gf(mat[i], mat[i], inv); 130| | 131| 6.72k| out[i] = gf_mul(out[i], inv); ------------------ | | 14| 6.72k|#define gf_mul CRYPTO_NAMESPACE(gf_mul) | | ------------------ | | | | 4| 6.72k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864F_AVX2_ ## fun | | ------------------ ------------------ 132| | 133| 436k| for (j = 0; j < SYS_T; j++) { ------------------ | | 8| 436k|#define SYS_T 64 ------------------ | Branch (133:21): [True: 430k, False: 6.72k] ------------------ 134| 430k| if (j != i) { ------------------ | Branch (134:17): [True: 423k, False: 6.72k] ------------------ 135| 423k| t = extract_gf(mat[j], i); 136| | 137| 423k| vec_mul_gf(v, mat[i], t); 138| 423k| vec_add(mat[j], mat[j], v); 139| | 140| 423k| out[j] ^= gf_mul(out[i], t); ------------------ | | 14| 423k|#define gf_mul CRYPTO_NAMESPACE(gf_mul) | | ------------------ | | | | 4| 423k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864F_AVX2_ ## fun | | ------------------ ------------------ 141| 423k| } 142| 430k| } 143| 6.72k| } 144| | 145| 105| return 0; 146| 105|} PQCLEAN_MCELIECE348864F_AVX2_vec_GF_mul: 6| 6.61k|void vec_GF_mul(vec out[ GFBITS ], vec v[ GFBITS ], gf a[ SYS_T ]) { 7| 6.61k| int i, j; 8| 6.61k| vec buf[GFBITS][2], prod[GFBITS], tmp[GFBITS]; 9| | 10| 6.61k| const vec allone = -1; 11| | 12| | // polynomial multiplication 13| | 14| 85.9k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 85.9k|#define GFBITS 12 ------------------ | Branch (14:17): [True: 79.3k, False: 6.61k] ------------------ 15| 79.3k| buf[i][0] = 0; 16| 79.3k| buf[i][1] = 0; 17| 79.3k| } 18| | 19| 429k| for (i = SYS_T - 1; i >= 0; i--) { ------------------ | | 8| 6.61k|#define SYS_T 64 ------------------ | Branch (19:25): [True: 423k, False: 6.61k] ------------------ 20| 5.50M| for (j = 0; j < GFBITS; j++) { ------------------ | | 6| 5.50M|#define GFBITS 12 ------------------ | Branch (20:21): [True: 5.08M, False: 423k] ------------------ 21| 5.08M| buf[j][1] <<= 1; 22| 5.08M| buf[j][1] |= buf[j][0] >> 63; 23| 5.08M| buf[j][0] <<= 1; 24| 5.08M| } 25| | 26| 423k| vec_mul_gf(prod, v, a[i]); 27| | 28| 5.50M| for (j = 0; j < GFBITS; j++) { ------------------ | | 6| 5.50M|#define GFBITS 12 ------------------ | Branch (28:21): [True: 5.08M, False: 423k] ------------------ 29| 5.08M| buf[j][0] ^= prod[j]; 30| 5.08M| } 31| 423k| } 32| | 33| | // reduction modulo y^64 + y^3 + y + z 34| | 35| 85.9k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 85.9k|#define GFBITS 12 ------------------ | Branch (35:17): [True: 79.3k, False: 6.61k] ------------------ 36| 79.3k| prod[i] = buf[i][1] & (allone << 3); 37| 79.3k| } 38| | 39| 6.61k| vec_mul_gf(tmp, prod, 2); 40| | 41| 85.9k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 85.9k|#define GFBITS 12 ------------------ | Branch (41:17): [True: 79.3k, False: 6.61k] ------------------ 42| 79.3k| buf[i][1] ^= prod[i] >> (SYS_T - 3); ------------------ | | 8| 79.3k|#define SYS_T 64 ------------------ 43| 79.3k| buf[i][0] ^= prod[i] << (64 - (SYS_T - 3)); ------------------ | | 8| 79.3k|#define SYS_T 64 ------------------ 44| 79.3k| buf[i][1] ^= prod[i] >> (SYS_T - 1); ------------------ | | 8| 79.3k|#define SYS_T 64 ------------------ 45| 79.3k| buf[i][0] ^= prod[i] << (64 - (SYS_T - 1)); ------------------ | | 8| 79.3k|#define SYS_T 64 ------------------ 46| 79.3k| buf[i][0] ^= tmp[i]; 47| 79.3k| } 48| | 49| | // 50| | 51| 85.9k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 85.9k|#define GFBITS 12 ------------------ | Branch (51:17): [True: 79.3k, False: 6.61k] ------------------ 52| 79.3k| prod[i] = buf[i][1] & 0x7; 53| 79.3k| } 54| | 55| 6.61k| vec_mul_gf(tmp, prod, 2); 56| | 57| 85.9k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 85.9k|#define GFBITS 12 ------------------ | Branch (57:17): [True: 79.3k, False: 6.61k] ------------------ 58| 79.3k| buf[i][0] ^= prod[i] << (64 - (SYS_T - 3)); ------------------ | | 8| 79.3k|#define SYS_T 64 ------------------ 59| 79.3k| buf[i][0] ^= prod[i] << (64 - (SYS_T - 1)); ------------------ | | 8| 79.3k|#define SYS_T 64 ------------------ 60| 79.3k| buf[i][0] ^= tmp[i]; 61| 79.3k| } 62| | 63| | // 64| | 65| 85.9k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 85.9k|#define GFBITS 12 ------------------ | Branch (65:17): [True: 79.3k, False: 6.61k] ------------------ 66| 79.3k| out[i] = buf[i][0]; 67| 79.3k| } 68| 6.61k|} PQCLEAN_MCELIECE348864F_AVX2_vec256_sq: 9| 3.39k|void vec256_sq(vec256 *out, vec256 *in) { 10| 3.39k| int i; 11| 3.39k| vec256 result[GFBITS]; 12| | 13| 3.39k| result[0] = in[0] ^ in[6]; 14| 3.39k| result[1] = in[11]; 15| 3.39k| result[2] = in[1] ^ in[7]; 16| 3.39k| result[3] = in[6]; 17| 3.39k| result[4] = in[2] ^ in[11] ^ in[8]; 18| 3.39k| result[5] = in[7]; 19| 3.39k| result[6] = in[3] ^ in[9]; 20| 3.39k| result[7] = in[8]; 21| 3.39k| result[8] = in[4] ^ in[10]; 22| 3.39k| result[9] = in[9]; 23| 3.39k| result[10] = in[5] ^ in[11]; 24| 3.39k| result[11] = in[10]; 25| | 26| 44.1k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 44.1k|#define GFBITS 12 ------------------ | Branch (26:17): [True: 40.7k, False: 3.39k] ------------------ 27| 40.7k| out[i] = result[i]; 28| 40.7k| } 29| 3.39k|} PQCLEAN_MCELIECE348864F_AVX2_vec256_inv: 32| 188|void vec256_inv(vec256 *out, vec256 *in) { 33| 188| vec256 tmp_11[ GFBITS ]; 34| 188| vec256 tmp_1111[ GFBITS ]; 35| | 36| 188| vec256_copy(out, in); 37| | 38| 188| vec256_sq(out, out); ------------------ | | 14| 188|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 188|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864F_AVX2_ ## fun | | ------------------ ------------------ 39| 188| vec256_mul(tmp_11, out, in); // ^11 40| | 41| 188| vec256_sq(out, tmp_11); ------------------ | | 14| 188|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 188|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864F_AVX2_ ## fun | | ------------------ ------------------ 42| 188| vec256_sq(out, out); ------------------ | | 14| 188|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 188|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864F_AVX2_ ## fun | | ------------------ ------------------ 43| 188| vec256_mul(tmp_1111, out, tmp_11); // ^1111 44| | 45| 188| vec256_sq(out, tmp_1111); ------------------ | | 14| 188|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 188|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864F_AVX2_ ## fun | | ------------------ ------------------ 46| 188| vec256_sq(out, out); ------------------ | | 14| 188|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 188|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864F_AVX2_ ## fun | | ------------------ ------------------ 47| 188| vec256_sq(out, out); ------------------ | | 14| 188|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 188|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864F_AVX2_ ## fun | | ------------------ ------------------ 48| 188| vec256_sq(out, out); ------------------ | | 14| 188|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 188|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864F_AVX2_ ## fun | | ------------------ ------------------ 49| 188| vec256_mul(out, out, tmp_1111); // ^11111111 50| | 51| 188| vec256_sq(out, out); ------------------ | | 14| 188|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 188|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864F_AVX2_ ## fun | | ------------------ ------------------ 52| 188| vec256_sq(out, out); ------------------ | | 14| 188|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 188|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864F_AVX2_ ## fun | | ------------------ ------------------ 53| 188| vec256_mul(out, out, tmp_11); // ^1111111111 54| 188| vec256_sq(out, out); ------------------ | | 14| 188|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 188|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864F_AVX2_ ## fun | | ------------------ ------------------ 55| 188| vec256_mul(out, out, in); // ^11111111111 56| | 57| 188| vec256_sq(out, out); // ^111111111110 ------------------ | | 14| 188|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 188|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864F_AVX2_ ## fun | | ------------------ ------------------ 58| 188|} pk_gen.c:mov_columns: 58| 431|static int mov_columns(uint8_t mat[][ SYS_N / 8 ], int16_t *pi, uint64_t *pivots) { 59| 431| int i, j, k, s, block_idx, row; 60| 431| uint64_t buf[64], ctz_list[32], t, d, mask, one = 1; 61| | 62| 431| row = PK_NROWS - 32; ------------------ | | 13| 431|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 431|#define SYS_T 64 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 431|#define GFBITS 12 | | ------------------ ------------------ 63| 431| block_idx = row / 8; 64| | 65| | // extract the 32x64 matrix 66| | 67| 14.2k| for (i = 0; i < 32; i++) { ------------------ | Branch (67:17): [True: 13.7k, False: 431] ------------------ 68| 13.7k| buf[i] = load8( &mat[ row + i ][ block_idx ] ); ------------------ | | 11| 13.7k|#define load8 CRYPTO_NAMESPACE(load8) | | ------------------ | | | | 4| 13.7k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864F_CLEAN_ ## fun | | ------------------ ------------------ 69| 13.7k| } 70| | 71| | // compute the column indices of pivots by Gaussian elimination. 72| | // the indices are stored in ctz_list 73| | 74| 431| *pivots = 0; 75| | 76| 14.2k| for (i = 0; i < 32; i++) { ------------------ | Branch (76:17): [True: 13.7k, False: 431] ------------------ 77| 13.7k| t = buf[i]; 78| 227k| for (j = i + 1; j < 32; j++) { ------------------ | Branch (78:25): [True: 213k, False: 13.7k] ------------------ 79| 213k| t |= buf[j]; 80| 213k| } 81| | 82| 13.7k| if (uint64_is_zero_declassify(t)) { ------------------ | Branch (82:13): [True: 0, False: 13.7k] ------------------ 83| 0| return -1; // return if buf is not full rank 84| 0| } 85| | 86| 13.7k| ctz_list[i] = s = ctz(t); 87| 13.7k| *pivots |= one << ctz_list[i]; 88| | 89| 227k| for (j = i + 1; j < 32; j++) { ------------------ | Branch (89:25): [True: 213k, False: 13.7k] ------------------ 90| 213k| mask = (buf[i] >> s) & 1; 91| 213k| mask -= 1; 92| 213k| buf[i] ^= buf[j] & mask; 93| 213k| } 94| 227k| for (j = i + 1; j < 32; j++) { ------------------ | Branch (94:25): [True: 213k, False: 13.7k] ------------------ 95| 213k| mask = (buf[j] >> s) & 1; 96| 213k| mask = -mask; 97| 213k| buf[j] ^= buf[i] & mask; 98| 213k| } 99| 13.7k| } 100| | 101| | // updating permutation 102| | 103| 14.2k| for (j = 0; j < 32; j++) { ------------------ | Branch (103:19): [True: 13.7k, False: 431] ------------------ 104| 668k| for (k = j + 1; k < 64; k++) { ------------------ | Branch (104:25): [True: 655k, False: 13.7k] ------------------ 105| 655k| d = pi[ row + j ] ^ pi[ row + k ]; 106| 655k| d &= same_mask((uint16_t)k, (uint16_t)ctz_list[j]); 107| 655k| pi[ row + j ] ^= d; 108| 655k| pi[ row + k ] ^= d; 109| 655k| } 110| 13.7k| } 111| | 112| | // moving columns of mat according to the column indices of pivots 113| | 114| 595k| for (i = 0; i < PK_NROWS; i++) { ------------------ | | 13| 595k|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 595k|#define SYS_T 64 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 595k|#define GFBITS 12 | | ------------------ ------------------ | Branch (114:17): [True: 594k, False: 431] ------------------ 115| 594k| t = load8( &mat[ i ][ block_idx ] ); ------------------ | | 11| 594k|#define load8 CRYPTO_NAMESPACE(load8) | | ------------------ | | | | 4| 594k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864F_CLEAN_ ## fun | | ------------------ ------------------ 116| | 117| 19.6M| for (j = 0; j < 32; j++) { ------------------ | Branch (117:21): [True: 19.0M, False: 594k] ------------------ 118| 19.0M| d = t >> j; 119| 19.0M| d ^= t >> ctz_list[j]; 120| 19.0M| d &= 1; 121| | 122| 19.0M| t ^= d << ctz_list[j]; 123| 19.0M| t ^= d << j; 124| 19.0M| } 125| | 126| 594k| store8( &mat[ i ][ block_idx ], t ); ------------------ | | 13| 594k|#define store8 CRYPTO_NAMESPACE(store8) | | ------------------ | | | | 4| 594k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864F_CLEAN_ ## fun | | ------------------ ------------------ 127| 594k| } 128| | 129| 431| return 0; 130| 431|} pk_gen.c:ctz: 35| 13.7k|static inline int ctz(uint64_t in) { 36| 13.7k| int i, b, m = 0, r = 0; 37| | 38| 896k| for (i = 0; i < 64; i++) { ------------------ | Branch (38:17): [True: 882k, False: 13.7k] ------------------ 39| 882k| b = (in >> i) & 1; 40| 882k| m |= b; 41| 882k| r += (m ^ 1) & (b ^ 1); 42| 882k| } 43| | 44| 13.7k| return r; 45| 13.7k|} pk_gen.c:same_mask: 47| 655k|static inline uint64_t same_mask(uint16_t x, uint16_t y) { 48| 655k| uint64_t mask; 49| | 50| 655k| mask = x ^ y; 51| 655k| mask -= 1; 52| 655k| mask >>= 63; 53| 655k| mask = -mask; 54| | 55| 655k| return mask; 56| 655k|} PQCLEAN_MCELIECE460896_AVX2_load_bits: 188| 111|void load_bits(vec128 bits_int[][32], const unsigned char *bits) { 189| 111| int i, j; 190| 111| const unsigned char *ptr = bits; 191| | 192| 111| vec128 buf[64]; 193| | 194| 444| for (i = 0; i <= 5; i += 2) { ------------------ | Branch (194:17): [True: 333, False: 111] ------------------ 195| 21.6k| for (j = 0; j < 64; j++) { ------------------ | Branch (195:21): [True: 21.3k, False: 333] ------------------ 196| 21.3k| buf[j] = vec128_set2x(load8(ptr), load8(ptr + 512)); 197| 21.3k| ptr += 8; 198| 21.3k| } 199| | 200| 333| transpose_64x128_sp( buf ); 201| | 202| 10.9k| for (j = 0; j < 32; j++) { ------------------ | Branch (202:21): [True: 10.6k, False: 333] ------------------ 203| 10.6k| bits_int[i + 0][j] = vec128_unpack_low(buf[j], buf[j + 32]); 204| 10.6k| bits_int[i + 1][j] = vec128_unpack_high(buf[j], buf[j + 32]); 205| 10.6k| } 206| | 207| 333| ptr += 512; 208| 333| } 209| | 210| 1.55k| for (i = 6; i <= 18; i++) { ------------------ | Branch (210:17): [True: 1.44k, False: 111] ------------------ 211| 47.6k| for (j = 0; j < 32; j++) { ------------------ | Branch (211:21): [True: 46.1k, False: 1.44k] ------------------ 212| 46.1k| bits_int[i][j] = load16(ptr); 213| 46.1k| ptr += 16; 214| 46.1k| } 215| 1.44k| } 216| | 217| 444| for (i = 19; i < 25; i += 2) { ------------------ | Branch (217:18): [True: 333, False: 111] ------------------ 218| 21.6k| for (j = 0; j < 64; j++) { ------------------ | Branch (218:21): [True: 21.3k, False: 333] ------------------ 219| 21.3k| buf[j] = vec128_set2x(load8(ptr), load8(ptr + 512)); 220| 21.3k| ptr += 8; 221| 21.3k| } 222| | 223| 333| transpose_64x128_sp( buf ); 224| | 225| 10.9k| for (j = 0; j < 32; j++) { ------------------ | Branch (225:21): [True: 10.6k, False: 333] ------------------ 226| 10.6k| bits_int[i + 0][j] = vec128_unpack_low(buf[j], buf[j + 32]); 227| 10.6k| bits_int[i + 1][j] = vec128_unpack_high(buf[j], buf[j + 32]); 228| 10.6k| } 229| | 230| 333| ptr += 512; 231| 333| } 232| 111|} PQCLEAN_MCELIECE460896_AVX2_benes: 238| 222|void benes(vec128 *r, vec128 b[][32], int rev) { 239| 222| int inc; 240| | 241| 222| vec128 *b_ptr; 242| | 243| 222| if (rev == 0) { ------------------ | Branch (243:9): [True: 111, False: 111] ------------------ 244| 111| inc = 32; 245| 111| b_ptr = b[ 0]; 246| 111| } else { 247| 111| inc = -32; 248| 111| b_ptr = b[24]; 249| 111| } 250| | 251| | // 252| | 253| 222| transpose_64x128_sp( r ); 254| | 255| 222| layer_0(r, b_ptr); 256| 222| b_ptr += inc; 257| 222| layer_1(r, b_ptr); 258| 222| b_ptr += inc; 259| 222| layer_2(r, b_ptr); 260| 222| b_ptr += inc; 261| 222| layer_3(r, b_ptr); 262| 222| b_ptr += inc; 263| 222| layer_4(r, b_ptr); 264| 222| b_ptr += inc; 265| 222| layer_5(r, b_ptr); 266| 222| b_ptr += inc; 267| | 268| 222| transpose_64x128_sp( r ); 269| | 270| 222| layer_x(r, b_ptr); 271| 222| b_ptr += inc; 272| 222| layer_0(r, b_ptr); 273| 222| b_ptr += inc; 274| 222| layer_1(r, b_ptr); 275| 222| b_ptr += inc; 276| 222| layer_2(r, b_ptr); 277| 222| b_ptr += inc; 278| 222| layer_3(r, b_ptr); 279| 222| b_ptr += inc; 280| 222| layer_4(r, b_ptr); 281| 222| b_ptr += inc; 282| 222| layer_5(r, b_ptr); 283| 222| b_ptr += inc; 284| 222| layer_4(r, b_ptr); 285| 222| b_ptr += inc; 286| 222| layer_3(r, b_ptr); 287| 222| b_ptr += inc; 288| 222| layer_2(r, b_ptr); 289| 222| b_ptr += inc; 290| 222| layer_1(r, b_ptr); 291| 222| b_ptr += inc; 292| 222| layer_0(r, b_ptr); 293| 222| b_ptr += inc; 294| 222| layer_x(r, b_ptr); 295| 222| b_ptr += inc; 296| | 297| 222| transpose_64x128_sp( r ); 298| | 299| 222| layer_5(r, b_ptr); 300| 222| b_ptr += inc; 301| 222| layer_4(r, b_ptr); 302| 222| b_ptr += inc; 303| 222| layer_3(r, b_ptr); 304| 222| b_ptr += inc; 305| 222| layer_2(r, b_ptr); 306| 222| b_ptr += inc; 307| 222| layer_1(r, b_ptr); 308| 222| b_ptr += inc; 309| 222| layer_0(r, b_ptr); 310| | 311| 222| transpose_64x128_sp( r ); 312| 222|} benes.c:layer_x: 14| 3.08k|static void layer_x(vec128 *data, vec128 *bits) { 15| 3.08k| int i; 16| 3.08k| vec128 v0, v1; 17| 3.08k| vec128 d; 18| | 19| 101k| for (i = 0; i < 64; i += 2) { ------------------ | Branch (19:17): [True: 98.5k, False: 3.08k] ------------------ 20| 98.5k| v0 = vec128_unpack_low(data[i + 0], data[i + 1]); 21| 98.5k| v1 = vec128_unpack_high(data[i + 0], data[i + 1]); 22| | 23| 98.5k| d = vec128_xor(v0, v1); 24| 98.5k| d = vec128_and(d, *bits++); 25| 98.5k| v0 = vec128_xor(v0, d); 26| 98.5k| v1 = vec128_xor(v1, d); 27| | 28| 98.5k| data[i + 0] = vec128_unpack_low(v0, v1); 29| 98.5k| data[i + 1] = vec128_unpack_high(v0, v1); 30| 98.5k| } 31| 3.08k|} PQCLEAN_MCELIECE460896_AVX2_bm: 147| 111|void bm(vec128 *out, vec256 *in) { 148| 111| int i; 149| 111| uint16_t N, L; 150| 111| uint16_t mask; 151| 111| uint64_t one = 1; 152| 111| uint64_t v[2]; 153| | 154| 111| typedef union { 155| 111| vec128 v[GFBITS][2]; 156| 111| vec256 V[GFBITS]; 157| 111| } db_t; 158| | 159| 111| vec128 prod[ GFBITS ]; 160| 111| vec128 interval[GFBITS]; 161| | 162| 111| db_t db; 163| 111| db_t BC_tmp; 164| 111| db_t BC; 165| | 166| 111| gf d, b; 167| 111| gf coefs[256]; 168| | 169| | // initialization 170| | 171| 111| get_coefs(coefs, in); 172| | 173| 111| BC.v[0][0] = vec128_set2x(0, one << 62); 174| 111| BC.v[0][1] = vec128_set2x(0, one << 63); 175| | 176| 1.44k| for (i = 1; i < GFBITS; i++) { ------------------ | | 6| 1.44k|#define GFBITS 13 ------------------ | Branch (176:17): [True: 1.33k, False: 111] ------------------ 177| 1.33k| BC.v[i][0] = BC.v[i][1] = vec128_setzero(); 178| 1.33k| } 179| | 180| 111| b = 1; 181| 111| L = 0; 182| | 183| | // 184| | 185| 1.55k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 1.55k|#define GFBITS 13 ------------------ | Branch (185:17): [True: 1.44k, False: 111] ------------------ 186| 1.44k| interval[i] = vec128_setzero(); 187| 1.44k| } 188| | 189| 21.4k| for (N = 0; N < SYS_T * 2; N++) { ------------------ | | 8| 21.4k|#define SYS_T 96 ------------------ | Branch (189:17): [True: 21.3k, False: 111] ------------------ 190| 21.3k| update_asm(interval, coefs[N], 16); ------------------ | | 1| 21.3k|#define update_asm CRYPTO_NAMESPACE(update_asm) | | ------------------ | | | | 4| 21.3k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896_AVX2_ ## fun | | ------------------ ------------------ 191| 21.3k| vec128_mul_asm(prod, interval, BC.v[0] + 1, 32); ------------------ | | 10| 21.3k|#define vec128_mul_asm CRYPTO_NAMESPACE(vec128_mul_asm) | | ------------------ | | | | 4| 21.3k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896_AVX2_ ## fun | | ------------------ ------------------ 192| | 193| 21.3k| d = vec_reduce_asm(prod); ------------------ | | 3| 21.3k|#define vec_reduce_asm CRYPTO_NAMESPACE(vec_reduce_asm) | | ------------------ | | | | 4| 21.3k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896_AVX2_ ## fun | | ------------------ ------------------ 194| | 195| 21.3k| mask = mask_nonzero(d) & mask_leq(L * 2, N); 196| | 197| 298k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 298k|#define GFBITS 13 ------------------ | Branch (197:21): [True: 277k, False: 21.3k] ------------------ 198| 277k| db.v[i][0] = vec128_setbits((d >> i) & 1); 199| 277k| db.v[i][1] = vec128_setbits((b >> i) & 1); 200| 277k| } 201| | 202| 21.3k| vec256_mul((vec256 *)BC_tmp.V, (vec256 *)db.V, (vec256 *)BC.V); 203| | 204| 21.3k| vec128_cmov(BC.v, mask); 205| 21.3k| update_asm(BC.v, 0, 32); ------------------ | | 1| 21.3k|#define update_asm CRYPTO_NAMESPACE(update_asm) | | ------------------ | | | | 4| 21.3k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896_AVX2_ ## fun | | ------------------ ------------------ 206| | 207| 298k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 298k|#define GFBITS 13 ------------------ | Branch (207:21): [True: 277k, False: 21.3k] ------------------ 208| 277k| BC.v[i][1] = vec128_xor(BC_tmp.v[i][0], BC_tmp.v[i][1]); 209| 277k| } 210| | 211| 21.3k| b = (d & mask) | (b & ~mask); 212| 21.3k| L = ((N + 1 - L) & mask) | (L & ~mask); 213| 21.3k| } 214| | 215| 1.55k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 1.55k|#define GFBITS 13 ------------------ | Branch (215:17): [True: 1.44k, False: 111] ------------------ 216| 1.44k| v[0] = vec128_extract(BC.v[i][1], 0); ------------------ | | 29| 1.44k|#define vec128_extract(a, i) ((uint64_t) _mm_extract_epi64((vec128) (a), (i))) ------------------ 217| 1.44k| v[1] = vec128_extract(BC.v[i][1], 1); ------------------ | | 29| 1.44k|#define vec128_extract(a, i) ((uint64_t) _mm_extract_epi64((vec128) (a), (i))) ------------------ 218| | 219| 1.44k| out[i] = vec128_set2x((v[0] >> 31) | (v[1] << 33), v[1] >> 31); 220| 1.44k| } 221| 111|} bm.c:vec128_cmov: 45| 180k|static inline void vec128_cmov(vec128 out[][2], uint16_t mask) { 46| 180k| int i; 47| | 48| 180k| vec128 v0, v1; 49| | 50| 180k| vec128 m0 = vec128_set1_16b( mask); 51| 180k| vec128 m1 = vec128_set1_16b(~mask); 52| | 53| 2.52M| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 2.52M|#define GFBITS 13 ------------------ | Branch (53:17): [True: 2.34M, False: 180k] ------------------ 54| 2.34M| v0 = vec128_and(out[i][1], m0); 55| 2.34M| v1 = vec128_and(out[i][0], m1); 56| 2.34M| out[i][0] = vec128_or(v0, v1); 57| 2.34M| } 58| 180k|} PQCLEAN_MCELIECE460896_AVX2_controlbitsfrompermutation: 205| 111|void controlbitsfrompermutation(unsigned char *out, const int16 *pi, long long w, long long n) { 206| 111| PQCLEAN_VLA(int32, temp, (size_t)(2 * n)); ------------------ | | 57| 111|# define PQCLEAN_VLA(__t,__x,__s) __t __x[__s] ------------------ 207| 111| PQCLEAN_VLA(int16, pi_test, (size_t)n); ------------------ | | 57| 111|# define PQCLEAN_VLA(__t,__x,__s) __t __x[__s] ------------------ 208| 111| int16 diff; 209| 111| int i; 210| 111| unsigned char *ptr; 211| | 212| 111| OQS_MEM_cleanse(temp, (size_t)n * 2); 213| 111| OQS_MEM_cleanse(pi_test, (size_t)n); 214| | 215| 111| while (1) { ------------------ | Branch (215:12): [True: 111, Folded] ------------------ 216| 111| OQS_MEM_cleanse(out, (size_t)((((2 * w - 1)*n / 2) + 7) / 8)); 217| 111| cbrecursion(out, 0, 1, pi, w, n, temp); 218| | 219| | // check for correctness 220| | 221| 909k| for (i = 0; i < n; i++) { ------------------ | Branch (221:21): [True: 909k, False: 111] ------------------ 222| 909k| pi_test[i] = (int16)i; 223| 909k| } 224| | 225| 111| ptr = out; 226| 1.55k| for (i = 0; i < w; i++) { ------------------ | Branch (226:21): [True: 1.44k, False: 111] ------------------ 227| 1.44k| layer(pi_test, ptr, i, (int32)n); 228| 1.44k| ptr += n >> 4; 229| 1.44k| } 230| | 231| 1.44k| for (i = (int)(w - 2); i >= 0; i--) { ------------------ | Branch (231:32): [True: 1.33k, False: 111] ------------------ 232| 1.33k| layer(pi_test, ptr, i, (int32)n); 233| 1.33k| ptr += n >> 4; 234| 1.33k| } 235| | 236| 111| diff = 0; 237| 909k| for (i = 0; i < n; i++) { ------------------ | Branch (237:21): [True: 909k, False: 111] ------------------ 238| 909k| diff |= pi[i] ^ pi_test[i]; 239| 909k| } 240| | 241| 111| diff = crypto_int16_nonzero_mask(diff); ------------------ | | 12| 111|#define crypto_int16_nonzero_mask CRYPTO_NAMESPACE(crypto_int16_nonzero_mask) | | ------------------ | | | | 4| 111|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896_AVX2_ ## fun | | ------------------ ------------------ 242| 111| crypto_declassify(&diff, sizeof diff); 243| 111| if (diff == 0) { ------------------ | Branch (243:13): [True: 111, False: 0] ------------------ 244| 111| break; 245| 111| } 246| 111| } 247| 111|} PQCLEAN_MCELIECE460896_AVX2_crypto_int16_negative_mask: 3| 222|crypto_int16 crypto_int16_negative_mask(crypto_int16 crypto_int16_x) { 4| 222| return crypto_int16_x >> 15; 5| 222|} PQCLEAN_MCELIECE460896_AVX2_crypto_int16_nonzero_mask: 7| 111|crypto_int16 crypto_int16_nonzero_mask(crypto_int16 crypto_int16_x) { 8| 111| return crypto_int16_negative_mask(crypto_int16_x) | crypto_int16_negative_mask(-crypto_int16_x); ------------------ | | 10| 111|#define crypto_int16_negative_mask CRYPTO_NAMESPACE(crypto_int16_negative_mask) | | ------------------ | | | | 4| 111|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896_AVX2_ ## fun | | ------------------ ------------------ return crypto_int16_negative_mask(crypto_int16_x) | crypto_int16_negative_mask(-crypto_int16_x); ------------------ | | 10| 111|#define crypto_int16_negative_mask CRYPTO_NAMESPACE(crypto_int16_negative_mask) | | ------------------ | | | | 4| 111|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896_AVX2_ ## fun | | ------------------ ------------------ 9| 111|} PQCLEAN_MCELIECE460896_AVX2_crypto_int32_negative_mask: 3| 70.9M|crypto_int32 crypto_int32_negative_mask(crypto_int32 crypto_int32_x) { 4| 70.9M| return crypto_int32_x >> 31; 5| 70.9M|} PQCLEAN_MCELIECE460896_AVX2_crypto_int32_min: 37| 70.9M|crypto_int32 crypto_int32_min(crypto_int32 crypto_int32_x, crypto_int32 crypto_int32_y) { 38| 70.9M| crypto_int32 crypto_int32_xy = crypto_int32_y ^ crypto_int32_x; 39| 70.9M| crypto_int32 crypto_int32_z = crypto_int32_y - crypto_int32_x; 40| 70.9M| crypto_int32_z ^= crypto_int32_xy & (crypto_int32_z ^ crypto_int32_y); 41| 70.9M| crypto_int32_z = crypto_int32_negative_mask(crypto_int32_z); ------------------ | | 9| 70.9M|#define crypto_int32_negative_mask CRYPTO_NAMESPACE(crypto_int32_negative_mask) | | ------------------ | | | | 4| 70.9M|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896_AVX2_ ## fun | | ------------------ ------------------ 42| 70.9M| crypto_int32_z &= crypto_int32_xy; 43| 70.9M| return crypto_int32_x ^ crypto_int32_z; 44| 70.9M|} PQCLEAN_MCELIECE460896_AVX2_crypto_uint16_signed_negative_mask: 3| 312k|crypto_uint16_signed crypto_uint16_signed_negative_mask(crypto_uint16_signed crypto_uint16_signed_x) { 4| 312k| return crypto_uint16_signed_x >> 15; 5| 312k|} PQCLEAN_MCELIECE460896_AVX2_crypto_uint16_nonzero_mask: 7| 106k|crypto_uint16 crypto_uint16_nonzero_mask(crypto_uint16 crypto_uint16_x) { 8| 106k| return crypto_uint16_signed_negative_mask(crypto_uint16_x) | crypto_uint16_signed_negative_mask(-crypto_uint16_x); ------------------ | | 11| 106k|#define crypto_uint16_signed_negative_mask CRYPTO_NAMESPACE(crypto_uint16_signed_negative_mask) | | ------------------ | | | | 4| 106k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896_AVX2_ ## fun | | ------------------ ------------------ return crypto_uint16_signed_negative_mask(crypto_uint16_x) | crypto_uint16_signed_negative_mask(-crypto_uint16_x); ------------------ | | 11| 106k|#define crypto_uint16_signed_negative_mask CRYPTO_NAMESPACE(crypto_uint16_signed_negative_mask) | | ------------------ | | | | 4| 106k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896_AVX2_ ## fun | | ------------------ ------------------ 9| 106k|} PQCLEAN_MCELIECE460896_AVX2_crypto_uint16_zero_mask: 11| 106k|crypto_uint16 crypto_uint16_zero_mask(crypto_uint16 crypto_uint16_x) { 12| 106k| return ~crypto_uint16_nonzero_mask(crypto_uint16_x); ------------------ | | 13| 106k|#define crypto_uint16_nonzero_mask CRYPTO_NAMESPACE(crypto_uint16_nonzero_mask) | | ------------------ | | | | 4| 106k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896_AVX2_ ## fun | | ------------------ ------------------ 13| 106k|} PQCLEAN_MCELIECE460896_AVX2_crypto_uint16_smaller_mask: 24| 99.6k|crypto_uint16 crypto_uint16_smaller_mask(crypto_uint16 crypto_uint16_x, crypto_uint16 crypto_uint16_y) { 25| 99.6k| crypto_uint16 crypto_uint16_xy = crypto_uint16_x ^ crypto_uint16_y; 26| 99.6k| crypto_uint16 crypto_uint16_z = crypto_uint16_x - crypto_uint16_y; 27| 99.6k| crypto_uint16_z ^= crypto_uint16_xy & (crypto_uint16_z ^ crypto_uint16_x ^ (((crypto_uint16) 1) << 15)); 28| 99.6k| return crypto_uint16_signed_negative_mask(crypto_uint16_z); ------------------ | | 11| 99.6k|#define crypto_uint16_signed_negative_mask CRYPTO_NAMESPACE(crypto_uint16_signed_negative_mask) | | ------------------ | | | | 4| 99.6k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896_AVX2_ ## fun | | ------------------ ------------------ 29| 99.6k|} PQCLEAN_MCELIECE460896_AVX2_crypto_uint32_signed_negative_mask: 3| 104k|crypto_uint32_signed crypto_uint32_signed_negative_mask(crypto_uint32_signed crypto_uint32_signed_x) { 4| 104k| return crypto_uint32_signed_x >> 31; 5| 104k|} PQCLEAN_MCELIECE460896_AVX2_crypto_uint32_nonzero_mask: 7| 52.4k|crypto_uint32 crypto_uint32_nonzero_mask(crypto_uint32 crypto_uint32_x) { 8| 52.4k| return crypto_uint32_signed_negative_mask(crypto_uint32_x) | crypto_uint32_signed_negative_mask(-crypto_uint32_x); ------------------ | | 11| 52.4k|#define crypto_uint32_signed_negative_mask CRYPTO_NAMESPACE(crypto_uint32_signed_negative_mask) | | ------------------ | | | | 4| 52.4k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896_AVX2_ ## fun | | ------------------ ------------------ return crypto_uint32_signed_negative_mask(crypto_uint32_x) | crypto_uint32_signed_negative_mask(-crypto_uint32_x); ------------------ | | 11| 52.4k|#define crypto_uint32_signed_negative_mask CRYPTO_NAMESPACE(crypto_uint32_signed_negative_mask) | | ------------------ | | | | 4| 52.4k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896_AVX2_ ## fun | | ------------------ ------------------ 9| 52.4k|} PQCLEAN_MCELIECE460896_AVX2_crypto_uint32_unequal_mask: 15| 52.4k|crypto_uint32 crypto_uint32_unequal_mask(crypto_uint32 crypto_uint32_x, crypto_uint32 crypto_uint32_y) { 16| 52.4k| crypto_uint32 crypto_uint32_xy = crypto_uint32_x ^ crypto_uint32_y; 17| 52.4k| return crypto_uint32_nonzero_mask(crypto_uint32_xy); ------------------ | | 13| 52.4k|#define crypto_uint32_nonzero_mask CRYPTO_NAMESPACE(crypto_uint32_nonzero_mask) | | ------------------ | | | | 4| 52.4k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896_AVX2_ ## fun | | ------------------ ------------------ 18| 52.4k|} PQCLEAN_MCELIECE460896_AVX2_crypto_uint32_equal_mask: 20| 52.4k|crypto_uint32 crypto_uint32_equal_mask(crypto_uint32 crypto_uint32_x, crypto_uint32 crypto_uint32_y) { 21| 52.4k| return ~crypto_uint32_unequal_mask(crypto_uint32_x, crypto_uint32_y); ------------------ | | 17| 52.4k|#define crypto_uint32_unequal_mask CRYPTO_NAMESPACE(crypto_uint32_unequal_mask) | | ------------------ | | | | 4| 52.4k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896_AVX2_ ## fun | | ------------------ ------------------ 22| 52.4k|} PQCLEAN_MCELIECE460896_AVX2_crypto_uint64_signed_negative_mask: 3| 20.5M|crypto_uint64_signed crypto_uint64_signed_negative_mask(crypto_uint64_signed crypto_uint64_signed_x) { 4| 20.5M| return crypto_uint64_signed_x >> 63; 5| 20.5M|} PQCLEAN_MCELIECE460896_AVX2_crypto_uint64_nonzero_mask: 7| 10.2M|crypto_uint64 crypto_uint64_nonzero_mask(crypto_uint64 crypto_uint64_x) { 8| 10.2M| return crypto_uint64_signed_negative_mask(crypto_uint64_x) | crypto_uint64_signed_negative_mask(-crypto_uint64_x); ------------------ | | 11| 10.2M|#define crypto_uint64_signed_negative_mask CRYPTO_NAMESPACE(crypto_uint64_signed_negative_mask) | | ------------------ | | | | 4| 10.2M|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896_AVX2_ ## fun | | ------------------ ------------------ return crypto_uint64_signed_negative_mask(crypto_uint64_x) | crypto_uint64_signed_negative_mask(-crypto_uint64_x); ------------------ | | 11| 10.2M|#define crypto_uint64_signed_negative_mask CRYPTO_NAMESPACE(crypto_uint64_signed_negative_mask) | | ------------------ | | | | 4| 10.2M|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896_AVX2_ ## fun | | ------------------ ------------------ 9| 10.2M|} PQCLEAN_MCELIECE460896_AVX2_crypto_uint64_zero_mask: 11| 1.34M|crypto_uint64 crypto_uint64_zero_mask(crypto_uint64 crypto_uint64_x) { 12| 1.34M| return ~crypto_uint64_nonzero_mask(crypto_uint64_x); ------------------ | | 13| 1.34M|#define crypto_uint64_nonzero_mask CRYPTO_NAMESPACE(crypto_uint64_nonzero_mask) | | ------------------ | | | | 4| 1.34M|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896_AVX2_ ## fun | | ------------------ ------------------ 13| 1.34M|} PQCLEAN_MCELIECE460896_AVX2_crypto_uint64_unequal_mask: 15| 8.93M|crypto_uint64 crypto_uint64_unequal_mask(crypto_uint64 crypto_uint64_x, crypto_uint64 crypto_uint64_y) { 16| 8.93M| crypto_uint64 crypto_uint64_xy = crypto_uint64_x ^ crypto_uint64_y; 17| 8.93M| return crypto_uint64_nonzero_mask(crypto_uint64_xy); ------------------ | | 13| 8.93M|#define crypto_uint64_nonzero_mask CRYPTO_NAMESPACE(crypto_uint64_nonzero_mask) | | ------------------ | | | | 4| 8.93M|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896_AVX2_ ## fun | | ------------------ ------------------ 18| 8.93M|} PQCLEAN_MCELIECE460896_AVX2_crypto_uint64_equal_mask: 20| 8.93M|crypto_uint64 crypto_uint64_equal_mask(crypto_uint64 crypto_uint64_x, crypto_uint64 crypto_uint64_y) { 21| 8.93M| return ~crypto_uint64_unequal_mask(crypto_uint64_x, crypto_uint64_y); ------------------ | | 17| 8.93M|#define crypto_uint64_unequal_mask CRYPTO_NAMESPACE(crypto_uint64_unequal_mask) | | ------------------ | | | | 4| 8.93M|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896_AVX2_ ## fun | | ------------------ ------------------ 22| 8.93M|} PQCLEAN_MCELIECE460896_AVX2_decrypt: 171| 111|int decrypt(unsigned char *e, const unsigned char *sk, const unsigned char *s) { 172| 111| int i; 173| | 174| 111| uint16_t check_synd; 175| 111| uint16_t check_weight; 176| | 177| 111| vec256 inv[ 32 ][ GFBITS ]; 178| 111| vec256 scaled[ 32 ][ GFBITS ]; 179| 111| vec256 eval[32][ GFBITS ]; 180| | 181| 111| vec128 error128[ 64 ]; 182| 111| vec256 error256[ 32 ]; 183| | 184| 111| vec256 s_priv[ GFBITS ]; 185| 111| vec256 s_priv_cmp[ GFBITS ]; 186| 111| vec128 locator[ GFBITS ]; 187| | 188| 111| vec128 recv128[ 64 ]; 189| 111| vec256 recv256[ 32 ]; 190| 111| vec256 allone; 191| | 192| 111| vec128 bits_int[25][32]; 193| | 194| | // Berlekamp decoder 195| | 196| 111| preprocess(recv128, s); 197| | 198| 111| load_bits(bits_int, sk + IRR_BYTES); ------------------ | | 10| 111|#define load_bits CRYPTO_NAMESPACE(load_bits) | | ------------------ | | | | 4| 111|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896_AVX2_ ## fun | | ------------------ ------------------ load_bits(bits_int, sk + IRR_BYTES); ------------------ | | 11| 111|#define IRR_BYTES (SYS_T * 2) | | ------------------ | | | | 8| 111|#define SYS_T 96 | | ------------------ ------------------ 199| 111| benes(recv128, bits_int, 1); ------------------ | | 9| 111|#define benes CRYPTO_NAMESPACE(benes) | | ------------------ | | | | 4| 111|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896_AVX2_ ## fun | | ------------------ ------------------ 200| | 201| 111| reformat_128to256(recv256, recv128); 202| | 203| 111| scaling(scaled, inv, sk, recv256); 204| 111| fft_tr(s_priv, scaled); ------------------ | | 9| 111|#define fft_tr CRYPTO_NAMESPACE(fft_tr) | | ------------------ | | | | 4| 111|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896_AVX2_ ## fun | | ------------------ ------------------ 205| 111| bm(locator, s_priv); ------------------ | | 10| 111|#define bm CRYPTO_NAMESPACE(bm) | | ------------------ | | | | 4| 111|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896_AVX2_ ## fun | | ------------------ ------------------ 206| | 207| 111| fft(eval, locator); ------------------ | | 10| 111|#define fft CRYPTO_NAMESPACE(fft) | | ------------------ | | | | 4| 111|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896_AVX2_ ## fun | | ------------------ ------------------ 208| | 209| | // reencryption and weight check 210| | 211| 111| allone = vec256_set1_16b(0xFFFF); 212| | 213| 3.66k| for (i = 0; i < 32; i++) { ------------------ | Branch (213:17): [True: 3.55k, False: 111] ------------------ 214| 3.55k| error256[i] = vec256_or_reduce(eval[i]); 215| 3.55k| error256[i] = vec256_xor(error256[i], allone); 216| 3.55k| } 217| | 218| 111| scaling_inv(scaled, inv, error256); 219| 111| fft_tr(s_priv_cmp, scaled); ------------------ | | 9| 111|#define fft_tr CRYPTO_NAMESPACE(fft_tr) | | ------------------ | | | | 4| 111|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896_AVX2_ ## fun | | ------------------ ------------------ 220| | 221| 111| check_synd = synd_cmp(s_priv, s_priv_cmp); 222| | 223| | // 224| | 225| 111| reformat_256to128(error128, error256); 226| 111| benes(error128, bits_int, 0); ------------------ | | 9| 111|#define benes CRYPTO_NAMESPACE(benes) | | ------------------ | | | | 4| 111|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896_AVX2_ ## fun | | ------------------ ------------------ 227| | 228| 111| postprocess(e, error128); 229| | 230| 111| check_weight = weight_check(e, error128); 231| | 232| 111| return 1 - (check_synd & check_weight); 233| 111|} PQCLEAN_MCELIECE460896_AVX2_encrypt: 112| 111|void encrypt(unsigned char *s, const unsigned char *pk, unsigned char *e) { 113| 111| gen_e(e); 114| | 115| 111| syndrome_asm(s, pk, e); ------------------ | | 1| 111|#define syndrome_asm CRYPTO_NAMESPACE(syndrome_asm) | | ------------------ | | | | 4| 111|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896_AVX2_ ## fun | | ------------------ ------------------ 116| 111|} PQCLEAN_MCELIECE460896_AVX2_fft: 265| 1.33k|void fft(vec256 out[][GFBITS], vec128 *in) { 266| 1.33k| radix_conversions(in); 267| 1.33k| butterflies(out, in); 268| 1.33k|} PQCLEAN_MCELIECE460896_AVX2_fft_tr: 397| 222|void fft_tr(vec256 *out, vec256 in[][ GFBITS ]) { 398| 222| butterflies_tr(out, in); 399| 222| radix_conversions_tr(out); 400| | 401| 222| postprocess(out); 402| 222|} fft_tr.c:postprocess: 381| 814|static void postprocess(vec256 *out) { 382| 814| int i; 383| 814| uint64_t v[4]; 384| | 385| 11.3k| for (i = 0; i < 13; i++) { ------------------ | Branch (385:17): [True: 10.5k, False: 814] ------------------ 386| 10.5k| v[0] = vec256_extract(out[i], 0); ------------------ | | 39| 10.5k|#define vec256_extract(a,i) ((uint64_t) _mm256_extract_epi64((vec256) (a),(i))) ------------------ 387| 10.5k| v[1] = vec256_extract(out[i], 1); ------------------ | | 39| 10.5k|#define vec256_extract(a,i) ((uint64_t) _mm256_extract_epi64((vec256) (a),(i))) ------------------ 388| 10.5k| v[2] = vec256_extract(out[i], 2); ------------------ | | 39| 10.5k|#define vec256_extract(a,i) ((uint64_t) _mm256_extract_epi64((vec256) (a),(i))) ------------------ 389| 10.5k| v[3] = vec256_extract(out[i], 3); ------------------ | | 39| 10.5k|#define vec256_extract(a,i) ((uint64_t) _mm256_extract_epi64((vec256) (a),(i))) ------------------ 390| | 391| 10.5k| v[3] = 0; 392| | 393| 10.5k| out[i] = vec256_set4x(v[0], v[1], v[2], v[3]); 394| 10.5k| } 395| 814|} PQCLEAN_MCELIECE460896_AVX2_gf_mul: 20| 10.2M|gf gf_mul(gf in0, gf in1) { 21| 10.2M| int i; 22| | 23| 10.2M| uint64_t tmp; 24| 10.2M| uint64_t t0; 25| 10.2M| uint64_t t1; 26| 10.2M| uint64_t t; 27| | 28| 10.2M| t0 = in0; 29| 10.2M| t1 = in1; 30| | 31| 10.2M| tmp = t0 * (t1 & 1); 32| | 33| 132M| for (i = 1; i < GFBITS; i++) { ------------------ | | 6| 132M|#define GFBITS 13 ------------------ | Branch (33:17): [True: 122M, False: 10.2M] ------------------ 34| 122M| tmp ^= (t0 * (t1 & (1 << i))); 35| 122M| } 36| | 37| | // 38| | 39| 10.2M| t = tmp & 0x1FF0000; 40| 10.2M| tmp ^= (t >> 9) ^ (t >> 10) ^ (t >> 12) ^ (t >> 13); 41| | 42| 10.2M| t = tmp & 0x000E000; 43| 10.2M| tmp ^= (t >> 9) ^ (t >> 10) ^ (t >> 12) ^ (t >> 13); 44| | 45| 10.2M| return tmp & GFMASK; ------------------ | | 19| 10.2M|#define GFMASK ((1 << GFBITS) - 1) | | ------------------ | | | | 6| 10.2M|#define GFBITS 13 | | ------------------ ------------------ 46| 10.2M|} PQCLEAN_MCELIECE460896_AVX2_gf_frac: 156| 106k|gf gf_frac(gf den, gf num) { 157| 106k| gf tmp_11; 158| 106k| gf tmp_1111; 159| 106k| gf out; 160| | 161| 106k| tmp_11 = gf_sqmul(den, den); // ^11 162| 106k| tmp_1111 = gf_sq2mul(tmp_11, tmp_11); // ^1111 163| 106k| out = gf_sq2(tmp_1111); 164| 106k| out = gf_sq2mul(out, tmp_1111); // ^11111111 165| 106k| out = gf_sq2(out); 166| 106k| out = gf_sq2mul(out, tmp_1111); // ^111111111111 167| | 168| 106k| return gf_sqmul(out, num); // ^1111111111110 = ^-1 169| 106k|} PQCLEAN_MCELIECE460896_AVX2_gf_inv: 172| 106k|gf gf_inv(gf den) { 173| 106k| return gf_frac(den, ((gf) 1)); ------------------ | | 10| 106k|#define gf_frac CRYPTO_NAMESPACE(gf_frac) | | ------------------ | | | | 4| 106k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896_AVX2_ ## fun | | ------------------ ------------------ 174| 106k|} pk_gen.c:PQCLEAN_MCELIECE460896_AVX2_int32_sort: 21| 111|static void int32_sort(int32_t *x, long long n) { 22| 111| long long top, p, q, r, i; 23| | 24| 111| if (n < 2) { ------------------ | Branch (24:9): [True: 0, False: 111] ------------------ 25| 0| return; 26| 0| } 27| 111| top = 1; 28| 1.22k| while (top < n - top) { ------------------ | Branch (28:12): [True: 1.11k, False: 111] ------------------ 29| 1.11k| top += top; 30| 1.11k| } 31| | 32| 1.33k| for (p = top; p > 0; p >>= 1) { ------------------ | Branch (32:19): [True: 1.22k, False: 111] ------------------ 33| 1.29M| for (i = 0; i < n - p; ++i) { ------------------ | Branch (33:21): [True: 1.29M, False: 1.22k] ------------------ 34| 1.29M| if (!(i & p)) { ------------------ | Branch (34:17): [True: 687k, False: 609k] ------------------ 35| 687k| int32_MINMAX(x[i], x[i + p]); ------------------ | | 11| 687k| do { \ | | 12| 687k| int32_t ab = (b) ^ (a); \ | | 13| 687k| int32_t c = (b) - (a); \ | | 14| 687k| c ^= ab & ((c) ^ (b)); \ | | 15| 687k| c >>= 31; \ | | 16| 687k| c &= ab; \ | | 17| 687k| (a) ^= c; \ | | 18| 687k| (b) ^= c; \ | | 19| 687k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 687k] | | ------------------ ------------------ 36| 687k| } 37| 1.29M| } 38| 1.22k| i = 0; 39| 7.32k| for (q = top; q > p; q >>= 1) { ------------------ | Branch (39:23): [True: 6.10k, False: 1.22k] ------------------ 40| 1.16M| for (; i < n - q; ++i) { ------------------ | Branch (40:20): [True: 1.15M, False: 6.10k] ------------------ 41| 1.15M| if (!(i & p)) { ------------------ | Branch (41:21): [True: 609k, False: 548k] ------------------ 42| 609k| int32_t a = x[i + p]; 43| 3.45M| for (r = q; r > p; r >>= 1) { ------------------ | Branch (43:33): [True: 2.84M, False: 609k] ------------------ 44| 2.84M| int32_MINMAX(a, x[i + r]); ------------------ | | 11| 2.84M| do { \ | | 12| 2.84M| int32_t ab = (b) ^ (a); \ | | 13| 2.84M| int32_t c = (b) - (a); \ | | 14| 2.84M| c ^= ab & ((c) ^ (b)); \ | | 15| 2.84M| c >>= 31; \ | | 16| 2.84M| c &= ab; \ | | 17| 2.84M| (a) ^= c; \ | | 18| 2.84M| (b) ^= c; \ | | 19| 2.84M| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 2.84M] | | ------------------ ------------------ 45| 2.84M| } 46| 609k| x[i + p] = a; 47| 609k| } 48| 1.15M| } 49| 6.10k| } 50| 1.22k| } 51| 111|} controlbits.c:PQCLEAN_MCELIECE460896_AVX2_int32_sort: 21| 3.64M|static void int32_sort(int32_t *x, long long n) { 22| 3.64M| long long top, p, q, r, i; 23| | 24| 3.64M| if (n < 2) { ------------------ | Branch (24:9): [True: 0, False: 3.64M] ------------------ 25| 0| return; 26| 0| } 27| 3.64M| top = 1; 28| 12.7M| while (top < n - top) { ------------------ | Branch (28:12): [True: 9.11M, False: 3.64M] ------------------ 29| 9.11M| top += top; 30| 9.11M| } 31| | 32| 16.3M| for (p = top; p > 0; p >>= 1) { ------------------ | Branch (32:19): [True: 12.7M, False: 3.64M] ------------------ 33| 1.75G| for (i = 0; i < n - p; ++i) { ------------------ | Branch (33:21): [True: 1.74G, False: 12.7M] ------------------ 34| 1.74G| if (!(i & p)) { ------------------ | Branch (34:17): [True: 973M, False: 767M] ------------------ 35| 973M| int32_MINMAX(x[i], x[i + p]); ------------------ | | 11| 973M| do { \ | | 12| 973M| int32_t ab = (b) ^ (a); \ | | 13| 973M| int32_t c = (b) - (a); \ | | 14| 973M| c ^= ab & ((c) ^ (b)); \ | | 15| 973M| c >>= 31; \ | | 16| 973M| c &= ab; \ | | 17| 973M| (a) ^= c; \ | | 18| 973M| (b) ^= c; \ | | 19| 973M| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 973M] | | ------------------ ------------------ 36| 973M| } 37| 1.74G| } 38| 12.7M| i = 0; 39| 34.6M| for (q = top; q > p; q >>= 1) { ------------------ | Branch (39:23): [True: 21.8M, False: 12.7M] ------------------ 40| 1.55G| for (; i < n - q; ++i) { ------------------ | Branch (40:20): [True: 1.53G, False: 21.8M] ------------------ 41| 1.53G| if (!(i & p)) { ------------------ | Branch (41:21): [True: 767M, False: 767M] ------------------ 42| 767M| int32_t a = x[i + p]; 43| 4.54G| for (r = q; r > p; r >>= 1) { ------------------ | Branch (43:33): [True: 3.78G, False: 767M] ------------------ 44| 3.78G| int32_MINMAX(a, x[i + r]); ------------------ | | 11| 3.78G| do { \ | | 12| 3.78G| int32_t ab = (b) ^ (a); \ | | 13| 3.78G| int32_t c = (b) - (a); \ | | 14| 3.78G| c ^= ab & ((c) ^ (b)); \ | | 15| 3.78G| c >>= 31; \ | | 16| 3.78G| c &= ab; \ | | 17| 3.78G| (a) ^= c; \ | | 18| 3.78G| (b) ^= c; \ | | 19| 3.78G| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 3.78G] | | ------------------ ------------------ 45| 3.78G| } 46| 767M| x[i + p] = a; 47| 767M| } 48| 1.53G| } 49| 21.8M| } 50| 12.7M| } 51| 3.64M|} encrypt.c:PQCLEAN_MCELIECE460896_AVX2_int32_sort: 21| 552|static void int32_sort(int32_t *x, long long n) { 22| 552| long long top, p, q, r, i; 23| | 24| 552| if (n < 2) { ------------------ | Branch (24:9): [True: 0, False: 552] ------------------ 25| 0| return; 26| 0| } 27| 552| top = 1; 28| 3.86k| while (top < n - top) { ------------------ | Branch (28:12): [True: 3.31k, False: 552] ------------------ 29| 3.31k| top += top; 30| 3.31k| } 31| | 32| 4.41k| for (p = top; p > 0; p >>= 1) { ------------------ | Branch (32:19): [True: 3.86k, False: 552] ------------------ 33| 304k| for (i = 0; i < n - p; ++i) { ------------------ | Branch (33:21): [True: 300k, False: 3.86k] ------------------ 34| 300k| if (!(i & p)) { ------------------ | Branch (34:17): [True: 167k, False: 133k] ------------------ 35| 167k| int32_MINMAX(x[i], x[i + p]); ------------------ | | 11| 167k| do { \ | | 12| 167k| int32_t ab = (b) ^ (a); \ | | 13| 167k| int32_t c = (b) - (a); \ | | 14| 167k| c ^= ab & ((c) ^ (b)); \ | | 15| 167k| c >>= 31; \ | | 16| 167k| c &= ab; \ | | 17| 167k| (a) ^= c; \ | | 18| 167k| (b) ^= c; \ | | 19| 167k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 167k] | | ------------------ ------------------ 36| 167k| } 37| 300k| } 38| 3.86k| i = 0; 39| 15.4k| for (q = top; q > p; q >>= 1) { ------------------ | Branch (39:23): [True: 11.5k, False: 3.86k] ------------------ 40| 259k| for (; i < n - q; ++i) { ------------------ | Branch (40:20): [True: 248k, False: 11.5k] ------------------ 41| 248k| if (!(i & p)) { ------------------ | Branch (41:21): [True: 133k, False: 115k] ------------------ 42| 133k| int32_t a = x[i + p]; 43| 521k| for (r = q; r > p; r >>= 1) { ------------------ | Branch (43:33): [True: 388k, False: 133k] ------------------ 44| 388k| int32_MINMAX(a, x[i + r]); ------------------ | | 11| 388k| do { \ | | 12| 388k| int32_t ab = (b) ^ (a); \ | | 13| 388k| int32_t c = (b) - (a); \ | | 14| 388k| c ^= ab & ((c) ^ (b)); \ | | 15| 388k| c >>= 31; \ | | 16| 388k| c &= ab; \ | | 17| 388k| (a) ^= c; \ | | 18| 388k| (b) ^= c; \ | | 19| 388k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 388k] | | ------------------ ------------------ 45| 388k| } 46| 133k| x[i + p] = a; 47| 133k| } 48| 248k| } 49| 11.5k| } 50| 3.86k| } 51| 552|} PQCLEAN_MCELIECE460896_AVX2_crypto_kem_enc: 22| 111|) { 23| 111| unsigned char e[ SYS_N / 8 ]; 24| 111| unsigned char one_ec[ 1 + SYS_N / 8 + SYND_BYTES ] = {1}; 25| | 26| | // 27| | 28| 111| encrypt(c, pk, e); ------------------ | | 9| 111|#define encrypt CRYPTO_NAMESPACE(encrypt) | | ------------------ | | | | 4| 111|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896_AVX2_ ## fun | | ------------------ ------------------ 29| | 30| 111| memcpy(one_ec + 1, e, SYS_N / 8); ------------------ | | 7| 111|#define SYS_N 4608 ------------------ 31| 111| memcpy(one_ec + 1 + SYS_N / 8, c, SYND_BYTES); ------------------ | | 7| 111|#define SYS_N 4608 ------------------ memcpy(one_ec + 1 + SYS_N / 8, c, SYND_BYTES); ------------------ | | 17| 111|#define SYND_BYTES ((PK_NROWS + 7)/8) | | ------------------ | | | | 13| 111|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 111|#define SYS_T 96 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 111|#define GFBITS 13 | | | | ------------------ | | ------------------ ------------------ 32| | 33| 111| crypto_hash_32b(key, one_ec, sizeof(one_ec)); ------------------ | | 7| 111| shake256(out, 32, in, inlen) | | ------------------ | | | | 12| 111|#define shake256 OQS_SHA3_shake256 | | ------------------ ------------------ 34| | 35| 111| return 0; 36| 111|} PQCLEAN_MCELIECE460896_AVX2_crypto_kem_dec: 42| 111|) { 43| 111| int i; 44| | 45| 111| unsigned char ret_decrypt = 0; 46| | 47| 111| uint16_t m; 48| | 49| 111| unsigned char e[ SYS_N / 8 ]; 50| 111| unsigned char preimage[ 1 + SYS_N / 8 + SYND_BYTES ]; 51| 111| unsigned char *x = preimage; 52| 111| const unsigned char *s = sk + 40 + IRR_BYTES + COND_BYTES; ------------------ | | 11| 111|#define IRR_BYTES (SYS_T * 2) | | ------------------ | | | | 8| 111|#define SYS_T 96 | | ------------------ ------------------ const unsigned char *s = sk + 40 + IRR_BYTES + COND_BYTES; ------------------ | | 10| 111|#define COND_BYTES ((1 << (GFBITS-4))*(2*GFBITS - 1)) | | ------------------ | | | | 6| 111|#define GFBITS 13 | | ------------------ | | #define COND_BYTES ((1 << (GFBITS-4))*(2*GFBITS - 1)) | | ------------------ | | | | 6| 111|#define GFBITS 13 | | ------------------ ------------------ 53| | 54| | // 55| | 56| 111| ret_decrypt = (unsigned char)decrypt(e, sk + 40, c); ------------------ | | 9| 111|#define decrypt CRYPTO_NAMESPACE(decrypt) | | ------------------ | | | | 4| 111|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896_AVX2_ ## fun | | ------------------ ------------------ 57| | 58| 111| m = ret_decrypt; 59| 111| m -= 1; 60| 111| m >>= 8; 61| | 62| 111| *x++ = m & 1; 63| 64.0k| for (i = 0; i < SYS_N / 8; i++) { ------------------ | | 7| 64.0k|#define SYS_N 4608 ------------------ | Branch (63:17): [True: 63.9k, False: 111] ------------------ 64| 63.9k| *x++ = (~m & s[i]) | (m & e[i]); 65| 63.9k| } 66| | 67| 17.4k| for (i = 0; i < SYND_BYTES; i++) { ------------------ | | 17| 17.4k|#define SYND_BYTES ((PK_NROWS + 7)/8) | | ------------------ | | | | 13| 17.4k|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 17.4k|#define SYS_T 96 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 17.4k|#define GFBITS 13 | | | | ------------------ | | ------------------ ------------------ | Branch (67:17): [True: 17.3k, False: 111] ------------------ 68| 17.3k| *x++ = c[i]; 69| 17.3k| } 70| | 71| 111| crypto_hash_32b(key, preimage, sizeof(preimage)); ------------------ | | 7| 111| shake256(out, 32, in, inlen) | | ------------------ | | | | 12| 111|#define shake256 OQS_SHA3_shake256 | | ------------------ ------------------ 72| | 73| 111| return 0; 74| 111|} PQCLEAN_MCELIECE460896_AVX2_crypto_kem_keypair: 80| 111|) { 81| 111| int i; 82| 111| unsigned char seed[ 33 ] = {64}; 83| 111| unsigned char r[ SYS_N / 8 + (1 << GFBITS)*sizeof(uint32_t) + SYS_T * 2 + 32 ]; 84| 111| unsigned char *rp, *skp; 85| | 86| 111| gf f[ SYS_T ]; // element in GF(2^mt) 87| 111| gf irr[ SYS_T ]; // Goppa polynomial 88| 111| uint32_t perm[ 1 << GFBITS ]; // random permutation as 32-bit integers 89| 111| int16_t pi[ 1 << GFBITS ]; // random permutation 90| | 91| 111| randombytes(seed + 1, 32); ------------------ | | 8| 111|#define randombytes OQS_randombytes ------------------ 92| | 93| 1.10k| while (1) { ------------------ | Branch (93:12): [True: 1.10k, Folded] ------------------ 94| 1.10k| rp = &r[ sizeof(r) - 32 ]; 95| 1.10k| skp = sk; 96| | 97| | // expanding and updating the seed 98| | 99| 1.10k| shake(r, sizeof(r), seed, 33); ------------------ | | 10| 1.10k| shake256(out, outlen, in, inlen) | | ------------------ | | | | 12| 1.10k|#define shake256 OQS_SHA3_shake256 | | ------------------ ------------------ 100| 1.10k| memcpy(skp, seed + 1, 32); 101| 1.10k| skp += 32 + 8; 102| 1.10k| memcpy(seed + 1, &r[ sizeof(r) - 32 ], 32); 103| | 104| | // generating irreducible polynomial 105| | 106| 1.10k| rp -= sizeof(f); 107| | 108| 107k| for (i = 0; i < SYS_T; i++) { ------------------ | | 8| 107k|#define SYS_T 96 ------------------ | Branch (108:21): [True: 106k, False: 1.10k] ------------------ 109| 106k| f[i] = load_gf(rp + i * 2); 110| 106k| } 111| | 112| 1.10k| if (genpoly_gen(irr, f)) { ------------------ | | 9| 1.10k|#define genpoly_gen CRYPTO_NAMESPACE(genpoly_gen) | | ------------------ | | | | 4| 1.10k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896_AVX2_ ## fun | | ------------------ ------------------ | Branch (112:13): [True: 0, False: 1.10k] ------------------ 113| 0| continue; 114| 0| } 115| | 116| 107k| for (i = 0; i < SYS_T; i++) { ------------------ | | 8| 107k|#define SYS_T 96 ------------------ | Branch (116:21): [True: 106k, False: 1.10k] ------------------ 117| 106k| store_gf(skp + i * 2, irr[i]); 118| 106k| } 119| | 120| 1.10k| skp += IRR_BYTES; ------------------ | | 11| 1.10k|#define IRR_BYTES (SYS_T * 2) | | ------------------ | | | | 8| 1.10k|#define SYS_T 96 | | ------------------ ------------------ 121| | 122| | // generating permutation 123| | 124| 1.10k| rp -= sizeof(perm); 125| | 126| 9.08M| for (i = 0; i < (1 << GFBITS); i++) { ------------------ | | 6| 9.08M|#define GFBITS 13 ------------------ | Branch (126:21): [True: 9.08M, False: 1.10k] ------------------ 127| 9.08M| perm[i] = load4(rp + i * 4); 128| 9.08M| } 129| | 130| 1.10k| if (pk_gen(pk, skp - IRR_BYTES, perm, pi)) { ------------------ | | 9| 1.10k|#define pk_gen CRYPTO_NAMESPACE(pk_gen) | | ------------------ | | | | 4| 1.10k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896_AVX2_ ## fun | | ------------------ ------------------ if (pk_gen(pk, skp - IRR_BYTES, perm, pi)) { ------------------ | | 11| 1.10k|#define IRR_BYTES (SYS_T * 2) | | ------------------ | | | | 8| 1.10k|#define SYS_T 96 | | ------------------ ------------------ | Branch (130:13): [True: 998, False: 111] ------------------ 131| 998| continue; 132| 998| } 133| | 134| 111| controlbitsfrompermutation(skp, pi, GFBITS, 1 << GFBITS); ------------------ | | 10| 111|#define controlbitsfrompermutation CRYPTO_NAMESPACE(controlbitsfrompermutation) | | ------------------ | | | | 4| 111|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896_AVX2_ ## fun | | ------------------ ------------------ controlbitsfrompermutation(skp, pi, GFBITS, 1 << GFBITS); ------------------ | | 6| 111|#define GFBITS 13 ------------------ controlbitsfrompermutation(skp, pi, GFBITS, 1 << GFBITS); ------------------ | | 6| 111|#define GFBITS 13 ------------------ 135| 111| skp += COND_BYTES; ------------------ | | 10| 111|#define COND_BYTES ((1 << (GFBITS-4))*(2*GFBITS - 1)) | | ------------------ | | | | 6| 111|#define GFBITS 13 | | ------------------ | | #define COND_BYTES ((1 << (GFBITS-4))*(2*GFBITS - 1)) | | ------------------ | | | | 6| 111|#define GFBITS 13 | | ------------------ ------------------ 136| | 137| | // storing the random string s 138| | 139| 111| rp -= SYS_N / 8; ------------------ | | 7| 111|#define SYS_N 4608 ------------------ 140| 111| memcpy(skp, rp, SYS_N / 8); ------------------ | | 7| 111|#define SYS_N 4608 ------------------ 141| | 142| | // storing positions of the 32 pivots 143| | 144| 111| store8(sk + 32, 0xFFFFFFFF); 145| | 146| 111| break; 147| 1.10k| } 148| | 149| 111| return 0; 150| 111|} PQCLEAN_MCELIECE460896_AVX2_pk_gen: 199| 1.10k|int pk_gen(unsigned char *pk, const unsigned char *irr, const uint32_t *perm, int16_t *pi) { 200| 1.10k|#define nBlocks_I ((PK_NROWS + 255) / 256) 201| | 202| 1.10k| int i, j, k, b; 203| 1.10k| int row, c; 204| | 205| 1.10k| union { 206| 1.10k| uint64_t w[ PK_NROWS ][ nBlocks_I * 4 ]; 207| 1.10k| vec256 v[ PK_NROWS ][ nBlocks_I ]; 208| 1.10k| } mat; 209| | 210| 1.10k| union { 211| 1.10k| uint64_t w[ PK_NROWS ][ par_width * 4 ]; 212| 1.10k| vec256 v[ PK_NROWS ][ par_width ]; 213| 1.10k| } par; 214| | 215| 1.10k| uint64_t one = 1; 216| 1.10k| uint64_t t; 217| 1.10k| uint16_t m; 218| 1.10k| vec256 mm; 219| | 220| 1.10k| vec128 sk_int[ GFBITS ]; 221| | 222| 1.10k| vec256 consts[ 32 ][ GFBITS ]; 223| 1.10k| vec256 eval[ 32 ][ GFBITS ]; 224| 1.10k| vec256 prod[ 32 ][ GFBITS ]; 225| 1.10k| vec256 tmp[ GFBITS ]; 226| | 227| 1.10k| uint64_t list[1 << GFBITS]; 228| | 229| 1.10k| uint16_t ind[ PK_NROWS ]; 230| 1.10k| uint16_t ind_inv[ PK_NROWS ]; 231| | 232| | // compute the inverses 233| | 234| 1.10k| irr_load(sk_int, irr); 235| | 236| 1.10k| fft(eval, sk_int); ------------------ | | 10| 1.10k|#define fft CRYPTO_NAMESPACE(fft) | | ------------------ | | | | 4| 1.10k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896_AVX2_ ## fun | | ------------------ ------------------ 237| | 238| 1.10k| vec256_copy(prod[0], eval[0]); 239| | 240| 35.4k| for (i = 1; i < 32; i++) { ------------------ | Branch (240:17): [True: 34.3k, False: 1.10k] ------------------ 241| 34.3k| vec256_mul(prod[i], prod[i - 1], eval[i]); 242| 34.3k| } 243| | 244| 1.10k| vec256_inv(tmp, prod[31]); ------------------ | | 11| 1.10k|#define vec256_inv CRYPTO_NAMESPACE(vec256_inv) | | ------------------ | | | | 4| 1.10k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896_AVX2_ ## fun | | ------------------ ------------------ 245| | 246| 35.4k| for (i = 30; i >= 0; i--) { ------------------ | Branch (246:18): [True: 34.3k, False: 1.10k] ------------------ 247| 34.3k| vec256_mul(prod[i + 1], prod[i], tmp); 248| 34.3k| vec256_mul(tmp, tmp, eval[i + 1]); 249| 34.3k| } 250| | 251| 1.10k| vec256_copy(prod[0], tmp); 252| | 253| | // fill matrix 254| | 255| 1.10k| de_bitslicing(list, prod); 256| | 257| 9.08M| for (i = 0; i < (1 << GFBITS); i++) { ------------------ | | 6| 9.08M|#define GFBITS 13 ------------------ | Branch (257:17): [True: 9.08M, False: 1.10k] ------------------ 258| 9.08M| list[i] <<= GFBITS; ------------------ | | 6| 9.08M|#define GFBITS 13 ------------------ 259| 9.08M| list[i] |= i; 260| 9.08M| list[i] |= ((uint64_t) perm[i]) << 31; 261| 9.08M| } 262| | 263| 1.10k| uint64_sort(list, 1 << GFBITS); ------------------ | | 6| 1.10k|#define GFBITS 13 ------------------ 264| | 265| 8.93M| for (i = 1; i < (1 << GFBITS); i++) { ------------------ | | 6| 8.93M|#define GFBITS 13 ------------------ | Branch (265:17): [True: 8.93M, False: 1.07k] ------------------ 266| 8.93M| if (uint64_is_equal_declassify(list[i - 1] >> 31, list[i] >> 31)) { ------------------ | Branch (266:13): [True: 34, False: 8.93M] ------------------ 267| 34| return -1; 268| 34| } 269| 8.93M| } 270| | 271| 1.07k| to_bitslicing_2x(consts, prod, list); 272| | 273| 8.80M| for (i = 0; i < (1 << GFBITS); i++) { ------------------ | | 6| 8.80M|#define GFBITS 13 ------------------ | Branch (273:17): [True: 8.80M, False: 1.07k] ------------------ 274| 8.80M| pi[i] = list[i] & GFMASK; ------------------ | | 19| 8.80M|#define GFMASK ((1 << GFBITS) - 1) | | ------------------ | | | | 6| 8.80M|#define GFBITS 13 | | ------------------ ------------------ 275| 8.80M| } 276| | 277| 6.45k| for (j = 0; j < nBlocks_I; j++) { ------------------ | | 200| 6.45k|#define nBlocks_I ((PK_NROWS + 255) / 256) | | ------------------ | | | | 13| 6.45k|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 6.45k|#define SYS_T 96 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 6.45k|#define GFBITS 13 | | | | ------------------ | | ------------------ ------------------ | Branch (277:17): [True: 5.37k, False: 1.07k] ------------------ 278| 75.2k| for (k = 0; k < GFBITS; k++) { ------------------ | | 6| 75.2k|#define GFBITS 13 ------------------ | Branch (278:21): [True: 69.8k, False: 5.37k] ------------------ 279| 69.8k| mat.v[ k ][ j ] = prod[ j ][ k ]; 280| 69.8k| } 281| 5.37k| } 282| | 283| 103k| for (i = 1; i < SYS_T; i++) { ------------------ | | 8| 103k|#define SYS_T 96 ------------------ | Branch (283:17): [True: 102k, False: 1.07k] ------------------ 284| 612k| for (j = 0; j < nBlocks_I; j++) { ------------------ | | 200| 612k|#define nBlocks_I ((PK_NROWS + 255) / 256) | | ------------------ | | | | 13| 612k|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 612k|#define SYS_T 96 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 612k|#define GFBITS 13 | | | | ------------------ | | ------------------ ------------------ | Branch (284:21): [True: 510k, False: 102k] ------------------ 285| 510k| vec256_mul(prod[j], prod[j], consts[j]); 286| | 287| 7.14M| for (k = 0; k < GFBITS; k++) { ------------------ | | 6| 7.14M|#define GFBITS 13 ------------------ | Branch (287:25): [True: 6.63M, False: 510k] ------------------ 288| 6.63M| mat.v[ i * GFBITS + k ][ j ] = prod[ j ][ k ]; ------------------ | | 6| 6.63M|#define GFBITS 13 ------------------ 289| 6.63M| } 290| 510k| } 291| 102k| } 292| | 293| | // gaussian elimination to obtain L, U, and P such that LP M = U 294| | // L and U are stored in the space of M 295| | // P is stored in ind 296| | 297| 1.34M| for (i = 0; i < PK_NROWS; i++) { ------------------ | | 13| 1.34M|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 1.34M|#define SYS_T 96 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 1.34M|#define GFBITS 13 | | ------------------ ------------------ | Branch (297:17): [True: 1.34M, False: 1.07k] ------------------ 298| 1.34M| ind_inv[i] = ind[ i ] = i; 299| 1.34M| } 300| | 301| 1.34M| for (row = 0; row < PK_NROWS; row++) { ------------------ | | 13| 1.34M|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 1.34M|#define SYS_T 96 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 1.34M|#define GFBITS 13 | | ------------------ ------------------ | Branch (301:19): [True: 1.34M, False: 111] ------------------ 302| 1.34M| i = row >> 6; 303| 1.34M| j = row & 63; 304| | 305| 837M| for (k = row + 1; k < PK_NROWS; k++) { ------------------ | | 13| 837M|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 837M|#define SYS_T 96 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 837M|#define GFBITS 13 | | ------------------ ------------------ | Branch (305:27): [True: 836M, False: 1.34M] ------------------ 306| 836M| extract_01_masks(&m, mat.w[ row ], mat.w[ k ], row); 307| 836M| uint16_cswap(&ind[row], &ind[k], m); 308| | 309| 836M| mm = vec256_set1_16b(m); 310| 5.01G| for (c = 0; c < nBlocks_I; c++) { ------------------ | | 200| 5.01G|#define nBlocks_I ((PK_NROWS + 255) / 256) | | ------------------ | | | | 13| 5.01G|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 5.01G|#define SYS_T 96 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 5.01G|#define GFBITS 13 | | | | ------------------ | | ------------------ ------------------ | Branch (310:25): [True: 4.18G, False: 836M] ------------------ 311| 4.18G| vec256_cswap(&mat.v[ row ][ c ], &mat.v[ k ][ c ], mm); 312| 4.18G| } 313| 836M| } 314| | 315| 1.34M| if ( uint64_is_zero_declassify((mat.w[ row ][ i ] >> j) & 1) ) { // return if not systematic ------------------ | Branch (315:14): [True: 964, False: 1.33M] ------------------ 316| 964| return -1; 317| 964| } 318| | 319| 837M| for (k = row + 1; k < PK_NROWS; k++) { ------------------ | | 13| 837M|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 837M|#define SYS_T 96 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 837M|#define GFBITS 13 | | ------------------ ------------------ | Branch (319:27): [True: 836M, False: 1.33M] ------------------ 320| 836M| t = mat.w[ k ][ i ] & (one << j); 321| 836M| mm = extract_mask256(mat.w[k], row); 322| | 323| 5.01G| for (c = 0; c < nBlocks_I; c++) { ------------------ | | 200| 5.01G|#define nBlocks_I ((PK_NROWS + 255) / 256) | | ------------------ | | | | 13| 5.01G|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 5.01G|#define SYS_T 96 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 5.01G|#define GFBITS 13 | | | | ------------------ | | ------------------ ------------------ | Branch (323:25): [True: 4.18G, False: 836M] ------------------ 324| 4.18G| mat.v[ k ][ c ] ^= mat.v[ row ][ c ] & mm; 325| 4.18G| } 326| | 327| 836M| mat.w[ k ][ i ] |= t; 328| 836M| } 329| 1.33M| } 330| | 331| | // apply M^-1 to the remaining columns 332| | 333| 111| composeinv(PK_NROWS, ind_inv, ind_inv, ind); ------------------ | | 13| 111|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 111|#define SYS_T 96 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 111|#define GFBITS 13 | | ------------------ ------------------ 334| | 335| 333| for (j = 4; j < 18; j += par_width) { ------------------ | | 30| 222|#define par_width 7 ------------------ | Branch (335:17): [True: 222, False: 111] ------------------ 336| 3.10k| for (k = 0; k < GFBITS; k++) { ------------------ | | 6| 3.10k|#define GFBITS 13 ------------------ | Branch (336:21): [True: 2.88k, False: 222] ------------------ 337| 23.0k| for (b = 0; b < par_width; b++) { ------------------ | | 30| 23.0k|#define par_width 7 ------------------ | Branch (337:25): [True: 20.2k, False: 2.88k] ------------------ 338| 20.2k| par.v[ k ][ b ] = prod[ j + b ][ k ]; 339| 20.2k| } 340| 2.88k| } 341| | 342| 21.3k| for (i = 1; i < SYS_T; i++) { ------------------ | | 8| 21.3k|#define SYS_T 96 ------------------ | Branch (342:21): [True: 21.0k, False: 222] ------------------ 343| 168k| for (b = 0; b < par_width; b++) { ------------------ | | 30| 168k|#define par_width 7 ------------------ | Branch (343:25): [True: 147k, False: 21.0k] ------------------ 344| 147k| vec256_mul(prod[j + b], prod[j + b], consts[j + b]); 345| 147k| } 346| | 347| 295k| for (k = 0; k < GFBITS; k++) { ------------------ | | 6| 295k|#define GFBITS 13 ------------------ | Branch (347:25): [True: 274k, False: 21.0k] ------------------ 348| 2.19M| for (b = 0; b < par_width; b++) { ------------------ | | 30| 2.19M|#define par_width 7 ------------------ | Branch (348:29): [True: 1.91M, False: 274k] ------------------ 349| 1.91M| par.v[ i * GFBITS + k ][ b ] = prod[ j + b ][ k ]; ------------------ | | 6| 1.91M|#define GFBITS 13 ------------------ 350| 1.91M| } 351| 274k| } 352| 21.0k| } 353| | 354| | // apply P 355| | 356| 277k| for (i = 0; i < PK_NROWS; i++) { ------------------ | | 13| 277k|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 277k|#define SYS_T 96 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 277k|#define GFBITS 13 | | ------------------ ------------------ | Branch (356:21): [True: 277k, False: 222] ------------------ 357| 277k| ind[i] = ind_inv[i]; 358| 277k| } 359| | 360| 222| sort_rows((1 << GFBITS) / 4, PK_NROWS, ind, par.v, 0); ------------------ | | 6| 222|#define GFBITS 13 ------------------ sort_rows((1 << GFBITS) / 4, PK_NROWS, ind, par.v, 0); ------------------ | | 13| 222|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 222|#define SYS_T 96 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 222|#define GFBITS 13 | | ------------------ ------------------ 361| | 362| | // apply L 363| | 364| 277k| for (row = PK_NROWS - 1; row >= 0; row--) { ------------------ | | 13| 222|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 222|#define SYS_T 96 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 222|#define GFBITS 13 | | ------------------ ------------------ | Branch (364:34): [True: 277k, False: 222] ------------------ 365| 173M| for (i = row - 1; i >= 0; i--) { ------------------ | Branch (365:31): [True: 172M, False: 277k] ------------------ 366| 172M| mm = extract_mask256(mat.w[row], i); 367| | 368| 1.38G| for (k = 0; k < par_width; k++) { ------------------ | | 30| 1.38G|#define par_width 7 ------------------ | Branch (368:29): [True: 1.20G, False: 172M] ------------------ 369| 1.20G| par.v[ row ][ k ] ^= par.v[ i ][ k ] & mm; 370| 1.20G| } 371| 172M| } 372| 277k| } 373| | 374| | // apply U^-1 375| | 376| 222| if (j == 4) { ------------------ | Branch (376:13): [True: 111, False: 111] ------------------ 377| 138k| for (i = 0; i < PK_NROWS; i++) { ------------------ | | 13| 138k|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 138k|#define SYS_T 96 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 138k|#define GFBITS 13 | | ------------------ ------------------ | Branch (377:25): [True: 138k, False: 111] ------------------ 378| 138k| par.v[i][0] = mat.v[i][nBlocks_I - 1]; ------------------ | | 200| 138k|#define nBlocks_I ((PK_NROWS + 255) / 256) | | ------------------ | | | | 13| 138k|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 138k|#define SYS_T 96 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 138k|#define GFBITS 13 | | | | ------------------ | | ------------------ ------------------ 379| 138k| } 380| 111| } 381| | 382| 277k| for (row = PK_NROWS - 1; row >= 0; row--) { ------------------ | | 13| 222|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 222|#define SYS_T 96 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 222|#define GFBITS 13 | | ------------------ ------------------ | Branch (382:34): [True: 277k, False: 222] ------------------ 383| 173M| for (i = PK_NROWS - 1; i > row; i--) { ------------------ | | 13| 277k|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 277k|#define SYS_T 96 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 277k|#define GFBITS 13 | | ------------------ ------------------ | Branch (383:36): [True: 172M, False: 277k] ------------------ 384| 172M| mm = extract_mask256(mat.w[row], i); 385| | 386| 1.38G| for (k = 0; k < par_width; k++) { ------------------ | | 30| 1.38G|#define par_width 7 ------------------ | Branch (386:29): [True: 1.20G, False: 172M] ------------------ 387| 1.20G| par.v[ row ][ k ] ^= par.v[ i ][ k ] & mm; 388| 1.20G| } 389| 172M| } 390| 277k| } 391| | 392| 222| if (j == 4) { ------------------ | Branch (392:13): [True: 111, False: 111] ------------------ 393| 138k| for (row = 0; row < PK_NROWS; row++) { ------------------ | | 13| 138k|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 138k|#define SYS_T 96 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 138k|#define GFBITS 13 | | ------------------ ------------------ | Branch (393:27): [True: 138k, False: 111] ------------------ 394| 138k| k = 3; 395| 138k| store_i(pk + PK_ROW_BYTES * row + j * 32 + k * 8 + 4 - 13 * 12, par.w[row][k] >> 32, 4); ------------------ | | 15| 138k|#define PK_ROW_BYTES ((PK_NCOLS + 7)/8) | | ------------------ | | | | 14| 138k|#define PK_NCOLS (SYS_N - PK_NROWS) | | | | ------------------ | | | | | | 7| 138k|#define SYS_N 4608 | | | | ------------------ | | | | #define PK_NCOLS (SYS_N - PK_NROWS) | | | | ------------------ | | | | | | 13| 138k|#define PK_NROWS (SYS_T*GFBITS) | | | | | | ------------------ | | | | | | | | 8| 138k|#define SYS_T 96 | | | | | | ------------------ | | | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | | | ------------------ | | | | | | | | 6| 138k|#define GFBITS 13 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 396| | 397| 3.46M| for (k = 4; k < 28; k++) { ------------------ | Branch (397:29): [True: 3.32M, False: 138k] ------------------ 398| 3.32M| store8(pk + PK_ROW_BYTES * row + j * 32 + k * 8 - 13 * 12, par.w[row][k]); ------------------ | | 15| 3.32M|#define PK_ROW_BYTES ((PK_NCOLS + 7)/8) | | ------------------ | | | | 14| 3.32M|#define PK_NCOLS (SYS_N - PK_NROWS) | | | | ------------------ | | | | | | 7| 3.32M|#define SYS_N 4608 | | | | ------------------ | | | | #define PK_NCOLS (SYS_N - PK_NROWS) | | | | ------------------ | | | | | | 13| 3.32M|#define PK_NROWS (SYS_T*GFBITS) | | | | | | ------------------ | | | | | | | | 8| 3.32M|#define SYS_T 96 | | | | | | ------------------ | | | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | | | ------------------ | | | | | | | | 6| 3.32M|#define GFBITS 13 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 399| 3.32M| } 400| 138k| } 401| 111| } else { 402| 138k| for (row = 0; row < PK_NROWS; row++) { ------------------ | | 13| 138k|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 138k|#define SYS_T 96 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 138k|#define GFBITS 13 | | ------------------ ------------------ | Branch (402:27): [True: 138k, False: 111] ------------------ 403| 4.01M| for (k = 0; k < 28; k++) { ------------------ | Branch (403:29): [True: 3.87M, False: 138k] ------------------ 404| 3.87M| store8(pk + PK_ROW_BYTES * row + j * 32 + k * 8 - 13 * 12, par.w[row][k]); ------------------ | | 15| 3.87M|#define PK_ROW_BYTES ((PK_NCOLS + 7)/8) | | ------------------ | | | | 14| 3.87M|#define PK_NCOLS (SYS_N - PK_NROWS) | | | | ------------------ | | | | | | 7| 3.87M|#define SYS_N 4608 | | | | ------------------ | | | | #define PK_NCOLS (SYS_N - PK_NROWS) | | | | ------------------ | | | | | | 13| 3.87M|#define PK_NROWS (SYS_T*GFBITS) | | | | | | ------------------ | | | | | | | | 8| 3.87M|#define SYS_T 96 | | | | | | ------------------ | | | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | | | ------------------ | | | | | | | | 6| 3.87M|#define GFBITS 13 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 405| 3.87M| } 406| 138k| } 407| 111| } 408| 222| } 409| | 410| | // 411| | 412| 111| return 0; 413| 1.07k|} PQCLEAN_MCELIECE460896_AVX2_genpoly_gen: 88| 1.10k|int genpoly_gen(gf *out, gf *f) { 89| 1.10k| int i, j, k; 90| | 91| 1.10k| gf t, inv; 92| | 93| 1.10k| uint64_t m; 94| 1.10k| vec128 mask; 95| | 96| 1.10k| union { 97| 1.10k| uint64_t d[ GFBITS ][ 128 ][2]; 98| 1.10k| vec128 v[ GFBITS ][ 128 ]; 99| 1.10k| } buf; 100| | 101| 1.10k| union { 102| 1.10k| uint64_t d[GFBITS][2]; 103| 1.10k| vec128 v[GFBITS]; 104| 1.10k| } v; 105| | 106| 1.10k| union { 107| 1.10k| uint64_t d[SYS_T][GFBITS][2]; 108| 1.10k| vec128 v[SYS_T][GFBITS]; 109| 1.10k| } mat; 110| | 111| | // fill matrix 112| | 113| 1.10k| buf.v[0][0] = vec128_set2x(1, 0); 114| 14.4k| for (i = 1; i < GFBITS; i++) { ------------------ | | 6| 14.4k|#define GFBITS 13 ------------------ | Branch (114:17): [True: 13.3k, False: 1.10k] ------------------ 115| 13.3k| buf.v[i][0] = vec128_setzero(); 116| 13.3k| } 117| | 118| 15.5k| for (j = 0; j < GFBITS; j++) { ------------------ | | 6| 15.5k|#define GFBITS 13 ------------------ | Branch (118:17): [True: 14.4k, False: 1.10k] ------------------ 119| 14.4k| v.v[j] = vec128_setzero(); 120| | 121| 1.39M| for (i = SYS_T - 1; i >= 0; i--) { ------------------ | | 8| 14.4k|#define SYS_T 96 ------------------ | Branch (121:29): [True: 1.38M, False: 14.4k] ------------------ 122| 1.38M| v.d[j][1] <<= 1; 123| 1.38M| v.d[j][1] |= v.d[j][0] >> 63; 124| 1.38M| v.d[j][0] <<= 1; 125| 1.38M| v.d[j][0] |= (f[i] >> j) & 1; 126| 1.38M| } 127| 14.4k| } 128| | 129| 15.5k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 15.5k|#define GFBITS 13 ------------------ | Branch (129:17): [True: 14.4k, False: 1.10k] ------------------ 130| 14.4k| buf.v[i][1] = v.v[i]; 131| 14.4k| } 132| | 133| 106k| for (k = 2; k <= SYS_T; k++) { ------------------ | | 8| 106k|#define SYS_T 96 ------------------ | Branch (133:17): [True: 105k, False: 1.10k] ------------------ 134| 105k| vec128_mul_GF(v.v, v.v, f); ------------------ | | 11| 105k|#define vec128_mul_GF CRYPTO_NAMESPACE(vec128_mul_GF) | | ------------------ | | | | 4| 105k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896_AVX2_ ## fun | | ------------------ ------------------ 135| | 136| 105k| if (k < SYS_T) { ------------------ | | 8| 105k|#define SYS_T 96 ------------------ | Branch (136:13): [True: 104k, False: 1.10k] ------------------ 137| 1.45M| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 1.45M|#define GFBITS 13 ------------------ | Branch (137:25): [True: 1.35M, False: 104k] ------------------ 138| 1.35M| buf.v[i][k] = v.v[i]; 139| 1.35M| } 140| 104k| } else { 141| 107k| for (i = 0; i < SYS_T; i++) { ------------------ | | 8| 107k|#define SYS_T 96 ------------------ | Branch (141:25): [True: 106k, False: 1.10k] ------------------ 142| 106k| out[i] = extract_gf(v.d, i); 143| 106k| } 144| 1.10k| } 145| 105k| } 146| | 147| 15.5k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 15.5k|#define GFBITS 13 ------------------ | Branch (147:17): [True: 14.4k, False: 1.10k] ------------------ 148| 14.4k| transpose_128x128(buf.d[i]); 149| 14.4k| } 150| | 151| 107k| for (j = 0; j < SYS_T; j++) { ------------------ | | 8| 107k|#define SYS_T 96 ------------------ | Branch (151:17): [True: 106k, False: 1.10k] ------------------ 152| 1.49M| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 1.49M|#define GFBITS 13 ------------------ | Branch (152:21): [True: 1.38M, False: 106k] ------------------ 153| 1.38M| mat.v[j][i] = buf.v[i][j]; 154| 1.38M| } 155| 106k| } 156| | 157| | // gaussian 158| | 159| 107k| for (i = 0; i < SYS_T; i++) { ------------------ | | 8| 107k|#define SYS_T 96 ------------------ | Branch (159:17): [True: 106k, False: 1.10k] ------------------ 160| 5.16M| for (j = i + 1; j < SYS_T; j++) { ------------------ | | 8| 5.16M|#define SYS_T 96 ------------------ | Branch (160:25): [True: 5.05M, False: 106k] ------------------ 161| 5.05M| m = extract_bit(mat.d[i], i); 162| 5.05M| m -= 1; 163| 5.05M| mask = vec128_set2x(m, m); 164| | 165| 70.7M| for (k = 0; k < GFBITS; k++) { ------------------ | | 6| 70.7M|#define GFBITS 13 ------------------ | Branch (165:25): [True: 65.7M, False: 5.05M] ------------------ 166| 65.7M| mat.v[i][k] ^= mat.v[j][k] & mask; 167| 65.7M| } 168| | 169| 5.05M| out[i] ^= out[j] & m; 170| 5.05M| } 171| | 172| | // 173| | 174| 106k| t = extract_gf(mat.d[i], i); 175| | 176| 106k| if (gf_is_zero_declassify(t)) { ------------------ | Branch (176:13): [True: 0, False: 106k] ------------------ 177| 0| return -1; // return if not systematic 178| 0| } 179| | 180| | // 181| | 182| 106k| inv = gf_inv(t); ------------------ | | 11| 106k|#define gf_inv CRYPTO_NAMESPACE(gf_inv) | | ------------------ | | | | 4| 106k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896_AVX2_ ## fun | | ------------------ ------------------ 183| 106k| vec128_mul_gf(mat.v[i], mat.v[i], inv); 184| | 185| 106k| out[i] = gf_mul(out[i], inv); ------------------ | | 14| 106k|#define gf_mul CRYPTO_NAMESPACE(gf_mul) | | ------------------ | | | | 4| 106k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896_AVX2_ ## fun | | ------------------ ------------------ 186| | 187| 10.3M| for (j = 0; j < SYS_T; j++) { ------------------ | | 8| 10.3M|#define SYS_T 96 ------------------ | Branch (187:21): [True: 10.2M, False: 106k] ------------------ 188| 10.2M| if (j != i) { ------------------ | Branch (188:17): [True: 10.1M, False: 106k] ------------------ 189| 10.1M| t = extract_gf(mat.d[j], i); 190| | 191| 10.1M| vec128_mul_gf(v.v, mat.v[i], t); 192| 10.1M| vec128_add(mat.v[j], mat.v[j], v.v); 193| | 194| 10.1M| out[j] ^= gf_mul(out[i], t); ------------------ | | 14| 10.1M|#define gf_mul CRYPTO_NAMESPACE(gf_mul) | | ------------------ | | | | 4| 10.1M|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896_AVX2_ ## fun | | ------------------ ------------------ 195| 10.1M| } 196| 10.2M| } 197| 106k| } 198| | 199| 1.10k| return 0; 200| 1.10k|} sk_gen.c:transpose_128x128: 52| 57.2k|static void transpose_128x128(uint64_t (*in)[2]) { 53| 57.2k| int i, j, k; 54| 57.2k| uint64_t m[2][2][64], t; 55| | 56| 171k| for (i = 0; i < 2; i++) { ------------------ | Branch (56:17): [True: 114k, False: 57.2k] ------------------ 57| 343k| for (j = 0; j < 2; j++) { ------------------ | Branch (57:21): [True: 229k, False: 114k] ------------------ 58| 14.8M| for (k = 0; k < 64; k++) { ------------------ | Branch (58:25): [True: 14.6M, False: 229k] ------------------ 59| 14.6M| m[i][j][k] = in[64 * i + k][j]; 60| 14.6M| } 61| 229k| } 62| 114k| } 63| | 64| 3.72M| for (k = 0; k < 64; k++) { ------------------ | Branch (64:17): [True: 3.66M, False: 57.2k] ------------------ 65| 3.66M| t = m[0][1][k]; 66| 3.66M| m[0][1][k] = m[1][0][k]; 67| 3.66M| m[1][0][k] = t; 68| 3.66M| } 69| | 70| 171k| for (i = 0; i < 2; i++) { ------------------ | Branch (70:17): [True: 114k, False: 57.2k] ------------------ 71| 343k| for (j = 0; j < 2; j++) { ------------------ | Branch (71:21): [True: 229k, False: 114k] ------------------ 72| 229k| transpose_64x64(m[i][j]); 73| 229k| } 74| 114k| } 75| | 76| 171k| for (i = 0; i < 2; i++) { ------------------ | Branch (76:17): [True: 114k, False: 57.2k] ------------------ 77| 343k| for (j = 0; j < 2; j++) { ------------------ | Branch (77:21): [True: 229k, False: 114k] ------------------ 78| 14.8M| for (k = 0; k < 64; k++) { ------------------ | Branch (78:25): [True: 14.6M, False: 229k] ------------------ 79| 14.6M| in[64 * i + k][j] = m[i][j][k]; 80| 14.6M| } 81| 229k| } 82| 114k| } 83| 57.2k|} fft.c:transpose_64x256_sp: 31| 41.6k|static inline void transpose_64x256_sp(vec256 *in) { 32| 41.6k| transpose_64x256_sp_asm(in); ------------------ | | 10| 41.6k|#define transpose_64x256_sp_asm CRYPTO_NAMESPACE(transpose_64x256_sp_asm) | | ------------------ | | | | 4| 41.6k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896_AVX2_ ## fun | | ------------------ ------------------ 33| 41.6k|} benes.c:transpose_64x128_sp: 25| 10.7k|static inline void transpose_64x128_sp(vec128 *in) { 26| 10.7k| transpose_64x128_sp_asm(in); ------------------ | | 9| 10.7k|#define transpose_64x128_sp_asm CRYPTO_NAMESPACE(transpose_64x128_sp_asm) | | ------------------ | | | | 4| 10.7k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896_AVX2_ ## fun | | ------------------ ------------------ 27| 10.7k|} benes.c:load16: 100| 320k|static inline vec128 load16(const unsigned char *in) { 101| 320k| return vec128_set2x( load8(in), load8(in + 8) ); 102| 320k|} PQCLEAN_MCELIECE460896_AVX2_vec128_mul_GF: 6| 105k|void vec128_mul_GF(vec128 out[ GFBITS ], vec128 v[ GFBITS ], gf a[ SYS_T ]) { 7| 105k| int i, j; 8| 105k| uint64_t buf[GFBITS][3]; 9| 105k| vec128 prod[GFBITS]; 10| 105k| uint64_t p[GFBITS]; 11| | 12| 105k| const uint64_t allone = -1; 13| | 14| | // polynomial multiplication 15| | 16| 1.47M| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 1.47M|#define GFBITS 13 ------------------ | Branch (16:17): [True: 1.36M, False: 105k] ------------------ 17| 1.36M| buf[i][0] = 0; 18| 1.36M| buf[i][1] = 0; 19| 1.36M| buf[i][2] = 0; 20| 1.36M| } 21| | 22| 10.2M| for (i = SYS_T - 1; i >= 0; i--) { ------------------ | | 8| 105k|#define SYS_T 96 ------------------ | Branch (22:25): [True: 10.1M, False: 105k] ------------------ 23| 141M| for (j = 0; j < GFBITS; j++) { ------------------ | | 6| 141M|#define GFBITS 13 ------------------ | Branch (23:21): [True: 131M, False: 10.1M] ------------------ 24| 131M| buf[j][2] <<= 1; 25| 131M| buf[j][2] |= buf[j][1] >> 63; 26| 131M| buf[j][1] <<= 1; 27| 131M| buf[j][1] |= buf[j][0] >> 63; 28| 131M| buf[j][0] <<= 1; 29| 131M| } 30| | 31| 10.1M| vec128_mul_gf(prod, v, a[i]); 32| | 33| 141M| for (j = 0; j < GFBITS; j++) { ------------------ | | 6| 141M|#define GFBITS 13 ------------------ | Branch (33:21): [True: 131M, False: 10.1M] ------------------ 34| 131M| buf[j][0] ^= vec128_extract(prod[j], 0); ------------------ | | 29| 131M|#define vec128_extract(a, i) ((uint64_t) _mm_extract_epi64((vec128) (a), (i))) ------------------ 35| 131M| buf[j][1] ^= vec128_extract(prod[j], 1); ------------------ | | 29| 131M|#define vec128_extract(a, i) ((uint64_t) _mm_extract_epi64((vec128) (a), (i))) ------------------ 36| 131M| } 37| 10.1M| } 38| | 39| | // reduction modulo y^96+y^10+y^9+y^6+1 40| | 41| 1.47M| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 1.47M|#define GFBITS 13 ------------------ | Branch (41:17): [True: 1.36M, False: 105k] ------------------ 42| 1.36M| p[i] = buf[i][2]; 43| | 44| 1.36M| buf[i][1] ^= p[i] >> (SYS_T - 10 - 64); ------------------ | | 8| 1.36M|#define SYS_T 96 ------------------ 45| 1.36M| buf[i][0] ^= p[i] << (64 - (SYS_T - 10 - 64)); ------------------ | | 8| 1.36M|#define SYS_T 96 ------------------ 46| 1.36M| buf[i][1] ^= p[i] >> (SYS_T - 9 - 64); ------------------ | | 8| 1.36M|#define SYS_T 96 ------------------ 47| 1.36M| buf[i][0] ^= p[i] << (64 - (SYS_T - 9 - 64)); ------------------ | | 8| 1.36M|#define SYS_T 96 ------------------ 48| 1.36M| buf[i][1] ^= p[i] >> (SYS_T - 6 - 64); ------------------ | | 8| 1.36M|#define SYS_T 96 ------------------ 49| 1.36M| buf[i][0] ^= p[i] << (64 - (SYS_T - 6 - 64)); ------------------ | | 8| 1.36M|#define SYS_T 96 ------------------ 50| 1.36M| buf[i][1] ^= p[i] >> (SYS_T - 64); ------------------ | | 8| 1.36M|#define SYS_T 96 ------------------ 51| 1.36M| buf[i][0] ^= p[i] << (64 - (SYS_T - 64)); ------------------ | | 8| 1.36M|#define SYS_T 96 ------------------ 52| 1.36M| } 53| | 54| | // 55| | 56| 1.47M| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 1.47M|#define GFBITS 13 ------------------ | Branch (56:17): [True: 1.36M, False: 105k] ------------------ 57| 1.36M| p[i] = buf[i][1] & (allone << 32); 58| | 59| 1.36M| buf[i][0] ^= p[i] >> (SYS_T - 10 - 64); ------------------ | | 8| 1.36M|#define SYS_T 96 ------------------ 60| 1.36M| buf[i][0] ^= p[i] >> (SYS_T - 9 - 64); ------------------ | | 8| 1.36M|#define SYS_T 96 ------------------ 61| 1.36M| buf[i][0] ^= p[i] >> (SYS_T - 6 - 64); ------------------ | | 8| 1.36M|#define SYS_T 96 ------------------ 62| 1.36M| buf[i][0] ^= p[i] >> (SYS_T - 64); ------------------ | | 8| 1.36M|#define SYS_T 96 ------------------ 63| 1.36M| } 64| | 65| | // 66| | 67| 1.47M| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 1.47M|#define GFBITS 13 ------------------ | Branch (67:17): [True: 1.36M, False: 105k] ------------------ 68| 1.36M| out[i] = vec128_set2x(buf[i][0], buf[i][1] & 0xFFFFFFFF); 69| 1.36M| } 70| 105k|} pk_gen.c:vec128_set2x: 46| 57.2k|static inline vec128 vec128_set2x(uint64_t a0, uint64_t a1) { 47| 57.2k| return _mm_set_epi64x(a1, a0); 48| 57.2k|} sk_gen.c:vec128_setzero: 25| 110k|static inline vec128 vec128_setzero(void) { 26| 110k| return _mm_setzero_si128(); 27| 110k|} sk_gen.c:vec128_xor: 35| 781M|static inline vec128 vec128_xor(vec128 a, vec128 b) { 36| 781M| return _mm_xor_si128(a, b); 37| 781M|} sk_gen.c:vec128_set2x: 46| 817M|static inline vec128 vec128_set2x(uint64_t a0, uint64_t a1) { 47| 817M| return _mm_set_epi64x(a1, a0); 48| 817M|} sk_gen.c:vec128_add: 70| 60.0M|static inline void vec128_add(vec128 *c, vec128 *a, vec128 *b) { 71| 60.0M| int i; 72| | 73| 841M| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 841M|#define GFBITS 13 ------------------ | Branch (73:17): [True: 781M, False: 60.0M] ------------------ 74| 781M| c[i] = vec128_xor(a[i], b[i]); 75| 781M| } 76| 60.0M|} sk_gen.c:vec128_mul: 93| 60.6M|static inline void vec128_mul(vec128 *h, vec128 *f, const vec128 *g) { 94| 60.6M| vec128_mul_asm(h, f, g, 16); ------------------ | | 10| 60.6M|#define vec128_mul_asm CRYPTO_NAMESPACE(vec128_mul_asm) | | ------------------ | | | | 4| 60.6M|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896_AVX2_ ## fun | | ------------------ ------------------ 95| 60.6M|} sk_gen.c:vec128_mul_gf: 97| 60.6M|static inline void vec128_mul_gf(vec128 out[ GFBITS ], vec128 v[ GFBITS ], gf a) { 98| 60.6M| int i; 99| | 100| 60.6M| uint64_t b; 101| 60.6M| vec128 bits[GFBITS]; 102| | 103| 848M| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 848M|#define GFBITS 13 ------------------ | Branch (103:17): [True: 787M, False: 60.6M] ------------------ 104| 787M| b = -((a >> i) & 1); 105| 787M| bits[i] = vec128_set2x(b, b); 106| 787M| } 107| | 108| 60.6M| vec128_mul(out, v, bits); 109| 60.6M|} vec128.c:vec128_mul_gf: 97| 60.0M|static inline void vec128_mul_gf(vec128 out[ GFBITS ], vec128 v[ GFBITS ], gf a) { 98| 60.0M| int i; 99| | 100| 60.0M| uint64_t b; 101| 60.0M| vec128 bits[GFBITS]; 102| | 103| 841M| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 841M|#define GFBITS 13 ------------------ | Branch (103:17): [True: 781M, False: 60.0M] ------------------ 104| 781M| b = -((a >> i) & 1); 105| 781M| bits[i] = vec128_set2x(b, b); 106| 781M| } 107| | 108| 60.0M| vec128_mul(out, v, bits); 109| 60.0M|} vec128.c:vec128_mul: 93| 60.0M|static inline void vec128_mul(vec128 *h, vec128 *f, const vec128 *g) { 94| 60.0M| vec128_mul_asm(h, f, g, 16); ------------------ | | 10| 60.0M|#define vec128_mul_asm CRYPTO_NAMESPACE(vec128_mul_asm) | | ------------------ | | | | 4| 60.0M|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896_AVX2_ ## fun | | ------------------ ------------------ 95| 60.0M|} vec128.c:vec128_set2x: 46| 787M|static inline vec128 vec128_set2x(uint64_t a0, uint64_t a1) { 47| 787M| return _mm_set_epi64x(a1, a0); 48| 787M|} fft.c:vec128_and: 31| 2.31M|static inline vec128 vec128_and(vec128 a, vec128 b) { 32| 2.31M| return _mm_and_si128(a, b); 33| 2.31M|} fft.c:vec128_xor: 35| 2.31M|static inline vec128 vec128_xor(vec128 a, vec128 b) { 36| 2.31M| return _mm_xor_si128(a, b); 37| 2.31M|} fft.c:vec128_set2x: 46| 1.21M|static inline vec128 vec128_set2x(uint64_t a0, uint64_t a1) { 47| 1.21M| return _mm_set_epi64x(a1, a0); 48| 1.21M|} fft.c:vec128_unpack_low: 50| 386k|static inline vec128 vec128_unpack_low(vec128 a, vec128 b) { 51| 386k| return _mm_unpacklo_epi64(a, b); 52| 386k|} fft.c:vec128_unpack_high: 54| 386k|static inline vec128 vec128_unpack_high(vec128 a, vec128 b) { 55| 386k| return _mm_unpackhi_epi64(a, b); 56| 386k|} fft.c:vec128_mul: 93| 53.5k|static inline void vec128_mul(vec128 *h, vec128 *f, const vec128 *g) { 94| 53.5k| vec128_mul_asm(h, f, g, 16); ------------------ | | 10| 53.5k|#define vec128_mul_asm CRYPTO_NAMESPACE(vec128_mul_asm) | | ------------------ | | | | 4| 53.5k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896_AVX2_ ## fun | | ------------------ ------------------ 95| 53.5k|} fft_tr.c:vec128_xor: 35| 100k|static inline vec128 vec128_xor(vec128 a, vec128 b) { 36| 100k| return _mm_xor_si128(a, b); 37| 100k|} fft_tr.c:vec128_setbits: 58| 120k|static inline vec128 vec128_setbits(uint64_t a) { 59| 120k| return _mm_set1_epi64x(-a); 60| 120k|} benes.c:vec128_and: 31| 1.23M|static inline vec128 vec128_and(vec128 a, vec128 b) { 32| 1.23M| return _mm_and_si128(a, b); 33| 1.23M|} benes.c:vec128_xor: 35| 3.69M|static inline vec128 vec128_xor(vec128 a, vec128 b) { 36| 3.69M| return _mm_xor_si128(a, b); 37| 3.69M|} benes.c:vec128_set2x: 46| 616k|static inline vec128 vec128_set2x(uint64_t a0, uint64_t a1) { 47| 616k| return _mm_set_epi64x(a1, a0); 48| 616k|} benes.c:vec128_unpack_low: 50| 344k|static inline vec128 vec128_unpack_low(vec128 a, vec128 b) { 51| 344k| return _mm_unpacklo_epi64(a, b); 52| 344k|} benes.c:vec128_unpack_high: 54| 344k|static inline vec128 vec128_unpack_high(vec128 a, vec128 b) { 55| 344k| return _mm_unpackhi_epi64(a, b); 56| 344k|} bm.c:vec128_xor: 35| 2.34M|static inline vec128 vec128_xor(vec128 a, vec128 b) { 36| 2.34M| return _mm_xor_si128(a, b); 37| 2.34M|} bm.c:vec128_set2x: 46| 6.46k|static inline vec128 vec128_set2x(uint64_t a0, uint64_t a1) { 47| 6.46k| return _mm_set_epi64x(a1, a0); 48| 6.46k|} bm.c:vec128_setbits: 58| 4.70M|static inline vec128 vec128_setbits(uint64_t a) { 59| 4.70M| return _mm_set1_epi64x(-a); 60| 4.70M|} PQCLEAN_MCELIECE460896_AVX2_vec256_sq: 9| 18.1k|void vec256_sq(vec256 *out, vec256 *in) { 10| 18.1k| int i; 11| 18.1k| vec256 result[GFBITS], t; 12| | 13| 18.1k| t = vec256_xor(in[11], in[12]); 14| | 15| 18.1k| result[0] = vec256_xor(in[0], in[11]); 16| 18.1k| result[1] = vec256_xor(in[7], t); 17| 18.1k| result[2] = vec256_xor(in[1], in[7]); 18| 18.1k| result[3] = vec256_xor(in[8], t); 19| 18.1k| result[4] = vec256_xor(in[2], in[7]); 20| 18.1k| result[4] = vec256_xor(result[4], in[8]); 21| 18.1k| result[4] = vec256_xor(result[4], t); 22| 18.1k| result[5] = vec256_xor(in[7], in[9]); 23| 18.1k| result[6] = vec256_xor(in[3], in[8]); 24| 18.1k| result[6] = vec256_xor(result[6], in[9]); 25| 18.1k| result[6] = vec256_xor(result[6], in[12]); 26| 18.1k| result[7] = vec256_xor(in[8], in[10]); 27| 18.1k| result[8] = vec256_xor(in[4], in[9]); 28| 18.1k| result[8] = vec256_xor(result[8], in[10]); 29| 18.1k| result[9] = vec256_xor(in[9], in[11]); 30| 18.1k| result[10] = vec256_xor(in[5], in[10]); 31| 18.1k| result[10] = vec256_xor(result[10], in[11]); 32| 18.1k| result[11] = vec256_xor(in[10], in[12]); 33| 18.1k| result[12] = vec256_xor(in[6], t); 34| | 35| 254k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 254k|#define GFBITS 13 ------------------ | Branch (35:17): [True: 236k, False: 18.1k] ------------------ 36| 236k| out[i] = result[i]; 37| 236k| } 38| 18.1k|} PQCLEAN_MCELIECE460896_AVX2_vec256_inv: 41| 1.22k|void vec256_inv(vec256 *out, vec256 *in) { 42| 1.22k| vec256 tmp_11[ GFBITS ]; 43| 1.22k| vec256 tmp_1111[ GFBITS ]; 44| | 45| 1.22k| vec256_copy(out, in); 46| | 47| 1.22k| vec256_sq(out, out); ------------------ | | 14| 1.22k|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 1.22k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896_AVX2_ ## fun | | ------------------ ------------------ 48| 1.22k| vec256_mul(tmp_11, out, in); // ^11 49| | 50| 1.22k| vec256_sq(out, tmp_11); ------------------ | | 14| 1.22k|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 1.22k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896_AVX2_ ## fun | | ------------------ ------------------ 51| 1.22k| vec256_sq(out, out); ------------------ | | 14| 1.22k|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 1.22k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896_AVX2_ ## fun | | ------------------ ------------------ 52| 1.22k| vec256_mul(tmp_1111, out, tmp_11); // ^1111 53| | 54| 1.22k| vec256_sq(out, tmp_1111); ------------------ | | 14| 1.22k|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 1.22k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896_AVX2_ ## fun | | ------------------ ------------------ 55| 1.22k| vec256_sq(out, out); ------------------ | | 14| 1.22k|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 1.22k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896_AVX2_ ## fun | | ------------------ ------------------ 56| 1.22k| vec256_sq(out, out); ------------------ | | 14| 1.22k|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 1.22k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896_AVX2_ ## fun | | ------------------ ------------------ 57| 1.22k| vec256_sq(out, out); ------------------ | | 14| 1.22k|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 1.22k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896_AVX2_ ## fun | | ------------------ ------------------ 58| 1.22k| vec256_mul(out, out, tmp_1111); // ^11111111 59| | 60| 1.22k| vec256_sq(out, out); ------------------ | | 14| 1.22k|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 1.22k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896_AVX2_ ## fun | | ------------------ ------------------ 61| 1.22k| vec256_sq(out, out); ------------------ | | 14| 1.22k|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 1.22k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896_AVX2_ ## fun | | ------------------ ------------------ 62| 1.22k| vec256_sq(out, out); ------------------ | | 14| 1.22k|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 1.22k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896_AVX2_ ## fun | | ------------------ ------------------ 63| 1.22k| vec256_sq(out, out); ------------------ | | 14| 1.22k|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 1.22k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896_AVX2_ ## fun | | ------------------ ------------------ 64| 1.22k| vec256_mul(out, out, tmp_1111); // ^111111111111 65| | 66| 1.22k| vec256_sq(out, out); // ^1111111111110 ------------------ | | 14| 1.22k|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 1.22k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896_AVX2_ ## fun | | ------------------ ------------------ 67| 1.22k|} vec256.c:vec256_xor: 49| 1.73M|static inline vec256 vec256_xor(vec256 a, vec256 b) { 50| 1.73M| return _mm256_xor_si256(a, b); 51| 1.73M|} decrypt.c:vec256_testz: 41| 770|static inline int vec256_testz(vec256 a) { 42| 770| return _mm256_testz_si256(a, a); 43| 770|} fft_tr.c:vec256_and: 45| 600k|static inline vec256 vec256_and(vec256 a, vec256 b) { 46| 600k| return _mm256_and_si256(a, b); 47| 600k|} bm.c:vec256_setzero: 30| 2.31k|static inline vec256 vec256_setzero(void) { 31| 2.31k| return _mm256_setzero_si256(); 32| 2.31k|} bm.c:vec256_set1_16b: 22| 6.16k|static inline vec256 vec256_set1_16b(uint16_t a) { 23| 6.16k| return _mm256_set1_epi16(a); 24| 6.16k|} bm.c:vec256_or: 53| 49.2k|static inline vec256 vec256_or(vec256 a, vec256 b) { 54| 49.2k| return _mm256_or_si256(a, b); 55| 49.2k|} bm.c:vec256_and: 45| 98.5k|static inline vec256 vec256_and(vec256 a, vec256 b) { 46| 98.5k| return _mm256_and_si256(a, b); 47| 98.5k|} bm.c:vec256_mul: 99| 180k|static inline void vec256_mul(vec256 *h, vec256 *f, const vec256 *g) { 100| 180k| vec256_mul_asm(h, f, g); ------------------ | | 13| 180k|#define vec256_mul_asm CRYPTO_NAMESPACE(vec256_mul_asm) | | ------------------ | | | | 4| 180k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896_AVX2_ ## fun | | ------------------ ------------------ 101| 180k|} gf.c:gf_sqmul: 85| 1.02M|static inline gf gf_sqmul(gf in, gf m) { 86| 1.02M| int i; 87| | 88| 1.02M| uint64_t x; 89| 1.02M| uint64_t t0; 90| 1.02M| uint64_t t1; 91| 1.02M| uint64_t t; 92| | 93| 1.02M| const uint64_t M[] = {0x0000001FF0000000, 94| 1.02M| 0x000000000FF80000, 95| 1.02M| 0x000000000007E000 96| 1.02M| }; 97| | 98| 1.02M| t0 = in; 99| 1.02M| t1 = m; 100| | 101| 1.02M| x = (t1 << 6) * (t0 & (1 << 6)); 102| | 103| 1.02M| t0 ^= (t0 << 7); 104| | 105| 1.02M| x ^= (t1 * (t0 & (0x04001))); 106| 1.02M| x ^= (t1 * (t0 & (0x08002))) << 1; 107| 1.02M| x ^= (t1 * (t0 & (0x10004))) << 2; 108| 1.02M| x ^= (t1 * (t0 & (0x20008))) << 3; 109| 1.02M| x ^= (t1 * (t0 & (0x40010))) << 4; 110| 1.02M| x ^= (t1 * (t0 & (0x80020))) << 5; 111| | 112| 4.11M| for (i = 0; i < 3; i++) { ------------------ | Branch (112:17): [True: 3.08M, False: 1.02M] ------------------ 113| 3.08M| t = x & M[i]; 114| 3.08M| x ^= (t >> 9) ^ (t >> 10) ^ (t >> 12) ^ (t >> 13); 115| 3.08M| } 116| | 117| 1.02M| return x & GFMASK; ------------------ | | 19| 1.02M|#define GFMASK ((1 << GFBITS) - 1) | | ------------------ | | | | 6| 1.02M|#define GFBITS 13 | | ------------------ ------------------ 118| 1.02M|} gf.c:gf_sq2mul: 122| 1.54M|static inline gf gf_sq2mul(gf in, gf m) { 123| 1.54M| int i; 124| | 125| 1.54M| uint64_t x; 126| 1.54M| uint64_t t0; 127| 1.54M| uint64_t t1; 128| 1.54M| uint64_t t; 129| | 130| 1.54M| const uint64_t M[] = {0x1FF0000000000000, 131| 1.54M| 0x000FF80000000000, 132| 1.54M| 0x000007FC00000000, 133| 1.54M| 0x00000003FE000000, 134| 1.54M| 0x0000000001FE0000, 135| 1.54M| 0x000000000001E000 136| 1.54M| }; 137| | 138| 1.54M| t0 = in; 139| 1.54M| t1 = m; 140| | 141| 1.54M| x = (t1 << 18) * (t0 & (1 << 6)); 142| | 143| 1.54M| t0 ^= (t0 << 21); 144| | 145| 1.54M| x ^= (t1 * (t0 & (0x010000001))); 146| 1.54M| x ^= (t1 * (t0 & (0x020000002))) << 3; 147| 1.54M| x ^= (t1 * (t0 & (0x040000004))) << 6; 148| 1.54M| x ^= (t1 * (t0 & (0x080000008))) << 9; 149| 1.54M| x ^= (t1 * (t0 & (0x100000010))) << 12; 150| 1.54M| x ^= (t1 * (t0 & (0x200000020))) << 15; 151| | 152| 10.7M| for (i = 0; i < 6; i++) { ------------------ | Branch (152:17): [True: 9.24M, False: 1.54M] ------------------ 153| 9.24M| t = x & M[i]; 154| 9.24M| x ^= (t >> 9) ^ (t >> 10) ^ (t >> 12) ^ (t >> 13); 155| 9.24M| } 156| | 157| 1.54M| return x & GFMASK; ------------------ | | 19| 1.54M|#define GFMASK ((1 << GFBITS) - 1) | | ------------------ | | | | 6| 1.54M|#define GFBITS 13 | | ------------------ ------------------ 158| 1.54M|} gf.c:gf_sq2: 52| 1.02M|static inline gf gf_sq2(gf in) { 53| 1.02M| int i; 54| | 55| 1.02M| const uint64_t B[] = {0x1111111111111111, 56| 1.02M| 0x0303030303030303, 57| 1.02M| 0x000F000F000F000F, 58| 1.02M| 0x000000FF000000FF 59| 1.02M| }; 60| | 61| 1.02M| const uint64_t M[] = {0x0001FF0000000000, 62| 1.02M| 0x000000FF80000000, 63| 1.02M| 0x000000007FC00000, 64| 1.02M| 0x00000000003FE000 65| 1.02M| }; 66| | 67| 1.02M| uint64_t x = in; 68| 1.02M| uint64_t t; 69| | 70| 1.02M| x = (x | (x << 24)) & B[3]; 71| 1.02M| x = (x | (x << 12)) & B[2]; 72| 1.02M| x = (x | (x << 6)) & B[1]; 73| 1.02M| x = (x | (x << 3)) & B[0]; 74| | 75| 5.13M| for (i = 0; i < 4; i++) { ------------------ | Branch (75:17): [True: 4.11M, False: 1.02M] ------------------ 76| 4.11M| t = x & M[i]; 77| 4.11M| x ^= (t >> 9) ^ (t >> 10) ^ (t >> 12) ^ (t >> 13); 78| 4.11M| } 79| | 80| 1.02M| return x & GFMASK; ------------------ | | 19| 1.02M|#define GFMASK ((1 << GFBITS) - 1) | | ------------------ | | | | 6| 1.02M|#define GFBITS 13 | | ------------------ ------------------ 81| 1.02M|} PQCLEAN_MCELIECE460896F_AVX2_load_bits: 188| 88|void load_bits(vec128 bits_int[][32], const unsigned char *bits) { 189| 88| int i, j; 190| 88| const unsigned char *ptr = bits; 191| | 192| 88| vec128 buf[64]; 193| | 194| 352| for (i = 0; i <= 5; i += 2) { ------------------ | Branch (194:17): [True: 264, False: 88] ------------------ 195| 17.1k| for (j = 0; j < 64; j++) { ------------------ | Branch (195:21): [True: 16.8k, False: 264] ------------------ 196| 16.8k| buf[j] = vec128_set2x(load8(ptr), load8(ptr + 512)); 197| 16.8k| ptr += 8; 198| 16.8k| } 199| | 200| 264| transpose_64x128_sp( buf ); 201| | 202| 8.71k| for (j = 0; j < 32; j++) { ------------------ | Branch (202:21): [True: 8.44k, False: 264] ------------------ 203| 8.44k| bits_int[i + 0][j] = vec128_unpack_low(buf[j], buf[j + 32]); 204| 8.44k| bits_int[i + 1][j] = vec128_unpack_high(buf[j], buf[j + 32]); 205| 8.44k| } 206| | 207| 264| ptr += 512; 208| 264| } 209| | 210| 1.23k| for (i = 6; i <= 18; i++) { ------------------ | Branch (210:17): [True: 1.14k, False: 88] ------------------ 211| 37.7k| for (j = 0; j < 32; j++) { ------------------ | Branch (211:21): [True: 36.6k, False: 1.14k] ------------------ 212| 36.6k| bits_int[i][j] = load16(ptr); 213| 36.6k| ptr += 16; 214| 36.6k| } 215| 1.14k| } 216| | 217| 352| for (i = 19; i < 25; i += 2) { ------------------ | Branch (217:18): [True: 264, False: 88] ------------------ 218| 17.1k| for (j = 0; j < 64; j++) { ------------------ | Branch (218:21): [True: 16.8k, False: 264] ------------------ 219| 16.8k| buf[j] = vec128_set2x(load8(ptr), load8(ptr + 512)); 220| 16.8k| ptr += 8; 221| 16.8k| } 222| | 223| 264| transpose_64x128_sp( buf ); 224| | 225| 8.71k| for (j = 0; j < 32; j++) { ------------------ | Branch (225:21): [True: 8.44k, False: 264] ------------------ 226| 8.44k| bits_int[i + 0][j] = vec128_unpack_low(buf[j], buf[j + 32]); 227| 8.44k| bits_int[i + 1][j] = vec128_unpack_high(buf[j], buf[j + 32]); 228| 8.44k| } 229| | 230| 264| ptr += 512; 231| 264| } 232| 88|} PQCLEAN_MCELIECE460896F_AVX2_benes: 238| 176|void benes(vec128 *r, vec128 b[][32], int rev) { 239| 176| int inc; 240| | 241| 176| vec128 *b_ptr; 242| | 243| 176| if (rev == 0) { ------------------ | Branch (243:9): [True: 88, False: 88] ------------------ 244| 88| inc = 32; 245| 88| b_ptr = b[ 0]; 246| 88| } else { 247| 88| inc = -32; 248| 88| b_ptr = b[24]; 249| 88| } 250| | 251| | // 252| | 253| 176| transpose_64x128_sp( r ); 254| | 255| 176| layer_0(r, b_ptr); 256| 176| b_ptr += inc; 257| 176| layer_1(r, b_ptr); 258| 176| b_ptr += inc; 259| 176| layer_2(r, b_ptr); 260| 176| b_ptr += inc; 261| 176| layer_3(r, b_ptr); 262| 176| b_ptr += inc; 263| 176| layer_4(r, b_ptr); 264| 176| b_ptr += inc; 265| 176| layer_5(r, b_ptr); 266| 176| b_ptr += inc; 267| | 268| 176| transpose_64x128_sp( r ); 269| | 270| 176| layer_x(r, b_ptr); 271| 176| b_ptr += inc; 272| 176| layer_0(r, b_ptr); 273| 176| b_ptr += inc; 274| 176| layer_1(r, b_ptr); 275| 176| b_ptr += inc; 276| 176| layer_2(r, b_ptr); 277| 176| b_ptr += inc; 278| 176| layer_3(r, b_ptr); 279| 176| b_ptr += inc; 280| 176| layer_4(r, b_ptr); 281| 176| b_ptr += inc; 282| 176| layer_5(r, b_ptr); 283| 176| b_ptr += inc; 284| 176| layer_4(r, b_ptr); 285| 176| b_ptr += inc; 286| 176| layer_3(r, b_ptr); 287| 176| b_ptr += inc; 288| 176| layer_2(r, b_ptr); 289| 176| b_ptr += inc; 290| 176| layer_1(r, b_ptr); 291| 176| b_ptr += inc; 292| 176| layer_0(r, b_ptr); 293| 176| b_ptr += inc; 294| 176| layer_x(r, b_ptr); 295| 176| b_ptr += inc; 296| | 297| 176| transpose_64x128_sp( r ); 298| | 299| 176| layer_5(r, b_ptr); 300| 176| b_ptr += inc; 301| 176| layer_4(r, b_ptr); 302| 176| b_ptr += inc; 303| 176| layer_3(r, b_ptr); 304| 176| b_ptr += inc; 305| 176| layer_2(r, b_ptr); 306| 176| b_ptr += inc; 307| 176| layer_1(r, b_ptr); 308| 176| b_ptr += inc; 309| 176| layer_0(r, b_ptr); 310| | 311| 176| transpose_64x128_sp( r ); 312| 176|} PQCLEAN_MCELIECE460896F_AVX2_bm: 147| 88|void bm(vec128 *out, vec256 *in) { 148| 88| int i; 149| 88| uint16_t N, L; 150| 88| uint16_t mask; 151| 88| uint64_t one = 1; 152| 88| uint64_t v[2]; 153| | 154| 88| typedef union { 155| 88| vec128 v[GFBITS][2]; 156| 88| vec256 V[GFBITS]; 157| 88| } db_t; 158| | 159| 88| vec128 prod[ GFBITS ]; 160| 88| vec128 interval[GFBITS]; 161| | 162| 88| db_t db; 163| 88| db_t BC_tmp; 164| 88| db_t BC; 165| | 166| 88| gf d, b; 167| 88| gf coefs[256]; 168| | 169| | // initialization 170| | 171| 88| get_coefs(coefs, in); 172| | 173| 88| BC.v[0][0] = vec128_set2x(0, one << 62); 174| 88| BC.v[0][1] = vec128_set2x(0, one << 63); 175| | 176| 1.14k| for (i = 1; i < GFBITS; i++) { ------------------ | | 6| 1.14k|#define GFBITS 13 ------------------ | Branch (176:17): [True: 1.05k, False: 88] ------------------ 177| 1.05k| BC.v[i][0] = BC.v[i][1] = vec128_setzero(); 178| 1.05k| } 179| | 180| 88| b = 1; 181| 88| L = 0; 182| | 183| | // 184| | 185| 1.23k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 1.23k|#define GFBITS 13 ------------------ | Branch (185:17): [True: 1.14k, False: 88] ------------------ 186| 1.14k| interval[i] = vec128_setzero(); 187| 1.14k| } 188| | 189| 16.9k| for (N = 0; N < SYS_T * 2; N++) { ------------------ | | 8| 16.9k|#define SYS_T 96 ------------------ | Branch (189:17): [True: 16.8k, False: 88] ------------------ 190| 16.8k| update_asm(interval, coefs[N], 16); ------------------ | | 1| 16.8k|#define update_asm CRYPTO_NAMESPACE(update_asm) | | ------------------ | | | | 4| 16.8k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896F_AVX2_ ## fun | | ------------------ ------------------ 191| 16.8k| vec128_mul_asm(prod, interval, BC.v[0] + 1, 32); ------------------ | | 10| 16.8k|#define vec128_mul_asm CRYPTO_NAMESPACE(vec128_mul_asm) | | ------------------ | | | | 4| 16.8k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896F_AVX2_ ## fun | | ------------------ ------------------ 192| | 193| 16.8k| d = vec_reduce_asm(prod); ------------------ | | 3| 16.8k|#define vec_reduce_asm CRYPTO_NAMESPACE(vec_reduce_asm) | | ------------------ | | | | 4| 16.8k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896F_AVX2_ ## fun | | ------------------ ------------------ 194| | 195| 16.8k| mask = mask_nonzero(d) & mask_leq(L * 2, N); 196| | 197| 236k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 236k|#define GFBITS 13 ------------------ | Branch (197:21): [True: 219k, False: 16.8k] ------------------ 198| 219k| db.v[i][0] = vec128_setbits((d >> i) & 1); 199| 219k| db.v[i][1] = vec128_setbits((b >> i) & 1); 200| 219k| } 201| | 202| 16.8k| vec256_mul((vec256 *)BC_tmp.V, (vec256 *)db.V, (vec256 *)BC.V); 203| | 204| 16.8k| vec128_cmov(BC.v, mask); 205| 16.8k| update_asm(BC.v, 0, 32); ------------------ | | 1| 16.8k|#define update_asm CRYPTO_NAMESPACE(update_asm) | | ------------------ | | | | 4| 16.8k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896F_AVX2_ ## fun | | ------------------ ------------------ 206| | 207| 236k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 236k|#define GFBITS 13 ------------------ | Branch (207:21): [True: 219k, False: 16.8k] ------------------ 208| 219k| BC.v[i][1] = vec128_xor(BC_tmp.v[i][0], BC_tmp.v[i][1]); 209| 219k| } 210| | 211| 16.8k| b = (d & mask) | (b & ~mask); 212| 16.8k| L = ((N + 1 - L) & mask) | (L & ~mask); 213| 16.8k| } 214| | 215| 1.23k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 1.23k|#define GFBITS 13 ------------------ | Branch (215:17): [True: 1.14k, False: 88] ------------------ 216| 1.14k| v[0] = vec128_extract(BC.v[i][1], 0); ------------------ | | 29| 1.14k|#define vec128_extract(a, i) ((uint64_t) _mm_extract_epi64((vec128) (a), (i))) ------------------ 217| 1.14k| v[1] = vec128_extract(BC.v[i][1], 1); ------------------ | | 29| 1.14k|#define vec128_extract(a, i) ((uint64_t) _mm_extract_epi64((vec128) (a), (i))) ------------------ 218| | 219| 1.14k| out[i] = vec128_set2x((v[0] >> 31) | (v[1] << 33), v[1] >> 31); 220| 1.14k| } 221| 88|} PQCLEAN_MCELIECE460896F_AVX2_controlbitsfrompermutation: 205| 88|void controlbitsfrompermutation(unsigned char *out, const int16 *pi, long long w, long long n) { 206| 88| PQCLEAN_VLA(int32, temp, (size_t)(2 * n)); ------------------ | | 57| 88|# define PQCLEAN_VLA(__t,__x,__s) __t __x[__s] ------------------ 207| 88| PQCLEAN_VLA(int16, pi_test, (size_t)n); ------------------ | | 57| 88|# define PQCLEAN_VLA(__t,__x,__s) __t __x[__s] ------------------ 208| 88| int16 diff; 209| 88| int i; 210| 88| unsigned char *ptr; 211| | 212| 88| OQS_MEM_cleanse(temp, (size_t)n * 2); 213| 88| OQS_MEM_cleanse(pi_test, (size_t)n); 214| | 215| 88| while (1) { ------------------ | Branch (215:12): [True: 88, Folded] ------------------ 216| 88| OQS_MEM_cleanse(out, (size_t)((((2 * w - 1)*n / 2) + 7) / 8)); 217| 88| cbrecursion(out, 0, 1, pi, w, n, temp); 218| | 219| | // check for correctness 220| | 221| 720k| for (i = 0; i < n; i++) { ------------------ | Branch (221:21): [True: 720k, False: 88] ------------------ 222| 720k| pi_test[i] = (int16)i; 223| 720k| } 224| | 225| 88| ptr = out; 226| 1.23k| for (i = 0; i < w; i++) { ------------------ | Branch (226:21): [True: 1.14k, False: 88] ------------------ 227| 1.14k| layer(pi_test, ptr, i, (int32)n); 228| 1.14k| ptr += n >> 4; 229| 1.14k| } 230| | 231| 1.14k| for (i = (int)(w - 2); i >= 0; i--) { ------------------ | Branch (231:32): [True: 1.05k, False: 88] ------------------ 232| 1.05k| layer(pi_test, ptr, i, (int32)n); 233| 1.05k| ptr += n >> 4; 234| 1.05k| } 235| | 236| 88| diff = 0; 237| 720k| for (i = 0; i < n; i++) { ------------------ | Branch (237:21): [True: 720k, False: 88] ------------------ 238| 720k| diff |= pi[i] ^ pi_test[i]; 239| 720k| } 240| | 241| 88| diff = crypto_int16_nonzero_mask(diff); ------------------ | | 12| 88|#define crypto_int16_nonzero_mask CRYPTO_NAMESPACE(crypto_int16_nonzero_mask) | | ------------------ | | | | 4| 88|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896F_AVX2_ ## fun | | ------------------ ------------------ 242| 88| crypto_declassify(&diff, sizeof diff); 243| 88| if (diff == 0) { ------------------ | Branch (243:13): [True: 88, False: 0] ------------------ 244| 88| break; 245| 88| } 246| 88| } 247| 88|} PQCLEAN_MCELIECE460896F_AVX2_crypto_int16_negative_mask: 3| 176|crypto_int16 crypto_int16_negative_mask(crypto_int16 crypto_int16_x) { 4| 176| return crypto_int16_x >> 15; 5| 176|} PQCLEAN_MCELIECE460896F_AVX2_crypto_int16_nonzero_mask: 7| 88|crypto_int16 crypto_int16_nonzero_mask(crypto_int16 crypto_int16_x) { 8| 88| return crypto_int16_negative_mask(crypto_int16_x) | crypto_int16_negative_mask(-crypto_int16_x); ------------------ | | 10| 88|#define crypto_int16_negative_mask CRYPTO_NAMESPACE(crypto_int16_negative_mask) | | ------------------ | | | | 4| 88|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896F_AVX2_ ## fun | | ------------------ ------------------ return crypto_int16_negative_mask(crypto_int16_x) | crypto_int16_negative_mask(-crypto_int16_x); ------------------ | | 10| 88|#define crypto_int16_negative_mask CRYPTO_NAMESPACE(crypto_int16_negative_mask) | | ------------------ | | | | 4| 88|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896F_AVX2_ ## fun | | ------------------ ------------------ 9| 88|} PQCLEAN_MCELIECE460896F_AVX2_crypto_int32_negative_mask: 3| 56.2M|crypto_int32 crypto_int32_negative_mask(crypto_int32 crypto_int32_x) { 4| 56.2M| return crypto_int32_x >> 31; 5| 56.2M|} PQCLEAN_MCELIECE460896F_AVX2_crypto_int32_min: 37| 56.2M|crypto_int32 crypto_int32_min(crypto_int32 crypto_int32_x, crypto_int32 crypto_int32_y) { 38| 56.2M| crypto_int32 crypto_int32_xy = crypto_int32_y ^ crypto_int32_x; 39| 56.2M| crypto_int32 crypto_int32_z = crypto_int32_y - crypto_int32_x; 40| 56.2M| crypto_int32_z ^= crypto_int32_xy & (crypto_int32_z ^ crypto_int32_y); 41| 56.2M| crypto_int32_z = crypto_int32_negative_mask(crypto_int32_z); ------------------ | | 9| 56.2M|#define crypto_int32_negative_mask CRYPTO_NAMESPACE(crypto_int32_negative_mask) | | ------------------ | | | | 4| 56.2M|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896F_AVX2_ ## fun | | ------------------ ------------------ 42| 56.2M| crypto_int32_z &= crypto_int32_xy; 43| 56.2M| return crypto_int32_x ^ crypto_int32_z; 44| 56.2M|} PQCLEAN_MCELIECE460896F_AVX2_crypto_uint16_signed_negative_mask: 3| 108k|crypto_uint16_signed crypto_uint16_signed_negative_mask(crypto_uint16_signed crypto_uint16_signed_x) { 4| 108k| return crypto_uint16_signed_x >> 15; 5| 108k|} PQCLEAN_MCELIECE460896F_AVX2_crypto_uint16_nonzero_mask: 7| 10.0k|crypto_uint16 crypto_uint16_nonzero_mask(crypto_uint16 crypto_uint16_x) { 8| 10.0k| return crypto_uint16_signed_negative_mask(crypto_uint16_x) | crypto_uint16_signed_negative_mask(-crypto_uint16_x); ------------------ | | 11| 10.0k|#define crypto_uint16_signed_negative_mask CRYPTO_NAMESPACE(crypto_uint16_signed_negative_mask) | | ------------------ | | | | 4| 10.0k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896F_AVX2_ ## fun | | ------------------ ------------------ return crypto_uint16_signed_negative_mask(crypto_uint16_x) | crypto_uint16_signed_negative_mask(-crypto_uint16_x); ------------------ | | 11| 10.0k|#define crypto_uint16_signed_negative_mask CRYPTO_NAMESPACE(crypto_uint16_signed_negative_mask) | | ------------------ | | | | 4| 10.0k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896F_AVX2_ ## fun | | ------------------ ------------------ 9| 10.0k|} PQCLEAN_MCELIECE460896F_AVX2_crypto_uint16_zero_mask: 11| 10.0k|crypto_uint16 crypto_uint16_zero_mask(crypto_uint16 crypto_uint16_x) { 12| 10.0k| return ~crypto_uint16_nonzero_mask(crypto_uint16_x); ------------------ | | 13| 10.0k|#define crypto_uint16_nonzero_mask CRYPTO_NAMESPACE(crypto_uint16_nonzero_mask) | | ------------------ | | | | 4| 10.0k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896F_AVX2_ ## fun | | ------------------ ------------------ 13| 10.0k|} PQCLEAN_MCELIECE460896F_AVX2_crypto_uint16_smaller_mask: 24| 88.5k|crypto_uint16 crypto_uint16_smaller_mask(crypto_uint16 crypto_uint16_x, crypto_uint16 crypto_uint16_y) { 25| 88.5k| crypto_uint16 crypto_uint16_xy = crypto_uint16_x ^ crypto_uint16_y; 26| 88.5k| crypto_uint16 crypto_uint16_z = crypto_uint16_x - crypto_uint16_y; 27| 88.5k| crypto_uint16_z ^= crypto_uint16_xy & (crypto_uint16_z ^ crypto_uint16_x ^ (((crypto_uint16) 1) << 15)); 28| 88.5k| return crypto_uint16_signed_negative_mask(crypto_uint16_z); ------------------ | | 11| 88.5k|#define crypto_uint16_signed_negative_mask CRYPTO_NAMESPACE(crypto_uint16_signed_negative_mask) | | ------------------ | | | | 4| 88.5k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896F_AVX2_ ## fun | | ------------------ ------------------ 29| 88.5k|} PQCLEAN_MCELIECE460896F_AVX2_crypto_uint32_signed_negative_mask: 3| 94.6k|crypto_uint32_signed crypto_uint32_signed_negative_mask(crypto_uint32_signed crypto_uint32_signed_x) { 4| 94.6k| return crypto_uint32_signed_x >> 31; 5| 94.6k|} PQCLEAN_MCELIECE460896F_AVX2_crypto_uint32_nonzero_mask: 7| 47.3k|crypto_uint32 crypto_uint32_nonzero_mask(crypto_uint32 crypto_uint32_x) { 8| 47.3k| return crypto_uint32_signed_negative_mask(crypto_uint32_x) | crypto_uint32_signed_negative_mask(-crypto_uint32_x); ------------------ | | 11| 47.3k|#define crypto_uint32_signed_negative_mask CRYPTO_NAMESPACE(crypto_uint32_signed_negative_mask) | | ------------------ | | | | 4| 47.3k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896F_AVX2_ ## fun | | ------------------ ------------------ return crypto_uint32_signed_negative_mask(crypto_uint32_x) | crypto_uint32_signed_negative_mask(-crypto_uint32_x); ------------------ | | 11| 47.3k|#define crypto_uint32_signed_negative_mask CRYPTO_NAMESPACE(crypto_uint32_signed_negative_mask) | | ------------------ | | | | 4| 47.3k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896F_AVX2_ ## fun | | ------------------ ------------------ 9| 47.3k|} PQCLEAN_MCELIECE460896F_AVX2_crypto_uint32_unequal_mask: 15| 47.3k|crypto_uint32 crypto_uint32_unequal_mask(crypto_uint32 crypto_uint32_x, crypto_uint32 crypto_uint32_y) { 16| 47.3k| crypto_uint32 crypto_uint32_xy = crypto_uint32_x ^ crypto_uint32_y; 17| 47.3k| return crypto_uint32_nonzero_mask(crypto_uint32_xy); ------------------ | | 13| 47.3k|#define crypto_uint32_nonzero_mask CRYPTO_NAMESPACE(crypto_uint32_nonzero_mask) | | ------------------ | | | | 4| 47.3k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896F_AVX2_ ## fun | | ------------------ ------------------ 18| 47.3k|} PQCLEAN_MCELIECE460896F_AVX2_crypto_uint32_equal_mask: 20| 47.3k|crypto_uint32 crypto_uint32_equal_mask(crypto_uint32 crypto_uint32_x, crypto_uint32 crypto_uint32_y) { 21| 47.3k| return ~crypto_uint32_unequal_mask(crypto_uint32_x, crypto_uint32_y); ------------------ | | 17| 47.3k|#define crypto_uint32_unequal_mask CRYPTO_NAMESPACE(crypto_uint32_unequal_mask) | | ------------------ | | | | 4| 47.3k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896F_AVX2_ ## fun | | ------------------ ------------------ 22| 47.3k|} PQCLEAN_MCELIECE460896F_AVX2_crypto_uint64_signed_negative_mask: 3| 1.78M|crypto_uint64_signed crypto_uint64_signed_negative_mask(crypto_uint64_signed crypto_uint64_signed_x) { 4| 1.78M| return crypto_uint64_signed_x >> 63; 5| 1.78M|} PQCLEAN_MCELIECE460896F_AVX2_crypto_uint64_nonzero_mask: 7| 892k|crypto_uint64 crypto_uint64_nonzero_mask(crypto_uint64 crypto_uint64_x) { 8| 892k| return crypto_uint64_signed_negative_mask(crypto_uint64_x) | crypto_uint64_signed_negative_mask(-crypto_uint64_x); ------------------ | | 11| 892k|#define crypto_uint64_signed_negative_mask CRYPTO_NAMESPACE(crypto_uint64_signed_negative_mask) | | ------------------ | | | | 4| 892k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896F_AVX2_ ## fun | | ------------------ ------------------ return crypto_uint64_signed_negative_mask(crypto_uint64_x) | crypto_uint64_signed_negative_mask(-crypto_uint64_x); ------------------ | | 11| 892k|#define crypto_uint64_signed_negative_mask CRYPTO_NAMESPACE(crypto_uint64_signed_negative_mask) | | ------------------ | | | | 4| 892k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896F_AVX2_ ## fun | | ------------------ ------------------ 9| 892k|} PQCLEAN_MCELIECE460896F_AVX2_crypto_uint64_zero_mask: 11| 112k|crypto_uint64 crypto_uint64_zero_mask(crypto_uint64 crypto_uint64_x) { 12| 112k| return ~crypto_uint64_nonzero_mask(crypto_uint64_x); ------------------ | | 13| 112k|#define crypto_uint64_nonzero_mask CRYPTO_NAMESPACE(crypto_uint64_nonzero_mask) | | ------------------ | | | | 4| 112k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896F_AVX2_ ## fun | | ------------------ ------------------ 13| 112k|} PQCLEAN_MCELIECE460896F_AVX2_crypto_uint64_unequal_mask: 15| 779k|crypto_uint64 crypto_uint64_unequal_mask(crypto_uint64 crypto_uint64_x, crypto_uint64 crypto_uint64_y) { 16| 779k| crypto_uint64 crypto_uint64_xy = crypto_uint64_x ^ crypto_uint64_y; 17| 779k| return crypto_uint64_nonzero_mask(crypto_uint64_xy); ------------------ | | 13| 779k|#define crypto_uint64_nonzero_mask CRYPTO_NAMESPACE(crypto_uint64_nonzero_mask) | | ------------------ | | | | 4| 779k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896F_AVX2_ ## fun | | ------------------ ------------------ 18| 779k|} PQCLEAN_MCELIECE460896F_AVX2_crypto_uint64_equal_mask: 20| 779k|crypto_uint64 crypto_uint64_equal_mask(crypto_uint64 crypto_uint64_x, crypto_uint64 crypto_uint64_y) { 21| 779k| return ~crypto_uint64_unequal_mask(crypto_uint64_x, crypto_uint64_y); ------------------ | | 17| 779k|#define crypto_uint64_unequal_mask CRYPTO_NAMESPACE(crypto_uint64_unequal_mask) | | ------------------ | | | | 4| 779k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896F_AVX2_ ## fun | | ------------------ ------------------ 22| 779k|} PQCLEAN_MCELIECE460896F_AVX2_decrypt: 171| 88|int decrypt(unsigned char *e, const unsigned char *sk, const unsigned char *s) { 172| 88| int i; 173| | 174| 88| uint16_t check_synd; 175| 88| uint16_t check_weight; 176| | 177| 88| vec256 inv[ 32 ][ GFBITS ]; 178| 88| vec256 scaled[ 32 ][ GFBITS ]; 179| 88| vec256 eval[32][ GFBITS ]; 180| | 181| 88| vec128 error128[ 64 ]; 182| 88| vec256 error256[ 32 ]; 183| | 184| 88| vec256 s_priv[ GFBITS ]; 185| 88| vec256 s_priv_cmp[ GFBITS ]; 186| 88| vec128 locator[ GFBITS ]; 187| | 188| 88| vec128 recv128[ 64 ]; 189| 88| vec256 recv256[ 32 ]; 190| 88| vec256 allone; 191| | 192| 88| vec128 bits_int[25][32]; 193| | 194| | // Berlekamp decoder 195| | 196| 88| preprocess(recv128, s); 197| | 198| 88| load_bits(bits_int, sk + IRR_BYTES); ------------------ | | 10| 88|#define load_bits CRYPTO_NAMESPACE(load_bits) | | ------------------ | | | | 4| 88|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896F_AVX2_ ## fun | | ------------------ ------------------ load_bits(bits_int, sk + IRR_BYTES); ------------------ | | 11| 88|#define IRR_BYTES (SYS_T * 2) | | ------------------ | | | | 8| 88|#define SYS_T 96 | | ------------------ ------------------ 199| 88| benes(recv128, bits_int, 1); ------------------ | | 9| 88|#define benes CRYPTO_NAMESPACE(benes) | | ------------------ | | | | 4| 88|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896F_AVX2_ ## fun | | ------------------ ------------------ 200| | 201| 88| reformat_128to256(recv256, recv128); 202| | 203| 88| scaling(scaled, inv, sk, recv256); 204| 88| fft_tr(s_priv, scaled); ------------------ | | 9| 88|#define fft_tr CRYPTO_NAMESPACE(fft_tr) | | ------------------ | | | | 4| 88|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896F_AVX2_ ## fun | | ------------------ ------------------ 205| 88| bm(locator, s_priv); ------------------ | | 10| 88|#define bm CRYPTO_NAMESPACE(bm) | | ------------------ | | | | 4| 88|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896F_AVX2_ ## fun | | ------------------ ------------------ 206| | 207| 88| fft(eval, locator); ------------------ | | 10| 88|#define fft CRYPTO_NAMESPACE(fft) | | ------------------ | | | | 4| 88|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896F_AVX2_ ## fun | | ------------------ ------------------ 208| | 209| | // reencryption and weight check 210| | 211| 88| allone = vec256_set1_16b(0xFFFF); 212| | 213| 2.90k| for (i = 0; i < 32; i++) { ------------------ | Branch (213:17): [True: 2.81k, False: 88] ------------------ 214| 2.81k| error256[i] = vec256_or_reduce(eval[i]); 215| 2.81k| error256[i] = vec256_xor(error256[i], allone); 216| 2.81k| } 217| | 218| 88| scaling_inv(scaled, inv, error256); 219| 88| fft_tr(s_priv_cmp, scaled); ------------------ | | 9| 88|#define fft_tr CRYPTO_NAMESPACE(fft_tr) | | ------------------ | | | | 4| 88|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896F_AVX2_ ## fun | | ------------------ ------------------ 220| | 221| 88| check_synd = synd_cmp(s_priv, s_priv_cmp); 222| | 223| | // 224| | 225| 88| reformat_256to128(error128, error256); 226| 88| benes(error128, bits_int, 0); ------------------ | | 9| 88|#define benes CRYPTO_NAMESPACE(benes) | | ------------------ | | | | 4| 88|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896F_AVX2_ ## fun | | ------------------ ------------------ 227| | 228| 88| postprocess(e, error128); 229| | 230| 88| check_weight = weight_check(e, error128); 231| | 232| 88| return 1 - (check_synd & check_weight); 233| 88|} PQCLEAN_MCELIECE460896F_AVX2_encrypt: 112| 88|void encrypt(unsigned char *s, const unsigned char *pk, unsigned char *e) { 113| 88| gen_e(e); 114| | 115| 88| syndrome_asm(s, pk, e); ------------------ | | 1| 88|#define syndrome_asm CRYPTO_NAMESPACE(syndrome_asm) | | ------------------ | | | | 4| 88|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896F_AVX2_ ## fun | | ------------------ ------------------ 116| 88|} PQCLEAN_MCELIECE460896F_AVX2_fft: 265| 281|void fft(vec256 out[][GFBITS], vec128 *in) { 266| 281| radix_conversions(in); 267| 281| butterflies(out, in); 268| 281|} PQCLEAN_MCELIECE460896F_AVX2_fft_tr: 397| 176|void fft_tr(vec256 *out, vec256 in[][ GFBITS ]) { 398| 176| butterflies_tr(out, in); 399| 176| radix_conversions_tr(out); 400| | 401| 176| postprocess(out); 402| 176|} PQCLEAN_MCELIECE460896F_AVX2_gf_mul: 20| 967k|gf gf_mul(gf in0, gf in1) { 21| 967k| int i; 22| | 23| 967k| uint64_t tmp; 24| 967k| uint64_t t0; 25| 967k| uint64_t t1; 26| 967k| uint64_t t; 27| | 28| 967k| t0 = in0; 29| 967k| t1 = in1; 30| | 31| 967k| tmp = t0 * (t1 & 1); 32| | 33| 12.5M| for (i = 1; i < GFBITS; i++) { ------------------ | | 6| 12.5M|#define GFBITS 13 ------------------ | Branch (33:17): [True: 11.6M, False: 967k] ------------------ 34| 11.6M| tmp ^= (t0 * (t1 & (1 << i))); 35| 11.6M| } 36| | 37| | // 38| | 39| 967k| t = tmp & 0x1FF0000; 40| 967k| tmp ^= (t >> 9) ^ (t >> 10) ^ (t >> 12) ^ (t >> 13); 41| | 42| 967k| t = tmp & 0x000E000; 43| 967k| tmp ^= (t >> 9) ^ (t >> 10) ^ (t >> 12) ^ (t >> 13); 44| | 45| 967k| return tmp & GFMASK; ------------------ | | 19| 967k|#define GFMASK ((1 << GFBITS) - 1) | | ------------------ | | | | 6| 967k|#define GFBITS 13 | | ------------------ ------------------ 46| 967k|} PQCLEAN_MCELIECE460896F_AVX2_gf_frac: 156| 10.0k|gf gf_frac(gf den, gf num) { 157| 10.0k| gf tmp_11; 158| 10.0k| gf tmp_1111; 159| 10.0k| gf out; 160| | 161| 10.0k| tmp_11 = gf_sqmul(den, den); // ^11 162| 10.0k| tmp_1111 = gf_sq2mul(tmp_11, tmp_11); // ^1111 163| 10.0k| out = gf_sq2(tmp_1111); 164| 10.0k| out = gf_sq2mul(out, tmp_1111); // ^11111111 165| 10.0k| out = gf_sq2(out); 166| 10.0k| out = gf_sq2mul(out, tmp_1111); // ^111111111111 167| | 168| 10.0k| return gf_sqmul(out, num); // ^1111111111110 = ^-1 169| 10.0k|} PQCLEAN_MCELIECE460896F_AVX2_gf_inv: 172| 10.0k|gf gf_inv(gf den) { 173| 10.0k| return gf_frac(den, ((gf) 1)); ------------------ | | 10| 10.0k|#define gf_frac CRYPTO_NAMESPACE(gf_frac) | | ------------------ | | | | 4| 10.0k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896F_AVX2_ ## fun | | ------------------ ------------------ 174| 10.0k|} pk_gen.c:PQCLEAN_MCELIECE460896F_AVX2_int32_sort: 21| 88|static void int32_sort(int32_t *x, long long n) { 22| 88| long long top, p, q, r, i; 23| | 24| 88| if (n < 2) { ------------------ | Branch (24:9): [True: 0, False: 88] ------------------ 25| 0| return; 26| 0| } 27| 88| top = 1; 28| 968| while (top < n - top) { ------------------ | Branch (28:12): [True: 880, False: 88] ------------------ 29| 880| top += top; 30| 880| } 31| | 32| 1.05k| for (p = top; p > 0; p >>= 1) { ------------------ | Branch (32:19): [True: 968, False: 88] ------------------ 33| 1.02M| for (i = 0; i < n - p; ++i) { ------------------ | Branch (33:21): [True: 1.02M, False: 968] ------------------ 34| 1.02M| if (!(i & p)) { ------------------ | Branch (34:17): [True: 544k, False: 483k] ------------------ 35| 544k| int32_MINMAX(x[i], x[i + p]); ------------------ | | 11| 544k| do { \ | | 12| 544k| int32_t ab = (b) ^ (a); \ | | 13| 544k| int32_t c = (b) - (a); \ | | 14| 544k| c ^= ab & ((c) ^ (b)); \ | | 15| 544k| c >>= 31; \ | | 16| 544k| c &= ab; \ | | 17| 544k| (a) ^= c; \ | | 18| 544k| (b) ^= c; \ | | 19| 544k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 544k] | | ------------------ ------------------ 36| 544k| } 37| 1.02M| } 38| 968| i = 0; 39| 5.80k| for (q = top; q > p; q >>= 1) { ------------------ | Branch (39:23): [True: 4.84k, False: 968] ------------------ 40| 923k| for (; i < n - q; ++i) { ------------------ | Branch (40:20): [True: 918k, False: 4.84k] ------------------ 41| 918k| if (!(i & p)) { ------------------ | Branch (41:21): [True: 483k, False: 435k] ------------------ 42| 483k| int32_t a = x[i + p]; 43| 2.73M| for (r = q; r > p; r >>= 1) { ------------------ | Branch (43:33): [True: 2.25M, False: 483k] ------------------ 44| 2.25M| int32_MINMAX(a, x[i + r]); ------------------ | | 11| 2.25M| do { \ | | 12| 2.25M| int32_t ab = (b) ^ (a); \ | | 13| 2.25M| int32_t c = (b) - (a); \ | | 14| 2.25M| c ^= ab & ((c) ^ (b)); \ | | 15| 2.25M| c >>= 31; \ | | 16| 2.25M| c &= ab; \ | | 17| 2.25M| (a) ^= c; \ | | 18| 2.25M| (b) ^= c; \ | | 19| 2.25M| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 2.25M] | | ------------------ ------------------ 45| 2.25M| } 46| 483k| x[i + p] = a; 47| 483k| } 48| 918k| } 49| 4.84k| } 50| 968| } 51| 88|} controlbits.c:PQCLEAN_MCELIECE460896F_AVX2_int32_sort: 21| 2.88M|static void int32_sort(int32_t *x, long long n) { 22| 2.88M| long long top, p, q, r, i; 23| | 24| 2.88M| if (n < 2) { ------------------ | Branch (24:9): [True: 0, False: 2.88M] ------------------ 25| 0| return; 26| 0| } 27| 2.88M| top = 1; 28| 10.1M| while (top < n - top) { ------------------ | Branch (28:12): [True: 7.22M, False: 2.88M] ------------------ 29| 7.22M| top += top; 30| 7.22M| } 31| | 32| 12.9M| for (p = top; p > 0; p >>= 1) { ------------------ | Branch (32:19): [True: 10.1M, False: 2.88M] ------------------ 33| 1.39G| for (i = 0; i < n - p; ++i) { ------------------ | Branch (33:21): [True: 1.38G, False: 10.1M] ------------------ 34| 1.38G| if (!(i & p)) { ------------------ | Branch (34:17): [True: 772M, False: 608M] ------------------ 35| 772M| int32_MINMAX(x[i], x[i + p]); ------------------ | | 11| 772M| do { \ | | 12| 772M| int32_t ab = (b) ^ (a); \ | | 13| 772M| int32_t c = (b) - (a); \ | | 14| 772M| c ^= ab & ((c) ^ (b)); \ | | 15| 772M| c >>= 31; \ | | 16| 772M| c &= ab; \ | | 17| 772M| (a) ^= c; \ | | 18| 772M| (b) ^= c; \ | | 19| 772M| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 772M] | | ------------------ ------------------ 36| 772M| } 37| 1.38G| } 38| 10.1M| i = 0; 39| 27.4M| for (q = top; q > p; q >>= 1) { ------------------ | Branch (39:23): [True: 17.3M, False: 10.1M] ------------------ 40| 1.23G| for (; i < n - q; ++i) { ------------------ | Branch (40:20): [True: 1.21G, False: 17.3M] ------------------ 41| 1.21G| if (!(i & p)) { ------------------ | Branch (41:21): [True: 608M, False: 608M] ------------------ 42| 608M| int32_t a = x[i + p]; 43| 3.60G| for (r = q; r > p; r >>= 1) { ------------------ | Branch (43:33): [True: 2.99G, False: 608M] ------------------ 44| 2.99G| int32_MINMAX(a, x[i + r]); ------------------ | | 11| 2.99G| do { \ | | 12| 2.99G| int32_t ab = (b) ^ (a); \ | | 13| 2.99G| int32_t c = (b) - (a); \ | | 14| 2.99G| c ^= ab & ((c) ^ (b)); \ | | 15| 2.99G| c >>= 31; \ | | 16| 2.99G| c &= ab; \ | | 17| 2.99G| (a) ^= c; \ | | 18| 2.99G| (b) ^= c; \ | | 19| 2.99G| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 2.99G] | | ------------------ ------------------ 45| 2.99G| } 46| 608M| x[i + p] = a; 47| 608M| } 48| 1.21G| } 49| 17.3M| } 50| 10.1M| } 51| 2.88M|} encrypt.c:PQCLEAN_MCELIECE460896F_AVX2_int32_sort: 21| 498|static void int32_sort(int32_t *x, long long n) { 22| 498| long long top, p, q, r, i; 23| | 24| 498| if (n < 2) { ------------------ | Branch (24:9): [True: 0, False: 498] ------------------ 25| 0| return; 26| 0| } 27| 498| top = 1; 28| 3.48k| while (top < n - top) { ------------------ | Branch (28:12): [True: 2.98k, False: 498] ------------------ 29| 2.98k| top += top; 30| 2.98k| } 31| | 32| 3.98k| for (p = top; p > 0; p >>= 1) { ------------------ | Branch (32:19): [True: 3.48k, False: 498] ------------------ 33| 274k| for (i = 0; i < n - p; ++i) { ------------------ | Branch (33:21): [True: 271k, False: 3.48k] ------------------ 34| 271k| if (!(i & p)) { ------------------ | Branch (34:17): [True: 151k, False: 120k] ------------------ 35| 151k| int32_MINMAX(x[i], x[i + p]); ------------------ | | 11| 151k| do { \ | | 12| 151k| int32_t ab = (b) ^ (a); \ | | 13| 151k| int32_t c = (b) - (a); \ | | 14| 151k| c ^= ab & ((c) ^ (b)); \ | | 15| 151k| c >>= 31; \ | | 16| 151k| c &= ab; \ | | 17| 151k| (a) ^= c; \ | | 18| 151k| (b) ^= c; \ | | 19| 151k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 151k] | | ------------------ ------------------ 36| 151k| } 37| 271k| } 38| 3.48k| i = 0; 39| 13.9k| for (q = top; q > p; q >>= 1) { ------------------ | Branch (39:23): [True: 10.4k, False: 3.48k] ------------------ 40| 234k| for (; i < n - q; ++i) { ------------------ | Branch (40:20): [True: 224k, False: 10.4k] ------------------ 41| 224k| if (!(i & p)) { ------------------ | Branch (41:21): [True: 120k, False: 104k] ------------------ 42| 120k| int32_t a = x[i + p]; 43| 470k| for (r = q; r > p; r >>= 1) { ------------------ | Branch (43:33): [True: 350k, False: 120k] ------------------ 44| 350k| int32_MINMAX(a, x[i + r]); ------------------ | | 11| 350k| do { \ | | 12| 350k| int32_t ab = (b) ^ (a); \ | | 13| 350k| int32_t c = (b) - (a); \ | | 14| 350k| c ^= ab & ((c) ^ (b)); \ | | 15| 350k| c >>= 31; \ | | 16| 350k| c &= ab; \ | | 17| 350k| (a) ^= c; \ | | 18| 350k| (b) ^= c; \ | | 19| 350k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 350k] | | ------------------ ------------------ 45| 350k| } 46| 120k| x[i + p] = a; 47| 120k| } 48| 224k| } 49| 10.4k| } 50| 3.48k| } 51| 498|} PQCLEAN_MCELIECE460896F_AVX2_crypto_kem_enc: 22| 88|) { 23| 88| unsigned char e[ SYS_N / 8 ]; 24| 88| unsigned char one_ec[ 1 + SYS_N / 8 + SYND_BYTES ] = {1}; 25| | 26| | // 27| | 28| 88| encrypt(c, pk, e); ------------------ | | 9| 88|#define encrypt CRYPTO_NAMESPACE(encrypt) | | ------------------ | | | | 4| 88|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896F_AVX2_ ## fun | | ------------------ ------------------ 29| | 30| 88| memcpy(one_ec + 1, e, SYS_N / 8); ------------------ | | 7| 88|#define SYS_N 4608 ------------------ 31| 88| memcpy(one_ec + 1 + SYS_N / 8, c, SYND_BYTES); ------------------ | | 7| 88|#define SYS_N 4608 ------------------ memcpy(one_ec + 1 + SYS_N / 8, c, SYND_BYTES); ------------------ | | 17| 88|#define SYND_BYTES ((PK_NROWS + 7)/8) | | ------------------ | | | | 13| 88|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 88|#define SYS_T 96 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 88|#define GFBITS 13 | | | | ------------------ | | ------------------ ------------------ 32| | 33| 88| crypto_hash_32b(key, one_ec, sizeof(one_ec)); ------------------ | | 7| 88| shake256(out, 32, in, inlen) | | ------------------ | | | | 12| 88|#define shake256 OQS_SHA3_shake256 | | ------------------ ------------------ 34| | 35| 88| return 0; 36| 88|} PQCLEAN_MCELIECE460896F_AVX2_crypto_kem_dec: 42| 88|) { 43| 88| int i; 44| | 45| 88| unsigned char ret_decrypt = 0; 46| | 47| 88| uint16_t m; 48| | 49| 88| unsigned char e[ SYS_N / 8 ]; 50| 88| unsigned char preimage[ 1 + SYS_N / 8 + SYND_BYTES ]; 51| 88| unsigned char *x = preimage; 52| 88| const unsigned char *s = sk + 40 + IRR_BYTES + COND_BYTES; ------------------ | | 11| 88|#define IRR_BYTES (SYS_T * 2) | | ------------------ | | | | 8| 88|#define SYS_T 96 | | ------------------ ------------------ const unsigned char *s = sk + 40 + IRR_BYTES + COND_BYTES; ------------------ | | 10| 88|#define COND_BYTES ((1 << (GFBITS-4))*(2*GFBITS - 1)) | | ------------------ | | | | 6| 88|#define GFBITS 13 | | ------------------ | | #define COND_BYTES ((1 << (GFBITS-4))*(2*GFBITS - 1)) | | ------------------ | | | | 6| 88|#define GFBITS 13 | | ------------------ ------------------ 53| | 54| | // 55| | 56| 88| ret_decrypt = (unsigned char)decrypt(e, sk + 40, c); ------------------ | | 9| 88|#define decrypt CRYPTO_NAMESPACE(decrypt) | | ------------------ | | | | 4| 88|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896F_AVX2_ ## fun | | ------------------ ------------------ 57| | 58| 88| m = ret_decrypt; 59| 88| m -= 1; 60| 88| m >>= 8; 61| | 62| 88| *x++ = m & 1; 63| 50.7k| for (i = 0; i < SYS_N / 8; i++) { ------------------ | | 7| 50.7k|#define SYS_N 4608 ------------------ | Branch (63:17): [True: 50.6k, False: 88] ------------------ 64| 50.6k| *x++ = (~m & s[i]) | (m & e[i]); 65| 50.6k| } 66| | 67| 13.8k| for (i = 0; i < SYND_BYTES; i++) { ------------------ | | 17| 13.8k|#define SYND_BYTES ((PK_NROWS + 7)/8) | | ------------------ | | | | 13| 13.8k|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 13.8k|#define SYS_T 96 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 13.8k|#define GFBITS 13 | | | | ------------------ | | ------------------ ------------------ | Branch (67:17): [True: 13.7k, False: 88] ------------------ 68| 13.7k| *x++ = c[i]; 69| 13.7k| } 70| | 71| 88| crypto_hash_32b(key, preimage, sizeof(preimage)); ------------------ | | 7| 88| shake256(out, 32, in, inlen) | | ------------------ | | | | 12| 88|#define shake256 OQS_SHA3_shake256 | | ------------------ ------------------ 72| | 73| 88| return 0; 74| 88|} PQCLEAN_MCELIECE460896F_AVX2_crypto_kem_keypair: 80| 88|) { 81| 88| int i; 82| 88| unsigned char seed[ 33 ] = {64}; 83| 88| unsigned char r[ SYS_N / 8 + (1 << GFBITS)*sizeof(uint32_t) + SYS_T * 2 + 32 ]; 84| 88| unsigned char *rp, *skp; 85| 88| uint64_t pivots; 86| | 87| 88| gf f[ SYS_T ]; // element in GF(2^mt) 88| 88| gf irr[ SYS_T ]; // Goppa polynomial 89| 88| uint32_t perm[ 1 << GFBITS ]; // random permutation as 32-bit integers 90| 88| int16_t pi[ 1 << GFBITS ]; // random permutation 91| | 92| 88| randombytes(seed + 1, 32); ------------------ | | 8| 88|#define randombytes OQS_randombytes ------------------ 93| | 94| 105| while (1) { ------------------ | Branch (94:12): [True: 105, Folded] ------------------ 95| 105| rp = &r[ sizeof(r) - 32 ]; 96| 105| skp = sk; 97| | 98| | // expanding and updating the seed 99| | 100| 105| shake(r, sizeof(r), seed, 33); ------------------ | | 10| 105| shake256(out, outlen, in, inlen) | | ------------------ | | | | 12| 105|#define shake256 OQS_SHA3_shake256 | | ------------------ ------------------ 101| 105| memcpy(skp, seed + 1, 32); 102| 105| skp += 32 + 8; 103| 105| memcpy(seed + 1, &r[ sizeof(r) - 32 ], 32); 104| | 105| | // generating irreducible polynomial 106| | 107| 105| rp -= sizeof(f); 108| | 109| 10.1k| for (i = 0; i < SYS_T; i++) { ------------------ | | 8| 10.1k|#define SYS_T 96 ------------------ | Branch (109:21): [True: 10.0k, False: 105] ------------------ 110| 10.0k| f[i] = load_gf(rp + i * 2); 111| 10.0k| } 112| | 113| 105| if (genpoly_gen(irr, f)) { ------------------ | | 9| 105|#define genpoly_gen CRYPTO_NAMESPACE(genpoly_gen) | | ------------------ | | | | 4| 105|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896F_AVX2_ ## fun | | ------------------ ------------------ | Branch (113:13): [True: 0, False: 105] ------------------ 114| 0| continue; 115| 0| } 116| | 117| 10.1k| for (i = 0; i < SYS_T; i++) { ------------------ | | 8| 10.1k|#define SYS_T 96 ------------------ | Branch (117:21): [True: 10.0k, False: 105] ------------------ 118| 10.0k| store_gf(skp + i * 2, irr[i]); 119| 10.0k| } 120| | 121| 105| skp += IRR_BYTES; ------------------ | | 11| 105|#define IRR_BYTES (SYS_T * 2) | | ------------------ | | | | 8| 105|#define SYS_T 96 | | ------------------ ------------------ 122| | 123| | // generating permutation 124| | 125| 105| rp -= sizeof(perm); 126| | 127| 860k| for (i = 0; i < (1 << GFBITS); i++) { ------------------ | | 6| 860k|#define GFBITS 13 ------------------ | Branch (127:21): [True: 860k, False: 105] ------------------ 128| 860k| perm[i] = load4(rp + i * 4); 129| 860k| } 130| | 131| 105| if (pk_gen(pk, skp - IRR_BYTES, perm, pi, &pivots)) { ------------------ | | 9| 105|#define pk_gen CRYPTO_NAMESPACE(pk_gen) | | ------------------ | | | | 4| 105|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896F_AVX2_ ## fun | | ------------------ ------------------ if (pk_gen(pk, skp - IRR_BYTES, perm, pi, &pivots)) { ------------------ | | 11| 105|#define IRR_BYTES (SYS_T * 2) | | ------------------ | | | | 8| 105|#define SYS_T 96 | | ------------------ ------------------ | Branch (131:13): [True: 17, False: 88] ------------------ 132| 17| continue; 133| 17| } 134| | 135| 88| controlbitsfrompermutation(skp, pi, GFBITS, 1 << GFBITS); ------------------ | | 10| 88|#define controlbitsfrompermutation CRYPTO_NAMESPACE(controlbitsfrompermutation) | | ------------------ | | | | 4| 88|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896F_AVX2_ ## fun | | ------------------ ------------------ controlbitsfrompermutation(skp, pi, GFBITS, 1 << GFBITS); ------------------ | | 6| 88|#define GFBITS 13 ------------------ controlbitsfrompermutation(skp, pi, GFBITS, 1 << GFBITS); ------------------ | | 6| 88|#define GFBITS 13 ------------------ 136| 88| skp += COND_BYTES; ------------------ | | 10| 88|#define COND_BYTES ((1 << (GFBITS-4))*(2*GFBITS - 1)) | | ------------------ | | | | 6| 88|#define GFBITS 13 | | ------------------ | | #define COND_BYTES ((1 << (GFBITS-4))*(2*GFBITS - 1)) | | ------------------ | | | | 6| 88|#define GFBITS 13 | | ------------------ ------------------ 137| | 138| | // storing the random string s 139| | 140| 88| rp -= SYS_N / 8; ------------------ | | 7| 88|#define SYS_N 4608 ------------------ 141| 88| memcpy(skp, rp, SYS_N / 8); ------------------ | | 7| 88|#define SYS_N 4608 ------------------ 142| | 143| | // storing positions of the 32 pivots 144| | 145| 88| store8(sk + 32, pivots); 146| | 147| 88| break; 148| 105| } 149| | 150| 88| return 0; 151| 88|} PQCLEAN_MCELIECE460896F_AVX2_pk_gen: 312| 105|int pk_gen(unsigned char *pk, const unsigned char *irr, const uint32_t *perm, int16_t *pi, uint64_t *pivots) { 313| 105| int i, j, k, b; 314| 105| int row, c; 315| | 316| 105| union { 317| 105| uint64_t w[ PK_NROWS ][ nBlocks_I * 4 ]; 318| 105| vec256 v[ PK_NROWS ][ nBlocks_I ]; 319| 105| } mat; 320| | 321| 105| union { 322| 105| uint64_t w[ PK_NROWS ][ 28 ]; 323| 105| vec256 v[ PK_NROWS ][ 7 ]; 324| 105| } par; 325| | 326| 105| uint64_t one = 1; 327| 105| uint64_t t; 328| 105| uint16_t m; 329| 105| vec256 mm; 330| | 331| 105| vec128 sk_int[ GFBITS ]; 332| | 333| 105| vec256 consts[ 32 ][ GFBITS ]; 334| 105| vec256 eval[ 32 ][ GFBITS ]; 335| 105| vec256 prod[ 32 ][ GFBITS ]; 336| 105| vec256 tmp[ GFBITS ]; 337| | 338| 105| uint64_t list[1 << GFBITS]; 339| | 340| 105| uint16_t ind[ PK_NROWS ]; 341| 105| uint16_t ind_inv[ PK_NROWS ]; 342| | 343| | // compute the inverses 344| | 345| 105| irr_load(sk_int, irr); 346| | 347| 105| fft(eval, sk_int); ------------------ | | 10| 105|#define fft CRYPTO_NAMESPACE(fft) | | ------------------ | | | | 4| 105|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896F_AVX2_ ## fun | | ------------------ ------------------ 348| | 349| 105| vec256_copy(prod[0], eval[0]); 350| | 351| 3.36k| for (i = 1; i < 32; i++) { ------------------ | Branch (351:17): [True: 3.25k, False: 105] ------------------ 352| 3.25k| vec256_mul(prod[i], prod[i - 1], eval[i]); 353| 3.25k| } 354| | 355| 105| vec256_inv(tmp, prod[31]); ------------------ | | 11| 105|#define vec256_inv CRYPTO_NAMESPACE(vec256_inv) | | ------------------ | | | | 4| 105|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896F_AVX2_ ## fun | | ------------------ ------------------ 356| | 357| 3.36k| for (i = 30; i >= 0; i--) { ------------------ | Branch (357:18): [True: 3.25k, False: 105] ------------------ 358| 3.25k| vec256_mul(prod[i + 1], prod[i], tmp); 359| 3.25k| vec256_mul(tmp, tmp, eval[i + 1]); 360| 3.25k| } 361| | 362| 105| vec256_copy(prod[0], tmp); 363| | 364| | // fill matrix 365| | 366| 105| de_bitslicing(list, prod); 367| | 368| 860k| for (i = 0; i < (1 << GFBITS); i++) { ------------------ | | 6| 860k|#define GFBITS 13 ------------------ | Branch (368:17): [True: 860k, False: 105] ------------------ 369| 860k| list[i] <<= GFBITS; ------------------ | | 6| 860k|#define GFBITS 13 ------------------ 370| 860k| list[i] |= i; 371| 860k| list[i] |= ((uint64_t) perm[i]) << 31; 372| 860k| } 373| | 374| 105| uint64_sort(list, 1 << GFBITS); ------------------ | | 6| 105|#define GFBITS 13 ------------------ 375| | 376| 779k| for (i = 1; i < (1 << GFBITS); i++) { ------------------ | | 6| 779k|#define GFBITS 13 ------------------ | Branch (376:17): [True: 779k, False: 88] ------------------ 377| 779k| if (uint64_is_equal_declassify(list[i - 1] >> 31, list[i] >> 31)) { ------------------ | Branch (377:13): [True: 17, False: 779k] ------------------ 378| 17| return -1; 379| 17| } 380| 779k| } 381| | 382| 88| to_bitslicing_2x(consts, prod, list); 383| | 384| 720k| for (i = 0; i < (1 << GFBITS); i++) { ------------------ | | 6| 720k|#define GFBITS 13 ------------------ | Branch (384:17): [True: 720k, False: 88] ------------------ 385| 720k| pi[i] = list[i] & GFMASK; ------------------ | | 19| 720k|#define GFMASK ((1 << GFBITS) - 1) | | ------------------ | | | | 6| 720k|#define GFBITS 13 | | ------------------ ------------------ 386| 720k| } 387| | 388| 528| for (j = 0; j < nBlocks_I; j++) { ------------------ | | 32| 528|#define nBlocks_I ((PK_NROWS + 255) / 256) | | ------------------ | | | | 13| 528|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 528|#define SYS_T 96 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 528|#define GFBITS 13 | | | | ------------------ | | ------------------ ------------------ | Branch (388:17): [True: 440, False: 88] ------------------ 389| 6.16k| for (k = 0; k < GFBITS; k++) { ------------------ | | 6| 6.16k|#define GFBITS 13 ------------------ | Branch (389:21): [True: 5.72k, False: 440] ------------------ 390| 5.72k| mat.v[ k ][ j ] = prod[ j ][ k ]; 391| 5.72k| } 392| 440| } 393| | 394| 8.44k| for (i = 1; i < SYS_T; i++) { ------------------ | | 8| 8.44k|#define SYS_T 96 ------------------ | Branch (394:17): [True: 8.36k, False: 88] ------------------ 395| 50.1k| for (j = 0; j < nBlocks_I; j++) { ------------------ | | 32| 50.1k|#define nBlocks_I ((PK_NROWS + 255) / 256) | | ------------------ | | | | 13| 50.1k|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 50.1k|#define SYS_T 96 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 50.1k|#define GFBITS 13 | | | | ------------------ | | ------------------ ------------------ | Branch (395:21): [True: 41.8k, False: 8.36k] ------------------ 396| 41.8k| vec256_mul(prod[j], prod[j], consts[j]); 397| | 398| 585k| for (k = 0; k < GFBITS; k++) { ------------------ | | 6| 585k|#define GFBITS 13 ------------------ | Branch (398:25): [True: 543k, False: 41.8k] ------------------ 399| 543k| mat.v[ i * GFBITS + k ][ j ] = prod[ j ][ k ]; ------------------ | | 6| 543k|#define GFBITS 13 ------------------ 400| 543k| } 401| 41.8k| } 402| 8.36k| } 403| | 404| | // gaussian elimination to obtain L, U, and P such that LP M = U 405| | // L and U are stored in the space of M 406| | // P is stored in ind 407| | 408| 109k| for (i = 0; i < PK_NROWS; i++) { ------------------ | | 13| 109k|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 109k|#define SYS_T 96 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 109k|#define GFBITS 13 | | ------------------ ------------------ | Branch (408:17): [True: 109k, False: 88] ------------------ 409| 109k| ind_inv[i] = ind[ i ] = i; 410| 109k| } 411| | 412| 109k| for (row = 0; row < PK_NROWS; row++) { ------------------ | | 13| 109k|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 109k|#define SYS_T 96 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 109k|#define GFBITS 13 | | ------------------ ------------------ | Branch (412:19): [True: 109k, False: 88] ------------------ 413| 109k| i = row >> 6; 414| 109k| j = row & 63; 415| | 416| 109k| if (row == PK_NROWS - 32) { ------------------ | | 13| 109k|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 109k|#define SYS_T 96 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 109k|#define GFBITS 13 | | ------------------ ------------------ | Branch (416:13): [True: 88, False: 109k] ------------------ 417| 88| if (mov_columns(mat.w, pi, pivots)) { ------------------ | Branch (417:17): [True: 0, False: 88] ------------------ 418| 0| return -1; 419| 0| } 420| 88| } 421| | 422| 68.5M| for (k = row + 1; k < PK_NROWS; k++) { ------------------ | | 13| 68.5M|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 68.5M|#define SYS_T 96 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 68.5M|#define GFBITS 13 | | ------------------ ------------------ | Branch (422:27): [True: 68.4M, False: 109k] ------------------ 423| 68.4M| extract_01_masks(&m, mat.w[ row ], mat.w[ k ], row); 424| 68.4M| uint16_cswap(&ind[row], &ind[k], m); 425| | 426| 68.4M| mm = vec256_set1_16b(m); 427| 410M| for (c = 0; c < nBlocks_I; c++) { ------------------ | | 32| 410M|#define nBlocks_I ((PK_NROWS + 255) / 256) | | ------------------ | | | | 13| 410M|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 410M|#define SYS_T 96 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 410M|#define GFBITS 13 | | | | ------------------ | | ------------------ ------------------ | Branch (427:25): [True: 342M, False: 68.4M] ------------------ 428| 342M| vec256_cswap(&mat.v[ row ][ c ], &mat.v[ k ][ c ], mm); 429| 342M| } 430| 68.4M| } 431| | 432| 109k| if ( uint64_is_zero_declassify((mat.w[ row ][ i ] >> j) & 1) ) { // return if not systematic ------------------ | Branch (432:14): [True: 0, False: 109k] ------------------ 433| 0| return -1; 434| 0| } 435| | 436| 68.5M| for (k = row + 1; k < PK_NROWS; k++) { ------------------ | | 13| 68.5M|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 68.5M|#define SYS_T 96 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 68.5M|#define GFBITS 13 | | ------------------ ------------------ | Branch (436:27): [True: 68.4M, False: 109k] ------------------ 437| 68.4M| t = mat.w[ k ][ i ] & (one << j); 438| 68.4M| mm = extract_mask256(mat.w[k], row); 439| | 440| 410M| for (c = 0; c < nBlocks_I; c++) { ------------------ | | 32| 410M|#define nBlocks_I ((PK_NROWS + 255) / 256) | | ------------------ | | | | 13| 410M|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 410M|#define SYS_T 96 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 410M|#define GFBITS 13 | | | | ------------------ | | ------------------ ------------------ | Branch (440:25): [True: 342M, False: 68.4M] ------------------ 441| 342M| mat.v[ k ][ c ] ^= mat.v[ row ][ c ] & mm; 442| 342M| } 443| | 444| 68.4M| mat.w[ k ][ i ] |= t; 445| 68.4M| } 446| 109k| } 447| | 448| | // apply M^-1 to the remaining columns 449| | 450| 88| composeinv(PK_NROWS, ind_inv, ind_inv, ind); ------------------ | | 13| 88|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 88|#define SYS_T 96 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 88|#define GFBITS 13 | | ------------------ ------------------ 451| | 452| 264| for (j = 4; j < 18; j += par_width) { ------------------ | | 33| 176|#define par_width 7 ------------------ | Branch (452:17): [True: 176, False: 88] ------------------ 453| 2.46k| for (k = 0; k < GFBITS; k++) { ------------------ | | 6| 2.46k|#define GFBITS 13 ------------------ | Branch (453:21): [True: 2.28k, False: 176] ------------------ 454| 18.3k| for (b = 0; b < par_width; b++) { ------------------ | | 33| 18.3k|#define par_width 7 ------------------ | Branch (454:25): [True: 16.0k, False: 2.28k] ------------------ 455| 16.0k| par.v[ k ][ b ] = prod[ j + b ][ k ]; 456| 16.0k| } 457| 2.28k| } 458| | 459| 16.8k| for (i = 1; i < SYS_T; i++) { ------------------ | | 8| 16.8k|#define SYS_T 96 ------------------ | Branch (459:21): [True: 16.7k, False: 176] ------------------ 460| 133k| for (b = 0; b < par_width; b++) { ------------------ | | 33| 133k|#define par_width 7 ------------------ | Branch (460:25): [True: 117k, False: 16.7k] ------------------ 461| 117k| vec256_mul(prod[j + b], prod[j + b], consts[j + b]); 462| 117k| } 463| | 464| 234k| for (k = 0; k < GFBITS; k++) { ------------------ | | 6| 234k|#define GFBITS 13 ------------------ | Branch (464:25): [True: 217k, False: 16.7k] ------------------ 465| 1.73M| for (b = 0; b < par_width; b++) { ------------------ | | 33| 1.73M|#define par_width 7 ------------------ | Branch (465:29): [True: 1.52M, False: 217k] ------------------ 466| 1.52M| par.v[ i * GFBITS + k ][ b ] = prod[ j + b ][ k ]; ------------------ | | 6| 1.52M|#define GFBITS 13 ------------------ 467| 1.52M| } 468| 217k| } 469| 16.7k| } 470| | 471| | // apply P 472| | 473| 219k| for (i = 0; i < PK_NROWS; i++) { ------------------ | | 13| 219k|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 219k|#define SYS_T 96 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 219k|#define GFBITS 13 | | ------------------ ------------------ | Branch (473:21): [True: 219k, False: 176] ------------------ 474| 219k| ind[i] = ind_inv[i]; 475| 219k| } 476| | 477| 176| sort_rows((1 << GFBITS) / 4, PK_NROWS, ind, par.v, 0); ------------------ | | 6| 176|#define GFBITS 13 ------------------ sort_rows((1 << GFBITS) / 4, PK_NROWS, ind, par.v, 0); ------------------ | | 13| 176|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 176|#define SYS_T 96 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 176|#define GFBITS 13 | | ------------------ ------------------ 478| | 479| | // apply L 480| | 481| 219k| for (row = PK_NROWS - 1; row >= 0; row--) { ------------------ | | 13| 176|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 176|#define SYS_T 96 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 176|#define GFBITS 13 | | ------------------ ------------------ | Branch (481:34): [True: 219k, False: 176] ------------------ 482| 137M| for (i = row - 1; i >= 0; i--) { ------------------ | Branch (482:31): [True: 136M, False: 219k] ------------------ 483| 136M| mm = extract_mask256(mat.w[row], i); 484| | 485| 1.09G| for (k = 0; k < par_width; k++) { ------------------ | | 33| 1.09G|#define par_width 7 ------------------ | Branch (485:29): [True: 958M, False: 136M] ------------------ 486| 958M| par.v[ row ][ k ] ^= par.v[ i ][ k ] & mm; 487| 958M| } 488| 136M| } 489| 219k| } 490| | 491| | // apply U^-1 492| | 493| 176| if (j == 4) { ------------------ | Branch (493:13): [True: 88, False: 88] ------------------ 494| 109k| for (i = 0; i < PK_NROWS; i++) { ------------------ | | 13| 109k|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 109k|#define SYS_T 96 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 109k|#define GFBITS 13 | | ------------------ ------------------ | Branch (494:25): [True: 109k, False: 88] ------------------ 495| 109k| par.v[i][0] = mat.v[i][ nBlocks_I - 1 ]; ------------------ | | 32| 109k|#define nBlocks_I ((PK_NROWS + 255) / 256) | | ------------------ | | | | 13| 109k|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 109k|#define SYS_T 96 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 109k|#define GFBITS 13 | | | | ------------------ | | ------------------ ------------------ 496| 109k| } 497| 88| } 498| | 499| 219k| for (row = PK_NROWS - 1; row >= 0; row--) { ------------------ | | 13| 176|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 176|#define SYS_T 96 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 176|#define GFBITS 13 | | ------------------ ------------------ | Branch (499:34): [True: 219k, False: 176] ------------------ 500| 137M| for (i = PK_NROWS - 1; i > row; i--) { ------------------ | | 13| 219k|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 219k|#define SYS_T 96 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 219k|#define GFBITS 13 | | ------------------ ------------------ | Branch (500:36): [True: 136M, False: 219k] ------------------ 501| 136M| mm = extract_mask256(mat.w[row], i); 502| | 503| 1.09G| for (k = 0; k < par_width; k++) { ------------------ | | 33| 1.09G|#define par_width 7 ------------------ | Branch (503:29): [True: 958M, False: 136M] ------------------ 504| 958M| par.v[ row ][ k ] ^= par.v[ i ][ k ] & mm; 505| 958M| } 506| 136M| } 507| 219k| } 508| | 509| 176| if (j == 4) { ------------------ | Branch (509:13): [True: 88, False: 88] ------------------ 510| 109k| for (row = 0; row < PK_NROWS; row++) { ------------------ | | 13| 109k|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 109k|#define SYS_T 96 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 109k|#define GFBITS 13 | | ------------------ ------------------ | Branch (510:27): [True: 109k, False: 88] ------------------ 511| 109k| k = 3; 512| 109k| store_i(pk + PK_ROW_BYTES * row + j * 32 + k * 8 + 4 - 13 * 12, par.w[row][k] >> 32, 4); ------------------ | | 15| 109k|#define PK_ROW_BYTES ((PK_NCOLS + 7)/8) | | ------------------ | | | | 14| 109k|#define PK_NCOLS (SYS_N - PK_NROWS) | | | | ------------------ | | | | | | 7| 109k|#define SYS_N 4608 | | | | ------------------ | | | | #define PK_NCOLS (SYS_N - PK_NROWS) | | | | ------------------ | | | | | | 13| 109k|#define PK_NROWS (SYS_T*GFBITS) | | | | | | ------------------ | | | | | | | | 8| 109k|#define SYS_T 96 | | | | | | ------------------ | | | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | | | ------------------ | | | | | | | | 6| 109k|#define GFBITS 13 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 513| | 514| 2.74M| for (k = 4; k < 28; k++) { ------------------ | Branch (514:29): [True: 2.63M, False: 109k] ------------------ 515| 2.63M| store8(pk + PK_ROW_BYTES * row + j * 32 + k * 8 - 13 * 12, par.w[row][k]); ------------------ | | 15| 2.63M|#define PK_ROW_BYTES ((PK_NCOLS + 7)/8) | | ------------------ | | | | 14| 2.63M|#define PK_NCOLS (SYS_N - PK_NROWS) | | | | ------------------ | | | | | | 7| 2.63M|#define SYS_N 4608 | | | | ------------------ | | | | #define PK_NCOLS (SYS_N - PK_NROWS) | | | | ------------------ | | | | | | 13| 2.63M|#define PK_NROWS (SYS_T*GFBITS) | | | | | | ------------------ | | | | | | | | 8| 2.63M|#define SYS_T 96 | | | | | | ------------------ | | | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | | | ------------------ | | | | | | | | 6| 2.63M|#define GFBITS 13 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 516| 2.63M| } 517| 109k| } 518| 88| } else { 519| 109k| for (row = 0; row < PK_NROWS; row++) { ------------------ | | 13| 109k|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 109k|#define SYS_T 96 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 109k|#define GFBITS 13 | | ------------------ ------------------ | Branch (519:27): [True: 109k, False: 88] ------------------ 520| 3.18M| for (k = 0; k < 28; k++) { ------------------ | Branch (520:29): [True: 3.07M, False: 109k] ------------------ 521| 3.07M| store8(pk + PK_ROW_BYTES * row + j * 32 + k * 8 - 13 * 12, par.w[row][k]); ------------------ | | 15| 3.07M|#define PK_ROW_BYTES ((PK_NCOLS + 7)/8) | | ------------------ | | | | 14| 3.07M|#define PK_NCOLS (SYS_N - PK_NROWS) | | | | ------------------ | | | | | | 7| 3.07M|#define SYS_N 4608 | | | | ------------------ | | | | #define PK_NCOLS (SYS_N - PK_NROWS) | | | | ------------------ | | | | | | 13| 3.07M|#define PK_NROWS (SYS_T*GFBITS) | | | | | | ------------------ | | | | | | | | 8| 3.07M|#define SYS_T 96 | | | | | | ------------------ | | | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | | | ------------------ | | | | | | | | 6| 3.07M|#define GFBITS 13 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 522| 3.07M| } 523| 109k| } 524| 88| } 525| 176| } 526| | 527| | // 528| | 529| 88| return 0; 530| 88|} PQCLEAN_MCELIECE460896F_AVX2_genpoly_gen: 88| 105|int genpoly_gen(gf *out, gf *f) { 89| 105| int i, j, k; 90| | 91| 105| gf t, inv; 92| | 93| 105| uint64_t m; 94| 105| vec128 mask; 95| | 96| 105| union { 97| 105| uint64_t d[ GFBITS ][ 128 ][2]; 98| 105| vec128 v[ GFBITS ][ 128 ]; 99| 105| } buf; 100| | 101| 105| union { 102| 105| uint64_t d[GFBITS][2]; 103| 105| vec128 v[GFBITS]; 104| 105| } v; 105| | 106| 105| union { 107| 105| uint64_t d[SYS_T][GFBITS][2]; 108| 105| vec128 v[SYS_T][GFBITS]; 109| 105| } mat; 110| | 111| | // fill matrix 112| | 113| 105| buf.v[0][0] = vec128_set2x(1, 0); 114| 1.36k| for (i = 1; i < GFBITS; i++) { ------------------ | | 6| 1.36k|#define GFBITS 13 ------------------ | Branch (114:17): [True: 1.26k, False: 105] ------------------ 115| 1.26k| buf.v[i][0] = vec128_setzero(); 116| 1.26k| } 117| | 118| 1.47k| for (j = 0; j < GFBITS; j++) { ------------------ | | 6| 1.47k|#define GFBITS 13 ------------------ | Branch (118:17): [True: 1.36k, False: 105] ------------------ 119| 1.36k| v.v[j] = vec128_setzero(); 120| | 121| 132k| for (i = SYS_T - 1; i >= 0; i--) { ------------------ | | 8| 1.36k|#define SYS_T 96 ------------------ | Branch (121:29): [True: 131k, False: 1.36k] ------------------ 122| 131k| v.d[j][1] <<= 1; 123| 131k| v.d[j][1] |= v.d[j][0] >> 63; 124| 131k| v.d[j][0] <<= 1; 125| 131k| v.d[j][0] |= (f[i] >> j) & 1; 126| 131k| } 127| 1.36k| } 128| | 129| 1.47k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 1.47k|#define GFBITS 13 ------------------ | Branch (129:17): [True: 1.36k, False: 105] ------------------ 130| 1.36k| buf.v[i][1] = v.v[i]; 131| 1.36k| } 132| | 133| 10.0k| for (k = 2; k <= SYS_T; k++) { ------------------ | | 8| 10.0k|#define SYS_T 96 ------------------ | Branch (133:17): [True: 9.97k, False: 105] ------------------ 134| 9.97k| vec128_mul_GF(v.v, v.v, f); ------------------ | | 11| 9.97k|#define vec128_mul_GF CRYPTO_NAMESPACE(vec128_mul_GF) | | ------------------ | | | | 4| 9.97k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896F_AVX2_ ## fun | | ------------------ ------------------ 135| | 136| 9.97k| if (k < SYS_T) { ------------------ | | 8| 9.97k|#define SYS_T 96 ------------------ | Branch (136:13): [True: 9.87k, False: 105] ------------------ 137| 138k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 138k|#define GFBITS 13 ------------------ | Branch (137:25): [True: 128k, False: 9.87k] ------------------ 138| 128k| buf.v[i][k] = v.v[i]; 139| 128k| } 140| 9.87k| } else { 141| 10.1k| for (i = 0; i < SYS_T; i++) { ------------------ | | 8| 10.1k|#define SYS_T 96 ------------------ | Branch (141:25): [True: 10.0k, False: 105] ------------------ 142| 10.0k| out[i] = extract_gf(v.d, i); 143| 10.0k| } 144| 105| } 145| 9.97k| } 146| | 147| 1.47k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 1.47k|#define GFBITS 13 ------------------ | Branch (147:17): [True: 1.36k, False: 105] ------------------ 148| 1.36k| transpose_128x128(buf.d[i]); 149| 1.36k| } 150| | 151| 10.1k| for (j = 0; j < SYS_T; j++) { ------------------ | | 8| 10.1k|#define SYS_T 96 ------------------ | Branch (151:17): [True: 10.0k, False: 105] ------------------ 152| 141k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 141k|#define GFBITS 13 ------------------ | Branch (152:21): [True: 131k, False: 10.0k] ------------------ 153| 131k| mat.v[j][i] = buf.v[i][j]; 154| 131k| } 155| 10.0k| } 156| | 157| | // gaussian 158| | 159| 10.1k| for (i = 0; i < SYS_T; i++) { ------------------ | | 8| 10.1k|#define SYS_T 96 ------------------ | Branch (159:17): [True: 10.0k, False: 105] ------------------ 160| 488k| for (j = i + 1; j < SYS_T; j++) { ------------------ | | 8| 488k|#define SYS_T 96 ------------------ | Branch (160:25): [True: 478k, False: 10.0k] ------------------ 161| 478k| m = extract_bit(mat.d[i], i); 162| 478k| m -= 1; 163| 478k| mask = vec128_set2x(m, m); 164| | 165| 6.70M| for (k = 0; k < GFBITS; k++) { ------------------ | | 6| 6.70M|#define GFBITS 13 ------------------ | Branch (165:25): [True: 6.22M, False: 478k] ------------------ 166| 6.22M| mat.v[i][k] ^= mat.v[j][k] & mask; 167| 6.22M| } 168| | 169| 478k| out[i] ^= out[j] & m; 170| 478k| } 171| | 172| | // 173| | 174| 10.0k| t = extract_gf(mat.d[i], i); 175| | 176| 10.0k| if (gf_is_zero_declassify(t)) { ------------------ | Branch (176:13): [True: 0, False: 10.0k] ------------------ 177| 0| return -1; // return if not systematic 178| 0| } 179| | 180| | // 181| | 182| 10.0k| inv = gf_inv(t); ------------------ | | 11| 10.0k|#define gf_inv CRYPTO_NAMESPACE(gf_inv) | | ------------------ | | | | 4| 10.0k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896F_AVX2_ ## fun | | ------------------ ------------------ 183| 10.0k| vec128_mul_gf(mat.v[i], mat.v[i], inv); 184| | 185| 10.0k| out[i] = gf_mul(out[i], inv); ------------------ | | 14| 10.0k|#define gf_mul CRYPTO_NAMESPACE(gf_mul) | | ------------------ | | | | 4| 10.0k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896F_AVX2_ ## fun | | ------------------ ------------------ 186| | 187| 977k| for (j = 0; j < SYS_T; j++) { ------------------ | | 8| 977k|#define SYS_T 96 ------------------ | Branch (187:21): [True: 967k, False: 10.0k] ------------------ 188| 967k| if (j != i) { ------------------ | Branch (188:17): [True: 957k, False: 10.0k] ------------------ 189| 957k| t = extract_gf(mat.d[j], i); 190| | 191| 957k| vec128_mul_gf(v.v, mat.v[i], t); 192| 957k| vec128_add(mat.v[j], mat.v[j], v.v); 193| | 194| 957k| out[j] ^= gf_mul(out[i], t); ------------------ | | 14| 957k|#define gf_mul CRYPTO_NAMESPACE(gf_mul) | | ------------------ | | | | 4| 957k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896F_AVX2_ ## fun | | ------------------ ------------------ 195| 957k| } 196| 967k| } 197| 10.0k| } 198| | 199| 105| return 0; 200| 105|} PQCLEAN_MCELIECE460896F_AVX2_vec128_mul_GF: 6| 9.97k|void vec128_mul_GF(vec128 out[ GFBITS ], vec128 v[ GFBITS ], gf a[ SYS_T ]) { 7| 9.97k| int i, j; 8| 9.97k| uint64_t buf[GFBITS][3]; 9| 9.97k| vec128 prod[GFBITS]; 10| 9.97k| uint64_t p[GFBITS]; 11| | 12| 9.97k| const uint64_t allone = -1; 13| | 14| | // polynomial multiplication 15| | 16| 139k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 139k|#define GFBITS 13 ------------------ | Branch (16:17): [True: 129k, False: 9.97k] ------------------ 17| 129k| buf[i][0] = 0; 18| 129k| buf[i][1] = 0; 19| 129k| buf[i][2] = 0; 20| 129k| } 21| | 22| 967k| for (i = SYS_T - 1; i >= 0; i--) { ------------------ | | 8| 9.97k|#define SYS_T 96 ------------------ | Branch (22:25): [True: 957k, False: 9.97k] ------------------ 23| 13.4M| for (j = 0; j < GFBITS; j++) { ------------------ | | 6| 13.4M|#define GFBITS 13 ------------------ | Branch (23:21): [True: 12.4M, False: 957k] ------------------ 24| 12.4M| buf[j][2] <<= 1; 25| 12.4M| buf[j][2] |= buf[j][1] >> 63; 26| 12.4M| buf[j][1] <<= 1; 27| 12.4M| buf[j][1] |= buf[j][0] >> 63; 28| 12.4M| buf[j][0] <<= 1; 29| 12.4M| } 30| | 31| 957k| vec128_mul_gf(prod, v, a[i]); 32| | 33| 13.4M| for (j = 0; j < GFBITS; j++) { ------------------ | | 6| 13.4M|#define GFBITS 13 ------------------ | Branch (33:21): [True: 12.4M, False: 957k] ------------------ 34| 12.4M| buf[j][0] ^= vec128_extract(prod[j], 0); ------------------ | | 29| 12.4M|#define vec128_extract(a, i) ((uint64_t) _mm_extract_epi64((vec128) (a), (i))) ------------------ 35| 12.4M| buf[j][1] ^= vec128_extract(prod[j], 1); ------------------ | | 29| 12.4M|#define vec128_extract(a, i) ((uint64_t) _mm_extract_epi64((vec128) (a), (i))) ------------------ 36| 12.4M| } 37| 957k| } 38| | 39| | // reduction modulo y^96+y^10+y^9+y^6+1 40| | 41| 139k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 139k|#define GFBITS 13 ------------------ | Branch (41:17): [True: 129k, False: 9.97k] ------------------ 42| 129k| p[i] = buf[i][2]; 43| | 44| 129k| buf[i][1] ^= p[i] >> (SYS_T - 10 - 64); ------------------ | | 8| 129k|#define SYS_T 96 ------------------ 45| 129k| buf[i][0] ^= p[i] << (64 - (SYS_T - 10 - 64)); ------------------ | | 8| 129k|#define SYS_T 96 ------------------ 46| 129k| buf[i][1] ^= p[i] >> (SYS_T - 9 - 64); ------------------ | | 8| 129k|#define SYS_T 96 ------------------ 47| 129k| buf[i][0] ^= p[i] << (64 - (SYS_T - 9 - 64)); ------------------ | | 8| 129k|#define SYS_T 96 ------------------ 48| 129k| buf[i][1] ^= p[i] >> (SYS_T - 6 - 64); ------------------ | | 8| 129k|#define SYS_T 96 ------------------ 49| 129k| buf[i][0] ^= p[i] << (64 - (SYS_T - 6 - 64)); ------------------ | | 8| 129k|#define SYS_T 96 ------------------ 50| 129k| buf[i][1] ^= p[i] >> (SYS_T - 64); ------------------ | | 8| 129k|#define SYS_T 96 ------------------ 51| 129k| buf[i][0] ^= p[i] << (64 - (SYS_T - 64)); ------------------ | | 8| 129k|#define SYS_T 96 ------------------ 52| 129k| } 53| | 54| | // 55| | 56| 139k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 139k|#define GFBITS 13 ------------------ | Branch (56:17): [True: 129k, False: 9.97k] ------------------ 57| 129k| p[i] = buf[i][1] & (allone << 32); 58| | 59| 129k| buf[i][0] ^= p[i] >> (SYS_T - 10 - 64); ------------------ | | 8| 129k|#define SYS_T 96 ------------------ 60| 129k| buf[i][0] ^= p[i] >> (SYS_T - 9 - 64); ------------------ | | 8| 129k|#define SYS_T 96 ------------------ 61| 129k| buf[i][0] ^= p[i] >> (SYS_T - 6 - 64); ------------------ | | 8| 129k|#define SYS_T 96 ------------------ 62| 129k| buf[i][0] ^= p[i] >> (SYS_T - 64); ------------------ | | 8| 129k|#define SYS_T 96 ------------------ 63| 129k| } 64| | 65| | // 66| | 67| 139k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 139k|#define GFBITS 13 ------------------ | Branch (67:17): [True: 129k, False: 9.97k] ------------------ 68| 129k| out[i] = vec128_set2x(buf[i][0], buf[i][1] & 0xFFFFFFFF); 69| 129k| } 70| 9.97k|} PQCLEAN_MCELIECE460896F_AVX2_vec256_sq: 9| 5.13k|void vec256_sq(vec256 *out, vec256 *in) { 10| 5.13k| int i; 11| 5.13k| vec256 result[GFBITS], t; 12| | 13| 5.13k| t = vec256_xor(in[11], in[12]); 14| | 15| 5.13k| result[0] = vec256_xor(in[0], in[11]); 16| 5.13k| result[1] = vec256_xor(in[7], t); 17| 5.13k| result[2] = vec256_xor(in[1], in[7]); 18| 5.13k| result[3] = vec256_xor(in[8], t); 19| 5.13k| result[4] = vec256_xor(in[2], in[7]); 20| 5.13k| result[4] = vec256_xor(result[4], in[8]); 21| 5.13k| result[4] = vec256_xor(result[4], t); 22| 5.13k| result[5] = vec256_xor(in[7], in[9]); 23| 5.13k| result[6] = vec256_xor(in[3], in[8]); 24| 5.13k| result[6] = vec256_xor(result[6], in[9]); 25| 5.13k| result[6] = vec256_xor(result[6], in[12]); 26| 5.13k| result[7] = vec256_xor(in[8], in[10]); 27| 5.13k| result[8] = vec256_xor(in[4], in[9]); 28| 5.13k| result[8] = vec256_xor(result[8], in[10]); 29| 5.13k| result[9] = vec256_xor(in[9], in[11]); 30| 5.13k| result[10] = vec256_xor(in[5], in[10]); 31| 5.13k| result[10] = vec256_xor(result[10], in[11]); 32| 5.13k| result[11] = vec256_xor(in[10], in[12]); 33| 5.13k| result[12] = vec256_xor(in[6], t); 34| | 35| 71.8k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 71.8k|#define GFBITS 13 ------------------ | Branch (35:17): [True: 66.7k, False: 5.13k] ------------------ 36| 66.7k| out[i] = result[i]; 37| 66.7k| } 38| 5.13k|} PQCLEAN_MCELIECE460896F_AVX2_vec256_inv: 41| 193|void vec256_inv(vec256 *out, vec256 *in) { 42| 193| vec256 tmp_11[ GFBITS ]; 43| 193| vec256 tmp_1111[ GFBITS ]; 44| | 45| 193| vec256_copy(out, in); 46| | 47| 193| vec256_sq(out, out); ------------------ | | 14| 193|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 193|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896F_AVX2_ ## fun | | ------------------ ------------------ 48| 193| vec256_mul(tmp_11, out, in); // ^11 49| | 50| 193| vec256_sq(out, tmp_11); ------------------ | | 14| 193|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 193|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896F_AVX2_ ## fun | | ------------------ ------------------ 51| 193| vec256_sq(out, out); ------------------ | | 14| 193|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 193|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896F_AVX2_ ## fun | | ------------------ ------------------ 52| 193| vec256_mul(tmp_1111, out, tmp_11); // ^1111 53| | 54| 193| vec256_sq(out, tmp_1111); ------------------ | | 14| 193|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 193|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896F_AVX2_ ## fun | | ------------------ ------------------ 55| 193| vec256_sq(out, out); ------------------ | | 14| 193|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 193|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896F_AVX2_ ## fun | | ------------------ ------------------ 56| 193| vec256_sq(out, out); ------------------ | | 14| 193|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 193|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896F_AVX2_ ## fun | | ------------------ ------------------ 57| 193| vec256_sq(out, out); ------------------ | | 14| 193|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 193|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896F_AVX2_ ## fun | | ------------------ ------------------ 58| 193| vec256_mul(out, out, tmp_1111); // ^11111111 59| | 60| 193| vec256_sq(out, out); ------------------ | | 14| 193|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 193|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896F_AVX2_ ## fun | | ------------------ ------------------ 61| 193| vec256_sq(out, out); ------------------ | | 14| 193|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 193|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896F_AVX2_ ## fun | | ------------------ ------------------ 62| 193| vec256_sq(out, out); ------------------ | | 14| 193|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 193|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896F_AVX2_ ## fun | | ------------------ ------------------ 63| 193| vec256_sq(out, out); ------------------ | | 14| 193|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 193|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896F_AVX2_ ## fun | | ------------------ ------------------ 64| 193| vec256_mul(out, out, tmp_1111); // ^111111111111 65| | 66| 193| vec256_sq(out, out); // ^1111111111110 ------------------ | | 14| 193|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 193|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896F_AVX2_ ## fun | | ------------------ ------------------ 67| 193|} PQCLEAN_MCELIECE6688128_AVX2_load_bits: 188| 111|void load_bits(vec128 bits_int[][32], const unsigned char *bits) { 189| 111| int i, j; 190| 111| const unsigned char *ptr = bits; 191| | 192| 111| vec128 buf[64]; 193| | 194| 444| for (i = 0; i <= 5; i += 2) { ------------------ | Branch (194:17): [True: 333, False: 111] ------------------ 195| 21.6k| for (j = 0; j < 64; j++) { ------------------ | Branch (195:21): [True: 21.3k, False: 333] ------------------ 196| 21.3k| buf[j] = vec128_set2x(load8(ptr), load8(ptr + 512)); 197| 21.3k| ptr += 8; 198| 21.3k| } 199| | 200| 333| transpose_64x128_sp( buf ); 201| | 202| 10.9k| for (j = 0; j < 32; j++) { ------------------ | Branch (202:21): [True: 10.6k, False: 333] ------------------ 203| 10.6k| bits_int[i + 0][j] = vec128_unpack_low(buf[j], buf[j + 32]); 204| 10.6k| bits_int[i + 1][j] = vec128_unpack_high(buf[j], buf[j + 32]); 205| 10.6k| } 206| | 207| 333| ptr += 512; 208| 333| } 209| | 210| 1.55k| for (i = 6; i <= 18; i++) { ------------------ | Branch (210:17): [True: 1.44k, False: 111] ------------------ 211| 47.6k| for (j = 0; j < 32; j++) { ------------------ | Branch (211:21): [True: 46.1k, False: 1.44k] ------------------ 212| 46.1k| bits_int[i][j] = load16(ptr); 213| 46.1k| ptr += 16; 214| 46.1k| } 215| 1.44k| } 216| | 217| 444| for (i = 19; i < 25; i += 2) { ------------------ | Branch (217:18): [True: 333, False: 111] ------------------ 218| 21.6k| for (j = 0; j < 64; j++) { ------------------ | Branch (218:21): [True: 21.3k, False: 333] ------------------ 219| 21.3k| buf[j] = vec128_set2x(load8(ptr), load8(ptr + 512)); 220| 21.3k| ptr += 8; 221| 21.3k| } 222| | 223| 333| transpose_64x128_sp( buf ); 224| | 225| 10.9k| for (j = 0; j < 32; j++) { ------------------ | Branch (225:21): [True: 10.6k, False: 333] ------------------ 226| 10.6k| bits_int[i + 0][j] = vec128_unpack_low(buf[j], buf[j + 32]); 227| 10.6k| bits_int[i + 1][j] = vec128_unpack_high(buf[j], buf[j + 32]); 228| 10.6k| } 229| | 230| 333| ptr += 512; 231| 333| } 232| 111|} PQCLEAN_MCELIECE6688128_AVX2_benes: 238| 222|void benes(vec128 *r, vec128 b[][32], int rev) { 239| 222| int inc; 240| | 241| 222| vec128 *b_ptr; 242| | 243| 222| if (rev == 0) { ------------------ | Branch (243:9): [True: 111, False: 111] ------------------ 244| 111| inc = 32; 245| 111| b_ptr = b[ 0]; 246| 111| } else { 247| 111| inc = -32; 248| 111| b_ptr = b[24]; 249| 111| } 250| | 251| | // 252| | 253| 222| transpose_64x128_sp( r ); 254| | 255| 222| layer_0(r, b_ptr); 256| 222| b_ptr += inc; 257| 222| layer_1(r, b_ptr); 258| 222| b_ptr += inc; 259| 222| layer_2(r, b_ptr); 260| 222| b_ptr += inc; 261| 222| layer_3(r, b_ptr); 262| 222| b_ptr += inc; 263| 222| layer_4(r, b_ptr); 264| 222| b_ptr += inc; 265| 222| layer_5(r, b_ptr); 266| 222| b_ptr += inc; 267| | 268| 222| transpose_64x128_sp( r ); 269| | 270| 222| layer_x(r, b_ptr); 271| 222| b_ptr += inc; 272| 222| layer_0(r, b_ptr); 273| 222| b_ptr += inc; 274| 222| layer_1(r, b_ptr); 275| 222| b_ptr += inc; 276| 222| layer_2(r, b_ptr); 277| 222| b_ptr += inc; 278| 222| layer_3(r, b_ptr); 279| 222| b_ptr += inc; 280| 222| layer_4(r, b_ptr); 281| 222| b_ptr += inc; 282| 222| layer_5(r, b_ptr); 283| 222| b_ptr += inc; 284| 222| layer_4(r, b_ptr); 285| 222| b_ptr += inc; 286| 222| layer_3(r, b_ptr); 287| 222| b_ptr += inc; 288| 222| layer_2(r, b_ptr); 289| 222| b_ptr += inc; 290| 222| layer_1(r, b_ptr); 291| 222| b_ptr += inc; 292| 222| layer_0(r, b_ptr); 293| 222| b_ptr += inc; 294| 222| layer_x(r, b_ptr); 295| 222| b_ptr += inc; 296| | 297| 222| transpose_64x128_sp( r ); 298| | 299| 222| layer_5(r, b_ptr); 300| 222| b_ptr += inc; 301| 222| layer_4(r, b_ptr); 302| 222| b_ptr += inc; 303| 222| layer_3(r, b_ptr); 304| 222| b_ptr += inc; 305| 222| layer_2(r, b_ptr); 306| 222| b_ptr += inc; 307| 222| layer_1(r, b_ptr); 308| 222| b_ptr += inc; 309| 222| layer_0(r, b_ptr); 310| | 311| 222| transpose_64x128_sp( r ); 312| 222|} PQCLEAN_MCELIECE6688128_AVX2_bm: 147| 111|void bm(vec128 *out, vec256 *in) { 148| 111| int i; 149| 111| uint16_t N, L; 150| 111| uint16_t mask; 151| 111| uint64_t one = 1, t; 152| | 153| 111| vec128 prod[ GFBITS ]; 154| 111| vec128 interval[GFBITS]; 155| | 156| 111| typedef union { 157| 111| vec128 v[GFBITS][2]; 158| 111| vec256 V[GFBITS]; 159| 111| } db_t; 160| | 161| 111| db_t db; 162| 111| db_t BC_tmp; 163| 111| db_t BC; 164| | 165| 111| gf d, b, c0 = 1; 166| 111| gf coefs[256]; 167| | 168| | // initialization 169| | 170| 111| get_coefs(coefs, in); 171| | 172| 111| BC.v[0][0] = vec128_set2x(0, one << 63); 173| 111| BC.v[0][1] = vec128_setzero(); 174| | 175| 1.44k| for (i = 1; i < GFBITS; i++) { ------------------ | | 6| 1.44k|#define GFBITS 13 ------------------ | Branch (175:17): [True: 1.33k, False: 111] ------------------ 176| 1.33k| BC.v[i][0] = BC.v[i][1] = vec128_setzero(); 177| 1.33k| } 178| | 179| 111| b = 1; 180| 111| L = 0; 181| | 182| | // 183| | 184| 1.55k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 1.55k|#define GFBITS 13 ------------------ | Branch (184:17): [True: 1.44k, False: 111] ------------------ 185| 1.44k| interval[i] = vec128_setzero(); 186| 1.44k| } 187| | 188| 28.5k| for (N = 0; N < 256; N++) { ------------------ | Branch (188:17): [True: 28.4k, False: 111] ------------------ 189| 28.4k| vec128_mul_asm(prod, interval, BC.v[0] + 1, 32); ------------------ | | 10| 28.4k|#define vec128_mul_asm CRYPTO_NAMESPACE(vec128_mul_asm) | | ------------------ | | | | 4| 28.4k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128_AVX2_ ## fun | | ------------------ ------------------ 190| 28.4k| update_asm(interval, coefs[N], 16); ------------------ | | 1| 28.4k|#define update_asm CRYPTO_NAMESPACE(update_asm) | | ------------------ | | | | 4| 28.4k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128_AVX2_ ## fun | | ------------------ ------------------ 191| | 192| 28.4k| d = vec_reduce_asm(prod); ------------------ | | 3| 28.4k|#define vec_reduce_asm CRYPTO_NAMESPACE(vec_reduce_asm) | | ------------------ | | | | 4| 28.4k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128_AVX2_ ## fun | | ------------------ ------------------ 193| | 194| 28.4k| t = gf_mul2(c0, coefs[N], b); ------------------ | | 13| 28.4k|#define gf_mul2 CRYPTO_NAMESPACE(gf_mul2) | | ------------------ | | | | 4| 28.4k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128_AVX2_ ## fun | | ------------------ ------------------ 195| 28.4k| d ^= t & 0xFFFFFFFF; 196| | 197| 28.4k| mask = mask_nonzero(d) & mask_leq(L * 2, N); 198| | 199| 397k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 397k|#define GFBITS 13 ------------------ | Branch (199:21): [True: 369k, False: 28.4k] ------------------ 200| 369k| db.v[i][0] = vec128_setbits((d >> i) & 1); 201| 369k| db.v[i][1] = vec128_setbits((b >> i) & 1); 202| 369k| } 203| | 204| 28.4k| vec256_mul((vec256 *) BC_tmp.V, (vec256 *) db.V, (vec256 *) BC.V); 205| | 206| 28.4k| vec128_cmov(BC.v, mask); 207| 28.4k| update_asm(BC.v, c0 & mask, 32); ------------------ | | 1| 28.4k|#define update_asm CRYPTO_NAMESPACE(update_asm) | | ------------------ | | | | 4| 28.4k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128_AVX2_ ## fun | | ------------------ ------------------ 208| | 209| 397k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 397k|#define GFBITS 13 ------------------ | Branch (209:21): [True: 369k, False: 28.4k] ------------------ 210| 369k| BC.v[i][1] = vec128_xor(BC_tmp.v[i][0], BC_tmp.v[i][1]); 211| 369k| } 212| | 213| 28.4k| c0 = t >> 32; 214| 28.4k| b = (d & mask) | (b & ~mask); 215| 28.4k| L = ((N + 1 - L) & mask) | (L & ~mask); 216| 28.4k| } 217| | 218| 111| c0 = gf_inv(c0); ------------------ | | 11| 111|#define gf_inv CRYPTO_NAMESPACE(gf_inv) | | ------------------ | | | | 4| 111|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128_AVX2_ ## fun | | ------------------ ------------------ 219| | 220| 1.55k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 1.55k|#define GFBITS 13 ------------------ | Branch (220:17): [True: 1.44k, False: 111] ------------------ 221| 1.44k| prod[i] = vec128_setbits((c0 >> i) & 1); 222| 1.44k| } 223| | 224| 111| vec128_mul_asm(out, prod, BC.v[0] + 1, 32); ------------------ | | 10| 111|#define vec128_mul_asm CRYPTO_NAMESPACE(vec128_mul_asm) | | ------------------ | | | | 4| 111|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128_AVX2_ ## fun | | ------------------ ------------------ 225| 111|} PQCLEAN_MCELIECE6688128_AVX2_controlbitsfrompermutation: 205| 111|void controlbitsfrompermutation(unsigned char *out, const int16 *pi, long long w, long long n) { 206| 111| PQCLEAN_VLA(int32, temp, (size_t)(2 * n)); ------------------ | | 57| 111|# define PQCLEAN_VLA(__t,__x,__s) __t __x[__s] ------------------ 207| 111| PQCLEAN_VLA(int16, pi_test, (size_t)n); ------------------ | | 57| 111|# define PQCLEAN_VLA(__t,__x,__s) __t __x[__s] ------------------ 208| 111| int16 diff; 209| 111| int i; 210| 111| unsigned char *ptr; 211| | 212| 111| OQS_MEM_cleanse(temp, (size_t)n * 2); 213| 111| OQS_MEM_cleanse(pi_test, (size_t)n); 214| | 215| 111| while (1) { ------------------ | Branch (215:12): [True: 111, Folded] ------------------ 216| 111| OQS_MEM_cleanse(out, (size_t)((((2 * w - 1)*n / 2) + 7) / 8)); 217| 111| cbrecursion(out, 0, 1, pi, w, n, temp); 218| | 219| | // check for correctness 220| | 221| 909k| for (i = 0; i < n; i++) { ------------------ | Branch (221:21): [True: 909k, False: 111] ------------------ 222| 909k| pi_test[i] = (int16)i; 223| 909k| } 224| | 225| 111| ptr = out; 226| 1.55k| for (i = 0; i < w; i++) { ------------------ | Branch (226:21): [True: 1.44k, False: 111] ------------------ 227| 1.44k| layer(pi_test, ptr, i, (int32)n); 228| 1.44k| ptr += n >> 4; 229| 1.44k| } 230| | 231| 1.44k| for (i = (int)(w - 2); i >= 0; i--) { ------------------ | Branch (231:32): [True: 1.33k, False: 111] ------------------ 232| 1.33k| layer(pi_test, ptr, i, (int32)n); 233| 1.33k| ptr += n >> 4; 234| 1.33k| } 235| | 236| 111| diff = 0; 237| 909k| for (i = 0; i < n; i++) { ------------------ | Branch (237:21): [True: 909k, False: 111] ------------------ 238| 909k| diff |= pi[i] ^ pi_test[i]; 239| 909k| } 240| | 241| 111| diff = crypto_int16_nonzero_mask(diff); ------------------ | | 12| 111|#define crypto_int16_nonzero_mask CRYPTO_NAMESPACE(crypto_int16_nonzero_mask) | | ------------------ | | | | 4| 111|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128_AVX2_ ## fun | | ------------------ ------------------ 242| 111| crypto_declassify(&diff, sizeof diff); 243| 111| if (diff == 0) { ------------------ | Branch (243:13): [True: 111, False: 0] ------------------ 244| 111| break; 245| 111| } 246| 111| } 247| 111|} PQCLEAN_MCELIECE6688128_AVX2_crypto_int16_negative_mask: 3| 222|crypto_int16 crypto_int16_negative_mask(crypto_int16 crypto_int16_x) { 4| 222| return crypto_int16_x >> 15; 5| 222|} PQCLEAN_MCELIECE6688128_AVX2_crypto_int16_nonzero_mask: 7| 111|crypto_int16 crypto_int16_nonzero_mask(crypto_int16 crypto_int16_x) { 8| 111| return crypto_int16_negative_mask(crypto_int16_x) | crypto_int16_negative_mask(-crypto_int16_x); ------------------ | | 10| 111|#define crypto_int16_negative_mask CRYPTO_NAMESPACE(crypto_int16_negative_mask) | | ------------------ | | | | 4| 111|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128_AVX2_ ## fun | | ------------------ ------------------ return crypto_int16_negative_mask(crypto_int16_x) | crypto_int16_negative_mask(-crypto_int16_x); ------------------ | | 10| 111|#define crypto_int16_negative_mask CRYPTO_NAMESPACE(crypto_int16_negative_mask) | | ------------------ | | | | 4| 111|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128_AVX2_ ## fun | | ------------------ ------------------ 9| 111|} PQCLEAN_MCELIECE6688128_AVX2_crypto_int32_negative_mask: 3| 70.9M|crypto_int32 crypto_int32_negative_mask(crypto_int32 crypto_int32_x) { 4| 70.9M| return crypto_int32_x >> 31; 5| 70.9M|} PQCLEAN_MCELIECE6688128_AVX2_crypto_int32_min: 37| 70.9M|crypto_int32 crypto_int32_min(crypto_int32 crypto_int32_x, crypto_int32 crypto_int32_y) { 38| 70.9M| crypto_int32 crypto_int32_xy = crypto_int32_y ^ crypto_int32_x; 39| 70.9M| crypto_int32 crypto_int32_z = crypto_int32_y - crypto_int32_x; 40| 70.9M| crypto_int32_z ^= crypto_int32_xy & (crypto_int32_z ^ crypto_int32_y); 41| 70.9M| crypto_int32_z = crypto_int32_negative_mask(crypto_int32_z); ------------------ | | 9| 70.9M|#define crypto_int32_negative_mask CRYPTO_NAMESPACE(crypto_int32_negative_mask) | | ------------------ | | | | 4| 70.9M|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128_AVX2_ ## fun | | ------------------ ------------------ 42| 70.9M| crypto_int32_z &= crypto_int32_xy; 43| 70.9M| return crypto_int32_x ^ crypto_int32_z; 44| 70.9M|} PQCLEAN_MCELIECE6688128_AVX2_crypto_uint16_signed_negative_mask: 3| 352k|crypto_uint16_signed crypto_uint16_signed_negative_mask(crypto_uint16_signed crypto_uint16_signed_x) { 4| 352k| return crypto_uint16_signed_x >> 15; 5| 352k|} PQCLEAN_MCELIECE6688128_AVX2_crypto_uint16_nonzero_mask: 7| 117k|crypto_uint16 crypto_uint16_nonzero_mask(crypto_uint16 crypto_uint16_x) { 8| 117k| return crypto_uint16_signed_negative_mask(crypto_uint16_x) | crypto_uint16_signed_negative_mask(-crypto_uint16_x); ------------------ | | 11| 117k|#define crypto_uint16_signed_negative_mask CRYPTO_NAMESPACE(crypto_uint16_signed_negative_mask) | | ------------------ | | | | 4| 117k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128_AVX2_ ## fun | | ------------------ ------------------ return crypto_uint16_signed_negative_mask(crypto_uint16_x) | crypto_uint16_signed_negative_mask(-crypto_uint16_x); ------------------ | | 11| 117k|#define crypto_uint16_signed_negative_mask CRYPTO_NAMESPACE(crypto_uint16_signed_negative_mask) | | ------------------ | | | | 4| 117k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128_AVX2_ ## fun | | ------------------ ------------------ 9| 117k|} PQCLEAN_MCELIECE6688128_AVX2_crypto_uint16_zero_mask: 11| 117k|crypto_uint16 crypto_uint16_zero_mask(crypto_uint16 crypto_uint16_x) { 12| 117k| return ~crypto_uint16_nonzero_mask(crypto_uint16_x); ------------------ | | 13| 117k|#define crypto_uint16_nonzero_mask CRYPTO_NAMESPACE(crypto_uint16_nonzero_mask) | | ------------------ | | | | 4| 117k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128_AVX2_ ## fun | | ------------------ ------------------ 13| 117k|} PQCLEAN_MCELIECE6688128_AVX2_crypto_uint16_smaller_mask: 24| 116k|crypto_uint16 crypto_uint16_smaller_mask(crypto_uint16 crypto_uint16_x, crypto_uint16 crypto_uint16_y) { 25| 116k| crypto_uint16 crypto_uint16_xy = crypto_uint16_x ^ crypto_uint16_y; 26| 116k| crypto_uint16 crypto_uint16_z = crypto_uint16_x - crypto_uint16_y; 27| 116k| crypto_uint16_z ^= crypto_uint16_xy & (crypto_uint16_z ^ crypto_uint16_x ^ (((crypto_uint16) 1) << 15)); 28| 116k| return crypto_uint16_signed_negative_mask(crypto_uint16_z); ------------------ | | 11| 116k|#define crypto_uint16_signed_negative_mask CRYPTO_NAMESPACE(crypto_uint16_signed_negative_mask) | | ------------------ | | | | 4| 116k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128_AVX2_ ## fun | | ------------------ ------------------ 29| 116k|} PQCLEAN_MCELIECE6688128_AVX2_crypto_uint32_signed_negative_mask: 3| 189k|crypto_uint32_signed crypto_uint32_signed_negative_mask(crypto_uint32_signed crypto_uint32_signed_x) { 4| 189k| return crypto_uint32_signed_x >> 31; 5| 189k|} PQCLEAN_MCELIECE6688128_AVX2_crypto_uint32_nonzero_mask: 7| 94.8k|crypto_uint32 crypto_uint32_nonzero_mask(crypto_uint32 crypto_uint32_x) { 8| 94.8k| return crypto_uint32_signed_negative_mask(crypto_uint32_x) | crypto_uint32_signed_negative_mask(-crypto_uint32_x); ------------------ | | 11| 94.8k|#define crypto_uint32_signed_negative_mask CRYPTO_NAMESPACE(crypto_uint32_signed_negative_mask) | | ------------------ | | | | 4| 94.8k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128_AVX2_ ## fun | | ------------------ ------------------ return crypto_uint32_signed_negative_mask(crypto_uint32_x) | crypto_uint32_signed_negative_mask(-crypto_uint32_x); ------------------ | | 11| 94.8k|#define crypto_uint32_signed_negative_mask CRYPTO_NAMESPACE(crypto_uint32_signed_negative_mask) | | ------------------ | | | | 4| 94.8k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128_AVX2_ ## fun | | ------------------ ------------------ 9| 94.8k|} PQCLEAN_MCELIECE6688128_AVX2_crypto_uint32_unequal_mask: 15| 94.8k|crypto_uint32 crypto_uint32_unequal_mask(crypto_uint32 crypto_uint32_x, crypto_uint32 crypto_uint32_y) { 16| 94.8k| crypto_uint32 crypto_uint32_xy = crypto_uint32_x ^ crypto_uint32_y; 17| 94.8k| return crypto_uint32_nonzero_mask(crypto_uint32_xy); ------------------ | | 13| 94.8k|#define crypto_uint32_nonzero_mask CRYPTO_NAMESPACE(crypto_uint32_nonzero_mask) | | ------------------ | | | | 4| 94.8k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128_AVX2_ ## fun | | ------------------ ------------------ 18| 94.8k|} PQCLEAN_MCELIECE6688128_AVX2_crypto_uint32_equal_mask: 20| 94.8k|crypto_uint32 crypto_uint32_equal_mask(crypto_uint32 crypto_uint32_x, crypto_uint32 crypto_uint32_y) { 21| 94.8k| return ~crypto_uint32_unequal_mask(crypto_uint32_x, crypto_uint32_y); ------------------ | | 17| 94.8k|#define crypto_uint32_unequal_mask CRYPTO_NAMESPACE(crypto_uint32_unequal_mask) | | ------------------ | | | | 4| 94.8k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128_AVX2_ ## fun | | ------------------ ------------------ 22| 94.8k|} PQCLEAN_MCELIECE6688128_AVX2_crypto_uint64_signed_negative_mask: 3| 17.7M|crypto_uint64_signed crypto_uint64_signed_negative_mask(crypto_uint64_signed crypto_uint64_signed_x) { 4| 17.7M| return crypto_uint64_signed_x >> 63; 5| 17.7M|} PQCLEAN_MCELIECE6688128_AVX2_crypto_uint64_nonzero_mask: 7| 8.85M|crypto_uint64 crypto_uint64_nonzero_mask(crypto_uint64 crypto_uint64_x) { 8| 8.85M| return crypto_uint64_signed_negative_mask(crypto_uint64_x) | crypto_uint64_signed_negative_mask(-crypto_uint64_x); ------------------ | | 11| 8.85M|#define crypto_uint64_signed_negative_mask CRYPTO_NAMESPACE(crypto_uint64_signed_negative_mask) | | ------------------ | | | | 4| 8.85M|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128_AVX2_ ## fun | | ------------------ ------------------ return crypto_uint64_signed_negative_mask(crypto_uint64_x) | crypto_uint64_signed_negative_mask(-crypto_uint64_x); ------------------ | | 11| 8.85M|#define crypto_uint64_signed_negative_mask CRYPTO_NAMESPACE(crypto_uint64_signed_negative_mask) | | ------------------ | | | | 4| 8.85M|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128_AVX2_ ## fun | | ------------------ ------------------ 9| 8.85M|} PQCLEAN_MCELIECE6688128_AVX2_crypto_uint64_zero_mask: 11| 1.46M|crypto_uint64 crypto_uint64_zero_mask(crypto_uint64 crypto_uint64_x) { 12| 1.46M| return ~crypto_uint64_nonzero_mask(crypto_uint64_x); ------------------ | | 13| 1.46M|#define crypto_uint64_nonzero_mask CRYPTO_NAMESPACE(crypto_uint64_nonzero_mask) | | ------------------ | | | | 4| 1.46M|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128_AVX2_ ## fun | | ------------------ ------------------ 13| 1.46M|} PQCLEAN_MCELIECE6688128_AVX2_crypto_uint64_unequal_mask: 15| 7.38M|crypto_uint64 crypto_uint64_unequal_mask(crypto_uint64 crypto_uint64_x, crypto_uint64 crypto_uint64_y) { 16| 7.38M| crypto_uint64 crypto_uint64_xy = crypto_uint64_x ^ crypto_uint64_y; 17| 7.38M| return crypto_uint64_nonzero_mask(crypto_uint64_xy); ------------------ | | 13| 7.38M|#define crypto_uint64_nonzero_mask CRYPTO_NAMESPACE(crypto_uint64_nonzero_mask) | | ------------------ | | | | 4| 7.38M|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128_AVX2_ ## fun | | ------------------ ------------------ 18| 7.38M|} PQCLEAN_MCELIECE6688128_AVX2_crypto_uint64_equal_mask: 20| 7.38M|crypto_uint64 crypto_uint64_equal_mask(crypto_uint64 crypto_uint64_x, crypto_uint64 crypto_uint64_y) { 21| 7.38M| return ~crypto_uint64_unequal_mask(crypto_uint64_x, crypto_uint64_y); ------------------ | | 17| 7.38M|#define crypto_uint64_unequal_mask CRYPTO_NAMESPACE(crypto_uint64_unequal_mask) | | ------------------ | | | | 4| 7.38M|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128_AVX2_ ## fun | | ------------------ ------------------ 22| 7.38M|} PQCLEAN_MCELIECE6688128_AVX2_decrypt: 171| 111|int decrypt(unsigned char *e, const unsigned char *sk, const unsigned char *s) { 172| 111| int i; 173| | 174| 111| uint16_t check_synd; 175| 111| uint16_t check_weight; 176| | 177| 111| vec256 inv[ 32 ][ GFBITS ]; 178| 111| vec256 scaled[ 32 ][ GFBITS ]; 179| 111| vec256 eval[32][ GFBITS ]; 180| | 181| 111| vec128 error128[ 64 ]; 182| 111| vec256 error256[ 32 ]; 183| | 184| 111| vec256 s_priv[ GFBITS ]; 185| 111| vec256 s_priv_cmp[ GFBITS ]; 186| 111| vec128 locator[ GFBITS ]; 187| | 188| 111| vec128 recv128[ 64 ]; 189| 111| vec256 recv256[ 32 ]; 190| 111| vec256 allone; 191| | 192| 111| vec128 bits_int[25][32]; 193| | 194| | // Berlekamp decoder 195| | 196| 111| preprocess(recv128, s); 197| | 198| 111| load_bits(bits_int, sk + IRR_BYTES); ------------------ | | 10| 111|#define load_bits CRYPTO_NAMESPACE(load_bits) | | ------------------ | | | | 4| 111|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128_AVX2_ ## fun | | ------------------ ------------------ load_bits(bits_int, sk + IRR_BYTES); ------------------ | | 11| 111|#define IRR_BYTES (SYS_T * 2) | | ------------------ | | | | 8| 111|#define SYS_T 128 | | ------------------ ------------------ 199| 111| benes(recv128, bits_int, 1); ------------------ | | 9| 111|#define benes CRYPTO_NAMESPACE(benes) | | ------------------ | | | | 4| 111|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128_AVX2_ ## fun | | ------------------ ------------------ 200| | 201| 111| reformat_128to256(recv256, recv128); 202| | 203| 111| scaling(scaled, inv, sk, recv256); 204| 111| fft_tr(s_priv, scaled); ------------------ | | 9| 111|#define fft_tr CRYPTO_NAMESPACE(fft_tr) | | ------------------ | | | | 4| 111|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128_AVX2_ ## fun | | ------------------ ------------------ 205| 111| bm(locator, s_priv); ------------------ | | 10| 111|#define bm CRYPTO_NAMESPACE(bm) | | ------------------ | | | | 4| 111|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128_AVX2_ ## fun | | ------------------ ------------------ 206| | 207| 111| fft(eval, locator); ------------------ | | 10| 111|#define fft CRYPTO_NAMESPACE(fft) | | ------------------ | | | | 4| 111|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128_AVX2_ ## fun | | ------------------ ------------------ 208| | 209| | // reencryption and weight check 210| | 211| 111| allone = vec256_set1_16b(0xFFFF); 212| | 213| 3.66k| for (i = 0; i < 32; i++) { ------------------ | Branch (213:17): [True: 3.55k, False: 111] ------------------ 214| 3.55k| error256[i] = vec256_or_reduce(eval[i]); 215| 3.55k| error256[i] = vec256_xor(error256[i], allone); 216| 3.55k| } 217| | 218| 111| scaling_inv(scaled, inv, error256); 219| 111| fft_tr(s_priv_cmp, scaled); ------------------ | | 9| 111|#define fft_tr CRYPTO_NAMESPACE(fft_tr) | | ------------------ | | | | 4| 111|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128_AVX2_ ## fun | | ------------------ ------------------ 220| | 221| 111| check_synd = synd_cmp(s_priv, s_priv_cmp); 222| | 223| | // 224| | 225| 111| reformat_256to128(error128, error256); 226| 111| benes(error128, bits_int, 0); ------------------ | | 9| 111|#define benes CRYPTO_NAMESPACE(benes) | | ------------------ | | | | 4| 111|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128_AVX2_ ## fun | | ------------------ ------------------ 227| | 228| 111| postprocess(e, error128); 229| | 230| 111| check_weight = weight_check(e, error128); 231| | 232| 111| return 1 - (check_synd & check_weight); 233| 111|} PQCLEAN_MCELIECE6688128_AVX2_encrypt: 116| 111|void encrypt(unsigned char *s, const unsigned char *pk, unsigned char *e) { 117| 111| gen_e(e); 118| | 119| 111| syndrome_asm(s, pk, e); ------------------ | | 1| 111|#define syndrome_asm CRYPTO_NAMESPACE(syndrome_asm) | | ------------------ | | | | 4| 111|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128_AVX2_ ## fun | | ------------------ ------------------ 120| 111|} PQCLEAN_MCELIECE6688128_AVX2_fft: 277| 1.14k|void fft(vec256 out[][GFBITS], vec128 *in) { 278| 1.14k| radix_conversions(in); 279| 1.14k| butterflies(out, in); 280| 1.14k|} PQCLEAN_MCELIECE6688128_AVX2_fft_tr: 380| 222|void fft_tr(vec256 *out, vec256 in[][ GFBITS ]) { 381| 222| butterflies_tr(out, in); 382| 222| radix_conversions_tr(out); 383| 222|} PQCLEAN_MCELIECE6688128_AVX2_gf_mul: 12| 15.0M|gf gf_mul(gf in0, gf in1) { 13| 15.0M| int i; 14| | 15| 15.0M| uint64_t tmp; 16| 15.0M| uint64_t t0; 17| 15.0M| uint64_t t1; 18| 15.0M| uint64_t t; 19| | 20| 15.0M| t0 = in0; 21| 15.0M| t1 = in1; 22| | 23| 15.0M| tmp = t0 * (t1 & 1); 24| | 25| 195M| for (i = 1; i < GFBITS; i++) { ------------------ | | 6| 195M|#define GFBITS 13 ------------------ | Branch (25:17): [True: 180M, False: 15.0M] ------------------ 26| 180M| tmp ^= (t0 * (t1 & (1 << i))); 27| 180M| } 28| | 29| | // 30| | 31| 15.0M| t = tmp & 0x1FF0000; 32| 15.0M| tmp ^= (t >> 9) ^ (t >> 10) ^ (t >> 12) ^ (t >> 13); 33| | 34| 15.0M| t = tmp & 0x000E000; 35| 15.0M| tmp ^= (t >> 9) ^ (t >> 10) ^ (t >> 12) ^ (t >> 13); 36| | 37| 15.0M| return tmp & GFMASK; ------------------ | | 19| 15.0M|#define GFMASK ((1 << GFBITS) - 1) | | ------------------ | | | | 6| 15.0M|#define GFBITS 13 | | ------------------ ------------------ 38| 15.0M|} PQCLEAN_MCELIECE6688128_AVX2_gf_mul2: 41| 28.4k|uint64_t gf_mul2(gf a, gf b0, gf b1) { 42| 28.4k| int i; 43| | 44| 28.4k| uint64_t tmp = 0; 45| 28.4k| uint64_t t0; 46| 28.4k| uint64_t t1; 47| 28.4k| uint64_t t; 48| 28.4k| uint64_t mask = 0x0000000100000001; 49| | 50| 28.4k| t0 = a; 51| 28.4k| t1 = b1; 52| 28.4k| t1 = (t1 << 32) | b0; 53| | 54| 397k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 397k|#define GFBITS 13 ------------------ | Branch (54:17): [True: 369k, False: 28.4k] ------------------ 55| 369k| tmp ^= t0 * (t1 & mask); 56| 369k| mask += mask; 57| 369k| } 58| | 59| | // 60| | 61| 28.4k| t = tmp & 0x01FF000001FF0000; 62| 28.4k| tmp ^= (t >> 9) ^ (t >> 10) ^ (t >> 12) ^ (t >> 13); 63| | 64| 28.4k| t = tmp & 0x0000E0000000E000; 65| 28.4k| tmp ^= (t >> 9) ^ (t >> 10) ^ (t >> 12) ^ (t >> 13); 66| | 67| 28.4k| return tmp & 0x00001FFF00001FFF; 68| 28.4k|} PQCLEAN_MCELIECE6688128_AVX2_gf_frac: 178| 117k|gf gf_frac(gf den, gf num) { 179| 117k| gf tmp_11; 180| 117k| gf tmp_1111; 181| 117k| gf out; 182| | 183| 117k| tmp_11 = gf_sqmul(den, den); // 11 184| 117k| tmp_1111 = gf_sq2mul(tmp_11, tmp_11); // 1111 185| 117k| out = gf_sq2(tmp_1111); 186| 117k| out = gf_sq2mul(out, tmp_1111); // 11111111 187| 117k| out = gf_sq2(out); 188| 117k| out = gf_sq2mul(out, tmp_1111); // 111111111111 189| | 190| 117k| return gf_sqmul(out, num); // 1111111111110 191| 117k|} PQCLEAN_MCELIECE6688128_AVX2_gf_inv: 194| 117k|gf gf_inv(gf den) { 195| 117k| return gf_frac(den, ((gf) 1)); ------------------ | | 10| 117k|#define gf_frac CRYPTO_NAMESPACE(gf_frac) | | ------------------ | | | | 4| 117k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128_AVX2_ ## fun | | ------------------ ------------------ 196| 117k|} pk_gen.c:PQCLEAN_MCELIECE6688128_AVX2_int32_sort: 21| 111|static void int32_sort(int32_t *x, long long n) { 22| 111| long long top, p, q, r, i; 23| | 24| 111| if (n < 2) { ------------------ | Branch (24:9): [True: 0, False: 111] ------------------ 25| 0| return; 26| 0| } 27| 111| top = 1; 28| 1.22k| while (top < n - top) { ------------------ | Branch (28:12): [True: 1.11k, False: 111] ------------------ 29| 1.11k| top += top; 30| 1.11k| } 31| | 32| 1.33k| for (p = top; p > 0; p >>= 1) { ------------------ | Branch (32:19): [True: 1.22k, False: 111] ------------------ 33| 1.80M| for (i = 0; i < n - p; ++i) { ------------------ | Branch (33:21): [True: 1.80M, False: 1.22k] ------------------ 34| 1.80M| if (!(i & p)) { ------------------ | Branch (34:17): [True: 959k, False: 845k] ------------------ 35| 959k| int32_MINMAX(x[i], x[i + p]); ------------------ | | 11| 959k| do { \ | | 12| 959k| int32_t ab = (b) ^ (a); \ | | 13| 959k| int32_t c = (b) - (a); \ | | 14| 959k| c ^= ab & ((c) ^ (b)); \ | | 15| 959k| c >>= 31; \ | | 16| 959k| c &= ab; \ | | 17| 959k| (a) ^= c; \ | | 18| 959k| (b) ^= c; \ | | 19| 959k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 959k] | | ------------------ ------------------ 36| 959k| } 37| 1.80M| } 38| 1.22k| i = 0; 39| 7.32k| for (q = top; q > p; q >>= 1) { ------------------ | Branch (39:23): [True: 6.10k, False: 1.22k] ------------------ 40| 1.62M| for (; i < n - q; ++i) { ------------------ | Branch (40:20): [True: 1.61M, False: 6.10k] ------------------ 41| 1.61M| if (!(i & p)) { ------------------ | Branch (41:21): [True: 845k, False: 774k] ------------------ 42| 845k| int32_t a = x[i + p]; 43| 4.95M| for (r = q; r > p; r >>= 1) { ------------------ | Branch (43:33): [True: 4.11M, False: 845k] ------------------ 44| 4.11M| int32_MINMAX(a, x[i + r]); ------------------ | | 11| 4.11M| do { \ | | 12| 4.11M| int32_t ab = (b) ^ (a); \ | | 13| 4.11M| int32_t c = (b) - (a); \ | | 14| 4.11M| c ^= ab & ((c) ^ (b)); \ | | 15| 4.11M| c >>= 31; \ | | 16| 4.11M| c &= ab; \ | | 17| 4.11M| (a) ^= c; \ | | 18| 4.11M| (b) ^= c; \ | | 19| 4.11M| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 4.11M] | | ------------------ ------------------ 45| 4.11M| } 46| 845k| x[i + p] = a; 47| 845k| } 48| 1.61M| } 49| 6.10k| } 50| 1.22k| } 51| 111|} controlbits.c:PQCLEAN_MCELIECE6688128_AVX2_int32_sort: 21| 3.64M|static void int32_sort(int32_t *x, long long n) { 22| 3.64M| long long top, p, q, r, i; 23| | 24| 3.64M| if (n < 2) { ------------------ | Branch (24:9): [True: 0, False: 3.64M] ------------------ 25| 0| return; 26| 0| } 27| 3.64M| top = 1; 28| 12.7M| while (top < n - top) { ------------------ | Branch (28:12): [True: 9.11M, False: 3.64M] ------------------ 29| 9.11M| top += top; 30| 9.11M| } 31| | 32| 16.3M| for (p = top; p > 0; p >>= 1) { ------------------ | Branch (32:19): [True: 12.7M, False: 3.64M] ------------------ 33| 1.75G| for (i = 0; i < n - p; ++i) { ------------------ | Branch (33:21): [True: 1.74G, False: 12.7M] ------------------ 34| 1.74G| if (!(i & p)) { ------------------ | Branch (34:17): [True: 973M, False: 767M] ------------------ 35| 973M| int32_MINMAX(x[i], x[i + p]); ------------------ | | 11| 973M| do { \ | | 12| 973M| int32_t ab = (b) ^ (a); \ | | 13| 973M| int32_t c = (b) - (a); \ | | 14| 973M| c ^= ab & ((c) ^ (b)); \ | | 15| 973M| c >>= 31; \ | | 16| 973M| c &= ab; \ | | 17| 973M| (a) ^= c; \ | | 18| 973M| (b) ^= c; \ | | 19| 973M| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 973M] | | ------------------ ------------------ 36| 973M| } 37| 1.74G| } 38| 12.7M| i = 0; 39| 34.6M| for (q = top; q > p; q >>= 1) { ------------------ | Branch (39:23): [True: 21.8M, False: 12.7M] ------------------ 40| 1.55G| for (; i < n - q; ++i) { ------------------ | Branch (40:20): [True: 1.53G, False: 21.8M] ------------------ 41| 1.53G| if (!(i & p)) { ------------------ | Branch (41:21): [True: 767M, False: 767M] ------------------ 42| 767M| int32_t a = x[i + p]; 43| 4.54G| for (r = q; r > p; r >>= 1) { ------------------ | Branch (43:33): [True: 3.78G, False: 767M] ------------------ 44| 3.78G| int32_MINMAX(a, x[i + r]); ------------------ | | 11| 3.78G| do { \ | | 12| 3.78G| int32_t ab = (b) ^ (a); \ | | 13| 3.78G| int32_t c = (b) - (a); \ | | 14| 3.78G| c ^= ab & ((c) ^ (b)); \ | | 15| 3.78G| c >>= 31; \ | | 16| 3.78G| c &= ab; \ | | 17| 3.78G| (a) ^= c; \ | | 18| 3.78G| (b) ^= c; \ | | 19| 3.78G| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 3.78G] | | ------------------ ------------------ 45| 3.78G| } 46| 767M| x[i + p] = a; 47| 767M| } 48| 1.53G| } 49| 21.8M| } 50| 12.7M| } 51| 3.64M|} encrypt.c:PQCLEAN_MCELIECE6688128_AVX2_int32_sort: 21| 747|static void int32_sort(int32_t *x, long long n) { 22| 747| long long top, p, q, r, i; 23| | 24| 747| if (n < 2) { ------------------ | Branch (24:9): [True: 0, False: 747] ------------------ 25| 0| return; 26| 0| } 27| 747| top = 1; 28| 5.22k| while (top < n - top) { ------------------ | Branch (28:12): [True: 4.48k, False: 747] ------------------ 29| 4.48k| top += top; 30| 4.48k| } 31| | 32| 5.97k| for (p = top; p > 0; p >>= 1) { ------------------ | Branch (32:19): [True: 5.22k, False: 747] ------------------ 33| 579k| for (i = 0; i < n - p; ++i) { ------------------ | Branch (33:21): [True: 574k, False: 5.22k] ------------------ 34| 574k| if (!(i & p)) { ------------------ | Branch (34:17): [True: 334k, False: 239k] ------------------ 35| 334k| int32_MINMAX(x[i], x[i + p]); ------------------ | | 11| 334k| do { \ | | 12| 334k| int32_t ab = (b) ^ (a); \ | | 13| 334k| int32_t c = (b) - (a); \ | | 14| 334k| c ^= ab & ((c) ^ (b)); \ | | 15| 334k| c >>= 31; \ | | 16| 334k| c &= ab; \ | | 17| 334k| (a) ^= c; \ | | 18| 334k| (b) ^= c; \ | | 19| 334k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 334k] | | ------------------ ------------------ 36| 334k| } 37| 574k| } 38| 5.22k| i = 0; 39| 20.9k| for (q = top; q > p; q >>= 1) { ------------------ | Branch (39:23): [True: 15.6k, False: 5.22k] ------------------ 40| 495k| for (; i < n - q; ++i) { ------------------ | Branch (40:20): [True: 479k, False: 15.6k] ------------------ 41| 479k| if (!(i & p)) { ------------------ | Branch (41:21): [True: 239k, False: 239k] ------------------ 42| 239k| int32_t a = x[i + p]; 43| 1.00M| for (r = q; r > p; r >>= 1) { ------------------ | Branch (43:33): [True: 764k, False: 239k] ------------------ 44| 764k| int32_MINMAX(a, x[i + r]); ------------------ | | 11| 764k| do { \ | | 12| 764k| int32_t ab = (b) ^ (a); \ | | 13| 764k| int32_t c = (b) - (a); \ | | 14| 764k| c ^= ab & ((c) ^ (b)); \ | | 15| 764k| c >>= 31; \ | | 16| 764k| c &= ab; \ | | 17| 764k| (a) ^= c; \ | | 18| 764k| (b) ^= c; \ | | 19| 764k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 764k] | | ------------------ ------------------ 45| 764k| } 46| 239k| x[i + p] = a; 47| 239k| } 48| 479k| } 49| 15.6k| } 50| 5.22k| } 51| 747|} PQCLEAN_MCELIECE6688128_AVX2_crypto_kem_enc: 22| 111|) { 23| 111| unsigned char e[ SYS_N / 8 ]; 24| 111| unsigned char one_ec[ 1 + SYS_N / 8 + SYND_BYTES ] = {1}; 25| | 26| | // 27| | 28| 111| encrypt(c, pk, e); ------------------ | | 9| 111|#define encrypt CRYPTO_NAMESPACE(encrypt) | | ------------------ | | | | 4| 111|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128_AVX2_ ## fun | | ------------------ ------------------ 29| | 30| 111| memcpy(one_ec + 1, e, SYS_N / 8); ------------------ | | 7| 111|#define SYS_N 6688 ------------------ 31| 111| memcpy(one_ec + 1 + SYS_N / 8, c, SYND_BYTES); ------------------ | | 7| 111|#define SYS_N 6688 ------------------ memcpy(one_ec + 1 + SYS_N / 8, c, SYND_BYTES); ------------------ | | 17| 111|#define SYND_BYTES ((PK_NROWS + 7)/8) | | ------------------ | | | | 13| 111|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 111|#define SYS_T 128 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 111|#define GFBITS 13 | | | | ------------------ | | ------------------ ------------------ 32| | 33| 111| crypto_hash_32b(key, one_ec, sizeof(one_ec)); ------------------ | | 7| 111| shake256(out, 32, in, inlen) | | ------------------ | | | | 12| 111|#define shake256 OQS_SHA3_shake256 | | ------------------ ------------------ 34| | 35| 111| return 0; 36| 111|} PQCLEAN_MCELIECE6688128_AVX2_crypto_kem_dec: 42| 111|) { 43| 111| int i; 44| | 45| 111| unsigned char ret_decrypt = 0; 46| | 47| 111| uint16_t m; 48| | 49| 111| unsigned char e[ SYS_N / 8 ]; 50| 111| unsigned char preimage[ 1 + SYS_N / 8 + SYND_BYTES ]; 51| 111| unsigned char *x = preimage; 52| 111| const unsigned char *s = sk + 40 + IRR_BYTES + COND_BYTES; ------------------ | | 11| 111|#define IRR_BYTES (SYS_T * 2) | | ------------------ | | | | 8| 111|#define SYS_T 128 | | ------------------ ------------------ const unsigned char *s = sk + 40 + IRR_BYTES + COND_BYTES; ------------------ | | 10| 111|#define COND_BYTES ((1 << (GFBITS-4))*(2*GFBITS - 1)) | | ------------------ | | | | 6| 111|#define GFBITS 13 | | ------------------ | | #define COND_BYTES ((1 << (GFBITS-4))*(2*GFBITS - 1)) | | ------------------ | | | | 6| 111|#define GFBITS 13 | | ------------------ ------------------ 53| | 54| | // 55| | 56| 111| ret_decrypt = (unsigned char)decrypt(e, sk + 40, c); ------------------ | | 9| 111|#define decrypt CRYPTO_NAMESPACE(decrypt) | | ------------------ | | | | 4| 111|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128_AVX2_ ## fun | | ------------------ ------------------ 57| | 58| 111| m = ret_decrypt; 59| 111| m -= 1; 60| 111| m >>= 8; 61| | 62| 111| *x++ = m & 1; 63| 92.9k| for (i = 0; i < SYS_N / 8; i++) { ------------------ | | 7| 92.9k|#define SYS_N 6688 ------------------ | Branch (63:17): [True: 92.7k, False: 111] ------------------ 64| 92.7k| *x++ = (~m & s[i]) | (m & e[i]); 65| 92.7k| } 66| | 67| 23.1k| for (i = 0; i < SYND_BYTES; i++) { ------------------ | | 17| 23.1k|#define SYND_BYTES ((PK_NROWS + 7)/8) | | ------------------ | | | | 13| 23.1k|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 23.1k|#define SYS_T 128 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 23.1k|#define GFBITS 13 | | | | ------------------ | | ------------------ ------------------ | Branch (67:17): [True: 23.0k, False: 111] ------------------ 68| 23.0k| *x++ = c[i]; 69| 23.0k| } 70| | 71| 111| crypto_hash_32b(key, preimage, sizeof(preimage)); ------------------ | | 7| 111| shake256(out, 32, in, inlen) | | ------------------ | | | | 12| 111|#define shake256 OQS_SHA3_shake256 | | ------------------ ------------------ 72| | 73| 111| return 0; 74| 111|} PQCLEAN_MCELIECE6688128_AVX2_crypto_kem_keypair: 80| 111|) { 81| 111| int i; 82| 111| unsigned char seed[ 33 ] = {64}; 83| 111| unsigned char r[ SYS_N / 8 + (1 << GFBITS)*sizeof(uint32_t) + SYS_T * 2 + 32 ]; 84| 111| unsigned char *rp, *skp; 85| | 86| 111| gf f[ SYS_T ]; // element in GF(2^mt) 87| 111| gf irr[ SYS_T ]; // Goppa polynomial 88| 111| uint32_t perm[ 1 << GFBITS ]; // random permutation as 32-bit integers 89| 111| int16_t pi[ 1 << GFBITS ]; // random permutation 90| | 91| 111| randombytes(seed + 1, 32); ------------------ | | 8| 111|#define randombytes OQS_randombytes ------------------ 92| | 93| 919| while (1) { ------------------ | Branch (93:12): [True: 919, Folded] ------------------ 94| 919| rp = &r[ sizeof(r) - 32 ]; 95| 919| skp = sk; 96| | 97| | // expanding and updating the seed 98| | 99| 919| shake(r, sizeof(r), seed, 33); ------------------ | | 10| 919| shake256(out, outlen, in, inlen) | | ------------------ | | | | 12| 919|#define shake256 OQS_SHA3_shake256 | | ------------------ ------------------ 100| 919| memcpy(skp, seed + 1, 32); 101| 919| skp += 32 + 8; 102| 919| memcpy(seed + 1, &r[ sizeof(r) - 32 ], 32); 103| | 104| | // generating irreducible polynomial 105| | 106| 919| rp -= sizeof(f); 107| | 108| 118k| for (i = 0; i < SYS_T; i++) { ------------------ | | 8| 118k|#define SYS_T 128 ------------------ | Branch (108:21): [True: 117k, False: 919] ------------------ 109| 117k| f[i] = load_gf(rp + i * 2); 110| 117k| } 111| | 112| 919| if (genpoly_gen(irr, f)) { ------------------ | | 9| 919|#define genpoly_gen CRYPTO_NAMESPACE(genpoly_gen) | | ------------------ | | | | 4| 919|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128_AVX2_ ## fun | | ------------------ ------------------ | Branch (112:13): [True: 0, False: 919] ------------------ 113| 0| continue; 114| 0| } 115| | 116| 118k| for (i = 0; i < SYS_T; i++) { ------------------ | | 8| 118k|#define SYS_T 128 ------------------ | Branch (116:21): [True: 117k, False: 919] ------------------ 117| 117k| store_gf(skp + i * 2, irr[i]); 118| 117k| } 119| | 120| 919| skp += IRR_BYTES; ------------------ | | 11| 919|#define IRR_BYTES (SYS_T * 2) | | ------------------ | | | | 8| 919|#define SYS_T 128 | | ------------------ ------------------ 121| | 122| | // generating permutation 123| | 124| 919| rp -= sizeof(perm); 125| | 126| 7.52M| for (i = 0; i < (1 << GFBITS); i++) { ------------------ | | 6| 7.52M|#define GFBITS 13 ------------------ | Branch (126:21): [True: 7.52M, False: 919] ------------------ 127| 7.52M| perm[i] = load4(rp + i * 4); 128| 7.52M| } 129| | 130| 919| if (pk_gen(pk, skp - IRR_BYTES, perm, pi)) { ------------------ | | 9| 919|#define pk_gen CRYPTO_NAMESPACE(pk_gen) | | ------------------ | | | | 4| 919|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128_AVX2_ ## fun | | ------------------ ------------------ if (pk_gen(pk, skp - IRR_BYTES, perm, pi)) { ------------------ | | 11| 919|#define IRR_BYTES (SYS_T * 2) | | ------------------ | | | | 8| 919|#define SYS_T 128 | | ------------------ ------------------ | Branch (130:13): [True: 808, False: 111] ------------------ 131| 808| continue; 132| 808| } 133| | 134| 111| controlbitsfrompermutation(skp, pi, GFBITS, 1 << GFBITS); ------------------ | | 10| 111|#define controlbitsfrompermutation CRYPTO_NAMESPACE(controlbitsfrompermutation) | | ------------------ | | | | 4| 111|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128_AVX2_ ## fun | | ------------------ ------------------ controlbitsfrompermutation(skp, pi, GFBITS, 1 << GFBITS); ------------------ | | 6| 111|#define GFBITS 13 ------------------ controlbitsfrompermutation(skp, pi, GFBITS, 1 << GFBITS); ------------------ | | 6| 111|#define GFBITS 13 ------------------ 135| 111| skp += COND_BYTES; ------------------ | | 10| 111|#define COND_BYTES ((1 << (GFBITS-4))*(2*GFBITS - 1)) | | ------------------ | | | | 6| 111|#define GFBITS 13 | | ------------------ | | #define COND_BYTES ((1 << (GFBITS-4))*(2*GFBITS - 1)) | | ------------------ | | | | 6| 111|#define GFBITS 13 | | ------------------ ------------------ 136| | 137| | // storing the random string s 138| | 139| 111| rp -= SYS_N / 8; ------------------ | | 7| 111|#define SYS_N 6688 ------------------ 140| 111| memcpy(skp, rp, SYS_N / 8); ------------------ | | 7| 111|#define SYS_N 6688 ------------------ 141| | 142| | // storing positions of the 32 pivots 143| | 144| 111| store8(sk + 32, 0xFFFFFFFF); 145| | 146| 111| break; 147| 919| } 148| | 149| 111| return 0; 150| 111|} PQCLEAN_MCELIECE6688128_AVX2_pk_gen: 199| 919|int pk_gen(unsigned char *pk, const unsigned char *irr, const uint32_t *perm, int16_t *pi) { 200| 919|#define nBlocks_I ((PK_NROWS + 255) / 256) 201| | 202| 919| int i, j, k, b; 203| 919| int row, c; 204| | 205| 919| union { 206| 919| uint64_t w[ PK_NROWS ][ nBlocks_I * 4 ]; 207| 919| vec256 v[ PK_NROWS ][ nBlocks_I ]; 208| 919| } mat; 209| | 210| 919| union { 211| 919| uint64_t w[ PK_NROWS ][ 28 ]; 212| 919| vec256 v[ PK_NROWS ][ 7 ]; 213| 919| } par; 214| | 215| 919| uint16_t m; 216| 919| vec256 mm; 217| | 218| 919| vec128 sk_int[ GFBITS ]; 219| | 220| 919| vec256 consts[ 32 ][ GFBITS ]; 221| 919| vec256 eval[ 32 ][ GFBITS ]; 222| 919| vec256 prod[ 32 ][ GFBITS ]; 223| 919| vec256 tmp[ GFBITS ]; 224| | 225| 919| uint64_t list[1 << GFBITS]; 226| 919| uint64_t one = 1; 227| 919| uint64_t t; 228| | 229| 919| uint16_t ind[ PK_NROWS ]; 230| 919| uint16_t ind_inv[ PK_NROWS ]; 231| | 232| | // compute the inverses 233| | 234| 919| irr_load(sk_int, irr); 235| | 236| 919| fft(eval, sk_int); ------------------ | | 10| 919|#define fft CRYPTO_NAMESPACE(fft) | | ------------------ | | | | 4| 919|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128_AVX2_ ## fun | | ------------------ ------------------ 237| | 238| 919| vec256_copy(prod[0], eval[0]); 239| | 240| 29.4k| for (i = 1; i < 32; i++) { ------------------ | Branch (240:17): [True: 28.4k, False: 919] ------------------ 241| 28.4k| vec256_mul(prod[i], prod[i - 1], eval[i]); 242| 28.4k| } 243| | 244| 919| vec256_inv(tmp, prod[31]); ------------------ | | 11| 919|#define vec256_inv CRYPTO_NAMESPACE(vec256_inv) | | ------------------ | | | | 4| 919|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128_AVX2_ ## fun | | ------------------ ------------------ 245| | 246| 29.4k| for (i = 30; i >= 0; i--) { ------------------ | Branch (246:18): [True: 28.4k, False: 919] ------------------ 247| 28.4k| vec256_mul(prod[i + 1], prod[i], tmp); 248| 28.4k| vec256_mul(tmp, tmp, eval[i + 1]); 249| 28.4k| } 250| | 251| 919| vec256_copy(prod[0], tmp); 252| | 253| | // fill matrix 254| | 255| 919| de_bitslicing(list, prod); 256| | 257| 7.52M| for (i = 0; i < (1 << GFBITS); i++) { ------------------ | | 6| 7.52M|#define GFBITS 13 ------------------ | Branch (257:17): [True: 7.52M, False: 919] ------------------ 258| 7.52M| list[i] <<= GFBITS; ------------------ | | 6| 7.52M|#define GFBITS 13 ------------------ 259| 7.52M| list[i] |= i; 260| 7.52M| list[i] |= ((uint64_t) perm[i]) << 31; 261| 7.52M| } 262| | 263| 919| uint64_sort(list, 1 << GFBITS); ------------------ | | 6| 919|#define GFBITS 13 ------------------ 264| | 265| 7.38M| for (i = 1; i < (1 << GFBITS); i++) { ------------------ | | 6| 7.38M|#define GFBITS 13 ------------------ | Branch (265:17): [True: 7.38M, False: 881] ------------------ 266| 7.38M| if (uint64_is_equal_declassify(list[i - 1] >> 31, list[i] >> 31)) { ------------------ | Branch (266:13): [True: 38, False: 7.38M] ------------------ 267| 38| return -1; 268| 38| } 269| 7.38M| } 270| | 271| 881| to_bitslicing_2x(consts, prod, list); 272| | 273| 7.21M| for (i = 0; i < (1 << GFBITS); i++) { ------------------ | | 6| 7.21M|#define GFBITS 13 ------------------ | Branch (273:17): [True: 7.21M, False: 881] ------------------ 274| 7.21M| pi[i] = list[i] & GFMASK; ------------------ | | 19| 7.21M|#define GFMASK ((1 << GFBITS) - 1) | | ------------------ | | | | 6| 7.21M|#define GFBITS 13 | | ------------------ ------------------ 275| 7.21M| } 276| | 277| 7.04k| for (j = 0; j < nBlocks_I; j++) { ------------------ | | 200| 7.04k|#define nBlocks_I ((PK_NROWS + 255) / 256) | | ------------------ | | | | 13| 7.04k|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 7.04k|#define SYS_T 128 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 7.04k|#define GFBITS 13 | | | | ------------------ | | ------------------ ------------------ | Branch (277:17): [True: 6.16k, False: 881] ------------------ 278| 86.3k| for (k = 0; k < GFBITS; k++) { ------------------ | | 6| 86.3k|#define GFBITS 13 ------------------ | Branch (278:21): [True: 80.1k, False: 6.16k] ------------------ 279| 80.1k| mat.v[ k ][ j ] = prod[ j ][ k ]; 280| 80.1k| } 281| 6.16k| } 282| | 283| 112k| for (i = 1; i < SYS_T; i++) { ------------------ | | 8| 112k|#define SYS_T 128 ------------------ | Branch (283:17): [True: 111k, False: 881] ------------------ 284| 895k| for (j = 0; j < nBlocks_I; j++) { ------------------ | | 200| 895k|#define nBlocks_I ((PK_NROWS + 255) / 256) | | ------------------ | | | | 13| 895k|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 895k|#define SYS_T 128 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 895k|#define GFBITS 13 | | | | ------------------ | | ------------------ ------------------ | Branch (284:21): [True: 783k, False: 111k] ------------------ 285| 783k| vec256_mul(prod[j], prod[j], consts[j]); 286| | 287| 10.9M| for (k = 0; k < GFBITS; k++) { ------------------ | | 6| 10.9M|#define GFBITS 13 ------------------ | Branch (287:25): [True: 10.1M, False: 783k] ------------------ 288| 10.1M| mat.v[ i * GFBITS + k ][ j ] = prod[ j ][ k ]; ------------------ | | 6| 10.1M|#define GFBITS 13 ------------------ 289| 10.1M| } 290| 783k| } 291| 111k| } 292| | 293| | // gaussian elimination to obtain L, U, and P such that LP M = U 294| | // L and U are stored in the space of M 295| | // P is stored in ind 296| | 297| 1.46M| for (i = 0; i < PK_NROWS; i++) { ------------------ | | 13| 1.46M|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 1.46M|#define SYS_T 128 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 1.46M|#define GFBITS 13 | | ------------------ ------------------ | Branch (297:17): [True: 1.46M, False: 881] ------------------ 298| 1.46M| ind_inv[i] = ind[ i ] = i; 299| 1.46M| } 300| | 301| 1.46M| for (row = 0; row < PK_NROWS; row++) { ------------------ | | 13| 1.46M|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 1.46M|#define SYS_T 128 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 1.46M|#define GFBITS 13 | | ------------------ ------------------ | Branch (301:19): [True: 1.46M, False: 111] ------------------ 302| 1.46M| i = row >> 6; 303| 1.46M| j = row & 63; 304| | 305| 1.22G| for (k = row + 1; k < PK_NROWS; k++) { ------------------ | | 13| 1.22G|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 1.22G|#define SYS_T 128 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 1.22G|#define GFBITS 13 | | ------------------ ------------------ | Branch (305:27): [True: 1.21G, False: 1.46M] ------------------ 306| 1.21G| extract_01_masks(&m, mat.w[ row ], mat.w[ k ], row); 307| 1.21G| uint16_cswap(&ind[row], &ind[k], m); 308| | 309| 1.21G| mm = vec256_set1_16b(m); 310| 9.75G| for (c = 0; c < nBlocks_I; c++) { ------------------ | | 200| 9.75G|#define nBlocks_I ((PK_NROWS + 255) / 256) | | ------------------ | | | | 13| 9.75G|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 9.75G|#define SYS_T 128 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 9.75G|#define GFBITS 13 | | | | ------------------ | | ------------------ ------------------ | Branch (310:25): [True: 8.53G, False: 1.21G] ------------------ 311| 8.53G| vec256_cswap(&mat.v[ row ][ c ], &mat.v[ k ][ c ], mm); 312| 8.53G| } 313| 1.21G| } 314| | 315| 1.46M| if ( uint64_is_zero_declassify((mat.w[ row ][ i ] >> j) & 1) ) { // return if not systematic ------------------ | Branch (315:14): [True: 770, False: 1.46M] ------------------ 316| 770| return -1; 317| 770| } 318| | 319| 1.22G| for (k = row + 1; k < PK_NROWS; k++) { ------------------ | | 13| 1.22G|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 1.22G|#define SYS_T 128 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 1.22G|#define GFBITS 13 | | ------------------ ------------------ | Branch (319:27): [True: 1.21G, False: 1.46M] ------------------ 320| 1.21G| t = mat.w[ k ][ i ] & (one << j); 321| 1.21G| mm = extract_mask256(mat.w[k], row); 322| | 323| 9.75G| for (c = 0; c < nBlocks_I; c++) { ------------------ | | 200| 9.75G|#define nBlocks_I ((PK_NROWS + 255) / 256) | | ------------------ | | | | 13| 9.75G|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 9.75G|#define SYS_T 128 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 9.75G|#define GFBITS 13 | | | | ------------------ | | ------------------ ------------------ | Branch (323:25): [True: 8.53G, False: 1.21G] ------------------ 324| 8.53G| mat.v[ k ][ c ] ^= mat.v[ row ][ c ] & mm; 325| 8.53G| } 326| | 327| 1.21G| mat.w[ k ][ i ] |= t; 328| 1.21G| } 329| 1.46M| } 330| | 331| | // apply M^-1 to the remaining columns 332| | 333| 111| composeinv(PK_NROWS, ind_inv, ind_inv, ind); ------------------ | | 13| 111|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 111|#define SYS_T 128 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 111|#define GFBITS 13 | | ------------------ ------------------ 334| | 335| 444| for (j = 6; j < 27; j += par_width) { ------------------ | | 30| 333|#define par_width 7 ------------------ | Branch (335:17): [True: 333, False: 111] ------------------ 336| 4.66k| for (k = 0; k < GFBITS; k++) { ------------------ | | 6| 4.66k|#define GFBITS 13 ------------------ | Branch (336:21): [True: 4.32k, False: 333] ------------------ 337| 34.6k| for (b = 0; b < par_width; b++) { ------------------ | | 30| 34.6k|#define par_width 7 ------------------ | Branch (337:25): [True: 30.3k, False: 4.32k] ------------------ 338| 30.3k| par.v[ k ][ b ] = prod[ j + b ][ k ]; 339| 30.3k| } 340| 4.32k| } 341| | 342| 42.6k| for (i = 1; i < SYS_T; i++) { ------------------ | | 8| 42.6k|#define SYS_T 128 ------------------ | Branch (342:21): [True: 42.2k, False: 333] ------------------ 343| 338k| for (b = 0; b < par_width; b++) { ------------------ | | 30| 338k|#define par_width 7 ------------------ | Branch (343:25): [True: 296k, False: 42.2k] ------------------ 344| 296k| vec256_mul(prod[ j + b ], prod[ j + b ], consts[ j + b ]); 345| 296k| } 346| | 347| 592k| for (k = 0; k < GFBITS; k++) { ------------------ | | 6| 592k|#define GFBITS 13 ------------------ | Branch (347:25): [True: 549k, False: 42.2k] ------------------ 348| 4.39M| for (b = 0; b < par_width; b++) { ------------------ | | 30| 4.39M|#define par_width 7 ------------------ | Branch (348:29): [True: 3.84M, False: 549k] ------------------ 349| 3.84M| par.v[ i * GFBITS + k ][ b ] = prod[ j + b ][ k ]; ------------------ | | 6| 3.84M|#define GFBITS 13 ------------------ 350| 3.84M| } 351| 549k| } 352| 42.2k| } 353| | 354| | // apply P 355| | 356| 554k| for (i = 0; i < PK_NROWS; i++) { ------------------ | | 13| 554k|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 554k|#define SYS_T 128 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 554k|#define GFBITS 13 | | ------------------ ------------------ | Branch (356:21): [True: 554k, False: 333] ------------------ 357| 554k| ind[i] = ind_inv[i]; 358| 554k| } 359| | 360| 333| sort_rows((1 << GFBITS) / 4, PK_NROWS, ind, par.v, 0); ------------------ | | 6| 333|#define GFBITS 13 ------------------ sort_rows((1 << GFBITS) / 4, PK_NROWS, ind, par.v, 0); ------------------ | | 13| 333|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 333|#define SYS_T 128 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 333|#define GFBITS 13 | | ------------------ ------------------ 361| | 362| | // apply L 363| | 364| 554k| for (row = PK_NROWS - 1; row >= 0; row--) { ------------------ | | 13| 333|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 333|#define SYS_T 128 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 333|#define GFBITS 13 | | ------------------ ------------------ | Branch (364:34): [True: 554k, False: 333] ------------------ 365| 461M| for (i = row - 1; i >= 0; i--) { ------------------ | Branch (365:31): [True: 460M, False: 554k] ------------------ 366| 460M| mm = extract_mask256(mat.w[row], i); 367| | 368| 3.68G| for (k = 0; k < par_width; k++) { ------------------ | | 30| 3.68G|#define par_width 7 ------------------ | Branch (368:29): [True: 3.22G, False: 460M] ------------------ 369| 3.22G| par.v[ row ][ k ] ^= par.v[ i ][ k ] & mm; 370| 3.22G| } 371| 460M| } 372| 554k| } 373| | 374| | // apply U^-1 375| | 376| 333| if (j == 6) { ------------------ | Branch (376:13): [True: 111, False: 222] ------------------ 377| 184k| for (i = 0; i < PK_NROWS; i++) { ------------------ | | 13| 184k|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 184k|#define SYS_T 128 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 184k|#define GFBITS 13 | | ------------------ ------------------ | Branch (377:25): [True: 184k, False: 111] ------------------ 378| 184k| par.v[i][0] = mat.v[i][nBlocks_I - 1]; ------------------ | | 200| 184k|#define nBlocks_I ((PK_NROWS + 255) / 256) | | ------------------ | | | | 13| 184k|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 184k|#define SYS_T 128 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 184k|#define GFBITS 13 | | | | ------------------ | | ------------------ ------------------ 379| 184k| } 380| 111| } 381| | 382| 554k| for (row = PK_NROWS - 1; row >= 0; row--) { ------------------ | | 13| 333|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 333|#define SYS_T 128 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 333|#define GFBITS 13 | | ------------------ ------------------ | Branch (382:34): [True: 554k, False: 333] ------------------ 383| 461M| for (i = PK_NROWS - 1; i > row; i--) { ------------------ | | 13| 554k|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 554k|#define SYS_T 128 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 554k|#define GFBITS 13 | | ------------------ ------------------ | Branch (383:36): [True: 460M, False: 554k] ------------------ 384| 460M| mm = extract_mask256(mat.w[row], i); 385| | 386| 3.68G| for (k = 0; k < par_width; k++) { ------------------ | | 30| 3.68G|#define par_width 7 ------------------ | Branch (386:29): [True: 3.22G, False: 460M] ------------------ 387| 3.22G| par.v[ row ][ k ] ^= par.v[ i ][ k ] & mm; 388| 3.22G| } 389| 460M| } 390| 554k| } 391| | 392| 333| if (j + par_width < 27) { ------------------ | | 30| 333|#define par_width 7 ------------------ | Branch (392:13): [True: 222, False: 111] ------------------ 393| 369k| for (row = 0; row < PK_NROWS; row++) { ------------------ | | 13| 369k|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 369k|#define SYS_T 128 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 369k|#define GFBITS 13 | | ------------------ ------------------ | Branch (393:27): [True: 369k, False: 222] ------------------ 394| 369k| if (j == 6) { ------------------ | Branch (394:21): [True: 184k, False: 184k] ------------------ 395| 184k| k = 2; 396| 184k| } else { 397| 184k| k = 0; 398| 184k| } 399| 10.3M| for (; k < 28; k++) { ------------------ | Branch (399:24): [True: 9.97M, False: 369k] ------------------ 400| 9.97M| store8(pk + PK_ROW_BYTES * row + j * 32 + k * 8 - 13 * 16, par.w[row][k]); ------------------ | | 15| 9.97M|#define PK_ROW_BYTES ((PK_NCOLS + 7)/8) | | ------------------ | | | | 14| 9.97M|#define PK_NCOLS (SYS_N - PK_NROWS) | | | | ------------------ | | | | | | 7| 9.97M|#define SYS_N 6688 | | | | ------------------ | | | | #define PK_NCOLS (SYS_N - PK_NROWS) | | | | ------------------ | | | | | | 13| 9.97M|#define PK_NROWS (SYS_T*GFBITS) | | | | | | ------------------ | | | | | | | | 8| 9.97M|#define SYS_T 128 | | | | | | ------------------ | | | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | | | ------------------ | | | | | | | | 6| 9.97M|#define GFBITS 13 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 401| 9.97M| } 402| 369k| } 403| 222| } else { 404| 184k| for (row = 0; row < PK_NROWS; row++) { ------------------ | | 13| 184k|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 184k|#define SYS_T 128 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 184k|#define GFBITS 13 | | ------------------ ------------------ | Branch (404:27): [True: 184k, False: 111] ------------------ 405| 4.61M| for (k = 0; k < 24; k++) { ------------------ | Branch (405:29): [True: 4.43M, False: 184k] ------------------ 406| 4.43M| store8(pk + PK_ROW_BYTES * row + j * 32 + k * 8 - 13 * 16, par.w[row][k]); ------------------ | | 15| 4.43M|#define PK_ROW_BYTES ((PK_NCOLS + 7)/8) | | ------------------ | | | | 14| 4.43M|#define PK_NCOLS (SYS_N - PK_NROWS) | | | | ------------------ | | | | | | 7| 4.43M|#define SYS_N 6688 | | | | ------------------ | | | | #define PK_NCOLS (SYS_N - PK_NROWS) | | | | ------------------ | | | | | | 13| 4.43M|#define PK_NROWS (SYS_T*GFBITS) | | | | | | ------------------ | | | | | | | | 8| 4.43M|#define SYS_T 128 | | | | | | ------------------ | | | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | | | ------------------ | | | | | | | | 6| 4.43M|#define GFBITS 13 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 407| 4.43M| } 408| | 409| 184k| store_i(pk + PK_ROW_BYTES * row + j * 32 + k * 8 - 13 * 16, par.w[row][k], 4); ------------------ | | 15| 184k|#define PK_ROW_BYTES ((PK_NCOLS + 7)/8) | | ------------------ | | | | 14| 184k|#define PK_NCOLS (SYS_N - PK_NROWS) | | | | ------------------ | | | | | | 7| 184k|#define SYS_N 6688 | | | | ------------------ | | | | #define PK_NCOLS (SYS_N - PK_NROWS) | | | | ------------------ | | | | | | 13| 184k|#define PK_NROWS (SYS_T*GFBITS) | | | | | | ------------------ | | | | | | | | 8| 184k|#define SYS_T 128 | | | | | | ------------------ | | | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | | | ------------------ | | | | | | | | 6| 184k|#define GFBITS 13 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 410| 184k| } 411| 111| } 412| 333| } 413| | 414| | // 415| | 416| 111| return 0; 417| 881|} PQCLEAN_MCELIECE6688128_AVX2_genpoly_gen: 88| 919|int genpoly_gen(gf *out, gf *f) { 89| 919| int i, j, k; 90| | 91| 919| gf t, inv; 92| | 93| 919| uint64_t m; 94| 919| vec128 mask; 95| | 96| 919| union { 97| 919| uint64_t d[ GFBITS ][ 128 ][2]; 98| 919| vec128 v[ GFBITS ][ 128 ]; 99| 919| } buf; 100| | 101| 919| union { 102| 919| uint64_t d[GFBITS][2]; 103| 919| vec128 v[GFBITS]; 104| 919| } v; 105| | 106| 919| union { 107| 919| uint64_t d[SYS_T][GFBITS][2]; 108| 919| vec128 v[SYS_T][GFBITS]; 109| 919| } mat; 110| | 111| | // fill matrix 112| | 113| 919| buf.v[0][0] = vec128_set2x(1, 0); 114| 11.9k| for (i = 1; i < GFBITS; i++) { ------------------ | | 6| 11.9k|#define GFBITS 13 ------------------ | Branch (114:17): [True: 11.0k, False: 919] ------------------ 115| 11.0k| buf.v[i][0] = vec128_setzero(); 116| 11.0k| } 117| | 118| 12.8k| for (j = 0; j < GFBITS; j++) { ------------------ | | 6| 12.8k|#define GFBITS 13 ------------------ | Branch (118:17): [True: 11.9k, False: 919] ------------------ 119| 11.9k| v.v[j] = vec128_setzero(); 120| | 121| 1.54M| for (i = SYS_T - 1; i >= 0; i--) { ------------------ | | 8| 11.9k|#define SYS_T 128 ------------------ | Branch (121:29): [True: 1.52M, False: 11.9k] ------------------ 122| 1.52M| v.d[j][1] <<= 1; 123| 1.52M| v.d[j][1] |= v.d[j][0] >> 63; 124| 1.52M| v.d[j][0] <<= 1; 125| 1.52M| v.d[j][0] |= (f[i] >> j) & 1; 126| 1.52M| } 127| 11.9k| } 128| | 129| 12.8k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 12.8k|#define GFBITS 13 ------------------ | Branch (129:17): [True: 11.9k, False: 919] ------------------ 130| 11.9k| buf.v[i][1] = v.v[i]; 131| 11.9k| } 132| | 133| 117k| for (k = 2; k <= SYS_T; k++) { ------------------ | | 8| 117k|#define SYS_T 128 ------------------ | Branch (133:17): [True: 116k, False: 919] ------------------ 134| 116k| vec128_mul_GF(v.v, v.v, f); ------------------ | | 11| 116k|#define vec128_mul_GF CRYPTO_NAMESPACE(vec128_mul_GF) | | ------------------ | | | | 4| 116k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128_AVX2_ ## fun | | ------------------ ------------------ 135| | 136| 116k| if (k < SYS_T) { ------------------ | | 8| 116k|#define SYS_T 128 ------------------ | Branch (136:13): [True: 115k, False: 919] ------------------ 137| 1.62M| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 1.62M|#define GFBITS 13 ------------------ | Branch (137:25): [True: 1.50M, False: 115k] ------------------ 138| 1.50M| buf.v[i][k] = v.v[i]; 139| 1.50M| } 140| 115k| } else { 141| 118k| for (i = 0; i < SYS_T; i++) { ------------------ | | 8| 118k|#define SYS_T 128 ------------------ | Branch (141:25): [True: 117k, False: 919] ------------------ 142| 117k| out[i] = extract_gf(v.d, i); 143| 117k| } 144| 919| } 145| 116k| } 146| | 147| 12.8k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 12.8k|#define GFBITS 13 ------------------ | Branch (147:17): [True: 11.9k, False: 919] ------------------ 148| 11.9k| transpose_128x128(buf.d[i]); 149| 11.9k| } 150| | 151| 118k| for (j = 0; j < SYS_T; j++) { ------------------ | | 8| 118k|#define SYS_T 128 ------------------ | Branch (151:17): [True: 117k, False: 919] ------------------ 152| 1.64M| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 1.64M|#define GFBITS 13 ------------------ | Branch (152:21): [True: 1.52M, False: 117k] ------------------ 153| 1.52M| mat.v[j][i] = buf.v[i][j]; 154| 1.52M| } 155| 117k| } 156| | 157| | // gaussian 158| | 159| 118k| for (i = 0; i < SYS_T; i++) { ------------------ | | 8| 118k|#define SYS_T 128 ------------------ | Branch (159:17): [True: 117k, False: 919] ------------------ 160| 7.58M| for (j = i + 1; j < SYS_T; j++) { ------------------ | | 8| 7.58M|#define SYS_T 128 ------------------ | Branch (160:25): [True: 7.46M, False: 117k] ------------------ 161| 7.46M| m = extract_bit(mat.d[i], i); 162| 7.46M| m -= 1; 163| 7.46M| mask = vec128_set2x(m, m); 164| | 165| 104M| for (k = 0; k < GFBITS; k++) { ------------------ | | 6| 104M|#define GFBITS 13 ------------------ | Branch (165:25): [True: 97.1M, False: 7.46M] ------------------ 166| 97.1M| mat.v[i][k] ^= mat.v[j][k] & mask; 167| 97.1M| } 168| | 169| 7.46M| out[i] ^= out[j] & m; 170| 7.46M| } 171| | 172| | // 173| | 174| 117k| t = extract_gf(mat.d[i], i); 175| | 176| 117k| if (gf_is_zero_declassify(t)) { ------------------ | Branch (176:13): [True: 0, False: 117k] ------------------ 177| 0| return -1; // return if not systematic 178| 0| } 179| | 180| | // 181| | 182| 117k| inv = gf_inv(t); ------------------ | | 11| 117k|#define gf_inv CRYPTO_NAMESPACE(gf_inv) | | ------------------ | | | | 4| 117k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128_AVX2_ ## fun | | ------------------ ------------------ 183| 117k| vec128_mul_gf(mat.v[i], mat.v[i], inv); 184| | 185| 117k| out[i] = gf_mul(out[i], inv); ------------------ | | 14| 117k|#define gf_mul CRYPTO_NAMESPACE(gf_mul) | | ------------------ | | | | 4| 117k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128_AVX2_ ## fun | | ------------------ ------------------ 186| | 187| 15.1M| for (j = 0; j < SYS_T; j++) { ------------------ | | 8| 15.1M|#define SYS_T 128 ------------------ | Branch (187:21): [True: 15.0M, False: 117k] ------------------ 188| 15.0M| if (j != i) { ------------------ | Branch (188:17): [True: 14.9M, False: 117k] ------------------ 189| 14.9M| t = extract_gf(mat.d[j], i); 190| | 191| 14.9M| vec128_mul_gf(v.v, mat.v[i], t); 192| 14.9M| vec128_add(mat.v[j], mat.v[j], v.v); 193| | 194| 14.9M| out[j] ^= gf_mul(out[i], t); ------------------ | | 14| 14.9M|#define gf_mul CRYPTO_NAMESPACE(gf_mul) | | ------------------ | | | | 4| 14.9M|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128_AVX2_ ## fun | | ------------------ ------------------ 195| 14.9M| } 196| 15.0M| } 197| 117k| } 198| | 199| 919| return 0; 200| 919|} PQCLEAN_MCELIECE6688128_AVX2_vec128_mul_GF: 6| 116k|void vec128_mul_GF(vec128 out[ GFBITS ], vec128 v[ GFBITS ], gf a[ SYS_T ]) { 7| 116k| int i, j; 8| 116k| uint64_t buf[GFBITS][4]; 9| 116k| vec128 prod[GFBITS]; 10| 116k| uint64_t p[GFBITS]; 11| | 12| | // polynomial multiplication 13| | 14| 1.63M| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 1.63M|#define GFBITS 13 ------------------ | Branch (14:17): [True: 1.51M, False: 116k] ------------------ 15| 1.51M| buf[i][0] = 0; 16| 1.51M| buf[i][1] = 0; 17| 1.51M| buf[i][2] = 0; 18| 1.51M| buf[i][3] = 0; 19| 1.51M| } 20| | 21| 15.0M| for (i = SYS_T - 1; i >= 0; i--) { ------------------ | | 8| 116k|#define SYS_T 128 ------------------ | Branch (21:25): [True: 14.9M, False: 116k] ------------------ 22| 209M| for (j = 0; j < GFBITS; j++) { ------------------ | | 6| 209M|#define GFBITS 13 ------------------ | Branch (22:21): [True: 194M, False: 14.9M] ------------------ 23| 194M| buf[j][3] <<= 1; 24| 194M| buf[j][3] |= buf[j][2] >> 63; 25| 194M| buf[j][2] <<= 1; 26| 194M| buf[j][2] |= buf[j][1] >> 63; 27| 194M| buf[j][1] <<= 1; 28| 194M| buf[j][1] |= buf[j][0] >> 63; 29| 194M| buf[j][0] <<= 1; 30| 194M| } 31| | 32| 14.9M| vec128_mul_gf(prod, v, a[i]); 33| | 34| 209M| for (j = 0; j < GFBITS; j++) { ------------------ | | 6| 209M|#define GFBITS 13 ------------------ | Branch (34:21): [True: 194M, False: 14.9M] ------------------ 35| 194M| buf[j][0] ^= vec128_extract(prod[j], 0); ------------------ | | 29| 194M|#define vec128_extract(a, i) ((uint64_t) _mm_extract_epi64((vec128) (a), (i))) ------------------ 36| 194M| buf[j][1] ^= vec128_extract(prod[j], 1); ------------------ | | 29| 194M|#define vec128_extract(a, i) ((uint64_t) _mm_extract_epi64((vec128) (a), (i))) ------------------ 37| 194M| } 38| 14.9M| } 39| | 40| | // reduction modulo y^128+y^7+y^2+y+1 41| | 42| 1.63M| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 1.63M|#define GFBITS 13 ------------------ | Branch (42:17): [True: 1.51M, False: 116k] ------------------ 43| 1.51M| p[i] = buf[i][3]; 44| | 45| 1.51M| buf[i][2] ^= p[i] >> (SYS_T - 7 - 64); ------------------ | | 8| 1.51M|#define SYS_T 128 ------------------ 46| 1.51M| buf[i][1] ^= p[i] << (64 - (SYS_T - 7 - 64)); ------------------ | | 8| 1.51M|#define SYS_T 128 ------------------ 47| 1.51M| buf[i][2] ^= p[i] >> (SYS_T - 2 - 64); ------------------ | | 8| 1.51M|#define SYS_T 128 ------------------ 48| 1.51M| buf[i][1] ^= p[i] << (64 - (SYS_T - 2 - 64)); ------------------ | | 8| 1.51M|#define SYS_T 128 ------------------ 49| 1.51M| buf[i][2] ^= p[i] >> (SYS_T - 1 - 64); ------------------ | | 8| 1.51M|#define SYS_T 128 ------------------ 50| 1.51M| buf[i][1] ^= p[i] << (64 - (SYS_T - 1 - 64)); ------------------ | | 8| 1.51M|#define SYS_T 128 ------------------ 51| 1.51M| buf[i][1] ^= p[i]; 52| 1.51M| } 53| | 54| | // 55| | 56| 1.63M| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 1.63M|#define GFBITS 13 ------------------ | Branch (56:17): [True: 1.51M, False: 116k] ------------------ 57| 1.51M| p[i] = buf[i][2]; 58| | 59| 1.51M| buf[i][1] ^= p[i] >> (SYS_T - 7 - 64); ------------------ | | 8| 1.51M|#define SYS_T 128 ------------------ 60| 1.51M| buf[i][0] ^= p[i] << (64 - (SYS_T - 7 - 64)); ------------------ | | 8| 1.51M|#define SYS_T 128 ------------------ 61| 1.51M| buf[i][1] ^= p[i] >> (SYS_T - 2 - 64); ------------------ | | 8| 1.51M|#define SYS_T 128 ------------------ 62| 1.51M| buf[i][0] ^= p[i] << (64 - (SYS_T - 2 - 64)); ------------------ | | 8| 1.51M|#define SYS_T 128 ------------------ 63| 1.51M| buf[i][1] ^= p[i] >> (SYS_T - 1 - 64); ------------------ | | 8| 1.51M|#define SYS_T 128 ------------------ 64| 1.51M| buf[i][0] ^= p[i] << (64 - (SYS_T - 1 - 64)); ------------------ | | 8| 1.51M|#define SYS_T 128 ------------------ 65| 1.51M| buf[i][0] ^= p[i]; 66| 1.51M| } 67| | 68| | // 69| | 70| 1.63M| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 1.63M|#define GFBITS 13 ------------------ | Branch (70:17): [True: 1.51M, False: 116k] ------------------ 71| 1.51M| out[i] = vec128_set2x(buf[i][0], buf[i][1]); 72| 1.51M| } 73| 116k|} PQCLEAN_MCELIECE6688128_AVX2_vec256_sq: 9| 15.9k|void vec256_sq(vec256 *out, vec256 *in) { 10| 15.9k| int i; 11| 15.9k| vec256 result[GFBITS], t; 12| | 13| 15.9k| t = vec256_xor(in[11], in[12]); 14| | 15| 15.9k| result[0] = vec256_xor(in[0], in[11]); 16| 15.9k| result[1] = vec256_xor(in[7], t); 17| 15.9k| result[2] = vec256_xor(in[1], in[7]); 18| 15.9k| result[3] = vec256_xor(in[8], t); 19| 15.9k| result[4] = vec256_xor(in[2], in[7]); 20| 15.9k| result[4] = vec256_xor(result[4], in[8]); 21| 15.9k| result[4] = vec256_xor(result[4], t); 22| 15.9k| result[5] = vec256_xor(in[7], in[9]); 23| 15.9k| result[6] = vec256_xor(in[3], in[8]); 24| 15.9k| result[6] = vec256_xor(result[6], in[9]); 25| 15.9k| result[6] = vec256_xor(result[6], in[12]); 26| 15.9k| result[7] = vec256_xor(in[8], in[10]); 27| 15.9k| result[8] = vec256_xor(in[4], in[9]); 28| 15.9k| result[8] = vec256_xor(result[8], in[10]); 29| 15.9k| result[9] = vec256_xor(in[9], in[11]); 30| 15.9k| result[10] = vec256_xor(in[5], in[10]); 31| 15.9k| result[10] = vec256_xor(result[10], in[11]); 32| 15.9k| result[11] = vec256_xor(in[10], in[12]); 33| 15.9k| result[12] = vec256_xor(in[6], t); 34| | 35| 222k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 222k|#define GFBITS 13 ------------------ | Branch (35:17): [True: 206k, False: 15.9k] ------------------ 36| 206k| out[i] = result[i]; 37| 206k| } 38| 15.9k|} PQCLEAN_MCELIECE6688128_AVX2_vec256_inv: 41| 1.03k|void vec256_inv(vec256 *out, vec256 *in) { 42| 1.03k| vec256 tmp_11[ GFBITS ]; 43| 1.03k| vec256 tmp_1111[ GFBITS ]; 44| | 45| 1.03k| vec256_copy(out, in); 46| | 47| 1.03k| vec256_sq(out, out); ------------------ | | 14| 1.03k|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 1.03k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128_AVX2_ ## fun | | ------------------ ------------------ 48| 1.03k| vec256_mul(tmp_11, out, in); // ^11 49| | 50| 1.03k| vec256_sq(out, tmp_11); ------------------ | | 14| 1.03k|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 1.03k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128_AVX2_ ## fun | | ------------------ ------------------ 51| 1.03k| vec256_sq(out, out); ------------------ | | 14| 1.03k|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 1.03k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128_AVX2_ ## fun | | ------------------ ------------------ 52| 1.03k| vec256_mul(tmp_1111, out, tmp_11); // ^1111 53| | 54| 1.03k| vec256_sq(out, tmp_1111); ------------------ | | 14| 1.03k|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 1.03k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128_AVX2_ ## fun | | ------------------ ------------------ 55| 1.03k| vec256_sq(out, out); ------------------ | | 14| 1.03k|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 1.03k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128_AVX2_ ## fun | | ------------------ ------------------ 56| 1.03k| vec256_sq(out, out); ------------------ | | 14| 1.03k|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 1.03k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128_AVX2_ ## fun | | ------------------ ------------------ 57| 1.03k| vec256_sq(out, out); ------------------ | | 14| 1.03k|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 1.03k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128_AVX2_ ## fun | | ------------------ ------------------ 58| 1.03k| vec256_mul(out, out, tmp_1111); // ^11111111 59| | 60| 1.03k| vec256_sq(out, out); ------------------ | | 14| 1.03k|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 1.03k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128_AVX2_ ## fun | | ------------------ ------------------ 61| 1.03k| vec256_sq(out, out); ------------------ | | 14| 1.03k|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 1.03k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128_AVX2_ ## fun | | ------------------ ------------------ 62| 1.03k| vec256_sq(out, out); ------------------ | | 14| 1.03k|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 1.03k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128_AVX2_ ## fun | | ------------------ ------------------ 63| 1.03k| vec256_sq(out, out); ------------------ | | 14| 1.03k|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 1.03k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128_AVX2_ ## fun | | ------------------ ------------------ 64| 1.03k| vec256_mul(out, out, tmp_1111); // ^111111111111 65| | 66| 1.03k| vec256_sq(out, out); // ^1111111111110 ------------------ | | 14| 1.03k|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 1.03k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128_AVX2_ ## fun | | ------------------ ------------------ 67| 1.03k|} PQCLEAN_MCELIECE6688128F_AVX2_load_bits: 188| 92|void load_bits(vec128 bits_int[][32], const unsigned char *bits) { 189| 92| int i, j; 190| 92| const unsigned char *ptr = bits; 191| | 192| 92| vec128 buf[64]; 193| | 194| 368| for (i = 0; i <= 5; i += 2) { ------------------ | Branch (194:17): [True: 276, False: 92] ------------------ 195| 17.9k| for (j = 0; j < 64; j++) { ------------------ | Branch (195:21): [True: 17.6k, False: 276] ------------------ 196| 17.6k| buf[j] = vec128_set2x(load8(ptr), load8(ptr + 512)); 197| 17.6k| ptr += 8; 198| 17.6k| } 199| | 200| 276| transpose_64x128_sp( buf ); 201| | 202| 9.10k| for (j = 0; j < 32; j++) { ------------------ | Branch (202:21): [True: 8.83k, False: 276] ------------------ 203| 8.83k| bits_int[i + 0][j] = vec128_unpack_low(buf[j], buf[j + 32]); 204| 8.83k| bits_int[i + 1][j] = vec128_unpack_high(buf[j], buf[j + 32]); 205| 8.83k| } 206| | 207| 276| ptr += 512; 208| 276| } 209| | 210| 1.28k| for (i = 6; i <= 18; i++) { ------------------ | Branch (210:17): [True: 1.19k, False: 92] ------------------ 211| 39.4k| for (j = 0; j < 32; j++) { ------------------ | Branch (211:21): [True: 38.2k, False: 1.19k] ------------------ 212| 38.2k| bits_int[i][j] = load16(ptr); 213| 38.2k| ptr += 16; 214| 38.2k| } 215| 1.19k| } 216| | 217| 368| for (i = 19; i < 25; i += 2) { ------------------ | Branch (217:18): [True: 276, False: 92] ------------------ 218| 17.9k| for (j = 0; j < 64; j++) { ------------------ | Branch (218:21): [True: 17.6k, False: 276] ------------------ 219| 17.6k| buf[j] = vec128_set2x(load8(ptr), load8(ptr + 512)); 220| 17.6k| ptr += 8; 221| 17.6k| } 222| | 223| 276| transpose_64x128_sp( buf ); 224| | 225| 9.10k| for (j = 0; j < 32; j++) { ------------------ | Branch (225:21): [True: 8.83k, False: 276] ------------------ 226| 8.83k| bits_int[i + 0][j] = vec128_unpack_low(buf[j], buf[j + 32]); 227| 8.83k| bits_int[i + 1][j] = vec128_unpack_high(buf[j], buf[j + 32]); 228| 8.83k| } 229| | 230| 276| ptr += 512; 231| 276| } 232| 92|} PQCLEAN_MCELIECE6688128F_AVX2_benes: 238| 184|void benes(vec128 *r, vec128 b[][32], int rev) { 239| 184| int inc; 240| | 241| 184| vec128 *b_ptr; 242| | 243| 184| if (rev == 0) { ------------------ | Branch (243:9): [True: 92, False: 92] ------------------ 244| 92| inc = 32; 245| 92| b_ptr = b[ 0]; 246| 92| } else { 247| 92| inc = -32; 248| 92| b_ptr = b[24]; 249| 92| } 250| | 251| | // 252| | 253| 184| transpose_64x128_sp( r ); 254| | 255| 184| layer_0(r, b_ptr); 256| 184| b_ptr += inc; 257| 184| layer_1(r, b_ptr); 258| 184| b_ptr += inc; 259| 184| layer_2(r, b_ptr); 260| 184| b_ptr += inc; 261| 184| layer_3(r, b_ptr); 262| 184| b_ptr += inc; 263| 184| layer_4(r, b_ptr); 264| 184| b_ptr += inc; 265| 184| layer_5(r, b_ptr); 266| 184| b_ptr += inc; 267| | 268| 184| transpose_64x128_sp( r ); 269| | 270| 184| layer_x(r, b_ptr); 271| 184| b_ptr += inc; 272| 184| layer_0(r, b_ptr); 273| 184| b_ptr += inc; 274| 184| layer_1(r, b_ptr); 275| 184| b_ptr += inc; 276| 184| layer_2(r, b_ptr); 277| 184| b_ptr += inc; 278| 184| layer_3(r, b_ptr); 279| 184| b_ptr += inc; 280| 184| layer_4(r, b_ptr); 281| 184| b_ptr += inc; 282| 184| layer_5(r, b_ptr); 283| 184| b_ptr += inc; 284| 184| layer_4(r, b_ptr); 285| 184| b_ptr += inc; 286| 184| layer_3(r, b_ptr); 287| 184| b_ptr += inc; 288| 184| layer_2(r, b_ptr); 289| 184| b_ptr += inc; 290| 184| layer_1(r, b_ptr); 291| 184| b_ptr += inc; 292| 184| layer_0(r, b_ptr); 293| 184| b_ptr += inc; 294| 184| layer_x(r, b_ptr); 295| 184| b_ptr += inc; 296| | 297| 184| transpose_64x128_sp( r ); 298| | 299| 184| layer_5(r, b_ptr); 300| 184| b_ptr += inc; 301| 184| layer_4(r, b_ptr); 302| 184| b_ptr += inc; 303| 184| layer_3(r, b_ptr); 304| 184| b_ptr += inc; 305| 184| layer_2(r, b_ptr); 306| 184| b_ptr += inc; 307| 184| layer_1(r, b_ptr); 308| 184| b_ptr += inc; 309| 184| layer_0(r, b_ptr); 310| | 311| 184| transpose_64x128_sp( r ); 312| 184|} PQCLEAN_MCELIECE6688128F_AVX2_bm: 147| 92|void bm(vec128 *out, vec256 *in) { 148| 92| int i; 149| 92| uint16_t N, L; 150| 92| uint16_t mask; 151| 92| uint64_t one = 1, t; 152| | 153| 92| vec128 prod[ GFBITS ]; 154| 92| vec128 interval[GFBITS]; 155| | 156| 92| typedef union { 157| 92| vec128 v[GFBITS][2]; 158| 92| vec256 V[GFBITS]; 159| 92| } db_t; 160| | 161| 92| db_t db; 162| 92| db_t BC_tmp; 163| 92| db_t BC; 164| | 165| 92| gf d, b, c0 = 1; 166| 92| gf coefs[256]; 167| | 168| | // initialization 169| | 170| 92| get_coefs(coefs, in); 171| | 172| 92| BC.v[0][0] = vec128_set2x(0, one << 63); 173| 92| BC.v[0][1] = vec128_setzero(); 174| | 175| 1.19k| for (i = 1; i < GFBITS; i++) { ------------------ | | 6| 1.19k|#define GFBITS 13 ------------------ | Branch (175:17): [True: 1.10k, False: 92] ------------------ 176| 1.10k| BC.v[i][0] = BC.v[i][1] = vec128_setzero(); 177| 1.10k| } 178| | 179| 92| b = 1; 180| 92| L = 0; 181| | 182| | // 183| | 184| 1.28k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 1.28k|#define GFBITS 13 ------------------ | Branch (184:17): [True: 1.19k, False: 92] ------------------ 185| 1.19k| interval[i] = vec128_setzero(); 186| 1.19k| } 187| | 188| 23.6k| for (N = 0; N < 256; N++) { ------------------ | Branch (188:17): [True: 23.5k, False: 92] ------------------ 189| 23.5k| vec128_mul_asm(prod, interval, BC.v[0] + 1, 32); ------------------ | | 10| 23.5k|#define vec128_mul_asm CRYPTO_NAMESPACE(vec128_mul_asm) | | ------------------ | | | | 4| 23.5k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128F_AVX2_ ## fun | | ------------------ ------------------ 190| 23.5k| update_asm(interval, coefs[N], 16); ------------------ | | 1| 23.5k|#define update_asm CRYPTO_NAMESPACE(update_asm) | | ------------------ | | | | 4| 23.5k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128F_AVX2_ ## fun | | ------------------ ------------------ 191| | 192| 23.5k| d = vec_reduce_asm(prod); ------------------ | | 3| 23.5k|#define vec_reduce_asm CRYPTO_NAMESPACE(vec_reduce_asm) | | ------------------ | | | | 4| 23.5k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128F_AVX2_ ## fun | | ------------------ ------------------ 193| | 194| 23.5k| t = gf_mul2(c0, coefs[N], b); ------------------ | | 13| 23.5k|#define gf_mul2 CRYPTO_NAMESPACE(gf_mul2) | | ------------------ | | | | 4| 23.5k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128F_AVX2_ ## fun | | ------------------ ------------------ 195| 23.5k| d ^= t & 0xFFFFFFFF; 196| | 197| 23.5k| mask = mask_nonzero(d) & mask_leq(L * 2, N); 198| | 199| 329k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 329k|#define GFBITS 13 ------------------ | Branch (199:21): [True: 306k, False: 23.5k] ------------------ 200| 306k| db.v[i][0] = vec128_setbits((d >> i) & 1); 201| 306k| db.v[i][1] = vec128_setbits((b >> i) & 1); 202| 306k| } 203| | 204| 23.5k| vec256_mul((vec256 *) BC_tmp.V, (vec256 *) db.V, (vec256 *) BC.V); 205| | 206| 23.5k| vec128_cmov(BC.v, mask); 207| 23.5k| update_asm(BC.v, c0 & mask, 32); ------------------ | | 1| 23.5k|#define update_asm CRYPTO_NAMESPACE(update_asm) | | ------------------ | | | | 4| 23.5k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128F_AVX2_ ## fun | | ------------------ ------------------ 208| | 209| 329k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 329k|#define GFBITS 13 ------------------ | Branch (209:21): [True: 306k, False: 23.5k] ------------------ 210| 306k| BC.v[i][1] = vec128_xor(BC_tmp.v[i][0], BC_tmp.v[i][1]); 211| 306k| } 212| | 213| 23.5k| c0 = t >> 32; 214| 23.5k| b = (d & mask) | (b & ~mask); 215| 23.5k| L = ((N + 1 - L) & mask) | (L & ~mask); 216| 23.5k| } 217| | 218| 92| c0 = gf_inv(c0); ------------------ | | 11| 92|#define gf_inv CRYPTO_NAMESPACE(gf_inv) | | ------------------ | | | | 4| 92|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128F_AVX2_ ## fun | | ------------------ ------------------ 219| | 220| 1.28k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 1.28k|#define GFBITS 13 ------------------ | Branch (220:17): [True: 1.19k, False: 92] ------------------ 221| 1.19k| prod[i] = vec128_setbits((c0 >> i) & 1); 222| 1.19k| } 223| | 224| 92| vec128_mul_asm(out, prod, BC.v[0] + 1, 32); ------------------ | | 10| 92|#define vec128_mul_asm CRYPTO_NAMESPACE(vec128_mul_asm) | | ------------------ | | | | 4| 92|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128F_AVX2_ ## fun | | ------------------ ------------------ 225| 92|} PQCLEAN_MCELIECE6688128F_AVX2_controlbitsfrompermutation: 205| 92|void controlbitsfrompermutation(unsigned char *out, const int16 *pi, long long w, long long n) { 206| 92| PQCLEAN_VLA(int32, temp, (size_t)(2 * n)); ------------------ | | 57| 92|# define PQCLEAN_VLA(__t,__x,__s) __t __x[__s] ------------------ 207| 92| PQCLEAN_VLA(int16, pi_test, (size_t)n); ------------------ | | 57| 92|# define PQCLEAN_VLA(__t,__x,__s) __t __x[__s] ------------------ 208| 92| int16 diff; 209| 92| int i; 210| 92| unsigned char *ptr; 211| | 212| 92| OQS_MEM_cleanse(temp, (size_t)n * 2); 213| 92| OQS_MEM_cleanse(pi_test, (size_t)n); 214| | 215| 92| while (1) { ------------------ | Branch (215:12): [True: 92, Folded] ------------------ 216| 92| OQS_MEM_cleanse(out, (size_t)((((2 * w - 1)*n / 2) + 7) / 8)); 217| 92| cbrecursion(out, 0, 1, pi, w, n, temp); 218| | 219| | // check for correctness 220| | 221| 753k| for (i = 0; i < n; i++) { ------------------ | Branch (221:21): [True: 753k, False: 92] ------------------ 222| 753k| pi_test[i] = (int16)i; 223| 753k| } 224| | 225| 92| ptr = out; 226| 1.28k| for (i = 0; i < w; i++) { ------------------ | Branch (226:21): [True: 1.19k, False: 92] ------------------ 227| 1.19k| layer(pi_test, ptr, i, (int32)n); 228| 1.19k| ptr += n >> 4; 229| 1.19k| } 230| | 231| 1.19k| for (i = (int)(w - 2); i >= 0; i--) { ------------------ | Branch (231:32): [True: 1.10k, False: 92] ------------------ 232| 1.10k| layer(pi_test, ptr, i, (int32)n); 233| 1.10k| ptr += n >> 4; 234| 1.10k| } 235| | 236| 92| diff = 0; 237| 753k| for (i = 0; i < n; i++) { ------------------ | Branch (237:21): [True: 753k, False: 92] ------------------ 238| 753k| diff |= pi[i] ^ pi_test[i]; 239| 753k| } 240| | 241| 92| diff = crypto_int16_nonzero_mask(diff); ------------------ | | 12| 92|#define crypto_int16_nonzero_mask CRYPTO_NAMESPACE(crypto_int16_nonzero_mask) | | ------------------ | | | | 4| 92|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128F_AVX2_ ## fun | | ------------------ ------------------ 242| 92| crypto_declassify(&diff, sizeof diff); 243| 92| if (diff == 0) { ------------------ | Branch (243:13): [True: 92, False: 0] ------------------ 244| 92| break; 245| 92| } 246| 92| } 247| 92|} PQCLEAN_MCELIECE6688128F_AVX2_crypto_int16_negative_mask: 3| 184|crypto_int16 crypto_int16_negative_mask(crypto_int16 crypto_int16_x) { 4| 184| return crypto_int16_x >> 15; 5| 184|} PQCLEAN_MCELIECE6688128F_AVX2_crypto_int16_nonzero_mask: 7| 92|crypto_int16 crypto_int16_nonzero_mask(crypto_int16 crypto_int16_x) { 8| 92| return crypto_int16_negative_mask(crypto_int16_x) | crypto_int16_negative_mask(-crypto_int16_x); ------------------ | | 10| 92|#define crypto_int16_negative_mask CRYPTO_NAMESPACE(crypto_int16_negative_mask) | | ------------------ | | | | 4| 92|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128F_AVX2_ ## fun | | ------------------ ------------------ return crypto_int16_negative_mask(crypto_int16_x) | crypto_int16_negative_mask(-crypto_int16_x); ------------------ | | 10| 92|#define crypto_int16_negative_mask CRYPTO_NAMESPACE(crypto_int16_negative_mask) | | ------------------ | | | | 4| 92|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128F_AVX2_ ## fun | | ------------------ ------------------ 9| 92|} PQCLEAN_MCELIECE6688128F_AVX2_crypto_int32_negative_mask: 3| 58.7M|crypto_int32 crypto_int32_negative_mask(crypto_int32 crypto_int32_x) { 4| 58.7M| return crypto_int32_x >> 31; 5| 58.7M|} PQCLEAN_MCELIECE6688128F_AVX2_crypto_int32_min: 37| 58.7M|crypto_int32 crypto_int32_min(crypto_int32 crypto_int32_x, crypto_int32 crypto_int32_y) { 38| 58.7M| crypto_int32 crypto_int32_xy = crypto_int32_y ^ crypto_int32_x; 39| 58.7M| crypto_int32 crypto_int32_z = crypto_int32_y - crypto_int32_x; 40| 58.7M| crypto_int32_z ^= crypto_int32_xy & (crypto_int32_z ^ crypto_int32_y); 41| 58.7M| crypto_int32_z = crypto_int32_negative_mask(crypto_int32_z); ------------------ | | 9| 58.7M|#define crypto_int32_negative_mask CRYPTO_NAMESPACE(crypto_int32_negative_mask) | | ------------------ | | | | 4| 58.7M|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128F_AVX2_ ## fun | | ------------------ ------------------ 42| 58.7M| crypto_int32_z &= crypto_int32_xy; 43| 58.7M| return crypto_int32_x ^ crypto_int32_z; 44| 58.7M|} PQCLEAN_MCELIECE6688128F_AVX2_crypto_uint16_signed_negative_mask: 3| 126k|crypto_uint16_signed crypto_uint16_signed_negative_mask(crypto_uint16_signed crypto_uint16_signed_x) { 4| 126k| return crypto_uint16_signed_x >> 15; 5| 126k|} PQCLEAN_MCELIECE6688128F_AVX2_crypto_uint16_nonzero_mask: 7| 15.1k|crypto_uint16 crypto_uint16_nonzero_mask(crypto_uint16 crypto_uint16_x) { 8| 15.1k| return crypto_uint16_signed_negative_mask(crypto_uint16_x) | crypto_uint16_signed_negative_mask(-crypto_uint16_x); ------------------ | | 11| 15.1k|#define crypto_uint16_signed_negative_mask CRYPTO_NAMESPACE(crypto_uint16_signed_negative_mask) | | ------------------ | | | | 4| 15.1k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128F_AVX2_ ## fun | | ------------------ ------------------ return crypto_uint16_signed_negative_mask(crypto_uint16_x) | crypto_uint16_signed_negative_mask(-crypto_uint16_x); ------------------ | | 11| 15.1k|#define crypto_uint16_signed_negative_mask CRYPTO_NAMESPACE(crypto_uint16_signed_negative_mask) | | ------------------ | | | | 4| 15.1k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128F_AVX2_ ## fun | | ------------------ ------------------ 9| 15.1k|} PQCLEAN_MCELIECE6688128F_AVX2_crypto_uint16_zero_mask: 11| 15.1k|crypto_uint16 crypto_uint16_zero_mask(crypto_uint16 crypto_uint16_x) { 12| 15.1k| return ~crypto_uint16_nonzero_mask(crypto_uint16_x); ------------------ | | 13| 15.1k|#define crypto_uint16_nonzero_mask CRYPTO_NAMESPACE(crypto_uint16_nonzero_mask) | | ------------------ | | | | 4| 15.1k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128F_AVX2_ ## fun | | ------------------ ------------------ 13| 15.1k|} PQCLEAN_MCELIECE6688128F_AVX2_crypto_uint16_smaller_mask: 24| 96.7k|crypto_uint16 crypto_uint16_smaller_mask(crypto_uint16 crypto_uint16_x, crypto_uint16 crypto_uint16_y) { 25| 96.7k| crypto_uint16 crypto_uint16_xy = crypto_uint16_x ^ crypto_uint16_y; 26| 96.7k| crypto_uint16 crypto_uint16_z = crypto_uint16_x - crypto_uint16_y; 27| 96.7k| crypto_uint16_z ^= crypto_uint16_xy & (crypto_uint16_z ^ crypto_uint16_x ^ (((crypto_uint16) 1) << 15)); 28| 96.7k| return crypto_uint16_signed_negative_mask(crypto_uint16_z); ------------------ | | 11| 96.7k|#define crypto_uint16_signed_negative_mask CRYPTO_NAMESPACE(crypto_uint16_signed_negative_mask) | | ------------------ | | | | 4| 96.7k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128F_AVX2_ ## fun | | ------------------ ------------------ 29| 96.7k|} PQCLEAN_MCELIECE6688128F_AVX2_crypto_uint32_signed_negative_mask: 3| 156k|crypto_uint32_signed crypto_uint32_signed_negative_mask(crypto_uint32_signed crypto_uint32_signed_x) { 4| 156k| return crypto_uint32_signed_x >> 31; 5| 156k|} PQCLEAN_MCELIECE6688128F_AVX2_crypto_uint32_nonzero_mask: 7| 78.4k|crypto_uint32 crypto_uint32_nonzero_mask(crypto_uint32 crypto_uint32_x) { 8| 78.4k| return crypto_uint32_signed_negative_mask(crypto_uint32_x) | crypto_uint32_signed_negative_mask(-crypto_uint32_x); ------------------ | | 11| 78.4k|#define crypto_uint32_signed_negative_mask CRYPTO_NAMESPACE(crypto_uint32_signed_negative_mask) | | ------------------ | | | | 4| 78.4k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128F_AVX2_ ## fun | | ------------------ ------------------ return crypto_uint32_signed_negative_mask(crypto_uint32_x) | crypto_uint32_signed_negative_mask(-crypto_uint32_x); ------------------ | | 11| 78.4k|#define crypto_uint32_signed_negative_mask CRYPTO_NAMESPACE(crypto_uint32_signed_negative_mask) | | ------------------ | | | | 4| 78.4k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128F_AVX2_ ## fun | | ------------------ ------------------ 9| 78.4k|} PQCLEAN_MCELIECE6688128F_AVX2_crypto_uint32_unequal_mask: 15| 78.4k|crypto_uint32 crypto_uint32_unequal_mask(crypto_uint32 crypto_uint32_x, crypto_uint32 crypto_uint32_y) { 16| 78.4k| crypto_uint32 crypto_uint32_xy = crypto_uint32_x ^ crypto_uint32_y; 17| 78.4k| return crypto_uint32_nonzero_mask(crypto_uint32_xy); ------------------ | | 13| 78.4k|#define crypto_uint32_nonzero_mask CRYPTO_NAMESPACE(crypto_uint32_nonzero_mask) | | ------------------ | | | | 4| 78.4k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128F_AVX2_ ## fun | | ------------------ ------------------ 18| 78.4k|} PQCLEAN_MCELIECE6688128F_AVX2_crypto_uint32_equal_mask: 20| 78.4k|crypto_uint32 crypto_uint32_equal_mask(crypto_uint32 crypto_uint32_x, crypto_uint32 crypto_uint32_y) { 21| 78.4k| return ~crypto_uint32_unequal_mask(crypto_uint32_x, crypto_uint32_y); ------------------ | | 17| 78.4k|#define crypto_uint32_unequal_mask CRYPTO_NAMESPACE(crypto_uint32_unequal_mask) | | ------------------ | | | | 4| 78.4k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128F_AVX2_ ## fun | | ------------------ ------------------ 22| 78.4k|} PQCLEAN_MCELIECE6688128F_AVX2_crypto_uint64_signed_negative_mask: 3| 2.04M|crypto_uint64_signed crypto_uint64_signed_negative_mask(crypto_uint64_signed crypto_uint64_signed_x) { 4| 2.04M| return crypto_uint64_signed_x >> 63; 5| 2.04M|} PQCLEAN_MCELIECE6688128F_AVX2_crypto_uint64_nonzero_mask: 7| 1.02M|crypto_uint64 crypto_uint64_nonzero_mask(crypto_uint64 crypto_uint64_x) { 8| 1.02M| return crypto_uint64_signed_negative_mask(crypto_uint64_x) | crypto_uint64_signed_negative_mask(-crypto_uint64_x); ------------------ | | 11| 1.02M|#define crypto_uint64_signed_negative_mask CRYPTO_NAMESPACE(crypto_uint64_signed_negative_mask) | | ------------------ | | | | 4| 1.02M|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128F_AVX2_ ## fun | | ------------------ ------------------ return crypto_uint64_signed_negative_mask(crypto_uint64_x) | crypto_uint64_signed_negative_mask(-crypto_uint64_x); ------------------ | | 11| 1.02M|#define crypto_uint64_signed_negative_mask CRYPTO_NAMESPACE(crypto_uint64_signed_negative_mask) | | ------------------ | | | | 4| 1.02M|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128F_AVX2_ ## fun | | ------------------ ------------------ 9| 1.02M|} PQCLEAN_MCELIECE6688128F_AVX2_crypto_uint64_zero_mask: 11| 156k|crypto_uint64 crypto_uint64_zero_mask(crypto_uint64 crypto_uint64_x) { 12| 156k| return ~crypto_uint64_nonzero_mask(crypto_uint64_x); ------------------ | | 13| 156k|#define crypto_uint64_nonzero_mask CRYPTO_NAMESPACE(crypto_uint64_nonzero_mask) | | ------------------ | | | | 4| 156k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128F_AVX2_ ## fun | | ------------------ ------------------ 13| 156k|} PQCLEAN_MCELIECE6688128F_AVX2_crypto_uint64_unequal_mask: 15| 865k|crypto_uint64 crypto_uint64_unequal_mask(crypto_uint64 crypto_uint64_x, crypto_uint64 crypto_uint64_y) { 16| 865k| crypto_uint64 crypto_uint64_xy = crypto_uint64_x ^ crypto_uint64_y; 17| 865k| return crypto_uint64_nonzero_mask(crypto_uint64_xy); ------------------ | | 13| 865k|#define crypto_uint64_nonzero_mask CRYPTO_NAMESPACE(crypto_uint64_nonzero_mask) | | ------------------ | | | | 4| 865k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128F_AVX2_ ## fun | | ------------------ ------------------ 18| 865k|} PQCLEAN_MCELIECE6688128F_AVX2_crypto_uint64_equal_mask: 20| 865k|crypto_uint64 crypto_uint64_equal_mask(crypto_uint64 crypto_uint64_x, crypto_uint64 crypto_uint64_y) { 21| 865k| return ~crypto_uint64_unequal_mask(crypto_uint64_x, crypto_uint64_y); ------------------ | | 17| 865k|#define crypto_uint64_unequal_mask CRYPTO_NAMESPACE(crypto_uint64_unequal_mask) | | ------------------ | | | | 4| 865k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128F_AVX2_ ## fun | | ------------------ ------------------ 22| 865k|} PQCLEAN_MCELIECE6688128F_AVX2_decrypt: 171| 92|int decrypt(unsigned char *e, const unsigned char *sk, const unsigned char *s) { 172| 92| int i; 173| | 174| 92| uint16_t check_synd; 175| 92| uint16_t check_weight; 176| | 177| 92| vec256 inv[ 32 ][ GFBITS ]; 178| 92| vec256 scaled[ 32 ][ GFBITS ]; 179| 92| vec256 eval[32][ GFBITS ]; 180| | 181| 92| vec128 error128[ 64 ]; 182| 92| vec256 error256[ 32 ]; 183| | 184| 92| vec256 s_priv[ GFBITS ]; 185| 92| vec256 s_priv_cmp[ GFBITS ]; 186| 92| vec128 locator[ GFBITS ]; 187| | 188| 92| vec128 recv128[ 64 ]; 189| 92| vec256 recv256[ 32 ]; 190| 92| vec256 allone; 191| | 192| 92| vec128 bits_int[25][32]; 193| | 194| | // Berlekamp decoder 195| | 196| 92| preprocess(recv128, s); 197| | 198| 92| load_bits(bits_int, sk + IRR_BYTES); ------------------ | | 10| 92|#define load_bits CRYPTO_NAMESPACE(load_bits) | | ------------------ | | | | 4| 92|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128F_AVX2_ ## fun | | ------------------ ------------------ load_bits(bits_int, sk + IRR_BYTES); ------------------ | | 11| 92|#define IRR_BYTES (SYS_T * 2) | | ------------------ | | | | 8| 92|#define SYS_T 128 | | ------------------ ------------------ 199| 92| benes(recv128, bits_int, 1); ------------------ | | 9| 92|#define benes CRYPTO_NAMESPACE(benes) | | ------------------ | | | | 4| 92|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128F_AVX2_ ## fun | | ------------------ ------------------ 200| | 201| 92| reformat_128to256(recv256, recv128); 202| | 203| 92| scaling(scaled, inv, sk, recv256); 204| 92| fft_tr(s_priv, scaled); ------------------ | | 9| 92|#define fft_tr CRYPTO_NAMESPACE(fft_tr) | | ------------------ | | | | 4| 92|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128F_AVX2_ ## fun | | ------------------ ------------------ 205| 92| bm(locator, s_priv); ------------------ | | 10| 92|#define bm CRYPTO_NAMESPACE(bm) | | ------------------ | | | | 4| 92|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128F_AVX2_ ## fun | | ------------------ ------------------ 206| | 207| 92| fft(eval, locator); ------------------ | | 10| 92|#define fft CRYPTO_NAMESPACE(fft) | | ------------------ | | | | 4| 92|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128F_AVX2_ ## fun | | ------------------ ------------------ 208| | 209| | // reencryption and weight check 210| | 211| 92| allone = vec256_set1_16b(0xFFFF); 212| | 213| 3.03k| for (i = 0; i < 32; i++) { ------------------ | Branch (213:17): [True: 2.94k, False: 92] ------------------ 214| 2.94k| error256[i] = vec256_or_reduce(eval[i]); 215| 2.94k| error256[i] = vec256_xor(error256[i], allone); 216| 2.94k| } 217| | 218| 92| scaling_inv(scaled, inv, error256); 219| 92| fft_tr(s_priv_cmp, scaled); ------------------ | | 9| 92|#define fft_tr CRYPTO_NAMESPACE(fft_tr) | | ------------------ | | | | 4| 92|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128F_AVX2_ ## fun | | ------------------ ------------------ 220| | 221| 92| check_synd = synd_cmp(s_priv, s_priv_cmp); 222| | 223| | // 224| | 225| 92| reformat_256to128(error128, error256); 226| 92| benes(error128, bits_int, 0); ------------------ | | 9| 92|#define benes CRYPTO_NAMESPACE(benes) | | ------------------ | | | | 4| 92|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128F_AVX2_ ## fun | | ------------------ ------------------ 227| | 228| 92| postprocess(e, error128); 229| | 230| 92| check_weight = weight_check(e, error128); 231| | 232| 92| return 1 - (check_synd & check_weight); 233| 92|} PQCLEAN_MCELIECE6688128F_AVX2_encrypt: 116| 92|void encrypt(unsigned char *s, const unsigned char *pk, unsigned char *e) { 117| 92| gen_e(e); 118| | 119| 92| syndrome_asm(s, pk, e); ------------------ | | 1| 92|#define syndrome_asm CRYPTO_NAMESPACE(syndrome_asm) | | ------------------ | | | | 4| 92|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128F_AVX2_ ## fun | | ------------------ ------------------ 120| 92|} PQCLEAN_MCELIECE6688128F_AVX2_fft: 277| 302|void fft(vec256 out[][GFBITS], vec128 *in) { 278| 302| radix_conversions(in); 279| 302| butterflies(out, in); 280| 302|} PQCLEAN_MCELIECE6688128F_AVX2_fft_tr: 380| 184|void fft_tr(vec256 *out, vec256 in[][ GFBITS ]) { 381| 184| butterflies_tr(out, in); 382| 184| radix_conversions_tr(out); 383| 184|} PQCLEAN_MCELIECE6688128F_AVX2_gf_mul: 12| 1.93M|gf gf_mul(gf in0, gf in1) { 13| 1.93M| int i; 14| | 15| 1.93M| uint64_t tmp; 16| 1.93M| uint64_t t0; 17| 1.93M| uint64_t t1; 18| 1.93M| uint64_t t; 19| | 20| 1.93M| t0 = in0; 21| 1.93M| t1 = in1; 22| | 23| 1.93M| tmp = t0 * (t1 & 1); 24| | 25| 25.1M| for (i = 1; i < GFBITS; i++) { ------------------ | | 6| 25.1M|#define GFBITS 13 ------------------ | Branch (25:17): [True: 23.1M, False: 1.93M] ------------------ 26| 23.1M| tmp ^= (t0 * (t1 & (1 << i))); 27| 23.1M| } 28| | 29| | // 30| | 31| 1.93M| t = tmp & 0x1FF0000; 32| 1.93M| tmp ^= (t >> 9) ^ (t >> 10) ^ (t >> 12) ^ (t >> 13); 33| | 34| 1.93M| t = tmp & 0x000E000; 35| 1.93M| tmp ^= (t >> 9) ^ (t >> 10) ^ (t >> 12) ^ (t >> 13); 36| | 37| 1.93M| return tmp & GFMASK; ------------------ | | 19| 1.93M|#define GFMASK ((1 << GFBITS) - 1) | | ------------------ | | | | 6| 1.93M|#define GFBITS 13 | | ------------------ ------------------ 38| 1.93M|} PQCLEAN_MCELIECE6688128F_AVX2_gf_mul2: 41| 23.5k|uint64_t gf_mul2(gf a, gf b0, gf b1) { 42| 23.5k| int i; 43| | 44| 23.5k| uint64_t tmp = 0; 45| 23.5k| uint64_t t0; 46| 23.5k| uint64_t t1; 47| 23.5k| uint64_t t; 48| 23.5k| uint64_t mask = 0x0000000100000001; 49| | 50| 23.5k| t0 = a; 51| 23.5k| t1 = b1; 52| 23.5k| t1 = (t1 << 32) | b0; 53| | 54| 329k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 329k|#define GFBITS 13 ------------------ | Branch (54:17): [True: 306k, False: 23.5k] ------------------ 55| 306k| tmp ^= t0 * (t1 & mask); 56| 306k| mask += mask; 57| 306k| } 58| | 59| | // 60| | 61| 23.5k| t = tmp & 0x01FF000001FF0000; 62| 23.5k| tmp ^= (t >> 9) ^ (t >> 10) ^ (t >> 12) ^ (t >> 13); 63| | 64| 23.5k| t = tmp & 0x0000E0000000E000; 65| 23.5k| tmp ^= (t >> 9) ^ (t >> 10) ^ (t >> 12) ^ (t >> 13); 66| | 67| 23.5k| return tmp & 0x00001FFF00001FFF; 68| 23.5k|} PQCLEAN_MCELIECE6688128F_AVX2_gf_frac: 178| 15.1k|gf gf_frac(gf den, gf num) { 179| 15.1k| gf tmp_11; 180| 15.1k| gf tmp_1111; 181| 15.1k| gf out; 182| | 183| 15.1k| tmp_11 = gf_sqmul(den, den); // 11 184| 15.1k| tmp_1111 = gf_sq2mul(tmp_11, tmp_11); // 1111 185| 15.1k| out = gf_sq2(tmp_1111); 186| 15.1k| out = gf_sq2mul(out, tmp_1111); // 11111111 187| 15.1k| out = gf_sq2(out); 188| 15.1k| out = gf_sq2mul(out, tmp_1111); // 111111111111 189| | 190| 15.1k| return gf_sqmul(out, num); // 1111111111110 191| 15.1k|} PQCLEAN_MCELIECE6688128F_AVX2_gf_inv: 194| 15.1k|gf gf_inv(gf den) { 195| 15.1k| return gf_frac(den, ((gf) 1)); ------------------ | | 10| 15.1k|#define gf_frac CRYPTO_NAMESPACE(gf_frac) | | ------------------ | | | | 4| 15.1k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128F_AVX2_ ## fun | | ------------------ ------------------ 196| 15.1k|} pk_gen.c:PQCLEAN_MCELIECE6688128F_AVX2_int32_sort: 21| 92|static void int32_sort(int32_t *x, long long n) { 22| 92| long long top, p, q, r, i; 23| | 24| 92| if (n < 2) { ------------------ | Branch (24:9): [True: 0, False: 92] ------------------ 25| 0| return; 26| 0| } 27| 92| top = 1; 28| 1.01k| while (top < n - top) { ------------------ | Branch (28:12): [True: 920, False: 92] ------------------ 29| 920| top += top; 30| 920| } 31| | 32| 1.10k| for (p = top; p > 0; p >>= 1) { ------------------ | Branch (32:19): [True: 1.01k, False: 92] ------------------ 33| 1.49M| for (i = 0; i < n - p; ++i) { ------------------ | Branch (33:21): [True: 1.49M, False: 1.01k] ------------------ 34| 1.49M| if (!(i & p)) { ------------------ | Branch (34:17): [True: 794k, False: 700k] ------------------ 35| 794k| int32_MINMAX(x[i], x[i + p]); ------------------ | | 11| 794k| do { \ | | 12| 794k| int32_t ab = (b) ^ (a); \ | | 13| 794k| int32_t c = (b) - (a); \ | | 14| 794k| c ^= ab & ((c) ^ (b)); \ | | 15| 794k| c >>= 31; \ | | 16| 794k| c &= ab; \ | | 17| 794k| (a) ^= c; \ | | 18| 794k| (b) ^= c; \ | | 19| 794k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 794k] | | ------------------ ------------------ 36| 794k| } 37| 1.49M| } 38| 1.01k| i = 0; 39| 6.07k| for (q = top; q > p; q >>= 1) { ------------------ | Branch (39:23): [True: 5.06k, False: 1.01k] ------------------ 40| 1.34M| for (; i < n - q; ++i) { ------------------ | Branch (40:20): [True: 1.34M, False: 5.06k] ------------------ 41| 1.34M| if (!(i & p)) { ------------------ | Branch (41:21): [True: 700k, False: 641k] ------------------ 42| 700k| int32_t a = x[i + p]; 43| 4.10M| for (r = q; r > p; r >>= 1) { ------------------ | Branch (43:33): [True: 3.40M, False: 700k] ------------------ 44| 3.40M| int32_MINMAX(a, x[i + r]); ------------------ | | 11| 3.40M| do { \ | | 12| 3.40M| int32_t ab = (b) ^ (a); \ | | 13| 3.40M| int32_t c = (b) - (a); \ | | 14| 3.40M| c ^= ab & ((c) ^ (b)); \ | | 15| 3.40M| c >>= 31; \ | | 16| 3.40M| c &= ab; \ | | 17| 3.40M| (a) ^= c; \ | | 18| 3.40M| (b) ^= c; \ | | 19| 3.40M| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 3.40M] | | ------------------ ------------------ 45| 3.40M| } 46| 700k| x[i + p] = a; 47| 700k| } 48| 1.34M| } 49| 5.06k| } 50| 1.01k| } 51| 92|} controlbits.c:PQCLEAN_MCELIECE6688128F_AVX2_int32_sort: 21| 3.01M|static void int32_sort(int32_t *x, long long n) { 22| 3.01M| long long top, p, q, r, i; 23| | 24| 3.01M| if (n < 2) { ------------------ | Branch (24:9): [True: 0, False: 3.01M] ------------------ 25| 0| return; 26| 0| } 27| 3.01M| top = 1; 28| 10.5M| while (top < n - top) { ------------------ | Branch (28:12): [True: 7.55M, False: 3.01M] ------------------ 29| 7.55M| top += top; 30| 7.55M| } 31| | 32| 13.5M| for (p = top; p > 0; p >>= 1) { ------------------ | Branch (32:19): [True: 10.5M, False: 3.01M] ------------------ 33| 1.45G| for (i = 0; i < n - p; ++i) { ------------------ | Branch (33:21): [True: 1.44G, False: 10.5M] ------------------ 34| 1.44G| if (!(i & p)) { ------------------ | Branch (34:17): [True: 807M, False: 636M] ------------------ 35| 807M| int32_MINMAX(x[i], x[i + p]); ------------------ | | 11| 807M| do { \ | | 12| 807M| int32_t ab = (b) ^ (a); \ | | 13| 807M| int32_t c = (b) - (a); \ | | 14| 807M| c ^= ab & ((c) ^ (b)); \ | | 15| 807M| c >>= 31; \ | | 16| 807M| c &= ab; \ | | 17| 807M| (a) ^= c; \ | | 18| 807M| (b) ^= c; \ | | 19| 807M| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 807M] | | ------------------ ------------------ 36| 807M| } 37| 1.44G| } 38| 10.5M| i = 0; 39| 28.6M| for (q = top; q > p; q >>= 1) { ------------------ | Branch (39:23): [True: 18.1M, False: 10.5M] ------------------ 40| 1.29G| for (; i < n - q; ++i) { ------------------ | Branch (40:20): [True: 1.27G, False: 18.1M] ------------------ 41| 1.27G| if (!(i & p)) { ------------------ | Branch (41:21): [True: 636M, False: 636M] ------------------ 42| 636M| int32_t a = x[i + p]; 43| 3.76G| for (r = q; r > p; r >>= 1) { ------------------ | Branch (43:33): [True: 3.13G, False: 636M] ------------------ 44| 3.13G| int32_MINMAX(a, x[i + r]); ------------------ | | 11| 3.13G| do { \ | | 12| 3.13G| int32_t ab = (b) ^ (a); \ | | 13| 3.13G| int32_t c = (b) - (a); \ | | 14| 3.13G| c ^= ab & ((c) ^ (b)); \ | | 15| 3.13G| c >>= 31; \ | | 16| 3.13G| c &= ab; \ | | 17| 3.13G| (a) ^= c; \ | | 18| 3.13G| (b) ^= c; \ | | 19| 3.13G| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 3.13G] | | ------------------ ------------------ 45| 3.13G| } 46| 636M| x[i + p] = a; 47| 636M| } 48| 1.27G| } 49| 18.1M| } 50| 10.5M| } 51| 3.01M|} encrypt.c:PQCLEAN_MCELIECE6688128F_AVX2_int32_sort: 21| 618|static void int32_sort(int32_t *x, long long n) { 22| 618| long long top, p, q, r, i; 23| | 24| 618| if (n < 2) { ------------------ | Branch (24:9): [True: 0, False: 618] ------------------ 25| 0| return; 26| 0| } 27| 618| top = 1; 28| 4.32k| while (top < n - top) { ------------------ | Branch (28:12): [True: 3.70k, False: 618] ------------------ 29| 3.70k| top += top; 30| 3.70k| } 31| | 32| 4.94k| for (p = top; p > 0; p >>= 1) { ------------------ | Branch (32:19): [True: 4.32k, False: 618] ------------------ 33| 479k| for (i = 0; i < n - p; ++i) { ------------------ | Branch (33:21): [True: 475k, False: 4.32k] ------------------ 34| 475k| if (!(i & p)) { ------------------ | Branch (34:17): [True: 276k, False: 198k] ------------------ 35| 276k| int32_MINMAX(x[i], x[i + p]); ------------------ | | 11| 276k| do { \ | | 12| 276k| int32_t ab = (b) ^ (a); \ | | 13| 276k| int32_t c = (b) - (a); \ | | 14| 276k| c ^= ab & ((c) ^ (b)); \ | | 15| 276k| c >>= 31; \ | | 16| 276k| c &= ab; \ | | 17| 276k| (a) ^= c; \ | | 18| 276k| (b) ^= c; \ | | 19| 276k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 276k] | | ------------------ ------------------ 36| 276k| } 37| 475k| } 38| 4.32k| i = 0; 39| 17.3k| for (q = top; q > p; q >>= 1) { ------------------ | Branch (39:23): [True: 12.9k, False: 4.32k] ------------------ 40| 409k| for (; i < n - q; ++i) { ------------------ | Branch (40:20): [True: 396k, False: 12.9k] ------------------ 41| 396k| if (!(i & p)) { ------------------ | Branch (41:21): [True: 198k, False: 198k] ------------------ 42| 198k| int32_t a = x[i + p]; 43| 830k| for (r = q; r > p; r >>= 1) { ------------------ | Branch (43:33): [True: 632k, False: 198k] ------------------ 44| 632k| int32_MINMAX(a, x[i + r]); ------------------ | | 11| 632k| do { \ | | 12| 632k| int32_t ab = (b) ^ (a); \ | | 13| 632k| int32_t c = (b) - (a); \ | | 14| 632k| c ^= ab & ((c) ^ (b)); \ | | 15| 632k| c >>= 31; \ | | 16| 632k| c &= ab; \ | | 17| 632k| (a) ^= c; \ | | 18| 632k| (b) ^= c; \ | | 19| 632k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 632k] | | ------------------ ------------------ 45| 632k| } 46| 198k| x[i + p] = a; 47| 198k| } 48| 396k| } 49| 12.9k| } 50| 4.32k| } 51| 618|} PQCLEAN_MCELIECE6688128F_AVX2_crypto_kem_enc: 22| 92|) { 23| 92| unsigned char e[ SYS_N / 8 ]; 24| 92| unsigned char one_ec[ 1 + SYS_N / 8 + SYND_BYTES ] = {1}; 25| | 26| | // 27| | 28| 92| encrypt(c, pk, e); ------------------ | | 9| 92|#define encrypt CRYPTO_NAMESPACE(encrypt) | | ------------------ | | | | 4| 92|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128F_AVX2_ ## fun | | ------------------ ------------------ 29| | 30| 92| memcpy(one_ec + 1, e, SYS_N / 8); ------------------ | | 7| 92|#define SYS_N 6688 ------------------ 31| 92| memcpy(one_ec + 1 + SYS_N / 8, c, SYND_BYTES); ------------------ | | 7| 92|#define SYS_N 6688 ------------------ memcpy(one_ec + 1 + SYS_N / 8, c, SYND_BYTES); ------------------ | | 17| 92|#define SYND_BYTES ((PK_NROWS + 7)/8) | | ------------------ | | | | 13| 92|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 92|#define SYS_T 128 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 92|#define GFBITS 13 | | | | ------------------ | | ------------------ ------------------ 32| | 33| 92| crypto_hash_32b(key, one_ec, sizeof(one_ec)); ------------------ | | 7| 92| shake256(out, 32, in, inlen) | | ------------------ | | | | 12| 92|#define shake256 OQS_SHA3_shake256 | | ------------------ ------------------ 34| | 35| 92| return 0; 36| 92|} PQCLEAN_MCELIECE6688128F_AVX2_crypto_kem_dec: 42| 92|) { 43| 92| int i; 44| | 45| 92| unsigned char ret_decrypt = 0; 46| | 47| 92| uint16_t m; 48| | 49| 92| unsigned char e[ SYS_N / 8 ]; 50| 92| unsigned char preimage[ 1 + SYS_N / 8 + SYND_BYTES ]; 51| 92| unsigned char *x = preimage; 52| 92| const unsigned char *s = sk + 40 + IRR_BYTES + COND_BYTES; ------------------ | | 11| 92|#define IRR_BYTES (SYS_T * 2) | | ------------------ | | | | 8| 92|#define SYS_T 128 | | ------------------ ------------------ const unsigned char *s = sk + 40 + IRR_BYTES + COND_BYTES; ------------------ | | 10| 92|#define COND_BYTES ((1 << (GFBITS-4))*(2*GFBITS - 1)) | | ------------------ | | | | 6| 92|#define GFBITS 13 | | ------------------ | | #define COND_BYTES ((1 << (GFBITS-4))*(2*GFBITS - 1)) | | ------------------ | | | | 6| 92|#define GFBITS 13 | | ------------------ ------------------ 53| | 54| | // 55| | 56| 92| ret_decrypt = (unsigned char)decrypt(e, sk + 40, c); ------------------ | | 9| 92|#define decrypt CRYPTO_NAMESPACE(decrypt) | | ------------------ | | | | 4| 92|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128F_AVX2_ ## fun | | ------------------ ------------------ 57| | 58| 92| m = ret_decrypt; 59| 92| m -= 1; 60| 92| m >>= 8; 61| | 62| 92| *x++ = m & 1; 63| 77.0k| for (i = 0; i < SYS_N / 8; i++) { ------------------ | | 7| 77.0k|#define SYS_N 6688 ------------------ | Branch (63:17): [True: 76.9k, False: 92] ------------------ 64| 76.9k| *x++ = (~m & s[i]) | (m & e[i]); 65| 76.9k| } 66| | 67| 19.2k| for (i = 0; i < SYND_BYTES; i++) { ------------------ | | 17| 19.2k|#define SYND_BYTES ((PK_NROWS + 7)/8) | | ------------------ | | | | 13| 19.2k|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 19.2k|#define SYS_T 128 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 19.2k|#define GFBITS 13 | | | | ------------------ | | ------------------ ------------------ | Branch (67:17): [True: 19.1k, False: 92] ------------------ 68| 19.1k| *x++ = c[i]; 69| 19.1k| } 70| | 71| 92| crypto_hash_32b(key, preimage, sizeof(preimage)); ------------------ | | 7| 92| shake256(out, 32, in, inlen) | | ------------------ | | | | 12| 92|#define shake256 OQS_SHA3_shake256 | | ------------------ ------------------ 72| | 73| 92| return 0; 74| 92|} PQCLEAN_MCELIECE6688128F_AVX2_crypto_kem_keypair: 80| 92|) { 81| 92| int i; 82| 92| unsigned char seed[ 33 ] = {64}; 83| 92| unsigned char r[ SYS_N / 8 + (1 << GFBITS)*sizeof(uint32_t) + SYS_T * 2 + 32 ]; 84| 92| unsigned char *rp, *skp; 85| 92| uint64_t pivots; 86| | 87| 92| gf f[ SYS_T ]; // element in GF(2^mt) 88| 92| gf irr[ SYS_T ]; // Goppa polynomial 89| 92| uint32_t perm[ 1 << GFBITS ]; // random permutation as 32-bit integers 90| 92| int16_t pi[ 1 << GFBITS ]; // random permutation 91| | 92| 92| randombytes(seed + 1, 32); ------------------ | | 8| 92|#define randombytes OQS_randombytes ------------------ 93| | 94| 118| while (1) { ------------------ | Branch (94:12): [True: 118, Folded] ------------------ 95| 118| rp = &r[ sizeof(r) - 32 ]; 96| 118| skp = sk; 97| | 98| | // expanding and updating the seed 99| | 100| 118| shake(r, sizeof(r), seed, 33); ------------------ | | 10| 118| shake256(out, outlen, in, inlen) | | ------------------ | | | | 12| 118|#define shake256 OQS_SHA3_shake256 | | ------------------ ------------------ 101| 118| memcpy(skp, seed + 1, 32); 102| 118| skp += 32 + 8; 103| 118| memcpy(seed + 1, &r[ sizeof(r) - 32 ], 32); 104| | 105| | // generating irreducible polynomial 106| | 107| 118| rp -= sizeof(f); 108| | 109| 15.2k| for (i = 0; i < SYS_T; i++) { ------------------ | | 8| 15.2k|#define SYS_T 128 ------------------ | Branch (109:21): [True: 15.1k, False: 118] ------------------ 110| 15.1k| f[i] = load_gf(rp + i * 2); 111| 15.1k| } 112| | 113| 118| if (genpoly_gen(irr, f)) { ------------------ | | 9| 118|#define genpoly_gen CRYPTO_NAMESPACE(genpoly_gen) | | ------------------ | | | | 4| 118|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128F_AVX2_ ## fun | | ------------------ ------------------ | Branch (113:13): [True: 0, False: 118] ------------------ 114| 0| continue; 115| 0| } 116| | 117| 15.2k| for (i = 0; i < SYS_T; i++) { ------------------ | | 8| 15.2k|#define SYS_T 128 ------------------ | Branch (117:21): [True: 15.1k, False: 118] ------------------ 118| 15.1k| store_gf(skp + i * 2, irr[i]); 119| 15.1k| } 120| | 121| 118| skp += IRR_BYTES; ------------------ | | 11| 118|#define IRR_BYTES (SYS_T * 2) | | ------------------ | | | | 8| 118|#define SYS_T 128 | | ------------------ ------------------ 122| | 123| | // generating permutation 124| | 125| 118| rp -= sizeof(perm); 126| | 127| 966k| for (i = 0; i < (1 << GFBITS); i++) { ------------------ | | 6| 966k|#define GFBITS 13 ------------------ | Branch (127:21): [True: 966k, False: 118] ------------------ 128| 966k| perm[i] = load4(rp + i * 4); 129| 966k| } 130| | 131| 118| if (pk_gen(pk, skp - IRR_BYTES, perm, pi, &pivots)) { ------------------ | | 9| 118|#define pk_gen CRYPTO_NAMESPACE(pk_gen) | | ------------------ | | | | 4| 118|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128F_AVX2_ ## fun | | ------------------ ------------------ if (pk_gen(pk, skp - IRR_BYTES, perm, pi, &pivots)) { ------------------ | | 11| 118|#define IRR_BYTES (SYS_T * 2) | | ------------------ | | | | 8| 118|#define SYS_T 128 | | ------------------ ------------------ | Branch (131:13): [True: 26, False: 92] ------------------ 132| 26| continue; 133| 26| } 134| | 135| 92| controlbitsfrompermutation(skp, pi, GFBITS, 1 << GFBITS); ------------------ | | 10| 92|#define controlbitsfrompermutation CRYPTO_NAMESPACE(controlbitsfrompermutation) | | ------------------ | | | | 4| 92|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128F_AVX2_ ## fun | | ------------------ ------------------ controlbitsfrompermutation(skp, pi, GFBITS, 1 << GFBITS); ------------------ | | 6| 92|#define GFBITS 13 ------------------ controlbitsfrompermutation(skp, pi, GFBITS, 1 << GFBITS); ------------------ | | 6| 92|#define GFBITS 13 ------------------ 136| 92| skp += COND_BYTES; ------------------ | | 10| 92|#define COND_BYTES ((1 << (GFBITS-4))*(2*GFBITS - 1)) | | ------------------ | | | | 6| 92|#define GFBITS 13 | | ------------------ | | #define COND_BYTES ((1 << (GFBITS-4))*(2*GFBITS - 1)) | | ------------------ | | | | 6| 92|#define GFBITS 13 | | ------------------ ------------------ 137| | 138| | // storing the random string s 139| | 140| 92| rp -= SYS_N / 8; ------------------ | | 7| 92|#define SYS_N 6688 ------------------ 141| 92| memcpy(skp, rp, SYS_N / 8); ------------------ | | 7| 92|#define SYS_N 6688 ------------------ 142| | 143| | // storing positions of the 32 pivots 144| | 145| 92| store8(sk + 32, pivots); 146| | 147| 92| break; 148| 118| } 149| | 150| 92| return 0; 151| 92|} PQCLEAN_MCELIECE6688128F_AVX2_pk_gen: 315| 118|int pk_gen(unsigned char *pk, const unsigned char *irr, const uint32_t *perm, int16_t *pi, uint64_t *pivots) { 316| 118| int i, j, k, b; 317| 118| int row, c; 318| | 319| 118| union { 320| 118| uint64_t w[ PK_NROWS ][ nBlocks_I * 4 ]; 321| 118| vec256 v[ PK_NROWS ][ nBlocks_I ]; 322| 118| } mat; 323| | 324| 118| union { 325| 118| uint64_t w[ PK_NROWS ][ 28 ]; 326| 118| vec256 v[ PK_NROWS ][ 7 ]; 327| 118| } par; 328| | 329| 118| uint16_t m; 330| 118| vec256 mm; 331| | 332| 118| vec128 sk_int[ GFBITS ]; 333| | 334| 118| vec256 consts[ 32 ][ GFBITS ]; 335| 118| vec256 eval[ 32 ][ GFBITS ]; 336| 118| vec256 prod[ 32 ][ GFBITS ]; 337| 118| vec256 tmp[ GFBITS ]; 338| | 339| 118| uint64_t list[1 << GFBITS]; 340| 118| uint64_t one = 1; 341| 118| uint64_t t; 342| | 343| 118| uint16_t ind[ PK_NROWS ]; 344| 118| uint16_t ind_inv[ PK_NROWS ]; 345| | 346| | // compute the inverses 347| | 348| 118| irr_load(sk_int, irr); 349| | 350| 118| fft(eval, sk_int); ------------------ | | 10| 118|#define fft CRYPTO_NAMESPACE(fft) | | ------------------ | | | | 4| 118|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128F_AVX2_ ## fun | | ------------------ ------------------ 351| | 352| 118| vec256_copy(prod[0], eval[0]); 353| | 354| 3.77k| for (i = 1; i < 32; i++) { ------------------ | Branch (354:17): [True: 3.65k, False: 118] ------------------ 355| 3.65k| vec256_mul(prod[i], prod[i - 1], eval[i]); 356| 3.65k| } 357| | 358| 118| vec256_inv(tmp, prod[31]); ------------------ | | 11| 118|#define vec256_inv CRYPTO_NAMESPACE(vec256_inv) | | ------------------ | | | | 4| 118|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128F_AVX2_ ## fun | | ------------------ ------------------ 359| | 360| 3.77k| for (i = 30; i >= 0; i--) { ------------------ | Branch (360:18): [True: 3.65k, False: 118] ------------------ 361| 3.65k| vec256_mul(prod[i + 1], prod[i], tmp); 362| 3.65k| vec256_mul(tmp, tmp, eval[i + 1]); 363| 3.65k| } 364| | 365| 118| vec256_copy(prod[0], tmp); 366| | 367| | // fill matrix 368| | 369| 118| de_bitslicing(list, prod); 370| | 371| 966k| for (i = 0; i < (1 << GFBITS); i++) { ------------------ | | 6| 966k|#define GFBITS 13 ------------------ | Branch (371:17): [True: 966k, False: 118] ------------------ 372| 966k| list[i] <<= GFBITS; ------------------ | | 6| 966k|#define GFBITS 13 ------------------ 373| 966k| list[i] |= i; 374| 966k| list[i] |= ((uint64_t) perm[i]) << 31; 375| 966k| } 376| | 377| 118| uint64_sort(list, 1 << GFBITS); ------------------ | | 6| 118|#define GFBITS 13 ------------------ 378| | 379| 865k| for (i = 1; i < (1 << GFBITS); i++) { ------------------ | | 6| 865k|#define GFBITS 13 ------------------ | Branch (379:17): [True: 865k, False: 92] ------------------ 380| 865k| if (uint64_is_equal_declassify(list[i - 1] >> 31, list[i] >> 31)) { ------------------ | Branch (380:13): [True: 26, False: 865k] ------------------ 381| 26| return -1; 382| 26| } 383| 865k| } 384| | 385| 92| to_bitslicing_2x(consts, prod, list); 386| | 387| 753k| for (i = 0; i < (1 << GFBITS); i++) { ------------------ | | 6| 753k|#define GFBITS 13 ------------------ | Branch (387:17): [True: 753k, False: 92] ------------------ 388| 753k| pi[i] = list[i] & GFMASK; ------------------ | | 19| 753k|#define GFMASK ((1 << GFBITS) - 1) | | ------------------ | | | | 6| 753k|#define GFBITS 13 | | ------------------ ------------------ 389| 753k| } 390| | 391| 736| for (j = 0; j < nBlocks_I; j++) { ------------------ | | 32| 736|#define nBlocks_I ((PK_NROWS + 255) / 256) | | ------------------ | | | | 13| 736|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 736|#define SYS_T 128 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 736|#define GFBITS 13 | | | | ------------------ | | ------------------ ------------------ | Branch (391:17): [True: 644, False: 92] ------------------ 392| 9.01k| for (k = 0; k < GFBITS; k++) { ------------------ | | 6| 9.01k|#define GFBITS 13 ------------------ | Branch (392:21): [True: 8.37k, False: 644] ------------------ 393| 8.37k| mat.v[ k ][ j ] = prod[ j ][ k ]; 394| 8.37k| } 395| 644| } 396| | 397| 11.7k| for (i = 1; i < SYS_T; i++) { ------------------ | | 8| 11.7k|#define SYS_T 128 ------------------ | Branch (397:17): [True: 11.6k, False: 92] ------------------ 398| 93.4k| for (j = 0; j < nBlocks_I; j++) { ------------------ | | 32| 93.4k|#define nBlocks_I ((PK_NROWS + 255) / 256) | | ------------------ | | | | 13| 93.4k|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 93.4k|#define SYS_T 128 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 93.4k|#define GFBITS 13 | | | | ------------------ | | ------------------ ------------------ | Branch (398:21): [True: 81.7k, False: 11.6k] ------------------ 399| 81.7k| vec256_mul(prod[j], prod[j], consts[j]); 400| | 401| 1.14M| for (k = 0; k < GFBITS; k++) { ------------------ | | 6| 1.14M|#define GFBITS 13 ------------------ | Branch (401:25): [True: 1.06M, False: 81.7k] ------------------ 402| 1.06M| mat.v[ i * GFBITS + k ][ j ] = prod[ j ][ k ]; ------------------ | | 6| 1.06M|#define GFBITS 13 ------------------ 403| 1.06M| } 404| 81.7k| } 405| 11.6k| } 406| | 407| | // gaussian elimination to obtain L, U, and P such that LP M = U 408| | // L and U are stored in the space of M 409| | // P is stored in ind 410| | 411| 153k| for (i = 0; i < PK_NROWS; i++) { ------------------ | | 13| 153k|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 153k|#define SYS_T 128 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 153k|#define GFBITS 13 | | ------------------ ------------------ | Branch (411:17): [True: 153k, False: 92] ------------------ 412| 153k| ind_inv[i] = ind[ i ] = i; 413| 153k| } 414| | 415| 153k| for (row = 0; row < PK_NROWS; row++) { ------------------ | | 13| 153k|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 153k|#define SYS_T 128 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 153k|#define GFBITS 13 | | ------------------ ------------------ | Branch (415:19): [True: 153k, False: 92] ------------------ 416| 153k| i = row >> 6; 417| 153k| j = row & 63; 418| | 419| 153k| if (row == PK_NROWS - 32) { ------------------ | | 13| 153k|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 153k|#define SYS_T 128 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 153k|#define GFBITS 13 | | ------------------ ------------------ | Branch (419:13): [True: 92, False: 152k] ------------------ 420| 92| if (mov_columns(mat.w, pi, pivots)) { ------------------ | Branch (420:17): [True: 0, False: 92] ------------------ 421| 0| return -1; 422| 0| } 423| 92| } 424| | 425| 127M| for (k = row + 1; k < PK_NROWS; k++) { ------------------ | | 13| 127M|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 127M|#define SYS_T 128 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 127M|#define GFBITS 13 | | ------------------ ------------------ | Branch (425:27): [True: 127M, False: 153k] ------------------ 426| 127M| extract_01_masks(&m, mat.w[ row ], mat.w[ k ], row); 427| 127M| uint16_cswap(&ind[row], &ind[k], m); 428| | 429| 127M| mm = vec256_set1_16b(m); 430| 1.01G| for (c = 0; c < nBlocks_I; c++) { ------------------ | | 32| 1.01G|#define nBlocks_I ((PK_NROWS + 255) / 256) | | ------------------ | | | | 13| 1.01G|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 1.01G|#define SYS_T 128 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 1.01G|#define GFBITS 13 | | | | ------------------ | | ------------------ ------------------ | Branch (430:25): [True: 891M, False: 127M] ------------------ 431| 891M| vec256_cswap(&mat.v[ row ][ c ], &mat.v[ k ][ c ], mm); 432| 891M| } 433| 127M| } 434| | 435| 153k| if ( uint64_is_zero_declassify((mat.w[ row ][ i ] >> j) & 1) ) { // return if not systematic ------------------ | Branch (435:14): [True: 0, False: 153k] ------------------ 436| 0| return -1; 437| 0| } 438| | 439| 127M| for (k = row + 1; k < PK_NROWS; k++) { ------------------ | | 13| 127M|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 127M|#define SYS_T 128 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 127M|#define GFBITS 13 | | ------------------ ------------------ | Branch (439:27): [True: 127M, False: 153k] ------------------ 440| 127M| t = mat.w[ k ][ i ] & (one << j); 441| 127M| mm = extract_mask256(mat.w[k], row); 442| | 443| 1.01G| for (c = 0; c < nBlocks_I; c++) { ------------------ | | 32| 1.01G|#define nBlocks_I ((PK_NROWS + 255) / 256) | | ------------------ | | | | 13| 1.01G|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 1.01G|#define SYS_T 128 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 1.01G|#define GFBITS 13 | | | | ------------------ | | ------------------ ------------------ | Branch (443:25): [True: 891M, False: 127M] ------------------ 444| 891M| mat.v[ k ][ c ] ^= mat.v[ row ][ c ] & mm; 445| 891M| } 446| | 447| 127M| mat.w[ k ][ i ] |= t; 448| 127M| } 449| 153k| } 450| | 451| | // apply M^-1 to the remaining columns 452| | 453| 92| composeinv(PK_NROWS, ind_inv, ind_inv, ind); ------------------ | | 13| 92|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 92|#define SYS_T 128 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 92|#define GFBITS 13 | | ------------------ ------------------ 454| | 455| 368| for (j = 6; j < 27; j += par_width) { ------------------ | | 33| 276|#define par_width 7 ------------------ | Branch (455:17): [True: 276, False: 92] ------------------ 456| 3.86k| for (k = 0; k < GFBITS; k++) { ------------------ | | 6| 3.86k|#define GFBITS 13 ------------------ | Branch (456:21): [True: 3.58k, False: 276] ------------------ 457| 28.7k| for (b = 0; b < par_width; b++) { ------------------ | | 33| 28.7k|#define par_width 7 ------------------ | Branch (457:25): [True: 25.1k, False: 3.58k] ------------------ 458| 25.1k| par.v[ k ][ b ] = prod[ j + b ][ k ]; 459| 25.1k| } 460| 3.58k| } 461| | 462| 35.3k| for (i = 1; i < SYS_T; i++) { ------------------ | | 8| 35.3k|#define SYS_T 128 ------------------ | Branch (462:21): [True: 35.0k, False: 276] ------------------ 463| 280k| for (b = 0; b < par_width; b++) { ------------------ | | 33| 280k|#define par_width 7 ------------------ | Branch (463:25): [True: 245k, False: 35.0k] ------------------ 464| 245k| vec256_mul(prod[ j + b ], prod[ j + b ], consts[ j + b ]); 465| 245k| } 466| | 467| 490k| for (k = 0; k < GFBITS; k++) { ------------------ | | 6| 490k|#define GFBITS 13 ------------------ | Branch (467:25): [True: 455k, False: 35.0k] ------------------ 468| 3.64M| for (b = 0; b < par_width; b++) { ------------------ | | 33| 3.64M|#define par_width 7 ------------------ | Branch (468:29): [True: 3.18M, False: 455k] ------------------ 469| 3.18M| par.v[ i * GFBITS + k ][ b ] = prod[ j + b ][ k ]; ------------------ | | 6| 3.18M|#define GFBITS 13 ------------------ 470| 3.18M| } 471| 455k| } 472| 35.0k| } 473| | 474| | // apply P 475| | 476| 459k| for (i = 0; i < PK_NROWS; i++) { ------------------ | | 13| 459k|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 459k|#define SYS_T 128 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 459k|#define GFBITS 13 | | ------------------ ------------------ | Branch (476:21): [True: 459k, False: 276] ------------------ 477| 459k| ind[i] = ind_inv[i]; 478| 459k| } 479| | 480| 276| sort_rows((1 << GFBITS) / 4, PK_NROWS, ind, par.v, 0); ------------------ | | 6| 276|#define GFBITS 13 ------------------ sort_rows((1 << GFBITS) / 4, PK_NROWS, ind, par.v, 0); ------------------ | | 13| 276|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 276|#define SYS_T 128 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 276|#define GFBITS 13 | | ------------------ ------------------ 481| | 482| | // apply L 483| | 484| 459k| for (row = PK_NROWS - 1; row >= 0; row--) { ------------------ | | 13| 276|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 276|#define SYS_T 128 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 276|#define GFBITS 13 | | ------------------ ------------------ | Branch (484:34): [True: 459k, False: 276] ------------------ 485| 382M| for (i = row - 1; i >= 0; i--) { ------------------ | Branch (485:31): [True: 381M, False: 459k] ------------------ 486| 381M| mm = extract_mask256(mat.w[row], i); 487| | 488| 3.05G| for (k = 0; k < par_width; k++) { ------------------ | | 33| 3.05G|#define par_width 7 ------------------ | Branch (488:29): [True: 2.67G, False: 381M] ------------------ 489| 2.67G| par.v[ row ][ k ] ^= par.v[ i ][ k ] & mm; 490| 2.67G| } 491| 381M| } 492| 459k| } 493| | 494| | // apply U^-1 495| | 496| 276| if (j == 6) { ------------------ | Branch (496:13): [True: 92, False: 184] ------------------ 497| 153k| for (i = 0; i < PK_NROWS; i++) { ------------------ | | 13| 153k|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 153k|#define SYS_T 128 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 153k|#define GFBITS 13 | | ------------------ ------------------ | Branch (497:25): [True: 153k, False: 92] ------------------ 498| 153k| par.v[i][0] = mat.v[i][ nBlocks_I - 1 ]; ------------------ | | 32| 153k|#define nBlocks_I ((PK_NROWS + 255) / 256) | | ------------------ | | | | 13| 153k|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 153k|#define SYS_T 128 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 153k|#define GFBITS 13 | | | | ------------------ | | ------------------ ------------------ 499| 153k| } 500| 92| } 501| | 502| 459k| for (row = PK_NROWS - 1; row >= 0; row--) { ------------------ | | 13| 276|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 276|#define SYS_T 128 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 276|#define GFBITS 13 | | ------------------ ------------------ | Branch (502:34): [True: 459k, False: 276] ------------------ 503| 382M| for (i = PK_NROWS - 1; i > row; i--) { ------------------ | | 13| 459k|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 459k|#define SYS_T 128 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 459k|#define GFBITS 13 | | ------------------ ------------------ | Branch (503:36): [True: 381M, False: 459k] ------------------ 504| 381M| mm = extract_mask256(mat.w[row], i); 505| | 506| 3.05G| for (k = 0; k < par_width; k++) { ------------------ | | 33| 3.05G|#define par_width 7 ------------------ | Branch (506:29): [True: 2.67G, False: 381M] ------------------ 507| 2.67G| par.v[ row ][ k ] ^= par.v[ i ][ k ] & mm; 508| 2.67G| } 509| 381M| } 510| 459k| } 511| | 512| | // 513| | 514| 276| if (j + par_width < 27) { ------------------ | | 33| 276|#define par_width 7 ------------------ | Branch (514:13): [True: 184, False: 92] ------------------ 515| 306k| for (row = 0; row < PK_NROWS; row++) { ------------------ | | 13| 306k|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 306k|#define SYS_T 128 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 306k|#define GFBITS 13 | | ------------------ ------------------ | Branch (515:27): [True: 306k, False: 184] ------------------ 516| 306k| if (j == 6) { ------------------ | Branch (516:21): [True: 153k, False: 153k] ------------------ 517| 153k| k = 2; 518| 153k| } else { 519| 153k| k = 0; 520| 153k| } 521| 8.57M| for (; k < 28; k++) { ------------------ | Branch (521:24): [True: 8.26M, False: 306k] ------------------ 522| 8.26M| store8(pk + PK_ROW_BYTES * row + j * 32 + k * 8 - 13 * 16, par.w[row][k]); ------------------ | | 15| 8.26M|#define PK_ROW_BYTES ((PK_NCOLS + 7)/8) | | ------------------ | | | | 14| 8.26M|#define PK_NCOLS (SYS_N - PK_NROWS) | | | | ------------------ | | | | | | 7| 8.26M|#define SYS_N 6688 | | | | ------------------ | | | | #define PK_NCOLS (SYS_N - PK_NROWS) | | | | ------------------ | | | | | | 13| 8.26M|#define PK_NROWS (SYS_T*GFBITS) | | | | | | ------------------ | | | | | | | | 8| 8.26M|#define SYS_T 128 | | | | | | ------------------ | | | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | | | ------------------ | | | | | | | | 6| 8.26M|#define GFBITS 13 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 523| 8.26M| } 524| 306k| } 525| 184| } else { 526| 153k| for (row = 0; row < PK_NROWS; row++) { ------------------ | | 13| 153k|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 153k|#define SYS_T 128 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 153k|#define GFBITS 13 | | ------------------ ------------------ | Branch (526:27): [True: 153k, False: 92] ------------------ 527| 3.82M| for (k = 0; k < 24; k++) { ------------------ | Branch (527:29): [True: 3.67M, False: 153k] ------------------ 528| 3.67M| store8(pk + PK_ROW_BYTES * row + j * 32 + k * 8 - 13 * 16, par.w[row][k]); ------------------ | | 15| 3.67M|#define PK_ROW_BYTES ((PK_NCOLS + 7)/8) | | ------------------ | | | | 14| 3.67M|#define PK_NCOLS (SYS_N - PK_NROWS) | | | | ------------------ | | | | | | 7| 3.67M|#define SYS_N 6688 | | | | ------------------ | | | | #define PK_NCOLS (SYS_N - PK_NROWS) | | | | ------------------ | | | | | | 13| 3.67M|#define PK_NROWS (SYS_T*GFBITS) | | | | | | ------------------ | | | | | | | | 8| 3.67M|#define SYS_T 128 | | | | | | ------------------ | | | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | | | ------------------ | | | | | | | | 6| 3.67M|#define GFBITS 13 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 529| 3.67M| } 530| | 531| 153k| store_i(pk + PK_ROW_BYTES * row + j * 32 + k * 8 - 13 * 16, par.w[row][k], 4); ------------------ | | 15| 153k|#define PK_ROW_BYTES ((PK_NCOLS + 7)/8) | | ------------------ | | | | 14| 153k|#define PK_NCOLS (SYS_N - PK_NROWS) | | | | ------------------ | | | | | | 7| 153k|#define SYS_N 6688 | | | | ------------------ | | | | #define PK_NCOLS (SYS_N - PK_NROWS) | | | | ------------------ | | | | | | 13| 153k|#define PK_NROWS (SYS_T*GFBITS) | | | | | | ------------------ | | | | | | | | 8| 153k|#define SYS_T 128 | | | | | | ------------------ | | | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | | | ------------------ | | | | | | | | 6| 153k|#define GFBITS 13 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 532| 153k| } 533| 92| } 534| 276| } 535| | 536| | // 537| | 538| 92| return 0; 539| 92|} PQCLEAN_MCELIECE6688128F_AVX2_genpoly_gen: 88| 118|int genpoly_gen(gf *out, gf *f) { 89| 118| int i, j, k; 90| | 91| 118| gf t, inv; 92| | 93| 118| uint64_t m; 94| 118| vec128 mask; 95| | 96| 118| union { 97| 118| uint64_t d[ GFBITS ][ 128 ][2]; 98| 118| vec128 v[ GFBITS ][ 128 ]; 99| 118| } buf; 100| | 101| 118| union { 102| 118| uint64_t d[GFBITS][2]; 103| 118| vec128 v[GFBITS]; 104| 118| } v; 105| | 106| 118| union { 107| 118| uint64_t d[SYS_T][GFBITS][2]; 108| 118| vec128 v[SYS_T][GFBITS]; 109| 118| } mat; 110| | 111| | // fill matrix 112| | 113| 118| buf.v[0][0] = vec128_set2x(1, 0); 114| 1.53k| for (i = 1; i < GFBITS; i++) { ------------------ | | 6| 1.53k|#define GFBITS 13 ------------------ | Branch (114:17): [True: 1.41k, False: 118] ------------------ 115| 1.41k| buf.v[i][0] = vec128_setzero(); 116| 1.41k| } 117| | 118| 1.65k| for (j = 0; j < GFBITS; j++) { ------------------ | | 6| 1.65k|#define GFBITS 13 ------------------ | Branch (118:17): [True: 1.53k, False: 118] ------------------ 119| 1.53k| v.v[j] = vec128_setzero(); 120| | 121| 197k| for (i = SYS_T - 1; i >= 0; i--) { ------------------ | | 8| 1.53k|#define SYS_T 128 ------------------ | Branch (121:29): [True: 196k, False: 1.53k] ------------------ 122| 196k| v.d[j][1] <<= 1; 123| 196k| v.d[j][1] |= v.d[j][0] >> 63; 124| 196k| v.d[j][0] <<= 1; 125| 196k| v.d[j][0] |= (f[i] >> j) & 1; 126| 196k| } 127| 1.53k| } 128| | 129| 1.65k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 1.65k|#define GFBITS 13 ------------------ | Branch (129:17): [True: 1.53k, False: 118] ------------------ 130| 1.53k| buf.v[i][1] = v.v[i]; 131| 1.53k| } 132| | 133| 15.1k| for (k = 2; k <= SYS_T; k++) { ------------------ | | 8| 15.1k|#define SYS_T 128 ------------------ | Branch (133:17): [True: 14.9k, False: 118] ------------------ 134| 14.9k| vec128_mul_GF(v.v, v.v, f); ------------------ | | 11| 14.9k|#define vec128_mul_GF CRYPTO_NAMESPACE(vec128_mul_GF) | | ------------------ | | | | 4| 14.9k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128F_AVX2_ ## fun | | ------------------ ------------------ 135| | 136| 14.9k| if (k < SYS_T) { ------------------ | | 8| 14.9k|#define SYS_T 128 ------------------ | Branch (136:13): [True: 14.8k, False: 118] ------------------ 137| 208k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 208k|#define GFBITS 13 ------------------ | Branch (137:25): [True: 193k, False: 14.8k] ------------------ 138| 193k| buf.v[i][k] = v.v[i]; 139| 193k| } 140| 14.8k| } else { 141| 15.2k| for (i = 0; i < SYS_T; i++) { ------------------ | | 8| 15.2k|#define SYS_T 128 ------------------ | Branch (141:25): [True: 15.1k, False: 118] ------------------ 142| 15.1k| out[i] = extract_gf(v.d, i); 143| 15.1k| } 144| 118| } 145| 14.9k| } 146| | 147| 1.65k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 1.65k|#define GFBITS 13 ------------------ | Branch (147:17): [True: 1.53k, False: 118] ------------------ 148| 1.53k| transpose_128x128(buf.d[i]); 149| 1.53k| } 150| | 151| 15.2k| for (j = 0; j < SYS_T; j++) { ------------------ | | 8| 15.2k|#define SYS_T 128 ------------------ | Branch (151:17): [True: 15.1k, False: 118] ------------------ 152| 211k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 211k|#define GFBITS 13 ------------------ | Branch (152:21): [True: 196k, False: 15.1k] ------------------ 153| 196k| mat.v[j][i] = buf.v[i][j]; 154| 196k| } 155| 15.1k| } 156| | 157| | // gaussian 158| | 159| 15.2k| for (i = 0; i < SYS_T; i++) { ------------------ | | 8| 15.2k|#define SYS_T 128 ------------------ | Branch (159:17): [True: 15.1k, False: 118] ------------------ 160| 974k| for (j = i + 1; j < SYS_T; j++) { ------------------ | | 8| 974k|#define SYS_T 128 ------------------ | Branch (160:25): [True: 959k, False: 15.1k] ------------------ 161| 959k| m = extract_bit(mat.d[i], i); 162| 959k| m -= 1; 163| 959k| mask = vec128_set2x(m, m); 164| | 165| 13.4M| for (k = 0; k < GFBITS; k++) { ------------------ | | 6| 13.4M|#define GFBITS 13 ------------------ | Branch (165:25): [True: 12.4M, False: 959k] ------------------ 166| 12.4M| mat.v[i][k] ^= mat.v[j][k] & mask; 167| 12.4M| } 168| | 169| 959k| out[i] ^= out[j] & m; 170| 959k| } 171| | 172| | // 173| | 174| 15.1k| t = extract_gf(mat.d[i], i); 175| | 176| 15.1k| if (gf_is_zero_declassify(t)) { ------------------ | Branch (176:13): [True: 0, False: 15.1k] ------------------ 177| 0| return -1; // return if not systematic 178| 0| } 179| | 180| | // 181| | 182| 15.1k| inv = gf_inv(t); ------------------ | | 11| 15.1k|#define gf_inv CRYPTO_NAMESPACE(gf_inv) | | ------------------ | | | | 4| 15.1k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128F_AVX2_ ## fun | | ------------------ ------------------ 183| 15.1k| vec128_mul_gf(mat.v[i], mat.v[i], inv); 184| | 185| 15.1k| out[i] = gf_mul(out[i], inv); ------------------ | | 14| 15.1k|#define gf_mul CRYPTO_NAMESPACE(gf_mul) | | ------------------ | | | | 4| 15.1k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128F_AVX2_ ## fun | | ------------------ ------------------ 186| | 187| 1.94M| for (j = 0; j < SYS_T; j++) { ------------------ | | 8| 1.94M|#define SYS_T 128 ------------------ | Branch (187:21): [True: 1.93M, False: 15.1k] ------------------ 188| 1.93M| if (j != i) { ------------------ | Branch (188:17): [True: 1.91M, False: 15.1k] ------------------ 189| 1.91M| t = extract_gf(mat.d[j], i); 190| | 191| 1.91M| vec128_mul_gf(v.v, mat.v[i], t); 192| 1.91M| vec128_add(mat.v[j], mat.v[j], v.v); 193| | 194| 1.91M| out[j] ^= gf_mul(out[i], t); ------------------ | | 14| 1.91M|#define gf_mul CRYPTO_NAMESPACE(gf_mul) | | ------------------ | | | | 4| 1.91M|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128F_AVX2_ ## fun | | ------------------ ------------------ 195| 1.91M| } 196| 1.93M| } 197| 15.1k| } 198| | 199| 118| return 0; 200| 118|} PQCLEAN_MCELIECE6688128F_AVX2_vec128_mul_GF: 6| 14.9k|void vec128_mul_GF(vec128 out[ GFBITS ], vec128 v[ GFBITS ], gf a[ SYS_T ]) { 7| 14.9k| int i, j; 8| 14.9k| uint64_t buf[GFBITS][4]; 9| 14.9k| vec128 prod[GFBITS]; 10| 14.9k| uint64_t p[GFBITS]; 11| | 12| | // polynomial multiplication 13| | 14| 209k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 209k|#define GFBITS 13 ------------------ | Branch (14:17): [True: 194k, False: 14.9k] ------------------ 15| 194k| buf[i][0] = 0; 16| 194k| buf[i][1] = 0; 17| 194k| buf[i][2] = 0; 18| 194k| buf[i][3] = 0; 19| 194k| } 20| | 21| 1.93M| for (i = SYS_T - 1; i >= 0; i--) { ------------------ | | 8| 14.9k|#define SYS_T 128 ------------------ | Branch (21:25): [True: 1.91M, False: 14.9k] ------------------ 22| 26.8M| for (j = 0; j < GFBITS; j++) { ------------------ | | 6| 26.8M|#define GFBITS 13 ------------------ | Branch (22:21): [True: 24.9M, False: 1.91M] ------------------ 23| 24.9M| buf[j][3] <<= 1; 24| 24.9M| buf[j][3] |= buf[j][2] >> 63; 25| 24.9M| buf[j][2] <<= 1; 26| 24.9M| buf[j][2] |= buf[j][1] >> 63; 27| 24.9M| buf[j][1] <<= 1; 28| 24.9M| buf[j][1] |= buf[j][0] >> 63; 29| 24.9M| buf[j][0] <<= 1; 30| 24.9M| } 31| | 32| 1.91M| vec128_mul_gf(prod, v, a[i]); 33| | 34| 26.8M| for (j = 0; j < GFBITS; j++) { ------------------ | | 6| 26.8M|#define GFBITS 13 ------------------ | Branch (34:21): [True: 24.9M, False: 1.91M] ------------------ 35| 24.9M| buf[j][0] ^= vec128_extract(prod[j], 0); ------------------ | | 29| 24.9M|#define vec128_extract(a, i) ((uint64_t) _mm_extract_epi64((vec128) (a), (i))) ------------------ 36| 24.9M| buf[j][1] ^= vec128_extract(prod[j], 1); ------------------ | | 29| 24.9M|#define vec128_extract(a, i) ((uint64_t) _mm_extract_epi64((vec128) (a), (i))) ------------------ 37| 24.9M| } 38| 1.91M| } 39| | 40| | // reduction modulo y^128+y^7+y^2+y+1 41| | 42| 209k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 209k|#define GFBITS 13 ------------------ | Branch (42:17): [True: 194k, False: 14.9k] ------------------ 43| 194k| p[i] = buf[i][3]; 44| | 45| 194k| buf[i][2] ^= p[i] >> (SYS_T - 7 - 64); ------------------ | | 8| 194k|#define SYS_T 128 ------------------ 46| 194k| buf[i][1] ^= p[i] << (64 - (SYS_T - 7 - 64)); ------------------ | | 8| 194k|#define SYS_T 128 ------------------ 47| 194k| buf[i][2] ^= p[i] >> (SYS_T - 2 - 64); ------------------ | | 8| 194k|#define SYS_T 128 ------------------ 48| 194k| buf[i][1] ^= p[i] << (64 - (SYS_T - 2 - 64)); ------------------ | | 8| 194k|#define SYS_T 128 ------------------ 49| 194k| buf[i][2] ^= p[i] >> (SYS_T - 1 - 64); ------------------ | | 8| 194k|#define SYS_T 128 ------------------ 50| 194k| buf[i][1] ^= p[i] << (64 - (SYS_T - 1 - 64)); ------------------ | | 8| 194k|#define SYS_T 128 ------------------ 51| 194k| buf[i][1] ^= p[i]; 52| 194k| } 53| | 54| | // 55| | 56| 209k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 209k|#define GFBITS 13 ------------------ | Branch (56:17): [True: 194k, False: 14.9k] ------------------ 57| 194k| p[i] = buf[i][2]; 58| | 59| 194k| buf[i][1] ^= p[i] >> (SYS_T - 7 - 64); ------------------ | | 8| 194k|#define SYS_T 128 ------------------ 60| 194k| buf[i][0] ^= p[i] << (64 - (SYS_T - 7 - 64)); ------------------ | | 8| 194k|#define SYS_T 128 ------------------ 61| 194k| buf[i][1] ^= p[i] >> (SYS_T - 2 - 64); ------------------ | | 8| 194k|#define SYS_T 128 ------------------ 62| 194k| buf[i][0] ^= p[i] << (64 - (SYS_T - 2 - 64)); ------------------ | | 8| 194k|#define SYS_T 128 ------------------ 63| 194k| buf[i][1] ^= p[i] >> (SYS_T - 1 - 64); ------------------ | | 8| 194k|#define SYS_T 128 ------------------ 64| 194k| buf[i][0] ^= p[i] << (64 - (SYS_T - 1 - 64)); ------------------ | | 8| 194k|#define SYS_T 128 ------------------ 65| 194k| buf[i][0] ^= p[i]; 66| 194k| } 67| | 68| | // 69| | 70| 209k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 209k|#define GFBITS 13 ------------------ | Branch (70:17): [True: 194k, False: 14.9k] ------------------ 71| 194k| out[i] = vec128_set2x(buf[i][0], buf[i][1]); 72| 194k| } 73| 14.9k|} PQCLEAN_MCELIECE6688128F_AVX2_vec256_sq: 9| 5.46k|void vec256_sq(vec256 *out, vec256 *in) { 10| 5.46k| int i; 11| 5.46k| vec256 result[GFBITS], t; 12| | 13| 5.46k| t = vec256_xor(in[11], in[12]); 14| | 15| 5.46k| result[0] = vec256_xor(in[0], in[11]); 16| 5.46k| result[1] = vec256_xor(in[7], t); 17| 5.46k| result[2] = vec256_xor(in[1], in[7]); 18| 5.46k| result[3] = vec256_xor(in[8], t); 19| 5.46k| result[4] = vec256_xor(in[2], in[7]); 20| 5.46k| result[4] = vec256_xor(result[4], in[8]); 21| 5.46k| result[4] = vec256_xor(result[4], t); 22| 5.46k| result[5] = vec256_xor(in[7], in[9]); 23| 5.46k| result[6] = vec256_xor(in[3], in[8]); 24| 5.46k| result[6] = vec256_xor(result[6], in[9]); 25| 5.46k| result[6] = vec256_xor(result[6], in[12]); 26| 5.46k| result[7] = vec256_xor(in[8], in[10]); 27| 5.46k| result[8] = vec256_xor(in[4], in[9]); 28| 5.46k| result[8] = vec256_xor(result[8], in[10]); 29| 5.46k| result[9] = vec256_xor(in[9], in[11]); 30| 5.46k| result[10] = vec256_xor(in[5], in[10]); 31| 5.46k| result[10] = vec256_xor(result[10], in[11]); 32| 5.46k| result[11] = vec256_xor(in[10], in[12]); 33| 5.46k| result[12] = vec256_xor(in[6], t); 34| | 35| 76.4k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 76.4k|#define GFBITS 13 ------------------ | Branch (35:17): [True: 71.0k, False: 5.46k] ------------------ 36| 71.0k| out[i] = result[i]; 37| 71.0k| } 38| 5.46k|} PQCLEAN_MCELIECE6688128F_AVX2_vec256_inv: 41| 210|void vec256_inv(vec256 *out, vec256 *in) { 42| 210| vec256 tmp_11[ GFBITS ]; 43| 210| vec256 tmp_1111[ GFBITS ]; 44| | 45| 210| vec256_copy(out, in); 46| | 47| 210| vec256_sq(out, out); ------------------ | | 14| 210|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 210|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128F_AVX2_ ## fun | | ------------------ ------------------ 48| 210| vec256_mul(tmp_11, out, in); // ^11 49| | 50| 210| vec256_sq(out, tmp_11); ------------------ | | 14| 210|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 210|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128F_AVX2_ ## fun | | ------------------ ------------------ 51| 210| vec256_sq(out, out); ------------------ | | 14| 210|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 210|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128F_AVX2_ ## fun | | ------------------ ------------------ 52| 210| vec256_mul(tmp_1111, out, tmp_11); // ^1111 53| | 54| 210| vec256_sq(out, tmp_1111); ------------------ | | 14| 210|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 210|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128F_AVX2_ ## fun | | ------------------ ------------------ 55| 210| vec256_sq(out, out); ------------------ | | 14| 210|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 210|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128F_AVX2_ ## fun | | ------------------ ------------------ 56| 210| vec256_sq(out, out); ------------------ | | 14| 210|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 210|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128F_AVX2_ ## fun | | ------------------ ------------------ 57| 210| vec256_sq(out, out); ------------------ | | 14| 210|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 210|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128F_AVX2_ ## fun | | ------------------ ------------------ 58| 210| vec256_mul(out, out, tmp_1111); // ^11111111 59| | 60| 210| vec256_sq(out, out); ------------------ | | 14| 210|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 210|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128F_AVX2_ ## fun | | ------------------ ------------------ 61| 210| vec256_sq(out, out); ------------------ | | 14| 210|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 210|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128F_AVX2_ ## fun | | ------------------ ------------------ 62| 210| vec256_sq(out, out); ------------------ | | 14| 210|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 210|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128F_AVX2_ ## fun | | ------------------ ------------------ 63| 210| vec256_sq(out, out); ------------------ | | 14| 210|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 210|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128F_AVX2_ ## fun | | ------------------ ------------------ 64| 210| vec256_mul(out, out, tmp_1111); // ^111111111111 65| | 66| 210| vec256_sq(out, out); // ^1111111111110 ------------------ | | 14| 210|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 210|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128F_AVX2_ ## fun | | ------------------ ------------------ 67| 210|} PQCLEAN_MCELIECE6960119_AVX2_load_bits: 188| 109|void load_bits(vec128 bits_int[][32], const unsigned char *bits) { 189| 109| int i, j; 190| 109| const unsigned char *ptr = bits; 191| | 192| 109| vec128 buf[64]; 193| | 194| 436| for (i = 0; i <= 5; i += 2) { ------------------ | Branch (194:17): [True: 327, False: 109] ------------------ 195| 21.2k| for (j = 0; j < 64; j++) { ------------------ | Branch (195:21): [True: 20.9k, False: 327] ------------------ 196| 20.9k| buf[j] = vec128_set2x(load8(ptr), load8(ptr + 512)); 197| 20.9k| ptr += 8; 198| 20.9k| } 199| | 200| 327| transpose_64x128_sp( buf ); 201| | 202| 10.7k| for (j = 0; j < 32; j++) { ------------------ | Branch (202:21): [True: 10.4k, False: 327] ------------------ 203| 10.4k| bits_int[i + 0][j] = vec128_unpack_low(buf[j], buf[j + 32]); 204| 10.4k| bits_int[i + 1][j] = vec128_unpack_high(buf[j], buf[j + 32]); 205| 10.4k| } 206| | 207| 327| ptr += 512; 208| 327| } 209| | 210| 1.52k| for (i = 6; i <= 18; i++) { ------------------ | Branch (210:17): [True: 1.41k, False: 109] ------------------ 211| 46.7k| for (j = 0; j < 32; j++) { ------------------ | Branch (211:21): [True: 45.3k, False: 1.41k] ------------------ 212| 45.3k| bits_int[i][j] = load16(ptr); 213| 45.3k| ptr += 16; 214| 45.3k| } 215| 1.41k| } 216| | 217| 436| for (i = 19; i < 25; i += 2) { ------------------ | Branch (217:18): [True: 327, False: 109] ------------------ 218| 21.2k| for (j = 0; j < 64; j++) { ------------------ | Branch (218:21): [True: 20.9k, False: 327] ------------------ 219| 20.9k| buf[j] = vec128_set2x(load8(ptr), load8(ptr + 512)); 220| 20.9k| ptr += 8; 221| 20.9k| } 222| | 223| 327| transpose_64x128_sp( buf ); 224| | 225| 10.7k| for (j = 0; j < 32; j++) { ------------------ | Branch (225:21): [True: 10.4k, False: 327] ------------------ 226| 10.4k| bits_int[i + 0][j] = vec128_unpack_low(buf[j], buf[j + 32]); 227| 10.4k| bits_int[i + 1][j] = vec128_unpack_high(buf[j], buf[j + 32]); 228| 10.4k| } 229| | 230| 327| ptr += 512; 231| 327| } 232| 109|} PQCLEAN_MCELIECE6960119_AVX2_benes: 238| 218|void benes(vec128 *r, vec128 b[][32], int rev) { 239| 218| int inc; 240| | 241| 218| vec128 *b_ptr; 242| | 243| 218| if (rev == 0) { ------------------ | Branch (243:9): [True: 109, False: 109] ------------------ 244| 109| inc = 32; 245| 109| b_ptr = b[ 0]; 246| 109| } else { 247| 109| inc = -32; 248| 109| b_ptr = b[24]; 249| 109| } 250| | 251| | // 252| | 253| 218| transpose_64x128_sp( r ); 254| | 255| 218| layer_0(r, b_ptr); 256| 218| b_ptr += inc; 257| 218| layer_1(r, b_ptr); 258| 218| b_ptr += inc; 259| 218| layer_2(r, b_ptr); 260| 218| b_ptr += inc; 261| 218| layer_3(r, b_ptr); 262| 218| b_ptr += inc; 263| 218| layer_4(r, b_ptr); 264| 218| b_ptr += inc; 265| 218| layer_5(r, b_ptr); 266| 218| b_ptr += inc; 267| | 268| 218| transpose_64x128_sp( r ); 269| | 270| 218| layer_x(r, b_ptr); 271| 218| b_ptr += inc; 272| 218| layer_0(r, b_ptr); 273| 218| b_ptr += inc; 274| 218| layer_1(r, b_ptr); 275| 218| b_ptr += inc; 276| 218| layer_2(r, b_ptr); 277| 218| b_ptr += inc; 278| 218| layer_3(r, b_ptr); 279| 218| b_ptr += inc; 280| 218| layer_4(r, b_ptr); 281| 218| b_ptr += inc; 282| 218| layer_5(r, b_ptr); 283| 218| b_ptr += inc; 284| 218| layer_4(r, b_ptr); 285| 218| b_ptr += inc; 286| 218| layer_3(r, b_ptr); 287| 218| b_ptr += inc; 288| 218| layer_2(r, b_ptr); 289| 218| b_ptr += inc; 290| 218| layer_1(r, b_ptr); 291| 218| b_ptr += inc; 292| 218| layer_0(r, b_ptr); 293| 218| b_ptr += inc; 294| 218| layer_x(r, b_ptr); 295| 218| b_ptr += inc; 296| | 297| 218| transpose_64x128_sp( r ); 298| | 299| 218| layer_5(r, b_ptr); 300| 218| b_ptr += inc; 301| 218| layer_4(r, b_ptr); 302| 218| b_ptr += inc; 303| 218| layer_3(r, b_ptr); 304| 218| b_ptr += inc; 305| 218| layer_2(r, b_ptr); 306| 218| b_ptr += inc; 307| 218| layer_1(r, b_ptr); 308| 218| b_ptr += inc; 309| 218| layer_0(r, b_ptr); 310| | 311| 218| transpose_64x128_sp( r ); 312| 218|} PQCLEAN_MCELIECE6960119_AVX2_bm: 147| 109|void bm(vec128 *out, vec256 *in) { 148| 109| int i; 149| 109| uint16_t N, L; 150| 109| uint16_t mask; 151| 109| uint64_t one = 1; 152| 109| uint64_t v[2]; 153| | 154| 109| vec128 prod[ GFBITS ]; 155| 109| vec128 interval[GFBITS]; 156| | 157| 109| typedef union { 158| 109| vec128 v[GFBITS][2]; 159| 109| vec256 V[GFBITS]; 160| 109| } db_t; 161| | 162| 109| db_t db; 163| 109| db_t BC_tmp; 164| 109| db_t BC; 165| | 166| 109| gf d, b; 167| 109| gf coefs[256]; 168| | 169| | // initialization 170| | 171| 109| get_coefs(coefs, in); 172| | 173| 109| BC.v[0][0] = vec128_set2x(0, one << 62); 174| 109| BC.v[0][1] = vec128_set2x(0, one << 63); 175| | 176| 1.41k| for (i = 1; i < GFBITS; i++) { ------------------ | | 6| 1.41k|#define GFBITS 13 ------------------ | Branch (176:17): [True: 1.30k, False: 109] ------------------ 177| 1.30k| BC.v[i][0] = BC.v[i][1] = vec128_setzero(); 178| 1.30k| } 179| | 180| 109| b = 1; 181| 109| L = 0; 182| | 183| | // 184| | 185| 1.52k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 1.52k|#define GFBITS 13 ------------------ | Branch (185:17): [True: 1.41k, False: 109] ------------------ 186| 1.41k| interval[i] = vec128_setzero(); 187| 1.41k| } 188| | 189| 26.0k| for (N = 0; N < SYS_T * 2; N++) { ------------------ | | 8| 26.0k|#define SYS_T 119 ------------------ | Branch (189:17): [True: 25.9k, False: 109] ------------------ 190| 25.9k| update_asm(interval, coefs[N], 16); ------------------ | | 1| 25.9k|#define update_asm CRYPTO_NAMESPACE(update_asm) | | ------------------ | | | | 4| 25.9k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119_AVX2_ ## fun | | ------------------ ------------------ 191| 25.9k| vec128_mul_asm(prod, interval, BC.v[0] + 1, 32); ------------------ | | 10| 25.9k|#define vec128_mul_asm CRYPTO_NAMESPACE(vec128_mul_asm) | | ------------------ | | | | 4| 25.9k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119_AVX2_ ## fun | | ------------------ ------------------ 192| | 193| 25.9k| d = vec_reduce_asm(prod); ------------------ | | 3| 25.9k|#define vec_reduce_asm CRYPTO_NAMESPACE(vec_reduce_asm) | | ------------------ | | | | 4| 25.9k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119_AVX2_ ## fun | | ------------------ ------------------ 194| | 195| 25.9k| mask = mask_nonzero(d) & mask_leq(L * 2, N); 196| | 197| 363k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 363k|#define GFBITS 13 ------------------ | Branch (197:21): [True: 337k, False: 25.9k] ------------------ 198| 337k| db.v[i][0] = vec128_setbits((d >> i) & 1); 199| 337k| db.v[i][1] = vec128_setbits((b >> i) & 1); 200| 337k| } 201| | 202| 25.9k| vec256_mul((vec256 *) BC_tmp.V, (vec256 *) db.V, (vec256 *) BC.V); 203| | 204| 25.9k| vec128_cmov(BC.v, mask); 205| 25.9k| update_asm(BC.v, 0, 32); ------------------ | | 1| 25.9k|#define update_asm CRYPTO_NAMESPACE(update_asm) | | ------------------ | | | | 4| 25.9k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119_AVX2_ ## fun | | ------------------ ------------------ 206| | 207| 363k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 363k|#define GFBITS 13 ------------------ | Branch (207:21): [True: 337k, False: 25.9k] ------------------ 208| 337k| BC.v[i][1] = vec128_xor(BC_tmp.v[i][0], BC_tmp.v[i][1]); 209| 337k| } 210| | 211| 25.9k| b = (d & mask) | (b & ~mask); 212| 25.9k| L = ((N + 1 - L) & mask) | (L & ~mask); 213| 25.9k| } 214| | 215| 1.52k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 1.52k|#define GFBITS 13 ------------------ | Branch (215:17): [True: 1.41k, False: 109] ------------------ 216| 1.41k| v[0] = vec128_extract(BC.v[i][1], 0); ------------------ | | 29| 1.41k|#define vec128_extract(a, i) ((uint64_t) _mm_extract_epi64((vec128) (a), (i))) ------------------ 217| 1.41k| v[1] = vec128_extract(BC.v[i][1], 1); ------------------ | | 29| 1.41k|#define vec128_extract(a, i) ((uint64_t) _mm_extract_epi64((vec128) (a), (i))) ------------------ 218| | 219| 1.41k| out[i] = vec128_set2x((v[0] >> 8) | (v[1] << 56), v[1] >> 8); 220| 1.41k| } 221| 109|} PQCLEAN_MCELIECE6960119_AVX2_controlbitsfrompermutation: 205| 109|void controlbitsfrompermutation(unsigned char *out, const int16 *pi, long long w, long long n) { 206| 109| PQCLEAN_VLA(int32, temp, (size_t)(2 * n)); ------------------ | | 57| 109|# define PQCLEAN_VLA(__t,__x,__s) __t __x[__s] ------------------ 207| 109| PQCLEAN_VLA(int16, pi_test, (size_t)n); ------------------ | | 57| 109|# define PQCLEAN_VLA(__t,__x,__s) __t __x[__s] ------------------ 208| 109| int16 diff; 209| 109| int i; 210| 109| unsigned char *ptr; 211| | 212| 109| OQS_MEM_cleanse(temp, (size_t)n * 2); 213| 109| OQS_MEM_cleanse(pi_test, (size_t)n); 214| | 215| 109| while (1) { ------------------ | Branch (215:12): [True: 109, Folded] ------------------ 216| 109| OQS_MEM_cleanse(out, (size_t)((((2 * w - 1)*n / 2) + 7) / 8)); 217| 109| cbrecursion(out, 0, 1, pi, w, n, temp); 218| | 219| | // check for correctness 220| | 221| 893k| for (i = 0; i < n; i++) { ------------------ | Branch (221:21): [True: 892k, False: 109] ------------------ 222| 892k| pi_test[i] = (int16)i; 223| 892k| } 224| | 225| 109| ptr = out; 226| 1.52k| for (i = 0; i < w; i++) { ------------------ | Branch (226:21): [True: 1.41k, False: 109] ------------------ 227| 1.41k| layer(pi_test, ptr, i, (int32)n); 228| 1.41k| ptr += n >> 4; 229| 1.41k| } 230| | 231| 1.41k| for (i = (int)(w - 2); i >= 0; i--) { ------------------ | Branch (231:32): [True: 1.30k, False: 109] ------------------ 232| 1.30k| layer(pi_test, ptr, i, (int32)n); 233| 1.30k| ptr += n >> 4; 234| 1.30k| } 235| | 236| 109| diff = 0; 237| 893k| for (i = 0; i < n; i++) { ------------------ | Branch (237:21): [True: 892k, False: 109] ------------------ 238| 892k| diff |= pi[i] ^ pi_test[i]; 239| 892k| } 240| | 241| 109| diff = crypto_int16_nonzero_mask(diff); ------------------ | | 12| 109|#define crypto_int16_nonzero_mask CRYPTO_NAMESPACE(crypto_int16_nonzero_mask) | | ------------------ | | | | 4| 109|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119_AVX2_ ## fun | | ------------------ ------------------ 242| 109| crypto_declassify(&diff, sizeof diff); 243| 109| if (diff == 0) { ------------------ | Branch (243:13): [True: 109, False: 0] ------------------ 244| 109| break; 245| 109| } 246| 109| } 247| 109|} PQCLEAN_MCELIECE6960119_AVX2_crypto_int16_negative_mask: 3| 218|crypto_int16 crypto_int16_negative_mask(crypto_int16 crypto_int16_x) { 4| 218| return crypto_int16_x >> 15; 5| 218|} PQCLEAN_MCELIECE6960119_AVX2_crypto_int16_nonzero_mask: 7| 109|crypto_int16 crypto_int16_nonzero_mask(crypto_int16 crypto_int16_x) { 8| 109| return crypto_int16_negative_mask(crypto_int16_x) | crypto_int16_negative_mask(-crypto_int16_x); ------------------ | | 10| 109|#define crypto_int16_negative_mask CRYPTO_NAMESPACE(crypto_int16_negative_mask) | | ------------------ | | | | 4| 109|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119_AVX2_ ## fun | | ------------------ ------------------ return crypto_int16_negative_mask(crypto_int16_x) | crypto_int16_negative_mask(-crypto_int16_x); ------------------ | | 10| 109|#define crypto_int16_negative_mask CRYPTO_NAMESPACE(crypto_int16_negative_mask) | | ------------------ | | | | 4| 109|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119_AVX2_ ## fun | | ------------------ ------------------ 9| 109|} PQCLEAN_MCELIECE6960119_AVX2_crypto_int32_negative_mask: 3| 69.6M|crypto_int32 crypto_int32_negative_mask(crypto_int32 crypto_int32_x) { 4| 69.6M| return crypto_int32_x >> 31; 5| 69.6M|} PQCLEAN_MCELIECE6960119_AVX2_crypto_int32_min: 37| 69.6M|crypto_int32 crypto_int32_min(crypto_int32 crypto_int32_x, crypto_int32 crypto_int32_y) { 38| 69.6M| crypto_int32 crypto_int32_xy = crypto_int32_y ^ crypto_int32_x; 39| 69.6M| crypto_int32 crypto_int32_z = crypto_int32_y - crypto_int32_x; 40| 69.6M| crypto_int32_z ^= crypto_int32_xy & (crypto_int32_z ^ crypto_int32_y); 41| 69.6M| crypto_int32_z = crypto_int32_negative_mask(crypto_int32_z); ------------------ | | 9| 69.6M|#define crypto_int32_negative_mask CRYPTO_NAMESPACE(crypto_int32_negative_mask) | | ------------------ | | | | 4| 69.6M|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119_AVX2_ ## fun | | ------------------ ------------------ 42| 69.6M| crypto_int32_z &= crypto_int32_xy; 43| 69.6M| return crypto_int32_x ^ crypto_int32_z; 44| 69.6M|} PQCLEAN_MCELIECE6960119_AVX2_crypto_uint16_signed_negative_mask: 3| 354k|crypto_uint16_signed crypto_uint16_signed_negative_mask(crypto_uint16_signed crypto_uint16_signed_x) { 4| 354k| return crypto_uint16_signed_x >> 15; 5| 354k|} PQCLEAN_MCELIECE6960119_AVX2_crypto_uint16_nonzero_mask: 7| 137k|crypto_uint16 crypto_uint16_nonzero_mask(crypto_uint16 crypto_uint16_x) { 8| 137k| return crypto_uint16_signed_negative_mask(crypto_uint16_x) | crypto_uint16_signed_negative_mask(-crypto_uint16_x); ------------------ | | 11| 137k|#define crypto_uint16_signed_negative_mask CRYPTO_NAMESPACE(crypto_uint16_signed_negative_mask) | | ------------------ | | | | 4| 137k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119_AVX2_ ## fun | | ------------------ ------------------ return crypto_uint16_signed_negative_mask(crypto_uint16_x) | crypto_uint16_signed_negative_mask(-crypto_uint16_x); ------------------ | | 11| 137k|#define crypto_uint16_signed_negative_mask CRYPTO_NAMESPACE(crypto_uint16_signed_negative_mask) | | ------------------ | | | | 4| 137k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119_AVX2_ ## fun | | ------------------ ------------------ 9| 137k|} PQCLEAN_MCELIECE6960119_AVX2_crypto_uint16_zero_mask: 11| 137k|crypto_uint16 crypto_uint16_zero_mask(crypto_uint16 crypto_uint16_x) { 12| 137k| return ~crypto_uint16_nonzero_mask(crypto_uint16_x); ------------------ | | 13| 137k|#define crypto_uint16_nonzero_mask CRYPTO_NAMESPACE(crypto_uint16_nonzero_mask) | | ------------------ | | | | 4| 137k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119_AVX2_ ## fun | | ------------------ ------------------ 13| 137k|} PQCLEAN_MCELIECE6960119_AVX2_crypto_uint16_smaller_mask: 24| 79.5k|crypto_uint16 crypto_uint16_smaller_mask(crypto_uint16 crypto_uint16_x, crypto_uint16 crypto_uint16_y) { 25| 79.5k| crypto_uint16 crypto_uint16_xy = crypto_uint16_x ^ crypto_uint16_y; 26| 79.5k| crypto_uint16 crypto_uint16_z = crypto_uint16_x - crypto_uint16_y; 27| 79.5k| crypto_uint16_z ^= crypto_uint16_xy & (crypto_uint16_z ^ crypto_uint16_x ^ (((crypto_uint16) 1) << 15)); 28| 79.5k| return crypto_uint16_signed_negative_mask(crypto_uint16_z); ------------------ | | 11| 79.5k|#define crypto_uint16_signed_negative_mask CRYPTO_NAMESPACE(crypto_uint16_signed_negative_mask) | | ------------------ | | | | 4| 79.5k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119_AVX2_ ## fun | | ------------------ ------------------ 29| 79.5k|} PQCLEAN_MCELIECE6960119_AVX2_crypto_uint32_signed_negative_mask: 3| 133k|crypto_uint32_signed crypto_uint32_signed_negative_mask(crypto_uint32_signed crypto_uint32_signed_x) { 4| 133k| return crypto_uint32_signed_x >> 31; 5| 133k|} PQCLEAN_MCELIECE6960119_AVX2_crypto_uint32_nonzero_mask: 7| 66.7k|crypto_uint32 crypto_uint32_nonzero_mask(crypto_uint32 crypto_uint32_x) { 8| 66.7k| return crypto_uint32_signed_negative_mask(crypto_uint32_x) | crypto_uint32_signed_negative_mask(-crypto_uint32_x); ------------------ | | 11| 66.7k|#define crypto_uint32_signed_negative_mask CRYPTO_NAMESPACE(crypto_uint32_signed_negative_mask) | | ------------------ | | | | 4| 66.7k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119_AVX2_ ## fun | | ------------------ ------------------ return crypto_uint32_signed_negative_mask(crypto_uint32_x) | crypto_uint32_signed_negative_mask(-crypto_uint32_x); ------------------ | | 11| 66.7k|#define crypto_uint32_signed_negative_mask CRYPTO_NAMESPACE(crypto_uint32_signed_negative_mask) | | ------------------ | | | | 4| 66.7k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119_AVX2_ ## fun | | ------------------ ------------------ 9| 66.7k|} PQCLEAN_MCELIECE6960119_AVX2_crypto_uint32_unequal_mask: 15| 66.7k|crypto_uint32 crypto_uint32_unequal_mask(crypto_uint32 crypto_uint32_x, crypto_uint32 crypto_uint32_y) { 16| 66.7k| crypto_uint32 crypto_uint32_xy = crypto_uint32_x ^ crypto_uint32_y; 17| 66.7k| return crypto_uint32_nonzero_mask(crypto_uint32_xy); ------------------ | | 13| 66.7k|#define crypto_uint32_nonzero_mask CRYPTO_NAMESPACE(crypto_uint32_nonzero_mask) | | ------------------ | | | | 4| 66.7k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119_AVX2_ ## fun | | ------------------ ------------------ 18| 66.7k|} PQCLEAN_MCELIECE6960119_AVX2_crypto_uint32_equal_mask: 20| 66.7k|crypto_uint32 crypto_uint32_equal_mask(crypto_uint32 crypto_uint32_x, crypto_uint32 crypto_uint32_y) { 21| 66.7k| return ~crypto_uint32_unequal_mask(crypto_uint32_x, crypto_uint32_y); ------------------ | | 17| 66.7k|#define crypto_uint32_unequal_mask CRYPTO_NAMESPACE(crypto_uint32_unequal_mask) | | ------------------ | | | | 4| 66.7k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119_AVX2_ ## fun | | ------------------ ------------------ 22| 66.7k|} PQCLEAN_MCELIECE6960119_AVX2_crypto_uint64_signed_negative_mask: 3| 22.1M|crypto_uint64_signed crypto_uint64_signed_negative_mask(crypto_uint64_signed crypto_uint64_signed_x) { 4| 22.1M| return crypto_uint64_signed_x >> 63; 5| 22.1M|} PQCLEAN_MCELIECE6960119_AVX2_crypto_uint64_nonzero_mask: 7| 11.0M|crypto_uint64 crypto_uint64_nonzero_mask(crypto_uint64 crypto_uint64_x) { 8| 11.0M| return crypto_uint64_signed_negative_mask(crypto_uint64_x) | crypto_uint64_signed_negative_mask(-crypto_uint64_x); ------------------ | | 11| 11.0M|#define crypto_uint64_signed_negative_mask CRYPTO_NAMESPACE(crypto_uint64_signed_negative_mask) | | ------------------ | | | | 4| 11.0M|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119_AVX2_ ## fun | | ------------------ ------------------ return crypto_uint64_signed_negative_mask(crypto_uint64_x) | crypto_uint64_signed_negative_mask(-crypto_uint64_x); ------------------ | | 11| 11.0M|#define crypto_uint64_signed_negative_mask CRYPTO_NAMESPACE(crypto_uint64_signed_negative_mask) | | ------------------ | | | | 4| 11.0M|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119_AVX2_ ## fun | | ------------------ ------------------ 9| 11.0M|} PQCLEAN_MCELIECE6960119_AVX2_crypto_uint64_zero_mask: 11| 1.73M|crypto_uint64 crypto_uint64_zero_mask(crypto_uint64 crypto_uint64_x) { 12| 1.73M| return ~crypto_uint64_nonzero_mask(crypto_uint64_x); ------------------ | | 13| 1.73M|#define crypto_uint64_nonzero_mask CRYPTO_NAMESPACE(crypto_uint64_nonzero_mask) | | ------------------ | | | | 4| 1.73M|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119_AVX2_ ## fun | | ------------------ ------------------ 13| 1.73M|} PQCLEAN_MCELIECE6960119_AVX2_crypto_uint64_unequal_mask: 15| 9.32M|crypto_uint64 crypto_uint64_unequal_mask(crypto_uint64 crypto_uint64_x, crypto_uint64 crypto_uint64_y) { 16| 9.32M| crypto_uint64 crypto_uint64_xy = crypto_uint64_x ^ crypto_uint64_y; 17| 9.32M| return crypto_uint64_nonzero_mask(crypto_uint64_xy); ------------------ | | 13| 9.32M|#define crypto_uint64_nonzero_mask CRYPTO_NAMESPACE(crypto_uint64_nonzero_mask) | | ------------------ | | | | 4| 9.32M|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119_AVX2_ ## fun | | ------------------ ------------------ 18| 9.32M|} PQCLEAN_MCELIECE6960119_AVX2_crypto_uint64_equal_mask: 20| 9.32M|crypto_uint64 crypto_uint64_equal_mask(crypto_uint64 crypto_uint64_x, crypto_uint64 crypto_uint64_y) { 21| 9.32M| return ~crypto_uint64_unequal_mask(crypto_uint64_x, crypto_uint64_y); ------------------ | | 17| 9.32M|#define crypto_uint64_unequal_mask CRYPTO_NAMESPACE(crypto_uint64_unequal_mask) | | ------------------ | | | | 4| 9.32M|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119_AVX2_ ## fun | | ------------------ ------------------ 22| 9.32M|} PQCLEAN_MCELIECE6960119_AVX2_decrypt: 171| 109|int decrypt(unsigned char *e, const unsigned char *sk, const unsigned char *s) { 172| 109| int i; 173| | 174| 109| uint16_t check_synd; 175| 109| uint16_t check_weight; 176| | 177| 109| vec256 inv[ 32 ][ GFBITS ]; 178| 109| vec256 scaled[ 32 ][ GFBITS ]; 179| 109| vec256 eval[32][ GFBITS ]; 180| | 181| 109| vec128 error128[ 64 ]; 182| 109| vec256 error256[ 32 ]; 183| | 184| 109| vec256 s_priv[ GFBITS ]; 185| 109| vec256 s_priv_cmp[ GFBITS ]; 186| 109| vec128 locator[ GFBITS ]; 187| | 188| 109| vec128 recv128[ 64 ]; 189| 109| vec256 recv256[ 32 ]; 190| 109| vec256 allone; 191| | 192| 109| vec128 bits_int[25][32]; 193| | 194| | // Berlekamp decoder 195| | 196| 109| preprocess(recv128, s); 197| | 198| 109| load_bits(bits_int, sk + IRR_BYTES); ------------------ | | 10| 109|#define load_bits CRYPTO_NAMESPACE(load_bits) | | ------------------ | | | | 4| 109|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119_AVX2_ ## fun | | ------------------ ------------------ load_bits(bits_int, sk + IRR_BYTES); ------------------ | | 11| 109|#define IRR_BYTES (SYS_T * 2) | | ------------------ | | | | 8| 109|#define SYS_T 119 | | ------------------ ------------------ 199| 109| benes(recv128, bits_int, 1); ------------------ | | 9| 109|#define benes CRYPTO_NAMESPACE(benes) | | ------------------ | | | | 4| 109|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119_AVX2_ ## fun | | ------------------ ------------------ 200| | 201| 109| reformat_128to256(recv256, recv128); 202| | 203| 109| scaling(scaled, inv, sk, recv256); 204| 109| fft_tr(s_priv, scaled); ------------------ | | 9| 109|#define fft_tr CRYPTO_NAMESPACE(fft_tr) | | ------------------ | | | | 4| 109|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119_AVX2_ ## fun | | ------------------ ------------------ 205| 109| bm(locator, s_priv); ------------------ | | 10| 109|#define bm CRYPTO_NAMESPACE(bm) | | ------------------ | | | | 4| 109|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119_AVX2_ ## fun | | ------------------ ------------------ 206| | 207| 109| fft(eval, locator); ------------------ | | 10| 109|#define fft CRYPTO_NAMESPACE(fft) | | ------------------ | | | | 4| 109|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119_AVX2_ ## fun | | ------------------ ------------------ 208| | 209| | // reencryption and weight check 210| | 211| 109| allone = vec256_set1_16b(0xFFFF); 212| | 213| 3.59k| for (i = 0; i < 32; i++) { ------------------ | Branch (213:17): [True: 3.48k, False: 109] ------------------ 214| 3.48k| error256[i] = vec256_or_reduce(eval[i]); 215| 3.48k| error256[i] = vec256_xor(error256[i], allone); 216| 3.48k| } 217| | 218| 109| scaling_inv(scaled, inv, error256); 219| 109| fft_tr(s_priv_cmp, scaled); ------------------ | | 9| 109|#define fft_tr CRYPTO_NAMESPACE(fft_tr) | | ------------------ | | | | 4| 109|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119_AVX2_ ## fun | | ------------------ ------------------ 220| | 221| 109| check_synd = synd_cmp(s_priv, s_priv_cmp); 222| | 223| | // 224| | 225| 109| reformat_256to128(error128, error256); 226| 109| benes(error128, bits_int, 0); ------------------ | | 9| 109|#define benes CRYPTO_NAMESPACE(benes) | | ------------------ | | | | 4| 109|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119_AVX2_ ## fun | | ------------------ ------------------ 227| | 228| 109| postprocess(e, error128); 229| | 230| 109| check_weight = weight_check(e, error128); 231| | 232| 109| return 1 - (check_synd & check_weight); 233| 109|} PQCLEAN_MCELIECE6960119_AVX2_encrypt: 116| 109|void encrypt(unsigned char *s, const unsigned char *pk, unsigned char *e) { 117| 109| gen_e(e); 118| | 119| 109| syndrome_asm(s, pk, e); ------------------ | | 1| 109|#define syndrome_asm CRYPTO_NAMESPACE(syndrome_asm) | | ------------------ | | | | 4| 109|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119_AVX2_ ## fun | | ------------------ ------------------ 120| 109|} PQCLEAN_MCELIECE6960119_AVX2_fft: 265| 1.37k|void fft(vec256 out[][GFBITS], vec128 *in) { 266| 1.37k| radix_conversions(in); 267| 1.37k| butterflies(out, in); 268| 1.37k|} PQCLEAN_MCELIECE6960119_AVX2_fft_tr: 398| 218|void fft_tr(vec256 *out, vec256 in[][ GFBITS ]) { 399| 218| butterflies_tr(out, in); 400| 218| radix_conversions_tr(out); 401| | 402| 218| postprocess(out); 403| 218|} PQCLEAN_MCELIECE6960119_AVX2_gf_mul: 20| 16.3M|gf gf_mul(gf in0, gf in1) { 21| 16.3M| int i; 22| | 23| 16.3M| uint64_t tmp; 24| 16.3M| uint64_t t0; 25| 16.3M| uint64_t t1; 26| 16.3M| uint64_t t; 27| | 28| 16.3M| t0 = in0; 29| 16.3M| t1 = in1; 30| | 31| 16.3M| tmp = t0 * (t1 & 1); 32| | 33| 212M| for (i = 1; i < GFBITS; i++) { ------------------ | | 6| 212M|#define GFBITS 13 ------------------ | Branch (33:17): [True: 196M, False: 16.3M] ------------------ 34| 196M| tmp ^= (t0 * (t1 & (1 << i))); 35| 196M| } 36| | 37| | // 38| | 39| 16.3M| t = tmp & 0x1FF0000; 40| 16.3M| tmp ^= (t >> 9) ^ (t >> 10) ^ (t >> 12) ^ (t >> 13); 41| | 42| 16.3M| t = tmp & 0x000E000; 43| 16.3M| tmp ^= (t >> 9) ^ (t >> 10) ^ (t >> 12) ^ (t >> 13); 44| | 45| 16.3M| return tmp & GFMASK; ------------------ | | 19| 16.3M|#define GFMASK ((1 << GFBITS) - 1) | | ------------------ | | | | 6| 16.3M|#define GFBITS 13 | | ------------------ ------------------ 46| 16.3M|} PQCLEAN_MCELIECE6960119_AVX2_gf_frac: 156| 137k|gf gf_frac(gf den, gf num) { 157| 137k| gf tmp_11; 158| 137k| gf tmp_1111; 159| 137k| gf out; 160| | 161| 137k| tmp_11 = gf_sqmul(den, den); // ^11 162| 137k| tmp_1111 = gf_sq2mul(tmp_11, tmp_11); // ^1111 163| 137k| out = gf_sq2(tmp_1111); 164| 137k| out = gf_sq2mul(out, tmp_1111); // ^11111111 165| 137k| out = gf_sq2(out); 166| 137k| out = gf_sq2mul(out, tmp_1111); // ^111111111111 167| | 168| 137k| return gf_sqmul(out, num); // ^1111111111110 = ^-1 169| 137k|} PQCLEAN_MCELIECE6960119_AVX2_gf_inv: 172| 137k|gf gf_inv(gf den) { 173| 137k| return gf_frac(den, ((gf) 1)); ------------------ | | 10| 137k|#define gf_frac CRYPTO_NAMESPACE(gf_frac) | | ------------------ | | | | 4| 137k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119_AVX2_ ## fun | | ------------------ ------------------ 174| 137k|} pk_gen.c:PQCLEAN_MCELIECE6960119_AVX2_int32_sort: 21| 109|static void int32_sort(int32_t *x, long long n) { 22| 109| long long top, p, q, r, i; 23| | 24| 109| if (n < 2) { ------------------ | Branch (24:9): [True: 0, False: 109] ------------------ 25| 0| return; 26| 0| } 27| 109| top = 1; 28| 1.19k| while (top < n - top) { ------------------ | Branch (28:12): [True: 1.09k, False: 109] ------------------ 29| 1.09k| top += top; 30| 1.09k| } 31| | 32| 1.30k| for (p = top; p > 0; p >>= 1) { ------------------ | Branch (32:19): [True: 1.19k, False: 109] ------------------ 33| 1.63M| for (i = 0; i < n - p; ++i) { ------------------ | Branch (33:21): [True: 1.63M, False: 1.19k] ------------------ 34| 1.63M| if (!(i & p)) { ------------------ | Branch (34:17): [True: 869k, False: 762k] ------------------ 35| 869k| int32_MINMAX(x[i], x[i + p]); ------------------ | | 11| 869k| do { \ | | 12| 869k| int32_t ab = (b) ^ (a); \ | | 13| 869k| int32_t c = (b) - (a); \ | | 14| 869k| c ^= ab & ((c) ^ (b)); \ | | 15| 869k| c >>= 31; \ | | 16| 869k| c &= ab; \ | | 17| 869k| (a) ^= c; \ | | 18| 869k| (b) ^= c; \ | | 19| 869k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 869k] | | ------------------ ------------------ 36| 869k| } 37| 1.63M| } 38| 1.19k| i = 0; 39| 7.19k| for (q = top; q > p; q >>= 1) { ------------------ | Branch (39:23): [True: 5.99k, False: 1.19k] ------------------ 40| 1.46M| for (; i < n - q; ++i) { ------------------ | Branch (40:20): [True: 1.46M, False: 5.99k] ------------------ 41| 1.46M| if (!(i & p)) { ------------------ | Branch (41:21): [True: 762k, False: 700k] ------------------ 42| 762k| int32_t a = x[i + p]; 43| 4.43M| for (r = q; r > p; r >>= 1) { ------------------ | Branch (43:33): [True: 3.67M, False: 762k] ------------------ 44| 3.67M| int32_MINMAX(a, x[i + r]); ------------------ | | 11| 3.67M| do { \ | | 12| 3.67M| int32_t ab = (b) ^ (a); \ | | 13| 3.67M| int32_t c = (b) - (a); \ | | 14| 3.67M| c ^= ab & ((c) ^ (b)); \ | | 15| 3.67M| c >>= 31; \ | | 16| 3.67M| c &= ab; \ | | 17| 3.67M| (a) ^= c; \ | | 18| 3.67M| (b) ^= c; \ | | 19| 3.67M| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 3.67M] | | ------------------ ------------------ 45| 3.67M| } 46| 762k| x[i + p] = a; 47| 762k| } 48| 1.46M| } 49| 5.99k| } 50| 1.19k| } 51| 109|} controlbits.c:PQCLEAN_MCELIECE6960119_AVX2_int32_sort: 21| 3.57M|static void int32_sort(int32_t *x, long long n) { 22| 3.57M| long long top, p, q, r, i; 23| | 24| 3.57M| if (n < 2) { ------------------ | Branch (24:9): [True: 0, False: 3.57M] ------------------ 25| 0| return; 26| 0| } 27| 3.57M| top = 1; 28| 12.5M| while (top < n - top) { ------------------ | Branch (28:12): [True: 8.94M, False: 3.57M] ------------------ 29| 8.94M| top += top; 30| 8.94M| } 31| | 32| 16.0M| for (p = top; p > 0; p >>= 1) { ------------------ | Branch (32:19): [True: 12.5M, False: 3.57M] ------------------ 33| 1.72G| for (i = 0; i < n - p; ++i) { ------------------ | Branch (33:21): [True: 1.70G, False: 12.5M] ------------------ 34| 1.70G| if (!(i & p)) { ------------------ | Branch (34:17): [True: 956M, False: 753M] ------------------ 35| 956M| int32_MINMAX(x[i], x[i + p]); ------------------ | | 11| 956M| do { \ | | 12| 956M| int32_t ab = (b) ^ (a); \ | | 13| 956M| int32_t c = (b) - (a); \ | | 14| 956M| c ^= ab & ((c) ^ (b)); \ | | 15| 956M| c >>= 31; \ | | 16| 956M| c &= ab; \ | | 17| 956M| (a) ^= c; \ | | 18| 956M| (b) ^= c; \ | | 19| 956M| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 956M] | | ------------------ ------------------ 36| 956M| } 37| 1.70G| } 38| 12.5M| i = 0; 39| 33.9M| for (q = top; q > p; q >>= 1) { ------------------ | Branch (39:23): [True: 21.4M, False: 12.5M] ------------------ 40| 1.52G| for (; i < n - q; ++i) { ------------------ | Branch (40:20): [True: 1.50G, False: 21.4M] ------------------ 41| 1.50G| if (!(i & p)) { ------------------ | Branch (41:21): [True: 753M, False: 753M] ------------------ 42| 753M| int32_t a = x[i + p]; 43| 4.46G| for (r = q; r > p; r >>= 1) { ------------------ | Branch (43:33): [True: 3.71G, False: 753M] ------------------ 44| 3.71G| int32_MINMAX(a, x[i + r]); ------------------ | | 11| 3.71G| do { \ | | 12| 3.71G| int32_t ab = (b) ^ (a); \ | | 13| 3.71G| int32_t c = (b) - (a); \ | | 14| 3.71G| c ^= ab & ((c) ^ (b)); \ | | 15| 3.71G| c >>= 31; \ | | 16| 3.71G| c &= ab; \ | | 17| 3.71G| (a) ^= c; \ | | 18| 3.71G| (b) ^= c; \ | | 19| 3.71G| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 3.71G] | | ------------------ ------------------ 45| 3.71G| } 46| 753M| x[i + p] = a; 47| 753M| } 48| 1.50G| } 49| 21.4M| } 50| 12.5M| } 51| 3.57M|} encrypt.c:PQCLEAN_MCELIECE6960119_AVX2_int32_sort: 21| 566|static void int32_sort(int32_t *x, long long n) { 22| 566| long long top, p, q, r, i; 23| | 24| 566| if (n < 2) { ------------------ | Branch (24:9): [True: 0, False: 566] ------------------ 25| 0| return; 26| 0| } 27| 566| top = 1; 28| 3.96k| while (top < n - top) { ------------------ | Branch (28:12): [True: 3.39k, False: 566] ------------------ 29| 3.39k| top += top; 30| 3.39k| } 31| | 32| 4.52k| for (p = top; p > 0; p >>= 1) { ------------------ | Branch (32:19): [True: 3.96k, False: 566] ------------------ 33| 403k| for (i = 0; i < n - p; ++i) { ------------------ | Branch (33:21): [True: 399k, False: 3.96k] ------------------ 34| 399k| if (!(i & p)) { ------------------ | Branch (34:17): [True: 225k, False: 174k] ------------------ 35| 225k| int32_MINMAX(x[i], x[i + p]); ------------------ | | 11| 225k| do { \ | | 12| 225k| int32_t ab = (b) ^ (a); \ | | 13| 225k| int32_t c = (b) - (a); \ | | 14| 225k| c ^= ab & ((c) ^ (b)); \ | | 15| 225k| c >>= 31; \ | | 16| 225k| c &= ab; \ | | 17| 225k| (a) ^= c; \ | | 18| 225k| (b) ^= c; \ | | 19| 225k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 225k] | | ------------------ ------------------ 36| 225k| } 37| 399k| } 38| 3.96k| i = 0; 39| 15.8k| for (q = top; q > p; q >>= 1) { ------------------ | Branch (39:23): [True: 11.8k, False: 3.96k] ------------------ 40| 344k| for (; i < n - q; ++i) { ------------------ | Branch (40:20): [True: 332k, False: 11.8k] ------------------ 41| 332k| if (!(i & p)) { ------------------ | Branch (41:21): [True: 174k, False: 158k] ------------------ 42| 174k| int32_t a = x[i + p]; 43| 717k| for (r = q; r > p; r >>= 1) { ------------------ | Branch (43:33): [True: 543k, False: 174k] ------------------ 44| 543k| int32_MINMAX(a, x[i + r]); ------------------ | | 11| 543k| do { \ | | 12| 543k| int32_t ab = (b) ^ (a); \ | | 13| 543k| int32_t c = (b) - (a); \ | | 14| 543k| c ^= ab & ((c) ^ (b)); \ | | 15| 543k| c >>= 31; \ | | 16| 543k| c &= ab; \ | | 17| 543k| (a) ^= c; \ | | 18| 543k| (b) ^= c; \ | | 19| 543k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 543k] | | ------------------ ------------------ 45| 543k| } 46| 174k| x[i + p] = a; 47| 174k| } 48| 332k| } 49| 11.8k| } 50| 3.96k| } 51| 566|} PQCLEAN_MCELIECE6960119_AVX2_crypto_kem_enc: 40| 109|) { 41| 109| unsigned char e[ SYS_N / 8 ]; 42| 109| unsigned char one_ec[ 1 + SYS_N / 8 + SYND_BYTES ] = {1}; 43| 109| unsigned char mask; 44| 109| int i, padding_ok; 45| | 46| | // 47| | 48| 109| padding_ok = check_pk_padding(pk); 49| | 50| 109| encrypt(c, pk, e); ------------------ | | 9| 109|#define encrypt CRYPTO_NAMESPACE(encrypt) | | ------------------ | | | | 4| 109|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119_AVX2_ ## fun | | ------------------ ------------------ 51| | 52| 109| memcpy(one_ec + 1, e, SYS_N / 8); ------------------ | | 7| 109|#define SYS_N 6960 ------------------ 53| 109| memcpy(one_ec + 1 + SYS_N / 8, c, SYND_BYTES); ------------------ | | 7| 109|#define SYS_N 6960 ------------------ memcpy(one_ec + 1 + SYS_N / 8, c, SYND_BYTES); ------------------ | | 17| 109|#define SYND_BYTES ((PK_NROWS + 7)/8) | | ------------------ | | | | 13| 109|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 109|#define SYS_T 119 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 109|#define GFBITS 13 | | | | ------------------ | | ------------------ ------------------ 54| | 55| 109| crypto_hash_32b(key, one_ec, sizeof(one_ec)); ------------------ | | 7| 109| shake256(out, 32, in, inlen) | | ------------------ | | | | 12| 109|#define shake256 OQS_SHA3_shake256 | | ------------------ ------------------ 56| | 57| | // clear outputs (set to all 0's) if padding bits are not all zero 58| | 59| 109| mask = (unsigned char)padding_ok; 60| 109| mask ^= 0xFF; 61| | 62| 21.2k| for (i = 0; i < SYND_BYTES; i++) { ------------------ | | 17| 21.2k|#define SYND_BYTES ((PK_NROWS + 7)/8) | | ------------------ | | | | 13| 21.2k|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 21.2k|#define SYS_T 119 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 21.2k|#define GFBITS 13 | | | | ------------------ | | ------------------ ------------------ | Branch (62:17): [True: 21.1k, False: 109] ------------------ 63| 21.1k| c[i] &= mask; 64| 21.1k| } 65| | 66| 3.59k| for (i = 0; i < 32; i++) { ------------------ | Branch (66:17): [True: 3.48k, False: 109] ------------------ 67| 3.48k| key[i] &= mask; 68| 3.48k| } 69| | 70| 109| return padding_ok; 71| 109|} PQCLEAN_MCELIECE6960119_AVX2_crypto_kem_dec: 90| 109|) { 91| 109| int i, padding_ok; 92| | 93| 109| unsigned char mask; 94| 109| unsigned char ret_decrypt = 0; 95| | 96| 109| uint16_t m; 97| | 98| 109| unsigned char e[ SYS_N / 8 ]; 99| 109| unsigned char preimage[ 1 + SYS_N / 8 + SYND_BYTES ]; 100| 109| unsigned char *x = preimage; 101| 109| const unsigned char *s = sk + 40 + IRR_BYTES + COND_BYTES; ------------------ | | 11| 109|#define IRR_BYTES (SYS_T * 2) | | ------------------ | | | | 8| 109|#define SYS_T 119 | | ------------------ ------------------ const unsigned char *s = sk + 40 + IRR_BYTES + COND_BYTES; ------------------ | | 10| 109|#define COND_BYTES ((1 << (GFBITS-4))*(2*GFBITS - 1)) | | ------------------ | | | | 6| 109|#define GFBITS 13 | | ------------------ | | #define COND_BYTES ((1 << (GFBITS-4))*(2*GFBITS - 1)) | | ------------------ | | | | 6| 109|#define GFBITS 13 | | ------------------ ------------------ 102| | 103| | // 104| | 105| 109| padding_ok = check_c_padding(c); 106| | 107| 109| ret_decrypt = (unsigned char)decrypt(e, sk + 40, c); ------------------ | | 9| 109|#define decrypt CRYPTO_NAMESPACE(decrypt) | | ------------------ | | | | 4| 109|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119_AVX2_ ## fun | | ------------------ ------------------ 108| | 109| 109| m = ret_decrypt; 110| 109| m -= 1; 111| 109| m >>= 8; 112| | 113| 109| *x++ = m & 1; 114| 94.9k| for (i = 0; i < SYS_N / 8; i++) { ------------------ | | 7| 94.9k|#define SYS_N 6960 ------------------ | Branch (114:17): [True: 94.8k, False: 109] ------------------ 115| 94.8k| *x++ = (~m & s[i]) | (m & e[i]); 116| 94.8k| } 117| | 118| 21.2k| for (i = 0; i < SYND_BYTES; i++) { ------------------ | | 17| 21.2k|#define SYND_BYTES ((PK_NROWS + 7)/8) | | ------------------ | | | | 13| 21.2k|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 21.2k|#define SYS_T 119 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 21.2k|#define GFBITS 13 | | | | ------------------ | | ------------------ ------------------ | Branch (118:17): [True: 21.1k, False: 109] ------------------ 119| 21.1k| *x++ = c[i]; 120| 21.1k| } 121| | 122| 109| crypto_hash_32b(key, preimage, sizeof(preimage)); ------------------ | | 7| 109| shake256(out, 32, in, inlen) | | ------------------ | | | | 12| 109|#define shake256 OQS_SHA3_shake256 | | ------------------ ------------------ 123| | 124| | // clear outputs (set to all 1's) if padding bits are not all zero 125| | 126| 109| mask = (unsigned char)padding_ok; 127| | 128| 3.59k| for (i = 0; i < 32; i++) { ------------------ | Branch (128:17): [True: 3.48k, False: 109] ------------------ 129| 3.48k| key[i] |= mask; 130| 3.48k| } 131| | 132| 109| return padding_ok; 133| 109|} PQCLEAN_MCELIECE6960119_AVX2_crypto_kem_keypair: 139| 109|) { 140| 109| int i; 141| 109| unsigned char seed[ 33 ] = {64}; 142| 109| unsigned char r[ SYS_N / 8 + (1 << GFBITS)*sizeof(uint32_t) + SYS_T * 2 + 32 ]; 143| 109| unsigned char *rp, *skp; 144| | 145| 109| gf f[ SYS_T ]; // element in GF(2^mt) 146| 109| gf irr[ SYS_T ]; // Goppa polynomial 147| 109| uint32_t perm[ 1 << GFBITS ]; // random permutation as 32-bit integers 148| 109| int16_t pi[ 1 << GFBITS ]; // random permutation 149| | 150| 109| randombytes(seed + 1, 32); ------------------ | | 8| 109|#define randombytes OQS_randombytes ------------------ 151| | 152| 1.15k| while (1) { ------------------ | Branch (152:12): [True: 1.15k, Folded] ------------------ 153| 1.15k| rp = &r[ sizeof(r) - 32 ]; 154| 1.15k| skp = sk; 155| | 156| | // expanding and updating the seed 157| | 158| 1.15k| shake(r, sizeof(r), seed, 33); ------------------ | | 10| 1.15k| shake256(out, outlen, in, inlen) | | ------------------ | | | | 12| 1.15k|#define shake256 OQS_SHA3_shake256 | | ------------------ ------------------ 159| 1.15k| memcpy(skp, seed + 1, 32); 160| 1.15k| skp += 32 + 8; 161| 1.15k| memcpy(seed + 1, &r[ sizeof(r) - 32 ], 32); 162| | 163| | // generating irreducible polynomial 164| | 165| 1.15k| rp -= sizeof(f); 166| | 167| 138k| for (i = 0; i < SYS_T; i++) { ------------------ | | 8| 138k|#define SYS_T 119 ------------------ | Branch (167:21): [True: 137k, False: 1.15k] ------------------ 168| 137k| f[i] = load_gf(rp + i * 2); 169| 137k| } 170| | 171| 1.15k| if (genpoly_gen(irr, f)) { ------------------ | | 9| 1.15k|#define genpoly_gen CRYPTO_NAMESPACE(genpoly_gen) | | ------------------ | | | | 4| 1.15k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119_AVX2_ ## fun | | ------------------ ------------------ | Branch (171:13): [True: 0, False: 1.15k] ------------------ 172| 0| continue; 173| 0| } 174| | 175| 138k| for (i = 0; i < SYS_T; i++) { ------------------ | | 8| 138k|#define SYS_T 119 ------------------ | Branch (175:21): [True: 137k, False: 1.15k] ------------------ 176| 137k| store_gf(skp + i * 2, irr[i]); 177| 137k| } 178| | 179| 1.15k| skp += IRR_BYTES; ------------------ | | 11| 1.15k|#define IRR_BYTES (SYS_T * 2) | | ------------------ | | | | 8| 1.15k|#define SYS_T 119 | | ------------------ ------------------ 180| | 181| | // generating permutation 182| | 183| 1.15k| rp -= sizeof(perm); 184| | 185| 9.47M| for (i = 0; i < (1 << GFBITS); i++) { ------------------ | | 6| 9.47M|#define GFBITS 13 ------------------ | Branch (185:21): [True: 9.47M, False: 1.15k] ------------------ 186| 9.47M| perm[i] = load4(rp + i * 4); 187| 9.47M| } 188| | 189| 1.15k| if (pk_gen(pk, skp - IRR_BYTES, perm, pi)) { ------------------ | | 9| 1.15k|#define pk_gen CRYPTO_NAMESPACE(pk_gen) | | ------------------ | | | | 4| 1.15k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119_AVX2_ ## fun | | ------------------ ------------------ if (pk_gen(pk, skp - IRR_BYTES, perm, pi)) { ------------------ | | 11| 1.15k|#define IRR_BYTES (SYS_T * 2) | | ------------------ | | | | 8| 1.15k|#define SYS_T 119 | | ------------------ ------------------ | Branch (189:13): [True: 1.04k, False: 109] ------------------ 190| 1.04k| continue; 191| 1.04k| } 192| | 193| 109| controlbitsfrompermutation(skp, pi, GFBITS, 1 << GFBITS); ------------------ | | 10| 109|#define controlbitsfrompermutation CRYPTO_NAMESPACE(controlbitsfrompermutation) | | ------------------ | | | | 4| 109|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119_AVX2_ ## fun | | ------------------ ------------------ controlbitsfrompermutation(skp, pi, GFBITS, 1 << GFBITS); ------------------ | | 6| 109|#define GFBITS 13 ------------------ controlbitsfrompermutation(skp, pi, GFBITS, 1 << GFBITS); ------------------ | | 6| 109|#define GFBITS 13 ------------------ 194| 109| skp += COND_BYTES; ------------------ | | 10| 109|#define COND_BYTES ((1 << (GFBITS-4))*(2*GFBITS - 1)) | | ------------------ | | | | 6| 109|#define GFBITS 13 | | ------------------ | | #define COND_BYTES ((1 << (GFBITS-4))*(2*GFBITS - 1)) | | ------------------ | | | | 6| 109|#define GFBITS 13 | | ------------------ ------------------ 195| | 196| | // storing the random string s 197| | 198| 109| rp -= SYS_N / 8; ------------------ | | 7| 109|#define SYS_N 6960 ------------------ 199| 109| memcpy(skp, rp, SYS_N / 8); ------------------ | | 7| 109|#define SYS_N 6960 ------------------ 200| | 201| | // storing positions of the 32 pivots 202| | 203| 109| store8(sk + 32, 0xFFFFFFFF); 204| | 205| 109| break; 206| 1.15k| } 207| | 208| 109| return 0; 209| 109|} PQCLEAN_MCELIECE6960119_AVX2_pk_gen: 199| 1.15k|int pk_gen(unsigned char *pk, const unsigned char *irr, const uint32_t *perm, int16_t *pi) { 200| 1.15k|#define nBlocks_I ((PK_NROWS + 255) / 256) 201| 1.15k| const int head = PK_NROWS % 64; ------------------ | | 13| 1.15k|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 1.15k|#define SYS_T 119 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 1.15k|#define GFBITS 13 | | ------------------ ------------------ 202| 1.15k| const int tail = PK_NCOLS % 64; ------------------ | | 14| 1.15k|#define PK_NCOLS (SYS_N - PK_NROWS) | | ------------------ | | | | 7| 1.15k|#define SYS_N 6960 | | ------------------ | | #define PK_NCOLS (SYS_N - PK_NROWS) | | ------------------ | | | | 13| 1.15k|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 1.15k|#define SYS_T 119 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 1.15k|#define GFBITS 13 | | | | ------------------ | | ------------------ ------------------ 203| 1.15k| const uint64_t one = 1; 204| | 205| 1.15k| int i, j, k, b; 206| 1.15k| int row, c; 207| | 208| 1.15k| union { 209| 1.15k| uint64_t w[ PK_NROWS ][ nBlocks_I * 4 ]; 210| 1.15k| vec256 v[ PK_NROWS ][ nBlocks_I ]; 211| 1.15k| } mat; 212| | 213| 1.15k| union { 214| 1.15k| uint64_t w[ PK_NROWS ][ par_width * 4 ]; 215| 1.15k| vec256 v[ PK_NROWS ][ par_width ]; 216| 1.15k| } par; 217| | 218| 1.15k| uint16_t m; 219| 1.15k| vec256 mm; 220| | 221| 1.15k| vec128 sk_int[ GFBITS ]; 222| | 223| 1.15k| vec256 consts[ 32 ][ GFBITS ]; 224| 1.15k| vec256 eval[ 32 ][ GFBITS ]; 225| 1.15k| vec256 prod[ 32 ][ GFBITS ]; 226| 1.15k| vec256 tmp[ GFBITS ]; 227| | 228| 1.15k| uint64_t list[1 << GFBITS]; 229| 1.15k| uint64_t buf[ PK_NROWS ]; 230| 1.15k| uint64_t t; 231| | 232| 1.15k| uint16_t ind[ PK_NROWS ]; 233| 1.15k| uint16_t ind_inv[ PK_NROWS ]; 234| | 235| | // compute the inverses 236| | 237| 1.15k| irr_load(sk_int, irr); 238| | 239| 1.15k| fft(eval, sk_int); ------------------ | | 10| 1.15k|#define fft CRYPTO_NAMESPACE(fft) | | ------------------ | | | | 4| 1.15k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119_AVX2_ ## fun | | ------------------ ------------------ 240| | 241| 1.15k| vec256_copy(prod[0], eval[0]); 242| | 243| 37.0k| for (i = 1; i < 32; i++) { ------------------ | Branch (243:17): [True: 35.8k, False: 1.15k] ------------------ 244| 35.8k| vec256_mul(prod[i], prod[i - 1], eval[i]); 245| 35.8k| } 246| | 247| 1.15k| vec256_inv(tmp, prod[31]); ------------------ | | 11| 1.15k|#define vec256_inv CRYPTO_NAMESPACE(vec256_inv) | | ------------------ | | | | 4| 1.15k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119_AVX2_ ## fun | | ------------------ ------------------ 248| | 249| 37.0k| for (i = 30; i >= 0; i--) { ------------------ | Branch (249:18): [True: 35.8k, False: 1.15k] ------------------ 250| 35.8k| vec256_mul(prod[i + 1], prod[i], tmp); 251| 35.8k| vec256_mul(tmp, tmp, eval[i + 1]); 252| 35.8k| } 253| | 254| 1.15k| vec256_copy(prod[0], tmp); 255| | 256| | // fill matrix 257| | 258| 1.15k| de_bitslicing(list, prod); 259| | 260| 9.47M| for (i = 0; i < (1 << GFBITS); i++) { ------------------ | | 6| 9.47M|#define GFBITS 13 ------------------ | Branch (260:17): [True: 9.47M, False: 1.15k] ------------------ 261| 9.47M| list[i] <<= GFBITS; ------------------ | | 6| 9.47M|#define GFBITS 13 ------------------ 262| 9.47M| list[i] |= i; 263| 9.47M| list[i] |= ((uint64_t) perm[i]) << 31; 264| 9.47M| } 265| | 266| 1.15k| uint64_sort(list, 1 << GFBITS); ------------------ | | 6| 1.15k|#define GFBITS 13 ------------------ 267| | 268| 9.32M| for (i = 1; i < (1 << GFBITS); i++) { ------------------ | | 6| 9.32M|#define GFBITS 13 ------------------ | Branch (268:17): [True: 9.32M, False: 1.12k] ------------------ 269| 9.32M| if (uint64_is_equal_declassify(list[i - 1] >> 31, list[i] >> 31)) { ------------------ | Branch (269:13): [True: 36, False: 9.32M] ------------------ 270| 36| return -1; 271| 36| } 272| 9.32M| } 273| | 274| 1.12k| to_bitslicing_2x(consts, prod, list); 275| | 276| 9.18M| for (i = 0; i < (1 << GFBITS); i++) { ------------------ | | 6| 9.18M|#define GFBITS 13 ------------------ | Branch (276:17): [True: 9.18M, False: 1.12k] ------------------ 277| 9.18M| pi[i] = list[i] & GFMASK; ------------------ | | 19| 9.18M|#define GFMASK ((1 << GFBITS) - 1) | | ------------------ | | | | 6| 9.18M|#define GFBITS 13 | | ------------------ ------------------ 278| 9.18M| } 279| | 280| 8.96k| for (j = 0; j < nBlocks_I; j++) { ------------------ | | 200| 8.96k|#define nBlocks_I ((PK_NROWS + 255) / 256) | | ------------------ | | | | 13| 8.96k|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 8.96k|#define SYS_T 119 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 8.96k|#define GFBITS 13 | | | | ------------------ | | ------------------ ------------------ | Branch (280:17): [True: 7.84k, False: 1.12k] ------------------ 281| 109k| for (k = 0; k < GFBITS; k++) { ------------------ | | 6| 109k|#define GFBITS 13 ------------------ | Branch (281:21): [True: 102k, False: 7.84k] ------------------ 282| 102k| mat.v[ k ][ j ] = prod[ j ][ k ]; 283| 102k| } 284| 7.84k| } 285| | 286| 133k| for (i = 1; i < SYS_T; i++) { ------------------ | | 8| 133k|#define SYS_T 119 ------------------ | Branch (286:17): [True: 132k, False: 1.12k] ------------------ 287| 1.05M| for (j = 0; j < nBlocks_I; j++) { ------------------ | | 200| 1.05M|#define nBlocks_I ((PK_NROWS + 255) / 256) | | ------------------ | | | | 13| 1.05M|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 1.05M|#define SYS_T 119 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 1.05M|#define GFBITS 13 | | | | ------------------ | | ------------------ ------------------ | Branch (287:21): [True: 925k, False: 132k] ------------------ 288| 925k| vec256_mul(prod[j], prod[j], consts[j]); 289| | 290| 12.9M| for (k = 0; k < GFBITS; k++) { ------------------ | | 6| 12.9M|#define GFBITS 13 ------------------ | Branch (290:25): [True: 12.0M, False: 925k] ------------------ 291| 12.0M| mat.v[ i * GFBITS + k ][ j ] = prod[ j ][ k ]; ------------------ | | 6| 12.0M|#define GFBITS 13 ------------------ 292| 12.0M| } 293| 925k| } 294| 132k| } 295| | 296| | // gaussian elimination to obtain L, U, and P such that LP M = U 297| | // L and U are stored in the space of M 298| | // P is stored in ind 299| | 300| 1.73M| for (i = 0; i < PK_NROWS; i++) { ------------------ | | 13| 1.73M|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 1.73M|#define SYS_T 119 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 1.73M|#define GFBITS 13 | | ------------------ ------------------ | Branch (300:17): [True: 1.73M, False: 1.12k] ------------------ 301| 1.73M| ind_inv[i] = ind[ i ] = i; 302| 1.73M| } 303| | 304| 1.73M| for (row = 0; row < PK_NROWS; row++) { ------------------ | | 13| 1.73M|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 1.73M|#define SYS_T 119 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 1.73M|#define GFBITS 13 | | ------------------ ------------------ | Branch (304:19): [True: 1.73M, False: 109] ------------------ 305| 1.73M| i = row >> 6; 306| 1.73M| j = row & 63; 307| | 308| 1.34G| for (k = row + 1; k < PK_NROWS; k++) { ------------------ | | 13| 1.34G|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 1.34G|#define SYS_T 119 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 1.34G|#define GFBITS 13 | | ------------------ ------------------ | Branch (308:27): [True: 1.34G, False: 1.73M] ------------------ 309| 1.34G| extract_01_masks(&m, mat.w[ row ], mat.w[ k ], row); 310| 1.34G| uint16_cswap(&ind[row], &ind[k], m); 311| | 312| 1.34G| mm = vec256_set1_16b(m); 313| 10.7G| for (c = 0; c < nBlocks_I; c++) { ------------------ | | 200| 10.7G|#define nBlocks_I ((PK_NROWS + 255) / 256) | | ------------------ | | | | 13| 10.7G|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 10.7G|#define SYS_T 119 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 10.7G|#define GFBITS 13 | | | | ------------------ | | ------------------ ------------------ | Branch (313:25): [True: 9.38G, False: 1.34G] ------------------ 314| 9.38G| vec256_cswap(&mat.v[ row ][ c ], &mat.v[ k ][ c ], mm); 315| 9.38G| } 316| 1.34G| } 317| | 318| 1.73M| if ( uint64_is_zero_declassify((mat.w[ row ][ i ] >> j) & 1) ) { // return if not systematic ------------------ | Branch (318:14): [True: 1.01k, False: 1.73M] ------------------ 319| 1.01k| return -1; 320| 1.01k| } 321| | 322| 1.34G| for (k = row + 1; k < PK_NROWS; k++) { ------------------ | | 13| 1.34G|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 1.34G|#define SYS_T 119 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 1.34G|#define GFBITS 13 | | ------------------ ------------------ | Branch (322:27): [True: 1.34G, False: 1.73M] ------------------ 323| 1.34G| t = mat.w[ k ][ i ] & (one << j); 324| 1.34G| mm = extract_mask256(mat.w[k], row); 325| | 326| 10.7G| for (c = 0; c < nBlocks_I; c++) { ------------------ | | 200| 10.7G|#define nBlocks_I ((PK_NROWS + 255) / 256) | | ------------------ | | | | 13| 10.7G|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 10.7G|#define SYS_T 119 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 10.7G|#define GFBITS 13 | | | | ------------------ | | ------------------ ------------------ | Branch (326:25): [True: 9.38G, False: 1.34G] ------------------ 327| 9.38G| mat.v[ k ][ c ] ^= mat.v[ row ][ c ] & mm; 328| 9.38G| } 329| | 330| 1.34G| mat.w[ k ][ i ] |= t; 331| 1.34G| } 332| 1.73M| } 333| | 334| | // apply M^-1 to the remaining columns 335| | 336| 109| composeinv(PK_NROWS, ind_inv, ind_inv, ind); ------------------ | | 13| 109|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 109|#define SYS_T 119 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 109|#define GFBITS 13 | | ------------------ ------------------ 337| | 338| 327| for (j = 6; j < 28; j += par_width) { ------------------ | | 30| 218|#define par_width 11 ------------------ | Branch (338:17): [True: 218, False: 109] ------------------ 339| 3.05k| for (k = 0; k < GFBITS; k++) { ------------------ | | 6| 3.05k|#define GFBITS 13 ------------------ | Branch (339:21): [True: 2.83k, False: 218] ------------------ 340| 34.0k| for (b = 0; b < par_width; b++) { ------------------ | | 30| 34.0k|#define par_width 11 ------------------ | Branch (340:25): [True: 31.1k, False: 2.83k] ------------------ 341| 31.1k| par.v[ k ][ b ] = prod[ j + b ][ k ]; 342| 31.1k| } 343| 2.83k| } 344| | 345| 25.9k| for (i = 1; i < SYS_T; i++) { ------------------ | | 8| 25.9k|#define SYS_T 119 ------------------ | Branch (345:21): [True: 25.7k, False: 218] ------------------ 346| 308k| for (b = 0; b < par_width; b++) { ------------------ | | 30| 308k|#define par_width 11 ------------------ | Branch (346:25): [True: 282k, False: 25.7k] ------------------ 347| 282k| vec256_mul(prod[j + b], prod[j + b], consts[j + b]); 348| 282k| } 349| | 350| 360k| for (k = 0; k < GFBITS; k++) { ------------------ | | 6| 360k|#define GFBITS 13 ------------------ | Branch (350:25): [True: 334k, False: 25.7k] ------------------ 351| 4.01M| for (b = 0; b < par_width; b++) { ------------------ | | 30| 4.01M|#define par_width 11 ------------------ | Branch (351:29): [True: 3.67M, False: 334k] ------------------ 352| 3.67M| par.v[ i * GFBITS + k ][ b ] = prod[ j + b ][ k ]; ------------------ | | 6| 3.67M|#define GFBITS 13 ------------------ 353| 3.67M| } 354| 334k| } 355| 25.7k| } 356| | 357| | // apply P 358| | 359| 337k| for (i = 0; i < PK_NROWS; i++) { ------------------ | | 13| 337k|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 337k|#define SYS_T 119 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 337k|#define GFBITS 13 | | ------------------ ------------------ | Branch (359:21): [True: 337k, False: 218] ------------------ 360| 337k| ind[i] = ind_inv[i]; 361| 337k| } 362| | 363| 218| sort_rows((1 << GFBITS) / 4, PK_NROWS, ind, par.v, 0); ------------------ | | 6| 218|#define GFBITS 13 ------------------ sort_rows((1 << GFBITS) / 4, PK_NROWS, ind, par.v, 0); ------------------ | | 13| 218|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 218|#define SYS_T 119 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 218|#define GFBITS 13 | | ------------------ ------------------ 364| | 365| | // apply L 366| | 367| 337k| for (row = PK_NROWS - 1; row >= 0; row--) { ------------------ | | 13| 218|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 218|#define SYS_T 119 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 218|#define GFBITS 13 | | ------------------ ------------------ | Branch (367:34): [True: 337k, False: 218] ------------------ 368| 261M| for (i = row - 1; i >= 0; i--) { ------------------ | Branch (368:31): [True: 260M, False: 337k] ------------------ 369| 260M| mm = extract_mask256(mat.w[row], i); 370| | 371| 3.12G| for (k = 0; k < par_width; k++) { ------------------ | | 30| 3.12G|#define par_width 11 ------------------ | Branch (371:29): [True: 2.86G, False: 260M] ------------------ 372| 2.86G| par.v[ row ][ k ] ^= par.v[ i ][ k ] & mm; 373| 2.86G| } 374| 260M| } 375| 337k| } 376| | 377| | // apply U^-1 378| | 379| 218| if (j == 6) { ------------------ | Branch (379:13): [True: 109, False: 109] ------------------ 380| 168k| for (i = 0; i < PK_NROWS; i++) { ------------------ | | 13| 168k|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 168k|#define SYS_T 119 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 168k|#define GFBITS 13 | | ------------------ ------------------ | Branch (380:25): [True: 168k, False: 109] ------------------ 381| 168k| par.v[i][0] = mat.v[i][nBlocks_I - 1]; ------------------ | | 200| 168k|#define nBlocks_I ((PK_NROWS + 255) / 256) | | ------------------ | | | | 13| 168k|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 168k|#define SYS_T 119 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 168k|#define GFBITS 13 | | | | ------------------ | | ------------------ ------------------ 382| 168k| } 383| 109| } 384| | 385| 337k| for (row = PK_NROWS - 1; row >= 0; row--) { ------------------ | | 13| 218|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 218|#define SYS_T 119 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 218|#define GFBITS 13 | | ------------------ ------------------ | Branch (385:34): [True: 337k, False: 218] ------------------ 386| 261M| for (i = PK_NROWS - 1; i > row; i--) { ------------------ | | 13| 337k|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 337k|#define SYS_T 119 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 337k|#define GFBITS 13 | | ------------------ ------------------ | Branch (386:36): [True: 260M, False: 337k] ------------------ 387| 260M| mm = extract_mask256(mat.w[row], i); 388| | 389| 3.12G| for (k = 0; k < par_width; k++) { ------------------ | | 30| 3.12G|#define par_width 11 ------------------ | Branch (389:29): [True: 2.86G, False: 260M] ------------------ 390| 2.86G| par.v[ row ][ k ] ^= par.v[ i ][ k ] & mm; 391| 2.86G| } 392| 260M| } 393| 337k| } 394| | 395| 218| if (j == 6) { ------------------ | Branch (395:13): [True: 109, False: 109] ------------------ 396| 168k| for (row = 0; row < PK_NROWS; row++) { ------------------ | | 13| 168k|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 168k|#define SYS_T 119 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 168k|#define GFBITS 13 | | ------------------ ------------------ | Branch (396:27): [True: 168k, False: 109] ------------------ 397| 7.41M| for (i = 0; i < 43; i++) { ------------------ | Branch (397:29): [True: 7.25M, False: 168k] ------------------ 398| 7.25M| store8(pk + PK_ROW_BYTES * row + i * 8, (par.w[row][i] >> head) | (par.w[row][i + 1] << (64 - head))); ------------------ | | 15| 7.25M|#define PK_ROW_BYTES ((PK_NCOLS + 7)/8) | | ------------------ | | | | 14| 7.25M|#define PK_NCOLS (SYS_N - PK_NROWS) | | | | ------------------ | | | | | | 7| 7.25M|#define SYS_N 6960 | | | | ------------------ | | | | #define PK_NCOLS (SYS_N - PK_NROWS) | | | | ------------------ | | | | | | 13| 7.25M|#define PK_NROWS (SYS_T*GFBITS) | | | | | | ------------------ | | | | | | | | 8| 7.25M|#define SYS_T 119 | | | | | | ------------------ | | | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | | | ------------------ | | | | | | | | 6| 7.25M|#define GFBITS 13 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 399| 7.25M| } 400| | 401| 168k| buf[row] = par.w[row][i] >> head; 402| 168k| } 403| 109| } else { 404| 168k| for (row = 0; row < PK_NROWS; row++) { ------------------ | | 13| 168k|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 168k|#define SYS_T 119 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 168k|#define GFBITS 13 | | ------------------ ------------------ | Branch (404:27): [True: 168k, False: 109] ------------------ 405| 168k| store8(pk + PK_ROW_BYTES * row + 43 * 8, buf[row] | (par.w[row][0] << (64 - head))); ------------------ | | 15| 168k|#define PK_ROW_BYTES ((PK_NCOLS + 7)/8) | | ------------------ | | | | 14| 168k|#define PK_NCOLS (SYS_N - PK_NROWS) | | | | ------------------ | | | | | | 7| 168k|#define SYS_N 6960 | | | | ------------------ | | | | #define PK_NCOLS (SYS_N - PK_NROWS) | | | | ------------------ | | | | | | 13| 168k|#define PK_NROWS (SYS_T*GFBITS) | | | | | | ------------------ | | | | | | | | 8| 168k|#define SYS_T 119 | | | | | | ------------------ | | | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | | | ------------------ | | | | | | | | 6| 168k|#define GFBITS 13 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 406| | 407| 6.91M| for (i = 0; i < 40; i++) { ------------------ | Branch (407:29): [True: 6.74M, False: 168k] ------------------ 408| 6.74M| store8(pk + PK_ROW_BYTES * row + (i + 44) * 8, (par.w[row][i] >> head) | (par.w[row][i + 1] << (64 - head))); ------------------ | | 15| 6.74M|#define PK_ROW_BYTES ((PK_NCOLS + 7)/8) | | ------------------ | | | | 14| 6.74M|#define PK_NCOLS (SYS_N - PK_NROWS) | | | | ------------------ | | | | | | 7| 6.74M|#define SYS_N 6960 | | | | ------------------ | | | | #define PK_NCOLS (SYS_N - PK_NROWS) | | | | ------------------ | | | | | | 13| 6.74M|#define PK_NROWS (SYS_T*GFBITS) | | | | | | ------------------ | | | | | | | | 8| 6.74M|#define SYS_T 119 | | | | | | ------------------ | | | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | | | ------------------ | | | | | | | | 6| 6.74M|#define GFBITS 13 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 409| 6.74M| } 410| | 411| 168k| par.w[row][i] >>= head; 412| 168k| par.w[row][i] &= (one << tail) - 1; 413| | 414| 168k| store_i(pk + PK_ROW_BYTES * row + (i + 44) * 8, par.w[row][i], (tail + 7) / 8); ------------------ | | 15| 168k|#define PK_ROW_BYTES ((PK_NCOLS + 7)/8) | | ------------------ | | | | 14| 168k|#define PK_NCOLS (SYS_N - PK_NROWS) | | | | ------------------ | | | | | | 7| 168k|#define SYS_N 6960 | | | | ------------------ | | | | #define PK_NCOLS (SYS_N - PK_NROWS) | | | | ------------------ | | | | | | 13| 168k|#define PK_NROWS (SYS_T*GFBITS) | | | | | | ------------------ | | | | | | | | 8| 168k|#define SYS_T 119 | | | | | | ------------------ | | | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | | | ------------------ | | | | | | | | 6| 168k|#define GFBITS 13 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 415| 168k| } 416| 109| } 417| 218| } 418| | 419| | // 420| | 421| 109| return 0; 422| 1.12k|} PQCLEAN_MCELIECE6960119_AVX2_genpoly_gen: 88| 1.15k|int genpoly_gen(gf *out, gf *f) { 89| 1.15k| int i, j, k; 90| | 91| 1.15k| gf t, inv; 92| | 93| 1.15k| uint64_t m; 94| 1.15k| vec128 mask; 95| | 96| 1.15k| union { 97| 1.15k| uint64_t d[ GFBITS ][ 128 ][2]; 98| 1.15k| vec128 v[ GFBITS ][ 128 ]; 99| 1.15k| } buf; 100| | 101| 1.15k| union { 102| 1.15k| uint64_t d[GFBITS][2]; 103| 1.15k| vec128 v[GFBITS]; 104| 1.15k| } v; 105| | 106| 1.15k| union { 107| 1.15k| uint64_t d[SYS_T][GFBITS][2]; 108| 1.15k| vec128 v[SYS_T][GFBITS]; 109| 1.15k| } mat; 110| | 111| | // fill matrix 112| | 113| 1.15k| buf.v[0][0] = vec128_set2x(1, 0); 114| 15.0k| for (i = 1; i < GFBITS; i++) { ------------------ | | 6| 15.0k|#define GFBITS 13 ------------------ | Branch (114:17): [True: 13.8k, False: 1.15k] ------------------ 115| 13.8k| buf.v[i][0] = vec128_setzero(); 116| 13.8k| } 117| | 118| 16.1k| for (j = 0; j < GFBITS; j++) { ------------------ | | 6| 16.1k|#define GFBITS 13 ------------------ | Branch (118:17): [True: 15.0k, False: 1.15k] ------------------ 119| 15.0k| v.v[j] = vec128_setzero(); 120| | 121| 1.80M| for (i = SYS_T - 1; i >= 0; i--) { ------------------ | | 8| 15.0k|#define SYS_T 119 ------------------ | Branch (121:29): [True: 1.78M, False: 15.0k] ------------------ 122| 1.78M| v.d[j][1] <<= 1; 123| 1.78M| v.d[j][1] |= v.d[j][0] >> 63; 124| 1.78M| v.d[j][0] <<= 1; 125| 1.78M| v.d[j][0] |= (f[i] >> j) & 1; 126| 1.78M| } 127| 15.0k| } 128| | 129| 16.1k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 16.1k|#define GFBITS 13 ------------------ | Branch (129:17): [True: 15.0k, False: 1.15k] ------------------ 130| 15.0k| buf.v[i][1] = v.v[i]; 131| 15.0k| } 132| | 133| 137k| for (k = 2; k <= SYS_T; k++) { ------------------ | | 8| 137k|#define SYS_T 119 ------------------ | Branch (133:17): [True: 136k, False: 1.15k] ------------------ 134| 136k| vec128_mul_GF(v.v, v.v, f); ------------------ | | 11| 136k|#define vec128_mul_GF CRYPTO_NAMESPACE(vec128_mul_GF) | | ------------------ | | | | 4| 136k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119_AVX2_ ## fun | | ------------------ ------------------ 135| | 136| 136k| if (k < SYS_T) { ------------------ | | 8| 136k|#define SYS_T 119 ------------------ | Branch (136:13): [True: 135k, False: 1.15k] ------------------ 137| 1.89M| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 1.89M|#define GFBITS 13 ------------------ | Branch (137:25): [True: 1.75M, False: 135k] ------------------ 138| 1.75M| buf.v[i][k] = v.v[i]; 139| 1.75M| } 140| 135k| } else { 141| 138k| for (i = 0; i < SYS_T; i++) { ------------------ | | 8| 138k|#define SYS_T 119 ------------------ | Branch (141:25): [True: 137k, False: 1.15k] ------------------ 142| 137k| out[i] = extract_gf(v.d, i); 143| 137k| } 144| 1.15k| } 145| 136k| } 146| | 147| 16.1k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 16.1k|#define GFBITS 13 ------------------ | Branch (147:17): [True: 15.0k, False: 1.15k] ------------------ 148| 15.0k| transpose_128x128(buf.d[i]); 149| 15.0k| } 150| | 151| 138k| for (j = 0; j < SYS_T; j++) { ------------------ | | 8| 138k|#define SYS_T 119 ------------------ | Branch (151:17): [True: 137k, False: 1.15k] ------------------ 152| 1.92M| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 1.92M|#define GFBITS 13 ------------------ | Branch (152:21): [True: 1.78M, False: 137k] ------------------ 153| 1.78M| mat.v[j][i] = buf.v[i][j]; 154| 1.78M| } 155| 137k| } 156| | 157| | // gaussian 158| | 159| 138k| for (i = 0; i < SYS_T; i++) { ------------------ | | 8| 138k|#define SYS_T 119 ------------------ | Branch (159:17): [True: 137k, False: 1.15k] ------------------ 160| 8.26M| for (j = i + 1; j < SYS_T; j++) { ------------------ | | 8| 8.26M|#define SYS_T 119 ------------------ | Branch (160:25): [True: 8.12M, False: 137k] ------------------ 161| 8.12M| m = extract_bit(mat.d[i], i); 162| 8.12M| m -= 1; 163| 8.12M| mask = vec128_set2x(m, m); 164| | 165| 113M| for (k = 0; k < GFBITS; k++) { ------------------ | | 6| 113M|#define GFBITS 13 ------------------ | Branch (165:25): [True: 105M, False: 8.12M] ------------------ 166| 105M| mat.v[i][k] ^= mat.v[j][k] & mask; 167| 105M| } 168| | 169| 8.12M| out[i] ^= out[j] & m; 170| 8.12M| } 171| | 172| | // 173| | 174| 137k| t = extract_gf(mat.d[i], i); 175| | 176| 137k| if (gf_is_zero_declassify(t)) { ------------------ | Branch (176:13): [True: 0, False: 137k] ------------------ 177| 0| return -1; // return if not systematic 178| 0| } 179| | 180| | // 181| | 182| 137k| inv = gf_inv(t); ------------------ | | 11| 137k|#define gf_inv CRYPTO_NAMESPACE(gf_inv) | | ------------------ | | | | 4| 137k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119_AVX2_ ## fun | | ------------------ ------------------ 183| 137k| vec128_mul_gf(mat.v[i], mat.v[i], inv); 184| | 185| 137k| out[i] = gf_mul(out[i], inv); ------------------ | | 14| 137k|#define gf_mul CRYPTO_NAMESPACE(gf_mul) | | ------------------ | | | | 4| 137k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119_AVX2_ ## fun | | ------------------ ------------------ 186| | 187| 16.5M| for (j = 0; j < SYS_T; j++) { ------------------ | | 8| 16.5M|#define SYS_T 119 ------------------ | Branch (187:21): [True: 16.3M, False: 137k] ------------------ 188| 16.3M| if (j != i) { ------------------ | Branch (188:17): [True: 16.2M, False: 137k] ------------------ 189| 16.2M| t = extract_gf(mat.d[j], i); 190| | 191| 16.2M| vec128_mul_gf(v.v, mat.v[i], t); 192| 16.2M| vec128_add(mat.v[j], mat.v[j], v.v); 193| | 194| 16.2M| out[j] ^= gf_mul(out[i], t); ------------------ | | 14| 16.2M|#define gf_mul CRYPTO_NAMESPACE(gf_mul) | | ------------------ | | | | 4| 16.2M|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119_AVX2_ ## fun | | ------------------ ------------------ 195| 16.2M| } 196| 16.3M| } 197| 137k| } 198| | 199| 1.15k| return 0; 200| 1.15k|} PQCLEAN_MCELIECE6960119_AVX2_vec128_mul_GF: 6| 136k|void vec128_mul_GF(vec128 out[ GFBITS ], vec128 v[ GFBITS ], gf a[ SYS_T ]) { 7| 136k| int i, j; 8| 136k| uint64_t buf[GFBITS][4]; 9| 136k| vec128 prod[GFBITS]; 10| 136k| uint64_t p[GFBITS]; 11| | 12| 136k| const uint64_t allone = -1; 13| | 14| | // polynomial multiplication 15| | 16| 1.91M| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 1.91M|#define GFBITS 13 ------------------ | Branch (16:17): [True: 1.77M, False: 136k] ------------------ 17| 1.77M| buf[i][0] = 0; 18| 1.77M| buf[i][1] = 0; 19| 1.77M| buf[i][2] = 0; 20| 1.77M| buf[i][3] = 0; 21| 1.77M| } 22| | 23| 16.3M| for (i = SYS_T - 1; i >= 0; i--) { ------------------ | | 8| 136k|#define SYS_T 119 ------------------ | Branch (23:25): [True: 16.2M, False: 136k] ------------------ 24| 227M| for (j = 0; j < GFBITS; j++) { ------------------ | | 6| 227M|#define GFBITS 13 ------------------ | Branch (24:21): [True: 211M, False: 16.2M] ------------------ 25| 211M| buf[j][3] <<= 1; 26| 211M| buf[j][3] |= buf[j][2] >> 63; 27| 211M| buf[j][2] <<= 1; 28| 211M| buf[j][2] |= buf[j][1] >> 63; 29| 211M| buf[j][1] <<= 1; 30| 211M| buf[j][1] |= buf[j][0] >> 63; 31| 211M| buf[j][0] <<= 1; 32| 211M| } 33| | 34| 16.2M| vec128_mul_gf(prod, v, a[i]); 35| | 36| 227M| for (j = 0; j < GFBITS; j++) { ------------------ | | 6| 227M|#define GFBITS 13 ------------------ | Branch (36:21): [True: 211M, False: 16.2M] ------------------ 37| 211M| buf[j][0] ^= vec128_extract(prod[j], 0); ------------------ | | 29| 211M|#define vec128_extract(a, i) ((uint64_t) _mm_extract_epi64((vec128) (a), (i))) ------------------ 38| 211M| buf[j][1] ^= vec128_extract(prod[j], 1); ------------------ | | 29| 211M|#define vec128_extract(a, i) ((uint64_t) _mm_extract_epi64((vec128) (a), (i))) ------------------ 39| 211M| } 40| 16.2M| } 41| | 42| | // reduction modulo y^119 + y^8 + 1 43| | 44| 1.91M| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 1.91M|#define GFBITS 13 ------------------ | Branch (44:17): [True: 1.77M, False: 136k] ------------------ 45| 1.77M| p[i] = buf[i][3]; 46| | 47| 1.77M| buf[i][2] ^= p[i] >> (SYS_T - 8 - 64); ------------------ | | 8| 1.77M|#define SYS_T 119 ------------------ 48| 1.77M| buf[i][1] ^= p[i] << (64 - (SYS_T - 8 - 64)); ------------------ | | 8| 1.77M|#define SYS_T 119 ------------------ 49| 1.77M| buf[i][2] ^= p[i] >> (SYS_T - 64); ------------------ | | 8| 1.77M|#define SYS_T 119 ------------------ 50| 1.77M| buf[i][1] ^= p[i] << (64 - (SYS_T - 64)); ------------------ | | 8| 1.77M|#define SYS_T 119 ------------------ 51| 1.77M| } 52| | 53| | // 54| | 55| 1.91M| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 1.91M|#define GFBITS 13 ------------------ | Branch (55:17): [True: 1.77M, False: 136k] ------------------ 56| 1.77M| p[i] = buf[i][2]; 57| | 58| 1.77M| buf[i][1] ^= p[i] >> (SYS_T - 8 - 64); ------------------ | | 8| 1.77M|#define SYS_T 119 ------------------ 59| 1.77M| buf[i][0] ^= p[i] << (64 - (SYS_T - 8 - 64)); ------------------ | | 8| 1.77M|#define SYS_T 119 ------------------ 60| 1.77M| buf[i][1] ^= p[i] >> (SYS_T - 64); ------------------ | | 8| 1.77M|#define SYS_T 119 ------------------ 61| 1.77M| buf[i][0] ^= p[i] << (64 - (SYS_T - 64)); ------------------ | | 8| 1.77M|#define SYS_T 119 ------------------ 62| 1.77M| } 63| | 64| | // 65| | 66| 1.91M| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 1.91M|#define GFBITS 13 ------------------ | Branch (66:17): [True: 1.77M, False: 136k] ------------------ 67| 1.77M| p[i] = buf[i][1] & (allone << (SYS_T - 64)); ------------------ | | 8| 1.77M|#define SYS_T 119 ------------------ 68| | 69| 1.77M| buf[i][0] ^= p[i] >> (SYS_T - 8 - 64); ------------------ | | 8| 1.77M|#define SYS_T 119 ------------------ 70| 1.77M| buf[i][0] ^= p[i] >> (SYS_T - 64); ------------------ | | 8| 1.77M|#define SYS_T 119 ------------------ 71| 1.77M| } 72| | 73| | // 74| | 75| 1.91M| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 1.91M|#define GFBITS 13 ------------------ | Branch (75:17): [True: 1.77M, False: 136k] ------------------ 76| 1.77M| out[i] = vec128_set2x(buf[i][0], buf[i][1] & (allone >> (128 - SYS_T))); ------------------ | | 8| 1.77M|#define SYS_T 119 ------------------ 77| 1.77M| } 78| 136k|} PQCLEAN_MCELIECE6960119_AVX2_vec256_sq: 9| 18.6k|void vec256_sq(vec256 *out, vec256 *in) { 10| 18.6k| int i; 11| 18.6k| vec256 result[GFBITS], t; 12| | 13| 18.6k| t = vec256_xor(in[11], in[12]); 14| | 15| 18.6k| result[0] = vec256_xor(in[0], in[11]); 16| 18.6k| result[1] = vec256_xor(in[7], t); 17| 18.6k| result[2] = vec256_xor(in[1], in[7]); 18| 18.6k| result[3] = vec256_xor(in[8], t); 19| 18.6k| result[4] = vec256_xor(in[2], in[7]); 20| 18.6k| result[4] = vec256_xor(result[4], in[8]); 21| 18.6k| result[4] = vec256_xor(result[4], t); 22| 18.6k| result[5] = vec256_xor(in[7], in[9]); 23| 18.6k| result[6] = vec256_xor(in[3], in[8]); 24| 18.6k| result[6] = vec256_xor(result[6], in[9]); 25| 18.6k| result[6] = vec256_xor(result[6], in[12]); 26| 18.6k| result[7] = vec256_xor(in[8], in[10]); 27| 18.6k| result[8] = vec256_xor(in[4], in[9]); 28| 18.6k| result[8] = vec256_xor(result[8], in[10]); 29| 18.6k| result[9] = vec256_xor(in[9], in[11]); 30| 18.6k| result[10] = vec256_xor(in[5], in[10]); 31| 18.6k| result[10] = vec256_xor(result[10], in[11]); 32| 18.6k| result[11] = vec256_xor(in[10], in[12]); 33| 18.6k| result[12] = vec256_xor(in[6], t); 34| | 35| 261k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 261k|#define GFBITS 13 ------------------ | Branch (35:17): [True: 242k, False: 18.6k] ------------------ 36| 242k| out[i] = result[i]; 37| 242k| } 38| 18.6k|} PQCLEAN_MCELIECE6960119_AVX2_vec256_inv: 41| 1.26k|void vec256_inv(vec256 *out, vec256 *in) { 42| 1.26k| vec256 tmp_11[ GFBITS ]; 43| 1.26k| vec256 tmp_1111[ GFBITS ]; 44| | 45| 1.26k| vec256_copy(out, in); 46| | 47| 1.26k| vec256_sq(out, out); ------------------ | | 14| 1.26k|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 1.26k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119_AVX2_ ## fun | | ------------------ ------------------ 48| 1.26k| vec256_mul(tmp_11, out, in); // ^11 49| | 50| 1.26k| vec256_sq(out, tmp_11); ------------------ | | 14| 1.26k|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 1.26k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119_AVX2_ ## fun | | ------------------ ------------------ 51| 1.26k| vec256_sq(out, out); ------------------ | | 14| 1.26k|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 1.26k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119_AVX2_ ## fun | | ------------------ ------------------ 52| 1.26k| vec256_mul(tmp_1111, out, tmp_11); // ^1111 53| | 54| 1.26k| vec256_sq(out, tmp_1111); ------------------ | | 14| 1.26k|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 1.26k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119_AVX2_ ## fun | | ------------------ ------------------ 55| 1.26k| vec256_sq(out, out); ------------------ | | 14| 1.26k|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 1.26k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119_AVX2_ ## fun | | ------------------ ------------------ 56| 1.26k| vec256_sq(out, out); ------------------ | | 14| 1.26k|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 1.26k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119_AVX2_ ## fun | | ------------------ ------------------ 57| 1.26k| vec256_sq(out, out); ------------------ | | 14| 1.26k|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 1.26k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119_AVX2_ ## fun | | ------------------ ------------------ 58| 1.26k| vec256_mul(out, out, tmp_1111); // ^11111111 59| | 60| 1.26k| vec256_sq(out, out); ------------------ | | 14| 1.26k|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 1.26k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119_AVX2_ ## fun | | ------------------ ------------------ 61| 1.26k| vec256_sq(out, out); ------------------ | | 14| 1.26k|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 1.26k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119_AVX2_ ## fun | | ------------------ ------------------ 62| 1.26k| vec256_sq(out, out); ------------------ | | 14| 1.26k|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 1.26k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119_AVX2_ ## fun | | ------------------ ------------------ 63| 1.26k| vec256_sq(out, out); ------------------ | | 14| 1.26k|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 1.26k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119_AVX2_ ## fun | | ------------------ ------------------ 64| 1.26k| vec256_mul(out, out, tmp_1111); // ^111111111111 65| | 66| 1.26k| vec256_sq(out, out); // ^1111111111110 ------------------ | | 14| 1.26k|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 1.26k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119_AVX2_ ## fun | | ------------------ ------------------ 67| 1.26k|} operations.c:check_pk_padding: 19| 208|static int check_pk_padding(const unsigned char *pk) { 20| 208| unsigned char b; 21| 208| int i, ret; 22| | 23| 208| b = 0; 24| 321k| for (i = 0; i < PK_NROWS; i++) { ------------------ | | 13| 321k|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 321k|#define SYS_T 119 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 321k|#define GFBITS 13 | | ------------------ ------------------ | Branch (24:17): [True: 321k, False: 208] ------------------ 25| 321k| b |= pk[i * PK_ROW_BYTES + PK_ROW_BYTES - 1]; ------------------ | | 15| 321k|#define PK_ROW_BYTES ((PK_NCOLS + 7)/8) | | ------------------ | | | | 14| 321k|#define PK_NCOLS (SYS_N - PK_NROWS) | | | | ------------------ | | | | | | 7| 321k|#define SYS_N 6960 | | | | ------------------ | | | | #define PK_NCOLS (SYS_N - PK_NROWS) | | | | ------------------ | | | | | | 13| 321k|#define PK_NROWS (SYS_T*GFBITS) | | | | | | ------------------ | | | | | | | | 8| 321k|#define SYS_T 119 | | | | | | ------------------ | | | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | | | ------------------ | | | | | | | | 6| 321k|#define GFBITS 13 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ b |= pk[i * PK_ROW_BYTES + PK_ROW_BYTES - 1]; ------------------ | | 15| 321k|#define PK_ROW_BYTES ((PK_NCOLS + 7)/8) | | ------------------ | | | | 14| 321k|#define PK_NCOLS (SYS_N - PK_NROWS) | | | | ------------------ | | | | | | 7| 321k|#define SYS_N 6960 | | | | ------------------ | | | | #define PK_NCOLS (SYS_N - PK_NROWS) | | | | ------------------ | | | | | | 13| 321k|#define PK_NROWS (SYS_T*GFBITS) | | | | | | ------------------ | | | | | | | | 8| 321k|#define SYS_T 119 | | | | | | ------------------ | | | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | | | ------------------ | | | | | | | | 6| 321k|#define GFBITS 13 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 26| 321k| } 27| | 28| 208| b >>= (PK_NCOLS % 8); ------------------ | | 14| 208|#define PK_NCOLS (SYS_N - PK_NROWS) | | ------------------ | | | | 7| 208|#define SYS_N 6960 | | ------------------ | | #define PK_NCOLS (SYS_N - PK_NROWS) | | ------------------ | | | | 13| 208|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 208|#define SYS_T 119 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 208|#define GFBITS 13 | | | | ------------------ | | ------------------ ------------------ 29| 208| b -= 1; 30| 208| b >>= 7; 31| 208| ret = b; 32| | 33| 208| return ret - 1; 34| 208|} operations.c:check_c_padding: 74| 208|static int check_c_padding(const unsigned char *c) { 75| 208| unsigned char b; 76| 208| int ret; 77| | 78| 208| b = c[ SYND_BYTES - 1 ] >> (PK_NROWS % 8); ------------------ | | 17| 208|#define SYND_BYTES ((PK_NROWS + 7)/8) | | ------------------ | | | | 13| 208|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 208|#define SYS_T 119 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 208|#define GFBITS 13 | | | | ------------------ | | ------------------ ------------------ b = c[ SYND_BYTES - 1 ] >> (PK_NROWS % 8); ------------------ | | 13| 208|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 208|#define SYS_T 119 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 208|#define GFBITS 13 | | ------------------ ------------------ 79| 208| b -= 1; 80| 208| b >>= 7; 81| 208| ret = b; 82| | 83| 208| return ret - 1; 84| 208|} PQCLEAN_MCELIECE6960119F_AVX2_load_bits: 188| 99|void load_bits(vec128 bits_int[][32], const unsigned char *bits) { 189| 99| int i, j; 190| 99| const unsigned char *ptr = bits; 191| | 192| 99| vec128 buf[64]; 193| | 194| 396| for (i = 0; i <= 5; i += 2) { ------------------ | Branch (194:17): [True: 297, False: 99] ------------------ 195| 19.3k| for (j = 0; j < 64; j++) { ------------------ | Branch (195:21): [True: 19.0k, False: 297] ------------------ 196| 19.0k| buf[j] = vec128_set2x(load8(ptr), load8(ptr + 512)); 197| 19.0k| ptr += 8; 198| 19.0k| } 199| | 200| 297| transpose_64x128_sp( buf ); 201| | 202| 9.80k| for (j = 0; j < 32; j++) { ------------------ | Branch (202:21): [True: 9.50k, False: 297] ------------------ 203| 9.50k| bits_int[i + 0][j] = vec128_unpack_low(buf[j], buf[j + 32]); 204| 9.50k| bits_int[i + 1][j] = vec128_unpack_high(buf[j], buf[j + 32]); 205| 9.50k| } 206| | 207| 297| ptr += 512; 208| 297| } 209| | 210| 1.38k| for (i = 6; i <= 18; i++) { ------------------ | Branch (210:17): [True: 1.28k, False: 99] ------------------ 211| 42.4k| for (j = 0; j < 32; j++) { ------------------ | Branch (211:21): [True: 41.1k, False: 1.28k] ------------------ 212| 41.1k| bits_int[i][j] = load16(ptr); 213| 41.1k| ptr += 16; 214| 41.1k| } 215| 1.28k| } 216| | 217| 396| for (i = 19; i < 25; i += 2) { ------------------ | Branch (217:18): [True: 297, False: 99] ------------------ 218| 19.3k| for (j = 0; j < 64; j++) { ------------------ | Branch (218:21): [True: 19.0k, False: 297] ------------------ 219| 19.0k| buf[j] = vec128_set2x(load8(ptr), load8(ptr + 512)); 220| 19.0k| ptr += 8; 221| 19.0k| } 222| | 223| 297| transpose_64x128_sp( buf ); 224| | 225| 9.80k| for (j = 0; j < 32; j++) { ------------------ | Branch (225:21): [True: 9.50k, False: 297] ------------------ 226| 9.50k| bits_int[i + 0][j] = vec128_unpack_low(buf[j], buf[j + 32]); 227| 9.50k| bits_int[i + 1][j] = vec128_unpack_high(buf[j], buf[j + 32]); 228| 9.50k| } 229| | 230| 297| ptr += 512; 231| 297| } 232| 99|} PQCLEAN_MCELIECE6960119F_AVX2_benes: 238| 198|void benes(vec128 *r, vec128 b[][32], int rev) { 239| 198| int inc; 240| | 241| 198| vec128 *b_ptr; 242| | 243| 198| if (rev == 0) { ------------------ | Branch (243:9): [True: 99, False: 99] ------------------ 244| 99| inc = 32; 245| 99| b_ptr = b[ 0]; 246| 99| } else { 247| 99| inc = -32; 248| 99| b_ptr = b[24]; 249| 99| } 250| | 251| | // 252| | 253| 198| transpose_64x128_sp( r ); 254| | 255| 198| layer_0(r, b_ptr); 256| 198| b_ptr += inc; 257| 198| layer_1(r, b_ptr); 258| 198| b_ptr += inc; 259| 198| layer_2(r, b_ptr); 260| 198| b_ptr += inc; 261| 198| layer_3(r, b_ptr); 262| 198| b_ptr += inc; 263| 198| layer_4(r, b_ptr); 264| 198| b_ptr += inc; 265| 198| layer_5(r, b_ptr); 266| 198| b_ptr += inc; 267| | 268| 198| transpose_64x128_sp( r ); 269| | 270| 198| layer_x(r, b_ptr); 271| 198| b_ptr += inc; 272| 198| layer_0(r, b_ptr); 273| 198| b_ptr += inc; 274| 198| layer_1(r, b_ptr); 275| 198| b_ptr += inc; 276| 198| layer_2(r, b_ptr); 277| 198| b_ptr += inc; 278| 198| layer_3(r, b_ptr); 279| 198| b_ptr += inc; 280| 198| layer_4(r, b_ptr); 281| 198| b_ptr += inc; 282| 198| layer_5(r, b_ptr); 283| 198| b_ptr += inc; 284| 198| layer_4(r, b_ptr); 285| 198| b_ptr += inc; 286| 198| layer_3(r, b_ptr); 287| 198| b_ptr += inc; 288| 198| layer_2(r, b_ptr); 289| 198| b_ptr += inc; 290| 198| layer_1(r, b_ptr); 291| 198| b_ptr += inc; 292| 198| layer_0(r, b_ptr); 293| 198| b_ptr += inc; 294| 198| layer_x(r, b_ptr); 295| 198| b_ptr += inc; 296| | 297| 198| transpose_64x128_sp( r ); 298| | 299| 198| layer_5(r, b_ptr); 300| 198| b_ptr += inc; 301| 198| layer_4(r, b_ptr); 302| 198| b_ptr += inc; 303| 198| layer_3(r, b_ptr); 304| 198| b_ptr += inc; 305| 198| layer_2(r, b_ptr); 306| 198| b_ptr += inc; 307| 198| layer_1(r, b_ptr); 308| 198| b_ptr += inc; 309| 198| layer_0(r, b_ptr); 310| | 311| 198| transpose_64x128_sp( r ); 312| 198|} PQCLEAN_MCELIECE6960119F_AVX2_bm: 147| 99|void bm(vec128 *out, vec256 *in) { 148| 99| int i; 149| 99| uint16_t N, L; 150| 99| uint16_t mask; 151| 99| uint64_t one = 1; 152| 99| uint64_t v[2]; 153| | 154| 99| vec128 prod[ GFBITS ]; 155| 99| vec128 interval[GFBITS]; 156| | 157| 99| typedef union { 158| 99| vec128 v[GFBITS][2]; 159| 99| vec256 V[GFBITS]; 160| 99| } db_t; 161| | 162| 99| db_t db; 163| 99| db_t BC_tmp; 164| 99| db_t BC; 165| | 166| 99| gf d, b; 167| 99| gf coefs[256]; 168| | 169| | // initialization 170| | 171| 99| get_coefs(coefs, in); 172| | 173| 99| BC.v[0][0] = vec128_set2x(0, one << 62); 174| 99| BC.v[0][1] = vec128_set2x(0, one << 63); 175| | 176| 1.28k| for (i = 1; i < GFBITS; i++) { ------------------ | | 6| 1.28k|#define GFBITS 13 ------------------ | Branch (176:17): [True: 1.18k, False: 99] ------------------ 177| 1.18k| BC.v[i][0] = BC.v[i][1] = vec128_setzero(); 178| 1.18k| } 179| | 180| 99| b = 1; 181| 99| L = 0; 182| | 183| | // 184| | 185| 1.38k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 1.38k|#define GFBITS 13 ------------------ | Branch (185:17): [True: 1.28k, False: 99] ------------------ 186| 1.28k| interval[i] = vec128_setzero(); 187| 1.28k| } 188| | 189| 23.6k| for (N = 0; N < SYS_T * 2; N++) { ------------------ | | 8| 23.6k|#define SYS_T 119 ------------------ | Branch (189:17): [True: 23.5k, False: 99] ------------------ 190| 23.5k| update_asm(interval, coefs[N], 16); ------------------ | | 1| 23.5k|#define update_asm CRYPTO_NAMESPACE(update_asm) | | ------------------ | | | | 4| 23.5k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119F_AVX2_ ## fun | | ------------------ ------------------ 191| 23.5k| vec128_mul_asm(prod, interval, BC.v[0] + 1, 32); ------------------ | | 10| 23.5k|#define vec128_mul_asm CRYPTO_NAMESPACE(vec128_mul_asm) | | ------------------ | | | | 4| 23.5k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119F_AVX2_ ## fun | | ------------------ ------------------ 192| | 193| 23.5k| d = vec_reduce_asm(prod); ------------------ | | 3| 23.5k|#define vec_reduce_asm CRYPTO_NAMESPACE(vec_reduce_asm) | | ------------------ | | | | 4| 23.5k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119F_AVX2_ ## fun | | ------------------ ------------------ 194| | 195| 23.5k| mask = mask_nonzero(d) & mask_leq(L * 2, N); 196| | 197| 329k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 329k|#define GFBITS 13 ------------------ | Branch (197:21): [True: 306k, False: 23.5k] ------------------ 198| 306k| db.v[i][0] = vec128_setbits((d >> i) & 1); 199| 306k| db.v[i][1] = vec128_setbits((b >> i) & 1); 200| 306k| } 201| | 202| 23.5k| vec256_mul((vec256 *) BC_tmp.V, (vec256 *) db.V, (vec256 *) BC.V); 203| | 204| 23.5k| vec128_cmov(BC.v, mask); 205| 23.5k| update_asm(BC.v, 0, 32); ------------------ | | 1| 23.5k|#define update_asm CRYPTO_NAMESPACE(update_asm) | | ------------------ | | | | 4| 23.5k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119F_AVX2_ ## fun | | ------------------ ------------------ 206| | 207| 329k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 329k|#define GFBITS 13 ------------------ | Branch (207:21): [True: 306k, False: 23.5k] ------------------ 208| 306k| BC.v[i][1] = vec128_xor(BC_tmp.v[i][0], BC_tmp.v[i][1]); 209| 306k| } 210| | 211| 23.5k| b = (d & mask) | (b & ~mask); 212| 23.5k| L = ((N + 1 - L) & mask) | (L & ~mask); 213| 23.5k| } 214| | 215| 1.38k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 1.38k|#define GFBITS 13 ------------------ | Branch (215:17): [True: 1.28k, False: 99] ------------------ 216| 1.28k| v[0] = vec128_extract(BC.v[i][1], 0); ------------------ | | 29| 1.28k|#define vec128_extract(a, i) ((uint64_t) _mm_extract_epi64((vec128) (a), (i))) ------------------ 217| 1.28k| v[1] = vec128_extract(BC.v[i][1], 1); ------------------ | | 29| 1.28k|#define vec128_extract(a, i) ((uint64_t) _mm_extract_epi64((vec128) (a), (i))) ------------------ 218| | 219| 1.28k| out[i] = vec128_set2x((v[0] >> 8) | (v[1] << 56), v[1] >> 8); 220| 1.28k| } 221| 99|} PQCLEAN_MCELIECE6960119F_AVX2_controlbitsfrompermutation: 205| 99|void controlbitsfrompermutation(unsigned char *out, const int16 *pi, long long w, long long n) { 206| 99| PQCLEAN_VLA(int32, temp, (size_t)(2 * n)); ------------------ | | 57| 99|# define PQCLEAN_VLA(__t,__x,__s) __t __x[__s] ------------------ 207| 99| PQCLEAN_VLA(int16, pi_test, (size_t)n); ------------------ | | 57| 99|# define PQCLEAN_VLA(__t,__x,__s) __t __x[__s] ------------------ 208| 99| int16 diff; 209| 99| int i; 210| 99| unsigned char *ptr; 211| | 212| 99| OQS_MEM_cleanse(temp, (size_t)n * 2); 213| 99| OQS_MEM_cleanse(pi_test, (size_t)n); 214| | 215| 99| while (1) { ------------------ | Branch (215:12): [True: 99, Folded] ------------------ 216| 99| OQS_MEM_cleanse(out, (size_t)((((2 * w - 1)*n / 2) + 7) / 8)); 217| 99| cbrecursion(out, 0, 1, pi, w, n, temp); 218| | 219| | // check for correctness 220| | 221| 811k| for (i = 0; i < n; i++) { ------------------ | Branch (221:21): [True: 811k, False: 99] ------------------ 222| 811k| pi_test[i] = (int16)i; 223| 811k| } 224| | 225| 99| ptr = out; 226| 1.38k| for (i = 0; i < w; i++) { ------------------ | Branch (226:21): [True: 1.28k, False: 99] ------------------ 227| 1.28k| layer(pi_test, ptr, i, (int32)n); 228| 1.28k| ptr += n >> 4; 229| 1.28k| } 230| | 231| 1.28k| for (i = (int)(w - 2); i >= 0; i--) { ------------------ | Branch (231:32): [True: 1.18k, False: 99] ------------------ 232| 1.18k| layer(pi_test, ptr, i, (int32)n); 233| 1.18k| ptr += n >> 4; 234| 1.18k| } 235| | 236| 99| diff = 0; 237| 811k| for (i = 0; i < n; i++) { ------------------ | Branch (237:21): [True: 811k, False: 99] ------------------ 238| 811k| diff |= pi[i] ^ pi_test[i]; 239| 811k| } 240| | 241| 99| diff = crypto_int16_nonzero_mask(diff); ------------------ | | 12| 99|#define crypto_int16_nonzero_mask CRYPTO_NAMESPACE(crypto_int16_nonzero_mask) | | ------------------ | | | | 4| 99|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119F_AVX2_ ## fun | | ------------------ ------------------ 242| 99| crypto_declassify(&diff, sizeof diff); 243| 99| if (diff == 0) { ------------------ | Branch (243:13): [True: 99, False: 0] ------------------ 244| 99| break; 245| 99| } 246| 99| } 247| 99|} PQCLEAN_MCELIECE6960119F_AVX2_crypto_int16_negative_mask: 3| 198|crypto_int16 crypto_int16_negative_mask(crypto_int16 crypto_int16_x) { 4| 198| return crypto_int16_x >> 15; 5| 198|} PQCLEAN_MCELIECE6960119F_AVX2_crypto_int16_nonzero_mask: 7| 99|crypto_int16 crypto_int16_nonzero_mask(crypto_int16 crypto_int16_x) { 8| 99| return crypto_int16_negative_mask(crypto_int16_x) | crypto_int16_negative_mask(-crypto_int16_x); ------------------ | | 10| 99|#define crypto_int16_negative_mask CRYPTO_NAMESPACE(crypto_int16_negative_mask) | | ------------------ | | | | 4| 99|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119F_AVX2_ ## fun | | ------------------ ------------------ return crypto_int16_negative_mask(crypto_int16_x) | crypto_int16_negative_mask(-crypto_int16_x); ------------------ | | 10| 99|#define crypto_int16_negative_mask CRYPTO_NAMESPACE(crypto_int16_negative_mask) | | ------------------ | | | | 4| 99|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119F_AVX2_ ## fun | | ------------------ ------------------ 9| 99|} PQCLEAN_MCELIECE6960119F_AVX2_crypto_int32_negative_mask: 3| 63.2M|crypto_int32 crypto_int32_negative_mask(crypto_int32 crypto_int32_x) { 4| 63.2M| return crypto_int32_x >> 31; 5| 63.2M|} PQCLEAN_MCELIECE6960119F_AVX2_crypto_int32_min: 37| 63.2M|crypto_int32 crypto_int32_min(crypto_int32 crypto_int32_x, crypto_int32 crypto_int32_y) { 38| 63.2M| crypto_int32 crypto_int32_xy = crypto_int32_y ^ crypto_int32_x; 39| 63.2M| crypto_int32 crypto_int32_z = crypto_int32_y - crypto_int32_x; 40| 63.2M| crypto_int32_z ^= crypto_int32_xy & (crypto_int32_z ^ crypto_int32_y); 41| 63.2M| crypto_int32_z = crypto_int32_negative_mask(crypto_int32_z); ------------------ | | 9| 63.2M|#define crypto_int32_negative_mask CRYPTO_NAMESPACE(crypto_int32_negative_mask) | | ------------------ | | | | 4| 63.2M|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119F_AVX2_ ## fun | | ------------------ ------------------ 42| 63.2M| crypto_int32_z &= crypto_int32_xy; 43| 63.2M| return crypto_int32_x ^ crypto_int32_z; 44| 63.2M|} PQCLEAN_MCELIECE6960119F_AVX2_crypto_uint16_signed_negative_mask: 3| 111k|crypto_uint16_signed crypto_uint16_signed_negative_mask(crypto_uint16_signed crypto_uint16_signed_x) { 4| 111k| return crypto_uint16_signed_x >> 15; 5| 111k|} PQCLEAN_MCELIECE6960119F_AVX2_crypto_uint16_nonzero_mask: 7| 15.4k|crypto_uint16 crypto_uint16_nonzero_mask(crypto_uint16 crypto_uint16_x) { 8| 15.4k| return crypto_uint16_signed_negative_mask(crypto_uint16_x) | crypto_uint16_signed_negative_mask(-crypto_uint16_x); ------------------ | | 11| 15.4k|#define crypto_uint16_signed_negative_mask CRYPTO_NAMESPACE(crypto_uint16_signed_negative_mask) | | ------------------ | | | | 4| 15.4k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119F_AVX2_ ## fun | | ------------------ ------------------ return crypto_uint16_signed_negative_mask(crypto_uint16_x) | crypto_uint16_signed_negative_mask(-crypto_uint16_x); ------------------ | | 11| 15.4k|#define crypto_uint16_signed_negative_mask CRYPTO_NAMESPACE(crypto_uint16_signed_negative_mask) | | ------------------ | | | | 4| 15.4k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119F_AVX2_ ## fun | | ------------------ ------------------ 9| 15.4k|} PQCLEAN_MCELIECE6960119F_AVX2_crypto_uint16_zero_mask: 11| 15.4k|crypto_uint16 crypto_uint16_zero_mask(crypto_uint16 crypto_uint16_x) { 12| 15.4k| return ~crypto_uint16_nonzero_mask(crypto_uint16_x); ------------------ | | 13| 15.4k|#define crypto_uint16_nonzero_mask CRYPTO_NAMESPACE(crypto_uint16_nonzero_mask) | | ------------------ | | | | 4| 15.4k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119F_AVX2_ ## fun | | ------------------ ------------------ 13| 15.4k|} PQCLEAN_MCELIECE6960119F_AVX2_crypto_uint16_smaller_mask: 24| 80.5k|crypto_uint16 crypto_uint16_smaller_mask(crypto_uint16 crypto_uint16_x, crypto_uint16 crypto_uint16_y) { 25| 80.5k| crypto_uint16 crypto_uint16_xy = crypto_uint16_x ^ crypto_uint16_y; 26| 80.5k| crypto_uint16 crypto_uint16_z = crypto_uint16_x - crypto_uint16_y; 27| 80.5k| crypto_uint16_z ^= crypto_uint16_xy & (crypto_uint16_z ^ crypto_uint16_x ^ (((crypto_uint16) 1) << 15)); 28| 80.5k| return crypto_uint16_signed_negative_mask(crypto_uint16_z); ------------------ | | 11| 80.5k|#define crypto_uint16_signed_negative_mask CRYPTO_NAMESPACE(crypto_uint16_signed_negative_mask) | | ------------------ | | | | 4| 80.5k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119F_AVX2_ ## fun | | ------------------ ------------------ 29| 80.5k|} PQCLEAN_MCELIECE6960119F_AVX2_crypto_uint32_signed_negative_mask: 3| 135k|crypto_uint32_signed crypto_uint32_signed_negative_mask(crypto_uint32_signed crypto_uint32_signed_x) { 4| 135k| return crypto_uint32_signed_x >> 31; 5| 135k|} PQCLEAN_MCELIECE6960119F_AVX2_crypto_uint32_nonzero_mask: 7| 67.7k|crypto_uint32 crypto_uint32_nonzero_mask(crypto_uint32 crypto_uint32_x) { 8| 67.7k| return crypto_uint32_signed_negative_mask(crypto_uint32_x) | crypto_uint32_signed_negative_mask(-crypto_uint32_x); ------------------ | | 11| 67.7k|#define crypto_uint32_signed_negative_mask CRYPTO_NAMESPACE(crypto_uint32_signed_negative_mask) | | ------------------ | | | | 4| 67.7k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119F_AVX2_ ## fun | | ------------------ ------------------ return crypto_uint32_signed_negative_mask(crypto_uint32_x) | crypto_uint32_signed_negative_mask(-crypto_uint32_x); ------------------ | | 11| 67.7k|#define crypto_uint32_signed_negative_mask CRYPTO_NAMESPACE(crypto_uint32_signed_negative_mask) | | ------------------ | | | | 4| 67.7k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119F_AVX2_ ## fun | | ------------------ ------------------ 9| 67.7k|} PQCLEAN_MCELIECE6960119F_AVX2_crypto_uint32_unequal_mask: 15| 67.7k|crypto_uint32 crypto_uint32_unequal_mask(crypto_uint32 crypto_uint32_x, crypto_uint32 crypto_uint32_y) { 16| 67.7k| crypto_uint32 crypto_uint32_xy = crypto_uint32_x ^ crypto_uint32_y; 17| 67.7k| return crypto_uint32_nonzero_mask(crypto_uint32_xy); ------------------ | | 13| 67.7k|#define crypto_uint32_nonzero_mask CRYPTO_NAMESPACE(crypto_uint32_nonzero_mask) | | ------------------ | | | | 4| 67.7k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119F_AVX2_ ## fun | | ------------------ ------------------ 18| 67.7k|} PQCLEAN_MCELIECE6960119F_AVX2_crypto_uint32_equal_mask: 20| 67.7k|crypto_uint32 crypto_uint32_equal_mask(crypto_uint32 crypto_uint32_x, crypto_uint32 crypto_uint32_y) { 21| 67.7k| return ~crypto_uint32_unequal_mask(crypto_uint32_x, crypto_uint32_y); ------------------ | | 17| 67.7k|#define crypto_uint32_unequal_mask CRYPTO_NAMESPACE(crypto_uint32_unequal_mask) | | ------------------ | | | | 4| 67.7k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119F_AVX2_ ## fun | | ------------------ ------------------ 22| 67.7k|} PQCLEAN_MCELIECE6960119F_AVX2_crypto_uint64_signed_negative_mask: 3| 2.17M|crypto_uint64_signed crypto_uint64_signed_negative_mask(crypto_uint64_signed crypto_uint64_signed_x) { 4| 2.17M| return crypto_uint64_signed_x >> 63; 5| 2.17M|} PQCLEAN_MCELIECE6960119F_AVX2_crypto_uint64_nonzero_mask: 7| 1.08M|crypto_uint64 crypto_uint64_nonzero_mask(crypto_uint64 crypto_uint64_x) { 8| 1.08M| return crypto_uint64_signed_negative_mask(crypto_uint64_x) | crypto_uint64_signed_negative_mask(-crypto_uint64_x); ------------------ | | 11| 1.08M|#define crypto_uint64_signed_negative_mask CRYPTO_NAMESPACE(crypto_uint64_signed_negative_mask) | | ------------------ | | | | 4| 1.08M|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119F_AVX2_ ## fun | | ------------------ ------------------ return crypto_uint64_signed_negative_mask(crypto_uint64_x) | crypto_uint64_signed_negative_mask(-crypto_uint64_x); ------------------ | | 11| 1.08M|#define crypto_uint64_signed_negative_mask CRYPTO_NAMESPACE(crypto_uint64_signed_negative_mask) | | ------------------ | | | | 4| 1.08M|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119F_AVX2_ ## fun | | ------------------ ------------------ 9| 1.08M|} PQCLEAN_MCELIECE6960119F_AVX2_crypto_uint64_zero_mask: 11| 156k|crypto_uint64 crypto_uint64_zero_mask(crypto_uint64 crypto_uint64_x) { 12| 156k| return ~crypto_uint64_nonzero_mask(crypto_uint64_x); ------------------ | | 13| 156k|#define crypto_uint64_nonzero_mask CRYPTO_NAMESPACE(crypto_uint64_nonzero_mask) | | ------------------ | | | | 4| 156k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119F_AVX2_ ## fun | | ------------------ ------------------ 13| 156k|} PQCLEAN_MCELIECE6960119F_AVX2_crypto_uint64_unequal_mask: 15| 933k|crypto_uint64 crypto_uint64_unequal_mask(crypto_uint64 crypto_uint64_x, crypto_uint64 crypto_uint64_y) { 16| 933k| crypto_uint64 crypto_uint64_xy = crypto_uint64_x ^ crypto_uint64_y; 17| 933k| return crypto_uint64_nonzero_mask(crypto_uint64_xy); ------------------ | | 13| 933k|#define crypto_uint64_nonzero_mask CRYPTO_NAMESPACE(crypto_uint64_nonzero_mask) | | ------------------ | | | | 4| 933k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119F_AVX2_ ## fun | | ------------------ ------------------ 18| 933k|} PQCLEAN_MCELIECE6960119F_AVX2_crypto_uint64_equal_mask: 20| 933k|crypto_uint64 crypto_uint64_equal_mask(crypto_uint64 crypto_uint64_x, crypto_uint64 crypto_uint64_y) { 21| 933k| return ~crypto_uint64_unequal_mask(crypto_uint64_x, crypto_uint64_y); ------------------ | | 17| 933k|#define crypto_uint64_unequal_mask CRYPTO_NAMESPACE(crypto_uint64_unequal_mask) | | ------------------ | | | | 4| 933k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119F_AVX2_ ## fun | | ------------------ ------------------ 22| 933k|} PQCLEAN_MCELIECE6960119F_AVX2_decrypt: 171| 99|int decrypt(unsigned char *e, const unsigned char *sk, const unsigned char *s) { 172| 99| int i; 173| | 174| 99| uint16_t check_synd; 175| 99| uint16_t check_weight; 176| | 177| 99| vec256 inv[ 32 ][ GFBITS ]; 178| 99| vec256 scaled[ 32 ][ GFBITS ]; 179| 99| vec256 eval[32][ GFBITS ]; 180| | 181| 99| vec128 error128[ 64 ]; 182| 99| vec256 error256[ 32 ]; 183| | 184| 99| vec256 s_priv[ GFBITS ]; 185| 99| vec256 s_priv_cmp[ GFBITS ]; 186| 99| vec128 locator[ GFBITS ]; 187| | 188| 99| vec128 recv128[ 64 ]; 189| 99| vec256 recv256[ 32 ]; 190| 99| vec256 allone; 191| | 192| 99| vec128 bits_int[25][32]; 193| | 194| | // Berlekamp decoder 195| | 196| 99| preprocess(recv128, s); 197| | 198| 99| load_bits(bits_int, sk + IRR_BYTES); ------------------ | | 10| 99|#define load_bits CRYPTO_NAMESPACE(load_bits) | | ------------------ | | | | 4| 99|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119F_AVX2_ ## fun | | ------------------ ------------------ load_bits(bits_int, sk + IRR_BYTES); ------------------ | | 11| 99|#define IRR_BYTES (SYS_T * 2) | | ------------------ | | | | 8| 99|#define SYS_T 119 | | ------------------ ------------------ 199| 99| benes(recv128, bits_int, 1); ------------------ | | 9| 99|#define benes CRYPTO_NAMESPACE(benes) | | ------------------ | | | | 4| 99|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119F_AVX2_ ## fun | | ------------------ ------------------ 200| | 201| 99| reformat_128to256(recv256, recv128); 202| | 203| 99| scaling(scaled, inv, sk, recv256); 204| 99| fft_tr(s_priv, scaled); ------------------ | | 9| 99|#define fft_tr CRYPTO_NAMESPACE(fft_tr) | | ------------------ | | | | 4| 99|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119F_AVX2_ ## fun | | ------------------ ------------------ 205| 99| bm(locator, s_priv); ------------------ | | 10| 99|#define bm CRYPTO_NAMESPACE(bm) | | ------------------ | | | | 4| 99|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119F_AVX2_ ## fun | | ------------------ ------------------ 206| | 207| 99| fft(eval, locator); ------------------ | | 10| 99|#define fft CRYPTO_NAMESPACE(fft) | | ------------------ | | | | 4| 99|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119F_AVX2_ ## fun | | ------------------ ------------------ 208| | 209| | // reencryption and weight check 210| | 211| 99| allone = vec256_set1_16b(0xFFFF); 212| | 213| 3.26k| for (i = 0; i < 32; i++) { ------------------ | Branch (213:17): [True: 3.16k, False: 99] ------------------ 214| 3.16k| error256[i] = vec256_or_reduce(eval[i]); 215| 3.16k| error256[i] = vec256_xor(error256[i], allone); 216| 3.16k| } 217| | 218| 99| scaling_inv(scaled, inv, error256); 219| 99| fft_tr(s_priv_cmp, scaled); ------------------ | | 9| 99|#define fft_tr CRYPTO_NAMESPACE(fft_tr) | | ------------------ | | | | 4| 99|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119F_AVX2_ ## fun | | ------------------ ------------------ 220| | 221| 99| check_synd = synd_cmp(s_priv, s_priv_cmp); 222| | 223| | // 224| | 225| 99| reformat_256to128(error128, error256); 226| 99| benes(error128, bits_int, 0); ------------------ | | 9| 99|#define benes CRYPTO_NAMESPACE(benes) | | ------------------ | | | | 4| 99|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119F_AVX2_ ## fun | | ------------------ ------------------ 227| | 228| 99| postprocess(e, error128); 229| | 230| 99| check_weight = weight_check(e, error128); 231| | 232| 99| return 1 - (check_synd & check_weight); 233| 99|} PQCLEAN_MCELIECE6960119F_AVX2_encrypt: 116| 99|void encrypt(unsigned char *s, const unsigned char *pk, unsigned char *e) { 117| 99| gen_e(e); 118| | 119| 99| syndrome_asm(s, pk, e); ------------------ | | 1| 99|#define syndrome_asm CRYPTO_NAMESPACE(syndrome_asm) | | ------------------ | | | | 4| 99|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119F_AVX2_ ## fun | | ------------------ ------------------ 120| 99|} PQCLEAN_MCELIECE6960119F_AVX2_fft: 265| 328|void fft(vec256 out[][GFBITS], vec128 *in) { 266| 328| radix_conversions(in); 267| 328| butterflies(out, in); 268| 328|} PQCLEAN_MCELIECE6960119F_AVX2_fft_tr: 398| 198|void fft_tr(vec256 *out, vec256 in[][ GFBITS ]) { 399| 198| butterflies_tr(out, in); 400| 198| radix_conversions_tr(out); 401| | 402| 198| postprocess(out); 403| 198|} PQCLEAN_MCELIECE6960119F_AVX2_gf_mul: 20| 1.84M|gf gf_mul(gf in0, gf in1) { 21| 1.84M| int i; 22| | 23| 1.84M| uint64_t tmp; 24| 1.84M| uint64_t t0; 25| 1.84M| uint64_t t1; 26| 1.84M| uint64_t t; 27| | 28| 1.84M| t0 = in0; 29| 1.84M| t1 = in1; 30| | 31| 1.84M| tmp = t0 * (t1 & 1); 32| | 33| 23.9M| for (i = 1; i < GFBITS; i++) { ------------------ | | 6| 23.9M|#define GFBITS 13 ------------------ | Branch (33:17): [True: 22.0M, False: 1.84M] ------------------ 34| 22.0M| tmp ^= (t0 * (t1 & (1 << i))); 35| 22.0M| } 36| | 37| | // 38| | 39| 1.84M| t = tmp & 0x1FF0000; 40| 1.84M| tmp ^= (t >> 9) ^ (t >> 10) ^ (t >> 12) ^ (t >> 13); 41| | 42| 1.84M| t = tmp & 0x000E000; 43| 1.84M| tmp ^= (t >> 9) ^ (t >> 10) ^ (t >> 12) ^ (t >> 13); 44| | 45| 1.84M| return tmp & GFMASK; ------------------ | | 19| 1.84M|#define GFMASK ((1 << GFBITS) - 1) | | ------------------ | | | | 6| 1.84M|#define GFBITS 13 | | ------------------ ------------------ 46| 1.84M|} PQCLEAN_MCELIECE6960119F_AVX2_gf_frac: 156| 15.4k|gf gf_frac(gf den, gf num) { 157| 15.4k| gf tmp_11; 158| 15.4k| gf tmp_1111; 159| 15.4k| gf out; 160| | 161| 15.4k| tmp_11 = gf_sqmul(den, den); // ^11 162| 15.4k| tmp_1111 = gf_sq2mul(tmp_11, tmp_11); // ^1111 163| 15.4k| out = gf_sq2(tmp_1111); 164| 15.4k| out = gf_sq2mul(out, tmp_1111); // ^11111111 165| 15.4k| out = gf_sq2(out); 166| 15.4k| out = gf_sq2mul(out, tmp_1111); // ^111111111111 167| | 168| 15.4k| return gf_sqmul(out, num); // ^1111111111110 = ^-1 169| 15.4k|} PQCLEAN_MCELIECE6960119F_AVX2_gf_inv: 172| 15.4k|gf gf_inv(gf den) { 173| 15.4k| return gf_frac(den, ((gf) 1)); ------------------ | | 10| 15.4k|#define gf_frac CRYPTO_NAMESPACE(gf_frac) | | ------------------ | | | | 4| 15.4k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119F_AVX2_ ## fun | | ------------------ ------------------ 174| 15.4k|} pk_gen.c:PQCLEAN_MCELIECE6960119F_AVX2_int32_sort: 21| 99|static void int32_sort(int32_t *x, long long n) { 22| 99| long long top, p, q, r, i; 23| | 24| 99| if (n < 2) { ------------------ | Branch (24:9): [True: 0, False: 99] ------------------ 25| 0| return; 26| 0| } 27| 99| top = 1; 28| 1.08k| while (top < n - top) { ------------------ | Branch (28:12): [True: 990, False: 99] ------------------ 29| 990| top += top; 30| 990| } 31| | 32| 1.18k| for (p = top; p > 0; p >>= 1) { ------------------ | Branch (32:19): [True: 1.08k, False: 99] ------------------ 33| 1.48M| for (i = 0; i < n - p; ++i) { ------------------ | Branch (33:21): [True: 1.48M, False: 1.08k] ------------------ 34| 1.48M| if (!(i & p)) { ------------------ | Branch (34:17): [True: 789k, False: 692k] ------------------ 35| 789k| int32_MINMAX(x[i], x[i + p]); ------------------ | | 11| 789k| do { \ | | 12| 789k| int32_t ab = (b) ^ (a); \ | | 13| 789k| int32_t c = (b) - (a); \ | | 14| 789k| c ^= ab & ((c) ^ (b)); \ | | 15| 789k| c >>= 31; \ | | 16| 789k| c &= ab; \ | | 17| 789k| (a) ^= c; \ | | 18| 789k| (b) ^= c; \ | | 19| 789k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 789k] | | ------------------ ------------------ 36| 789k| } 37| 1.48M| } 38| 1.08k| i = 0; 39| 6.53k| for (q = top; q > p; q >>= 1) { ------------------ | Branch (39:23): [True: 5.44k, False: 1.08k] ------------------ 40| 1.33M| for (; i < n - q; ++i) { ------------------ | Branch (40:20): [True: 1.32M, False: 5.44k] ------------------ 41| 1.32M| if (!(i & p)) { ------------------ | Branch (41:21): [True: 692k, False: 636k] ------------------ 42| 692k| int32_t a = x[i + p]; 43| 4.03M| for (r = q; r > p; r >>= 1) { ------------------ | Branch (43:33): [True: 3.33M, False: 692k] ------------------ 44| 3.33M| int32_MINMAX(a, x[i + r]); ------------------ | | 11| 3.33M| do { \ | | 12| 3.33M| int32_t ab = (b) ^ (a); \ | | 13| 3.33M| int32_t c = (b) - (a); \ | | 14| 3.33M| c ^= ab & ((c) ^ (b)); \ | | 15| 3.33M| c >>= 31; \ | | 16| 3.33M| c &= ab; \ | | 17| 3.33M| (a) ^= c; \ | | 18| 3.33M| (b) ^= c; \ | | 19| 3.33M| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 3.33M] | | ------------------ ------------------ 45| 3.33M| } 46| 692k| x[i + p] = a; 47| 692k| } 48| 1.32M| } 49| 5.44k| } 50| 1.08k| } 51| 99|} controlbits.c:PQCLEAN_MCELIECE6960119F_AVX2_int32_sort: 21| 3.24M|static void int32_sort(int32_t *x, long long n) { 22| 3.24M| long long top, p, q, r, i; 23| | 24| 3.24M| if (n < 2) { ------------------ | Branch (24:9): [True: 0, False: 3.24M] ------------------ 25| 0| return; 26| 0| } 27| 3.24M| top = 1; 28| 11.3M| while (top < n - top) { ------------------ | Branch (28:12): [True: 8.12M, False: 3.24M] ------------------ 29| 8.12M| top += top; 30| 8.12M| } 31| | 32| 14.6M| for (p = top; p > 0; p >>= 1) { ------------------ | Branch (32:19): [True: 11.3M, False: 3.24M] ------------------ 33| 1.56G| for (i = 0; i < n - p; ++i) { ------------------ | Branch (33:21): [True: 1.55G, False: 11.3M] ------------------ 34| 1.55G| if (!(i & p)) { ------------------ | Branch (34:17): [True: 868M, False: 684M] ------------------ 35| 868M| int32_MINMAX(x[i], x[i + p]); ------------------ | | 11| 868M| do { \ | | 12| 868M| int32_t ab = (b) ^ (a); \ | | 13| 868M| int32_t c = (b) - (a); \ | | 14| 868M| c ^= ab & ((c) ^ (b)); \ | | 15| 868M| c >>= 31; \ | | 16| 868M| c &= ab; \ | | 17| 868M| (a) ^= c; \ | | 18| 868M| (b) ^= c; \ | | 19| 868M| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 868M] | | ------------------ ------------------ 36| 868M| } 37| 1.55G| } 38| 11.3M| i = 0; 39| 30.8M| for (q = top; q > p; q >>= 1) { ------------------ | Branch (39:23): [True: 19.4M, False: 11.3M] ------------------ 40| 1.38G| for (; i < n - q; ++i) { ------------------ | Branch (40:20): [True: 1.36G, False: 19.4M] ------------------ 41| 1.36G| if (!(i & p)) { ------------------ | Branch (41:21): [True: 684M, False: 684M] ------------------ 42| 684M| int32_t a = x[i + p]; 43| 4.05G| for (r = q; r > p; r >>= 1) { ------------------ | Branch (43:33): [True: 3.37G, False: 684M] ------------------ 44| 3.37G| int32_MINMAX(a, x[i + r]); ------------------ | | 11| 3.37G| do { \ | | 12| 3.37G| int32_t ab = (b) ^ (a); \ | | 13| 3.37G| int32_t c = (b) - (a); \ | | 14| 3.37G| c ^= ab & ((c) ^ (b)); \ | | 15| 3.37G| c >>= 31; \ | | 16| 3.37G| c &= ab; \ | | 17| 3.37G| (a) ^= c; \ | | 18| 3.37G| (b) ^= c; \ | | 19| 3.37G| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 3.37G] | | ------------------ ------------------ 45| 3.37G| } 46| 684M| x[i + p] = a; 47| 684M| } 48| 1.36G| } 49| 19.4M| } 50| 11.3M| } 51| 3.24M|} encrypt.c:PQCLEAN_MCELIECE6960119F_AVX2_int32_sort: 21| 574|static void int32_sort(int32_t *x, long long n) { 22| 574| long long top, p, q, r, i; 23| | 24| 574| if (n < 2) { ------------------ | Branch (24:9): [True: 0, False: 574] ------------------ 25| 0| return; 26| 0| } 27| 574| top = 1; 28| 4.01k| while (top < n - top) { ------------------ | Branch (28:12): [True: 3.44k, False: 574] ------------------ 29| 3.44k| top += top; 30| 3.44k| } 31| | 32| 4.59k| for (p = top; p > 0; p >>= 1) { ------------------ | Branch (32:19): [True: 4.01k, False: 574] ------------------ 33| 409k| for (i = 0; i < n - p; ++i) { ------------------ | Branch (33:21): [True: 405k, False: 4.01k] ------------------ 34| 405k| if (!(i & p)) { ------------------ | Branch (34:17): [True: 228k, False: 176k] ------------------ 35| 228k| int32_MINMAX(x[i], x[i + p]); ------------------ | | 11| 228k| do { \ | | 12| 228k| int32_t ab = (b) ^ (a); \ | | 13| 228k| int32_t c = (b) - (a); \ | | 14| 228k| c ^= ab & ((c) ^ (b)); \ | | 15| 228k| c >>= 31; \ | | 16| 228k| c &= ab; \ | | 17| 228k| (a) ^= c; \ | | 18| 228k| (b) ^= c; \ | | 19| 228k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 228k] | | ------------------ ------------------ 36| 228k| } 37| 405k| } 38| 4.01k| i = 0; 39| 16.0k| for (q = top; q > p; q >>= 1) { ------------------ | Branch (39:23): [True: 12.0k, False: 4.01k] ------------------ 40| 349k| for (; i < n - q; ++i) { ------------------ | Branch (40:20): [True: 337k, False: 12.0k] ------------------ 41| 337k| if (!(i & p)) { ------------------ | Branch (41:21): [True: 176k, False: 160k] ------------------ 42| 176k| int32_t a = x[i + p]; 43| 727k| for (r = q; r > p; r >>= 1) { ------------------ | Branch (43:33): [True: 551k, False: 176k] ------------------ 44| 551k| int32_MINMAX(a, x[i + r]); ------------------ | | 11| 551k| do { \ | | 12| 551k| int32_t ab = (b) ^ (a); \ | | 13| 551k| int32_t c = (b) - (a); \ | | 14| 551k| c ^= ab & ((c) ^ (b)); \ | | 15| 551k| c >>= 31; \ | | 16| 551k| c &= ab; \ | | 17| 551k| (a) ^= c; \ | | 18| 551k| (b) ^= c; \ | | 19| 551k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 551k] | | ------------------ ------------------ 45| 551k| } 46| 176k| x[i + p] = a; 47| 176k| } 48| 337k| } 49| 12.0k| } 50| 4.01k| } 51| 574|} PQCLEAN_MCELIECE6960119F_AVX2_crypto_kem_enc: 40| 99|) { 41| 99| unsigned char e[ SYS_N / 8 ]; 42| 99| unsigned char one_ec[ 1 + SYS_N / 8 + SYND_BYTES ] = {1}; 43| 99| unsigned char mask; 44| 99| int i, padding_ok; 45| | 46| | // 47| | 48| 99| padding_ok = check_pk_padding(pk); 49| | 50| 99| encrypt(c, pk, e); ------------------ | | 9| 99|#define encrypt CRYPTO_NAMESPACE(encrypt) | | ------------------ | | | | 4| 99|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119F_AVX2_ ## fun | | ------------------ ------------------ 51| | 52| 99| memcpy(one_ec + 1, e, SYS_N / 8); ------------------ | | 7| 99|#define SYS_N 6960 ------------------ 53| 99| memcpy(one_ec + 1 + SYS_N / 8, c, SYND_BYTES); ------------------ | | 7| 99|#define SYS_N 6960 ------------------ memcpy(one_ec + 1 + SYS_N / 8, c, SYND_BYTES); ------------------ | | 17| 99|#define SYND_BYTES ((PK_NROWS + 7)/8) | | ------------------ | | | | 13| 99|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 99|#define SYS_T 119 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 99|#define GFBITS 13 | | | | ------------------ | | ------------------ ------------------ 54| | 55| 99| crypto_hash_32b(key, one_ec, sizeof(one_ec)); ------------------ | | 7| 99| shake256(out, 32, in, inlen) | | ------------------ | | | | 12| 99|#define shake256 OQS_SHA3_shake256 | | ------------------ ------------------ 56| | 57| | // clear outputs (set to all 0's) if padding bits are not all zero 58| | 59| 99| mask = (unsigned char)padding_ok; 60| 99| mask ^= 0xFF; 61| | 62| 19.3k| for (i = 0; i < SYND_BYTES; i++) { ------------------ | | 17| 19.3k|#define SYND_BYTES ((PK_NROWS + 7)/8) | | ------------------ | | | | 13| 19.3k|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 19.3k|#define SYS_T 119 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 19.3k|#define GFBITS 13 | | | | ------------------ | | ------------------ ------------------ | Branch (62:17): [True: 19.2k, False: 99] ------------------ 63| 19.2k| c[i] &= mask; 64| 19.2k| } 65| | 66| 3.26k| for (i = 0; i < 32; i++) { ------------------ | Branch (66:17): [True: 3.16k, False: 99] ------------------ 67| 3.16k| key[i] &= mask; 68| 3.16k| } 69| | 70| 99| return padding_ok; 71| 99|} PQCLEAN_MCELIECE6960119F_AVX2_crypto_kem_dec: 90| 99|) { 91| 99| int i, padding_ok; 92| | 93| 99| unsigned char mask; 94| 99| unsigned char ret_decrypt = 0; 95| | 96| 99| uint16_t m; 97| | 98| 99| unsigned char e[ SYS_N / 8 ]; 99| 99| unsigned char preimage[ 1 + SYS_N / 8 + SYND_BYTES ]; 100| 99| unsigned char *x = preimage; 101| 99| const unsigned char *s = sk + 40 + IRR_BYTES + COND_BYTES; ------------------ | | 11| 99|#define IRR_BYTES (SYS_T * 2) | | ------------------ | | | | 8| 99|#define SYS_T 119 | | ------------------ ------------------ const unsigned char *s = sk + 40 + IRR_BYTES + COND_BYTES; ------------------ | | 10| 99|#define COND_BYTES ((1 << (GFBITS-4))*(2*GFBITS - 1)) | | ------------------ | | | | 6| 99|#define GFBITS 13 | | ------------------ | | #define COND_BYTES ((1 << (GFBITS-4))*(2*GFBITS - 1)) | | ------------------ | | | | 6| 99|#define GFBITS 13 | | ------------------ ------------------ 102| | 103| | // 104| | 105| 99| padding_ok = check_c_padding(c); 106| | 107| 99| ret_decrypt = (unsigned char)decrypt(e, sk + 40, c); ------------------ | | 9| 99|#define decrypt CRYPTO_NAMESPACE(decrypt) | | ------------------ | | | | 4| 99|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119F_AVX2_ ## fun | | ------------------ ------------------ 108| | 109| 99| m = ret_decrypt; 110| 99| m -= 1; 111| 99| m >>= 8; 112| | 113| 99| *x++ = m & 1; 114| 86.2k| for (i = 0; i < SYS_N / 8; i++) { ------------------ | | 7| 86.2k|#define SYS_N 6960 ------------------ | Branch (114:17): [True: 86.1k, False: 99] ------------------ 115| 86.1k| *x++ = (~m & s[i]) | (m & e[i]); 116| 86.1k| } 117| | 118| 19.3k| for (i = 0; i < SYND_BYTES; i++) { ------------------ | | 17| 19.3k|#define SYND_BYTES ((PK_NROWS + 7)/8) | | ------------------ | | | | 13| 19.3k|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 19.3k|#define SYS_T 119 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 19.3k|#define GFBITS 13 | | | | ------------------ | | ------------------ ------------------ | Branch (118:17): [True: 19.2k, False: 99] ------------------ 119| 19.2k| *x++ = c[i]; 120| 19.2k| } 121| | 122| 99| crypto_hash_32b(key, preimage, sizeof(preimage)); ------------------ | | 7| 99| shake256(out, 32, in, inlen) | | ------------------ | | | | 12| 99|#define shake256 OQS_SHA3_shake256 | | ------------------ ------------------ 123| | 124| | // clear outputs (set to all 1's) if padding bits are not all zero 125| | 126| 99| mask = (unsigned char)padding_ok; 127| | 128| 3.26k| for (i = 0; i < 32; i++) { ------------------ | Branch (128:17): [True: 3.16k, False: 99] ------------------ 129| 3.16k| key[i] |= mask; 130| 3.16k| } 131| | 132| 99| return padding_ok; 133| 99|} PQCLEAN_MCELIECE6960119F_AVX2_crypto_kem_keypair: 139| 99|) { 140| 99| int i; 141| 99| unsigned char seed[ 33 ] = {64}; 142| 99| unsigned char r[ SYS_N / 8 + (1 << GFBITS)*sizeof(uint32_t) + SYS_T * 2 + 32 ]; 143| 99| unsigned char *rp, *skp; 144| 99| uint64_t pivots; 145| | 146| 99| gf f[ SYS_T ]; // element in GF(2^mt) 147| 99| gf irr[ SYS_T ]; // Goppa polynomial 148| 99| uint32_t perm[ 1 << GFBITS ]; // random permutation as 32-bit integers 149| 99| int16_t pi[ 1 << GFBITS ]; // random permutation 150| | 151| 99| randombytes(seed + 1, 32); ------------------ | | 8| 99|#define randombytes OQS_randombytes ------------------ 152| | 153| 130| while (1) { ------------------ | Branch (153:12): [True: 130, Folded] ------------------ 154| 130| rp = &r[ sizeof(r) - 32 ]; 155| 130| skp = sk; 156| | 157| | // expanding and updating the seed 158| | 159| 130| shake(r, sizeof(r), seed, 33); ------------------ | | 10| 130| shake256(out, outlen, in, inlen) | | ------------------ | | | | 12| 130|#define shake256 OQS_SHA3_shake256 | | ------------------ ------------------ 160| 130| memcpy(skp, seed + 1, 32); 161| 130| skp += 32 + 8; 162| 130| memcpy(seed + 1, &r[ sizeof(r) - 32 ], 32); 163| | 164| | // generating irreducible polynomial 165| | 166| 130| rp -= sizeof(f); 167| | 168| 15.6k| for (i = 0; i < SYS_T; i++) { ------------------ | | 8| 15.6k|#define SYS_T 119 ------------------ | Branch (168:21): [True: 15.4k, False: 130] ------------------ 169| 15.4k| f[i] = load_gf(rp + i * 2); 170| 15.4k| } 171| | 172| 130| if (genpoly_gen(irr, f)) { ------------------ | | 9| 130|#define genpoly_gen CRYPTO_NAMESPACE(genpoly_gen) | | ------------------ | | | | 4| 130|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119F_AVX2_ ## fun | | ------------------ ------------------ | Branch (172:13): [True: 0, False: 130] ------------------ 173| 0| continue; 174| 0| } 175| | 176| 15.6k| for (i = 0; i < SYS_T; i++) { ------------------ | | 8| 15.6k|#define SYS_T 119 ------------------ | Branch (176:21): [True: 15.4k, False: 130] ------------------ 177| 15.4k| store_gf(skp + i * 2, irr[i]); 178| 15.4k| } 179| | 180| 130| skp += IRR_BYTES; ------------------ | | 11| 130|#define IRR_BYTES (SYS_T * 2) | | ------------------ | | | | 8| 130|#define SYS_T 119 | | ------------------ ------------------ 181| | 182| | // generating permutation 183| | 184| 130| rp -= sizeof(perm); 185| | 186| 1.06M| for (i = 0; i < (1 << GFBITS); i++) { ------------------ | | 6| 1.06M|#define GFBITS 13 ------------------ | Branch (186:21): [True: 1.06M, False: 130] ------------------ 187| 1.06M| perm[i] = load4(rp + i * 4); 188| 1.06M| } 189| | 190| 130| if (pk_gen(pk, skp - IRR_BYTES, perm, pi, &pivots)) { ------------------ | | 9| 130|#define pk_gen CRYPTO_NAMESPACE(pk_gen) | | ------------------ | | | | 4| 130|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119F_AVX2_ ## fun | | ------------------ ------------------ if (pk_gen(pk, skp - IRR_BYTES, perm, pi, &pivots)) { ------------------ | | 11| 130|#define IRR_BYTES (SYS_T * 2) | | ------------------ | | | | 8| 130|#define SYS_T 119 | | ------------------ ------------------ | Branch (190:13): [True: 31, False: 99] ------------------ 191| 31| continue; 192| 31| } 193| | 194| 99| controlbitsfrompermutation(skp, pi, GFBITS, 1 << GFBITS); ------------------ | | 10| 99|#define controlbitsfrompermutation CRYPTO_NAMESPACE(controlbitsfrompermutation) | | ------------------ | | | | 4| 99|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119F_AVX2_ ## fun | | ------------------ ------------------ controlbitsfrompermutation(skp, pi, GFBITS, 1 << GFBITS); ------------------ | | 6| 99|#define GFBITS 13 ------------------ controlbitsfrompermutation(skp, pi, GFBITS, 1 << GFBITS); ------------------ | | 6| 99|#define GFBITS 13 ------------------ 195| 99| skp += COND_BYTES; ------------------ | | 10| 99|#define COND_BYTES ((1 << (GFBITS-4))*(2*GFBITS - 1)) | | ------------------ | | | | 6| 99|#define GFBITS 13 | | ------------------ | | #define COND_BYTES ((1 << (GFBITS-4))*(2*GFBITS - 1)) | | ------------------ | | | | 6| 99|#define GFBITS 13 | | ------------------ ------------------ 196| | 197| | // storing the random string s 198| | 199| 99| rp -= SYS_N / 8; ------------------ | | 7| 99|#define SYS_N 6960 ------------------ 200| 99| memcpy(skp, rp, SYS_N / 8); ------------------ | | 7| 99|#define SYS_N 6960 ------------------ 201| | 202| | // storing positions of the 32 pivots 203| | 204| 99| store8(sk + 32, pivots); 205| | 206| 99| break; 207| 130| } 208| | 209| 99| return 0; 210| 99|} PQCLEAN_MCELIECE6960119F_AVX2_pk_gen: 316| 130|int pk_gen(unsigned char *pk, const unsigned char *irr, const uint32_t *perm, int16_t *pi, uint64_t *pivots) { 317| |// const int nBlocks_I = (PK_NROWS + 255) / 256; 318| 130| const int head = PK_NROWS % 64; ------------------ | | 13| 130|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 130|#define SYS_T 119 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 130|#define GFBITS 13 | | ------------------ ------------------ 319| 130| const int tail = PK_NCOLS % 64; ------------------ | | 14| 130|#define PK_NCOLS (SYS_N - PK_NROWS) | | ------------------ | | | | 7| 130|#define SYS_N 6960 | | ------------------ | | #define PK_NCOLS (SYS_N - PK_NROWS) | | ------------------ | | | | 13| 130|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 130|#define SYS_T 119 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 130|#define GFBITS 13 | | | | ------------------ | | ------------------ ------------------ 320| 130| const uint64_t one = 1; 321| | 322| 130| int i, j, k, b; 323| 130| int row, c; 324| | 325| 130| union { 326| 130| uint64_t w[ PK_NROWS ][ nBlocks_I * 4 ]; 327| 130| vec256 v[ PK_NROWS ][ nBlocks_I ]; 328| 130| } mat; 329| | 330| 130| union { 331| 130| uint64_t w[ PK_NROWS ][ 44 ]; 332| 130| vec256 v[ PK_NROWS ][ 11 ]; 333| 130| } par; 334| | 335| 130| uint16_t m; 336| 130| vec256 mm; 337| | 338| 130| vec128 sk_int[ GFBITS ]; 339| | 340| 130| vec256 consts[ 32 ][ GFBITS ]; 341| 130| vec256 eval[ 32 ][ GFBITS ]; 342| 130| vec256 prod[ 32 ][ GFBITS ]; 343| 130| vec256 tmp[ GFBITS ]; 344| | 345| 130| uint64_t list[1 << GFBITS]; 346| 130| uint64_t buf[ PK_NROWS ]; 347| 130| uint64_t t; 348| | 349| 130| uint16_t ind[ PK_NROWS ]; 350| 130| uint16_t ind_inv[ PK_NROWS ]; 351| | 352| | // compute the inverses 353| | 354| 130| irr_load(sk_int, irr); 355| | 356| 130| fft(eval, sk_int); ------------------ | | 10| 130|#define fft CRYPTO_NAMESPACE(fft) | | ------------------ | | | | 4| 130|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119F_AVX2_ ## fun | | ------------------ ------------------ 357| | 358| 130| vec256_copy(prod[0], eval[0]); 359| | 360| 4.16k| for (i = 1; i < 32; i++) { ------------------ | Branch (360:17): [True: 4.03k, False: 130] ------------------ 361| 4.03k| vec256_mul(prod[i], prod[i - 1], eval[i]); 362| 4.03k| } 363| | 364| 130| vec256_inv(tmp, prod[31]); ------------------ | | 11| 130|#define vec256_inv CRYPTO_NAMESPACE(vec256_inv) | | ------------------ | | | | 4| 130|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119F_AVX2_ ## fun | | ------------------ ------------------ 365| | 366| 4.16k| for (i = 30; i >= 0; i--) { ------------------ | Branch (366:18): [True: 4.03k, False: 130] ------------------ 367| 4.03k| vec256_mul(prod[i + 1], prod[i], tmp); 368| 4.03k| vec256_mul(tmp, tmp, eval[i + 1]); 369| 4.03k| } 370| | 371| 130| vec256_copy(prod[0], tmp); 372| | 373| | // fill matrix 374| | 375| 130| de_bitslicing(list, prod); 376| | 377| 1.06M| for (i = 0; i < (1 << GFBITS); i++) { ------------------ | | 6| 1.06M|#define GFBITS 13 ------------------ | Branch (377:17): [True: 1.06M, False: 130] ------------------ 378| 1.06M| list[i] <<= GFBITS; ------------------ | | 6| 1.06M|#define GFBITS 13 ------------------ 379| 1.06M| list[i] |= i; 380| 1.06M| list[i] |= ((uint64_t) perm[i]) << 31; 381| 1.06M| } 382| | 383| 130| uint64_sort(list, 1 << GFBITS); ------------------ | | 6| 130|#define GFBITS 13 ------------------ 384| | 385| 933k| for (i = 1; i < (1 << GFBITS); i++) { ------------------ | | 6| 933k|#define GFBITS 13 ------------------ | Branch (385:17): [True: 933k, False: 99] ------------------ 386| 933k| if (uint64_is_equal_declassify(list[i - 1] >> 31, list[i] >> 31)) { ------------------ | Branch (386:13): [True: 31, False: 933k] ------------------ 387| 31| return -1; 388| 31| } 389| 933k| } 390| | 391| 99| to_bitslicing_2x(consts, prod, list); 392| | 393| 811k| for (i = 0; i < (1 << GFBITS); i++) { ------------------ | | 6| 811k|#define GFBITS 13 ------------------ | Branch (393:17): [True: 811k, False: 99] ------------------ 394| 811k| pi[i] = list[i] & GFMASK; ------------------ | | 19| 811k|#define GFMASK ((1 << GFBITS) - 1) | | ------------------ | | | | 6| 811k|#define GFBITS 13 | | ------------------ ------------------ 395| 811k| } 396| | 397| 792| for (j = 0; j < nBlocks_I; j++) { ------------------ | | 32| 792|#define nBlocks_I ((PK_NROWS + 255) / 256) | | ------------------ | | | | 13| 792|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 792|#define SYS_T 119 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 792|#define GFBITS 13 | | | | ------------------ | | ------------------ ------------------ | Branch (397:17): [True: 693, False: 99] ------------------ 398| 9.70k| for (k = 0; k < GFBITS; k++) { ------------------ | | 6| 9.70k|#define GFBITS 13 ------------------ | Branch (398:21): [True: 9.00k, False: 693] ------------------ 399| 9.00k| mat.v[ k ][ j ] = prod[ j ][ k ]; 400| 9.00k| } 401| 693| } 402| | 403| 11.7k| for (i = 1; i < SYS_T; i++) { ------------------ | | 8| 11.7k|#define SYS_T 119 ------------------ | Branch (403:17): [True: 11.6k, False: 99] ------------------ 404| 93.4k| for (j = 0; j < nBlocks_I; j++) { ------------------ | | 32| 93.4k|#define nBlocks_I ((PK_NROWS + 255) / 256) | | ------------------ | | | | 13| 93.4k|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 93.4k|#define SYS_T 119 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 93.4k|#define GFBITS 13 | | | | ------------------ | | ------------------ ------------------ | Branch (404:21): [True: 81.7k, False: 11.6k] ------------------ 405| 81.7k| vec256_mul(prod[j], prod[j], consts[j]); 406| | 407| 1.14M| for (k = 0; k < GFBITS; k++) { ------------------ | | 6| 1.14M|#define GFBITS 13 ------------------ | Branch (407:25): [True: 1.06M, False: 81.7k] ------------------ 408| 1.06M| mat.v[ i * GFBITS + k ][ j ] = prod[ j ][ k ]; ------------------ | | 6| 1.06M|#define GFBITS 13 ------------------ 409| 1.06M| } 410| 81.7k| } 411| 11.6k| } 412| | 413| | // gaussian elimination to obtain L, U, and P such that LP M = U 414| | // L and U are stored in the space of M 415| | // P is stored in ind 416| | 417| 153k| for (i = 0; i < PK_NROWS; i++) { ------------------ | | 13| 153k|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 153k|#define SYS_T 119 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 153k|#define GFBITS 13 | | ------------------ ------------------ | Branch (417:17): [True: 153k, False: 99] ------------------ 418| 153k| ind_inv[i] = ind[ i ] = i; 419| 153k| } 420| | 421| 153k| for (row = 0; row < PK_NROWS; row++) { ------------------ | | 13| 153k|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 153k|#define SYS_T 119 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 153k|#define GFBITS 13 | | ------------------ ------------------ | Branch (421:19): [True: 153k, False: 99] ------------------ 422| 153k| i = row >> 6; 423| 153k| j = row & 63; 424| | 425| 153k| if (row == PK_NROWS - 32) { ------------------ | | 13| 153k|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 153k|#define SYS_T 119 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 153k|#define GFBITS 13 | | ------------------ ------------------ | Branch (425:13): [True: 99, False: 153k] ------------------ 426| 99| if (mov_columns(mat.w, pi, pivots)) { ------------------ | Branch (426:17): [True: 0, False: 99] ------------------ 427| 0| return -1; 428| 0| } 429| 99| } 430| | 431| 118M| for (k = row + 1; k < PK_NROWS; k++) { ------------------ | | 13| 118M|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 118M|#define SYS_T 119 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 118M|#define GFBITS 13 | | ------------------ ------------------ | Branch (431:27): [True: 118M, False: 153k] ------------------ 432| 118M| extract_01_masks(&m, mat.w[ row ], mat.w[ k ], row); 433| 118M| uint16_cswap(&ind[row], &ind[k], m); 434| | 435| 118M| mm = vec256_set1_16b(m); 436| 947M| for (c = 0; c < nBlocks_I; c++) { ------------------ | | 32| 947M|#define nBlocks_I ((PK_NROWS + 255) / 256) | | ------------------ | | | | 13| 947M|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 947M|#define SYS_T 119 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 947M|#define GFBITS 13 | | | | ------------------ | | ------------------ ------------------ | Branch (436:25): [True: 828M, False: 118M] ------------------ 437| 828M| vec256_cswap(&mat.v[ row ][ c ], &mat.v[ k ][ c ], mm); 438| 828M| } 439| 118M| } 440| | 441| 153k| if ( uint64_is_zero_declassify((mat.w[ row ][ i ] >> j) & 1) ) { // return if not systematic ------------------ | Branch (441:14): [True: 0, False: 153k] ------------------ 442| 0| return -1; 443| 0| } 444| | 445| 118M| for (k = row + 1; k < PK_NROWS; k++) { ------------------ | | 13| 118M|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 118M|#define SYS_T 119 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 118M|#define GFBITS 13 | | ------------------ ------------------ | Branch (445:27): [True: 118M, False: 153k] ------------------ 446| 118M| t = mat.w[ k ][ i ] & (one << j); 447| 118M| mm = extract_mask256(mat.w[k], row); 448| | 449| 947M| for (c = 0; c < nBlocks_I; c++) { ------------------ | | 32| 947M|#define nBlocks_I ((PK_NROWS + 255) / 256) | | ------------------ | | | | 13| 947M|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 947M|#define SYS_T 119 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 947M|#define GFBITS 13 | | | | ------------------ | | ------------------ ------------------ | Branch (449:25): [True: 828M, False: 118M] ------------------ 450| 828M| mat.v[ k ][ c ] ^= mat.v[ row ][ c ] & mm; 451| 828M| } 452| | 453| 118M| mat.w[ k ][ i ] |= t; 454| 118M| } 455| 153k| } 456| | 457| | // apply M^-1 to the remaining columns 458| | 459| 99| composeinv(PK_NROWS, ind_inv, ind_inv, ind); ------------------ | | 13| 99|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 99|#define SYS_T 119 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 99|#define GFBITS 13 | | ------------------ ------------------ 460| | 461| 297| for (j = 6; j < 28; j += 11) { ------------------ | Branch (461:17): [True: 198, False: 99] ------------------ 462| 2.77k| for (k = 0; k < GFBITS; k++) { ------------------ | | 6| 2.77k|#define GFBITS 13 ------------------ | Branch (462:21): [True: 2.57k, False: 198] ------------------ 463| 30.8k| for (b = 0; b < 11; b++) { ------------------ | Branch (463:25): [True: 28.3k, False: 2.57k] ------------------ 464| 28.3k| par.v[ k ][ b ] = prod[ j + b ][ k ]; 465| 28.3k| } 466| 2.57k| } 467| | 468| 23.5k| for (i = 1; i < SYS_T; i++) { ------------------ | | 8| 23.5k|#define SYS_T 119 ------------------ | Branch (468:21): [True: 23.3k, False: 198] ------------------ 469| 280k| for (b = 0; b < 11; b++) { ------------------ | Branch (469:25): [True: 257k, False: 23.3k] ------------------ 470| 257k| vec256_mul(prod[j + b], prod[j + b], consts[j + b]); 471| 257k| } 472| | 473| 327k| for (k = 0; k < GFBITS; k++) { ------------------ | | 6| 327k|#define GFBITS 13 ------------------ | Branch (473:25): [True: 303k, False: 23.3k] ------------------ 474| 3.64M| for (b = 0; b < 11; b++) { ------------------ | Branch (474:29): [True: 3.34M, False: 303k] ------------------ 475| 3.34M| par.v[ i * GFBITS + k ][ b ] = prod[ j + b ][ k ]; ------------------ | | 6| 3.34M|#define GFBITS 13 ------------------ 476| 3.34M| } 477| 303k| } 478| 23.3k| } 479| | 480| | // apply P 481| | 482| 306k| for (i = 0; i < PK_NROWS; i++) { ------------------ | | 13| 306k|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 306k|#define SYS_T 119 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 306k|#define GFBITS 13 | | ------------------ ------------------ | Branch (482:21): [True: 306k, False: 198] ------------------ 483| 306k| ind[i] = ind_inv[i]; 484| 306k| } 485| | 486| 198| sort_rows((1 << GFBITS) / 4, PK_NROWS, ind, par.v, 0); ------------------ | | 6| 198|#define GFBITS 13 ------------------ sort_rows((1 << GFBITS) / 4, PK_NROWS, ind, par.v, 0); ------------------ | | 13| 198|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 198|#define SYS_T 119 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 198|#define GFBITS 13 | | ------------------ ------------------ 487| | 488| | // apply L 489| | 490| 306k| for (row = PK_NROWS - 1; row >= 0; row--) { ------------------ | | 13| 198|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 198|#define SYS_T 119 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 198|#define GFBITS 13 | | ------------------ ------------------ | Branch (490:34): [True: 306k, False: 198] ------------------ 491| 237M| for (i = row - 1; i >= 0; i--) { ------------------ | Branch (491:31): [True: 236M, False: 306k] ------------------ 492| 236M| mm = extract_mask256(mat.w[row], i); 493| | 494| 2.84G| for (k = 0; k < 11; k++) { ------------------ | Branch (494:29): [True: 2.60G, False: 236M] ------------------ 495| 2.60G| par.v[ row ][ k ] ^= par.v[ i ][ k ] & mm; 496| 2.60G| } 497| 236M| } 498| 306k| } 499| | 500| | // apply U^-1 501| | 502| 198| if (j == 6) { ------------------ | Branch (502:13): [True: 99, False: 99] ------------------ 503| 153k| for (i = 0; i < PK_NROWS; i++) { ------------------ | | 13| 153k|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 153k|#define SYS_T 119 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 153k|#define GFBITS 13 | | ------------------ ------------------ | Branch (503:25): [True: 153k, False: 99] ------------------ 504| 153k| par.v[i][0] = mat.v[ i ][ nBlocks_I - 1 ]; ------------------ | | 32| 153k|#define nBlocks_I ((PK_NROWS + 255) / 256) | | ------------------ | | | | 13| 153k|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 153k|#define SYS_T 119 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 153k|#define GFBITS 13 | | | | ------------------ | | ------------------ ------------------ 505| 153k| } 506| 99| } 507| | 508| 306k| for (row = PK_NROWS - 1; row >= 0; row--) { ------------------ | | 13| 198|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 198|#define SYS_T 119 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 198|#define GFBITS 13 | | ------------------ ------------------ | Branch (508:34): [True: 306k, False: 198] ------------------ 509| 237M| for (i = PK_NROWS - 1; i > row; i--) { ------------------ | | 13| 306k|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 306k|#define SYS_T 119 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 306k|#define GFBITS 13 | | ------------------ ------------------ | Branch (509:36): [True: 236M, False: 306k] ------------------ 510| 236M| mm = extract_mask256(mat.w[row], i); 511| | 512| 2.84G| for (k = 0; k < 11; k++) { ------------------ | Branch (512:29): [True: 2.60G, False: 236M] ------------------ 513| 2.60G| par.v[ row ][ k ] ^= par.v[ i ][ k ] & mm; 514| 2.60G| } 515| 236M| } 516| 306k| } 517| | 518| 198| if (j == 6) { ------------------ | Branch (518:13): [True: 99, False: 99] ------------------ 519| 153k| for (row = 0; row < PK_NROWS; row++) { ------------------ | | 13| 153k|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 153k|#define SYS_T 119 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 153k|#define GFBITS 13 | | ------------------ ------------------ | Branch (519:27): [True: 153k, False: 99] ------------------ 520| 6.73M| for (i = 0; i < 43; i++) { ------------------ | Branch (520:29): [True: 6.58M, False: 153k] ------------------ 521| 6.58M| store8(pk + PK_ROW_BYTES * row + i * 8, (par.w[row][i] >> head) | (par.w[row][i + 1] << (64 - head))); ------------------ | | 15| 6.58M|#define PK_ROW_BYTES ((PK_NCOLS + 7)/8) | | ------------------ | | | | 14| 6.58M|#define PK_NCOLS (SYS_N - PK_NROWS) | | | | ------------------ | | | | | | 7| 6.58M|#define SYS_N 6960 | | | | ------------------ | | | | #define PK_NCOLS (SYS_N - PK_NROWS) | | | | ------------------ | | | | | | 13| 6.58M|#define PK_NROWS (SYS_T*GFBITS) | | | | | | ------------------ | | | | | | | | 8| 6.58M|#define SYS_T 119 | | | | | | ------------------ | | | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | | | ------------------ | | | | | | | | 6| 6.58M|#define GFBITS 13 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 522| 6.58M| } 523| | 524| 153k| buf[row] = par.w[row][i] >> head; 525| 153k| } 526| 99| } else { 527| 153k| for (row = 0; row < PK_NROWS; row++) { ------------------ | | 13| 153k|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 153k|#define SYS_T 119 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 153k|#define GFBITS 13 | | ------------------ ------------------ | Branch (527:27): [True: 153k, False: 99] ------------------ 528| 153k| store8(pk + PK_ROW_BYTES * row + 43 * 8, buf[row] | (par.w[row][0] << (64 - head))); ------------------ | | 15| 153k|#define PK_ROW_BYTES ((PK_NCOLS + 7)/8) | | ------------------ | | | | 14| 153k|#define PK_NCOLS (SYS_N - PK_NROWS) | | | | ------------------ | | | | | | 7| 153k|#define SYS_N 6960 | | | | ------------------ | | | | #define PK_NCOLS (SYS_N - PK_NROWS) | | | | ------------------ | | | | | | 13| 153k|#define PK_NROWS (SYS_T*GFBITS) | | | | | | ------------------ | | | | | | | | 8| 153k|#define SYS_T 119 | | | | | | ------------------ | | | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | | | ------------------ | | | | | | | | 6| 153k|#define GFBITS 13 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 529| | 530| 6.27M| for (i = 0; i < 40; i++) { ------------------ | Branch (530:29): [True: 6.12M, False: 153k] ------------------ 531| 6.12M| store8(pk + PK_ROW_BYTES * row + (i + 44) * 8, (par.w[row][i] >> head) | (par.w[row][i + 1] << (64 - head))); ------------------ | | 15| 6.12M|#define PK_ROW_BYTES ((PK_NCOLS + 7)/8) | | ------------------ | | | | 14| 6.12M|#define PK_NCOLS (SYS_N - PK_NROWS) | | | | ------------------ | | | | | | 7| 6.12M|#define SYS_N 6960 | | | | ------------------ | | | | #define PK_NCOLS (SYS_N - PK_NROWS) | | | | ------------------ | | | | | | 13| 6.12M|#define PK_NROWS (SYS_T*GFBITS) | | | | | | ------------------ | | | | | | | | 8| 6.12M|#define SYS_T 119 | | | | | | ------------------ | | | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | | | ------------------ | | | | | | | | 6| 6.12M|#define GFBITS 13 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 532| 6.12M| } 533| | 534| 153k| par.w[row][i] >>= head; 535| 153k| par.w[row][i] &= (one << tail) - 1; 536| | 537| 153k| store_i(pk + PK_ROW_BYTES * row + (i + 44) * 8, par.w[row][i], (tail + 7) / 8); ------------------ | | 15| 153k|#define PK_ROW_BYTES ((PK_NCOLS + 7)/8) | | ------------------ | | | | 14| 153k|#define PK_NCOLS (SYS_N - PK_NROWS) | | | | ------------------ | | | | | | 7| 153k|#define SYS_N 6960 | | | | ------------------ | | | | #define PK_NCOLS (SYS_N - PK_NROWS) | | | | ------------------ | | | | | | 13| 153k|#define PK_NROWS (SYS_T*GFBITS) | | | | | | ------------------ | | | | | | | | 8| 153k|#define SYS_T 119 | | | | | | ------------------ | | | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | | | ------------------ | | | | | | | | 6| 153k|#define GFBITS 13 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 538| 153k| } 539| 99| } 540| | 541| 198| } 542| | 543| | // 544| | 545| 99| return 0; 546| 99|} PQCLEAN_MCELIECE6960119F_AVX2_genpoly_gen: 88| 130|int genpoly_gen(gf *out, gf *f) { 89| 130| int i, j, k; 90| | 91| 130| gf t, inv; 92| | 93| 130| uint64_t m; 94| 130| vec128 mask; 95| | 96| 130| union { 97| 130| uint64_t d[ GFBITS ][ 128 ][2]; 98| 130| vec128 v[ GFBITS ][ 128 ]; 99| 130| } buf; 100| | 101| 130| union { 102| 130| uint64_t d[GFBITS][2]; 103| 130| vec128 v[GFBITS]; 104| 130| } v; 105| | 106| 130| union { 107| 130| uint64_t d[SYS_T][GFBITS][2]; 108| 130| vec128 v[SYS_T][GFBITS]; 109| 130| } mat; 110| | 111| | // fill matrix 112| | 113| 130| buf.v[0][0] = vec128_set2x(1, 0); 114| 1.69k| for (i = 1; i < GFBITS; i++) { ------------------ | | 6| 1.69k|#define GFBITS 13 ------------------ | Branch (114:17): [True: 1.56k, False: 130] ------------------ 115| 1.56k| buf.v[i][0] = vec128_setzero(); 116| 1.56k| } 117| | 118| 1.82k| for (j = 0; j < GFBITS; j++) { ------------------ | | 6| 1.82k|#define GFBITS 13 ------------------ | Branch (118:17): [True: 1.69k, False: 130] ------------------ 119| 1.69k| v.v[j] = vec128_setzero(); 120| | 121| 202k| for (i = SYS_T - 1; i >= 0; i--) { ------------------ | | 8| 1.69k|#define SYS_T 119 ------------------ | Branch (121:29): [True: 201k, False: 1.69k] ------------------ 122| 201k| v.d[j][1] <<= 1; 123| 201k| v.d[j][1] |= v.d[j][0] >> 63; 124| 201k| v.d[j][0] <<= 1; 125| 201k| v.d[j][0] |= (f[i] >> j) & 1; 126| 201k| } 127| 1.69k| } 128| | 129| 1.82k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 1.82k|#define GFBITS 13 ------------------ | Branch (129:17): [True: 1.69k, False: 130] ------------------ 130| 1.69k| buf.v[i][1] = v.v[i]; 131| 1.69k| } 132| | 133| 15.4k| for (k = 2; k <= SYS_T; k++) { ------------------ | | 8| 15.4k|#define SYS_T 119 ------------------ | Branch (133:17): [True: 15.3k, False: 130] ------------------ 134| 15.3k| vec128_mul_GF(v.v, v.v, f); ------------------ | | 11| 15.3k|#define vec128_mul_GF CRYPTO_NAMESPACE(vec128_mul_GF) | | ------------------ | | | | 4| 15.3k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119F_AVX2_ ## fun | | ------------------ ------------------ 135| | 136| 15.3k| if (k < SYS_T) { ------------------ | | 8| 15.3k|#define SYS_T 119 ------------------ | Branch (136:13): [True: 15.2k, False: 130] ------------------ 137| 212k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 212k|#define GFBITS 13 ------------------ | Branch (137:25): [True: 197k, False: 15.2k] ------------------ 138| 197k| buf.v[i][k] = v.v[i]; 139| 197k| } 140| 15.2k| } else { 141| 15.6k| for (i = 0; i < SYS_T; i++) { ------------------ | | 8| 15.6k|#define SYS_T 119 ------------------ | Branch (141:25): [True: 15.4k, False: 130] ------------------ 142| 15.4k| out[i] = extract_gf(v.d, i); 143| 15.4k| } 144| 130| } 145| 15.3k| } 146| | 147| 1.82k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 1.82k|#define GFBITS 13 ------------------ | Branch (147:17): [True: 1.69k, False: 130] ------------------ 148| 1.69k| transpose_128x128(buf.d[i]); 149| 1.69k| } 150| | 151| 15.6k| for (j = 0; j < SYS_T; j++) { ------------------ | | 8| 15.6k|#define SYS_T 119 ------------------ | Branch (151:17): [True: 15.4k, False: 130] ------------------ 152| 216k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 216k|#define GFBITS 13 ------------------ | Branch (152:21): [True: 201k, False: 15.4k] ------------------ 153| 201k| mat.v[j][i] = buf.v[i][j]; 154| 201k| } 155| 15.4k| } 156| | 157| | // gaussian 158| | 159| 15.6k| for (i = 0; i < SYS_T; i++) { ------------------ | | 8| 15.6k|#define SYS_T 119 ------------------ | Branch (159:17): [True: 15.4k, False: 130] ------------------ 160| 928k| for (j = i + 1; j < SYS_T; j++) { ------------------ | | 8| 928k|#define SYS_T 119 ------------------ | Branch (160:25): [True: 912k, False: 15.4k] ------------------ 161| 912k| m = extract_bit(mat.d[i], i); 162| 912k| m -= 1; 163| 912k| mask = vec128_set2x(m, m); 164| | 165| 12.7M| for (k = 0; k < GFBITS; k++) { ------------------ | | 6| 12.7M|#define GFBITS 13 ------------------ | Branch (165:25): [True: 11.8M, False: 912k] ------------------ 166| 11.8M| mat.v[i][k] ^= mat.v[j][k] & mask; 167| 11.8M| } 168| | 169| 912k| out[i] ^= out[j] & m; 170| 912k| } 171| | 172| | // 173| | 174| 15.4k| t = extract_gf(mat.d[i], i); 175| | 176| 15.4k| if (gf_is_zero_declassify(t)) { ------------------ | Branch (176:13): [True: 0, False: 15.4k] ------------------ 177| 0| return -1; // return if not systematic 178| 0| } 179| | 180| | // 181| | 182| 15.4k| inv = gf_inv(t); ------------------ | | 11| 15.4k|#define gf_inv CRYPTO_NAMESPACE(gf_inv) | | ------------------ | | | | 4| 15.4k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119F_AVX2_ ## fun | | ------------------ ------------------ 183| 15.4k| vec128_mul_gf(mat.v[i], mat.v[i], inv); 184| | 185| 15.4k| out[i] = gf_mul(out[i], inv); ------------------ | | 14| 15.4k|#define gf_mul CRYPTO_NAMESPACE(gf_mul) | | ------------------ | | | | 4| 15.4k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119F_AVX2_ ## fun | | ------------------ ------------------ 186| | 187| 1.85M| for (j = 0; j < SYS_T; j++) { ------------------ | | 8| 1.85M|#define SYS_T 119 ------------------ | Branch (187:21): [True: 1.84M, False: 15.4k] ------------------ 188| 1.84M| if (j != i) { ------------------ | Branch (188:17): [True: 1.82M, False: 15.4k] ------------------ 189| 1.82M| t = extract_gf(mat.d[j], i); 190| | 191| 1.82M| vec128_mul_gf(v.v, mat.v[i], t); 192| 1.82M| vec128_add(mat.v[j], mat.v[j], v.v); 193| | 194| 1.82M| out[j] ^= gf_mul(out[i], t); ------------------ | | 14| 1.82M|#define gf_mul CRYPTO_NAMESPACE(gf_mul) | | ------------------ | | | | 4| 1.82M|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119F_AVX2_ ## fun | | ------------------ ------------------ 195| 1.82M| } 196| 1.84M| } 197| 15.4k| } 198| | 199| 130| return 0; 200| 130|} PQCLEAN_MCELIECE6960119F_AVX2_vec128_mul_GF: 6| 15.3k|void vec128_mul_GF(vec128 out[ GFBITS ], vec128 v[ GFBITS ], gf a[ SYS_T ]) { 7| 15.3k| int i, j; 8| 15.3k| uint64_t buf[GFBITS][4]; 9| 15.3k| vec128 prod[GFBITS]; 10| 15.3k| uint64_t p[GFBITS]; 11| | 12| 15.3k| const uint64_t allone = -1; 13| | 14| | // polynomial multiplication 15| | 16| 214k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 214k|#define GFBITS 13 ------------------ | Branch (16:17): [True: 199k, False: 15.3k] ------------------ 17| 199k| buf[i][0] = 0; 18| 199k| buf[i][1] = 0; 19| 199k| buf[i][2] = 0; 20| 199k| buf[i][3] = 0; 21| 199k| } 22| | 23| 1.84M| for (i = SYS_T - 1; i >= 0; i--) { ------------------ | | 8| 15.3k|#define SYS_T 119 ------------------ | Branch (23:25): [True: 1.82M, False: 15.3k] ------------------ 24| 25.5M| for (j = 0; j < GFBITS; j++) { ------------------ | | 6| 25.5M|#define GFBITS 13 ------------------ | Branch (24:21): [True: 23.7M, False: 1.82M] ------------------ 25| 23.7M| buf[j][3] <<= 1; 26| 23.7M| buf[j][3] |= buf[j][2] >> 63; 27| 23.7M| buf[j][2] <<= 1; 28| 23.7M| buf[j][2] |= buf[j][1] >> 63; 29| 23.7M| buf[j][1] <<= 1; 30| 23.7M| buf[j][1] |= buf[j][0] >> 63; 31| 23.7M| buf[j][0] <<= 1; 32| 23.7M| } 33| | 34| 1.82M| vec128_mul_gf(prod, v, a[i]); 35| | 36| 25.5M| for (j = 0; j < GFBITS; j++) { ------------------ | | 6| 25.5M|#define GFBITS 13 ------------------ | Branch (36:21): [True: 23.7M, False: 1.82M] ------------------ 37| 23.7M| buf[j][0] ^= vec128_extract(prod[j], 0); ------------------ | | 29| 23.7M|#define vec128_extract(a, i) ((uint64_t) _mm_extract_epi64((vec128) (a), (i))) ------------------ 38| 23.7M| buf[j][1] ^= vec128_extract(prod[j], 1); ------------------ | | 29| 23.7M|#define vec128_extract(a, i) ((uint64_t) _mm_extract_epi64((vec128) (a), (i))) ------------------ 39| 23.7M| } 40| 1.82M| } 41| | 42| | // reduction modulo y^119 + y^8 + 1 43| | 44| 214k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 214k|#define GFBITS 13 ------------------ | Branch (44:17): [True: 199k, False: 15.3k] ------------------ 45| 199k| p[i] = buf[i][3]; 46| | 47| 199k| buf[i][2] ^= p[i] >> (SYS_T - 8 - 64); ------------------ | | 8| 199k|#define SYS_T 119 ------------------ 48| 199k| buf[i][1] ^= p[i] << (64 - (SYS_T - 8 - 64)); ------------------ | | 8| 199k|#define SYS_T 119 ------------------ 49| 199k| buf[i][2] ^= p[i] >> (SYS_T - 64); ------------------ | | 8| 199k|#define SYS_T 119 ------------------ 50| 199k| buf[i][1] ^= p[i] << (64 - (SYS_T - 64)); ------------------ | | 8| 199k|#define SYS_T 119 ------------------ 51| 199k| } 52| | 53| | // 54| | 55| 214k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 214k|#define GFBITS 13 ------------------ | Branch (55:17): [True: 199k, False: 15.3k] ------------------ 56| 199k| p[i] = buf[i][2]; 57| | 58| 199k| buf[i][1] ^= p[i] >> (SYS_T - 8 - 64); ------------------ | | 8| 199k|#define SYS_T 119 ------------------ 59| 199k| buf[i][0] ^= p[i] << (64 - (SYS_T - 8 - 64)); ------------------ | | 8| 199k|#define SYS_T 119 ------------------ 60| 199k| buf[i][1] ^= p[i] >> (SYS_T - 64); ------------------ | | 8| 199k|#define SYS_T 119 ------------------ 61| 199k| buf[i][0] ^= p[i] << (64 - (SYS_T - 64)); ------------------ | | 8| 199k|#define SYS_T 119 ------------------ 62| 199k| } 63| | 64| | // 65| | 66| 214k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 214k|#define GFBITS 13 ------------------ | Branch (66:17): [True: 199k, False: 15.3k] ------------------ 67| 199k| p[i] = buf[i][1] & (allone << (SYS_T - 64)); ------------------ | | 8| 199k|#define SYS_T 119 ------------------ 68| | 69| 199k| buf[i][0] ^= p[i] >> (SYS_T - 8 - 64); ------------------ | | 8| 199k|#define SYS_T 119 ------------------ 70| 199k| buf[i][0] ^= p[i] >> (SYS_T - 64); ------------------ | | 8| 199k|#define SYS_T 119 ------------------ 71| 199k| } 72| | 73| | // 74| | 75| 214k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 214k|#define GFBITS 13 ------------------ | Branch (75:17): [True: 199k, False: 15.3k] ------------------ 76| 199k| out[i] = vec128_set2x(buf[i][0], buf[i][1] & (allone >> (128 - SYS_T))); ------------------ | | 8| 199k|#define SYS_T 119 ------------------ 77| 199k| } 78| 15.3k|} PQCLEAN_MCELIECE6960119F_AVX2_vec256_sq: 9| 5.91k|void vec256_sq(vec256 *out, vec256 *in) { 10| 5.91k| int i; 11| 5.91k| vec256 result[GFBITS], t; 12| | 13| 5.91k| t = vec256_xor(in[11], in[12]); 14| | 15| 5.91k| result[0] = vec256_xor(in[0], in[11]); 16| 5.91k| result[1] = vec256_xor(in[7], t); 17| 5.91k| result[2] = vec256_xor(in[1], in[7]); 18| 5.91k| result[3] = vec256_xor(in[8], t); 19| 5.91k| result[4] = vec256_xor(in[2], in[7]); 20| 5.91k| result[4] = vec256_xor(result[4], in[8]); 21| 5.91k| result[4] = vec256_xor(result[4], t); 22| 5.91k| result[5] = vec256_xor(in[7], in[9]); 23| 5.91k| result[6] = vec256_xor(in[3], in[8]); 24| 5.91k| result[6] = vec256_xor(result[6], in[9]); 25| 5.91k| result[6] = vec256_xor(result[6], in[12]); 26| 5.91k| result[7] = vec256_xor(in[8], in[10]); 27| 5.91k| result[8] = vec256_xor(in[4], in[9]); 28| 5.91k| result[8] = vec256_xor(result[8], in[10]); 29| 5.91k| result[9] = vec256_xor(in[9], in[11]); 30| 5.91k| result[10] = vec256_xor(in[5], in[10]); 31| 5.91k| result[10] = vec256_xor(result[10], in[11]); 32| 5.91k| result[11] = vec256_xor(in[10], in[12]); 33| 5.91k| result[12] = vec256_xor(in[6], t); 34| | 35| 82.8k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 82.8k|#define GFBITS 13 ------------------ | Branch (35:17): [True: 76.9k, False: 5.91k] ------------------ 36| 76.9k| out[i] = result[i]; 37| 76.9k| } 38| 5.91k|} PQCLEAN_MCELIECE6960119F_AVX2_vec256_inv: 41| 229|void vec256_inv(vec256 *out, vec256 *in) { 42| 229| vec256 tmp_11[ GFBITS ]; 43| 229| vec256 tmp_1111[ GFBITS ]; 44| | 45| 229| vec256_copy(out, in); 46| | 47| 229| vec256_sq(out, out); ------------------ | | 14| 229|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 229|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119F_AVX2_ ## fun | | ------------------ ------------------ 48| 229| vec256_mul(tmp_11, out, in); // ^11 49| | 50| 229| vec256_sq(out, tmp_11); ------------------ | | 14| 229|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 229|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119F_AVX2_ ## fun | | ------------------ ------------------ 51| 229| vec256_sq(out, out); ------------------ | | 14| 229|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 229|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119F_AVX2_ ## fun | | ------------------ ------------------ 52| 229| vec256_mul(tmp_1111, out, tmp_11); // ^1111 53| | 54| 229| vec256_sq(out, tmp_1111); ------------------ | | 14| 229|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 229|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119F_AVX2_ ## fun | | ------------------ ------------------ 55| 229| vec256_sq(out, out); ------------------ | | 14| 229|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 229|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119F_AVX2_ ## fun | | ------------------ ------------------ 56| 229| vec256_sq(out, out); ------------------ | | 14| 229|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 229|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119F_AVX2_ ## fun | | ------------------ ------------------ 57| 229| vec256_sq(out, out); ------------------ | | 14| 229|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 229|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119F_AVX2_ ## fun | | ------------------ ------------------ 58| 229| vec256_mul(out, out, tmp_1111); // ^11111111 59| | 60| 229| vec256_sq(out, out); ------------------ | | 14| 229|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 229|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119F_AVX2_ ## fun | | ------------------ ------------------ 61| 229| vec256_sq(out, out); ------------------ | | 14| 229|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 229|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119F_AVX2_ ## fun | | ------------------ ------------------ 62| 229| vec256_sq(out, out); ------------------ | | 14| 229|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 229|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119F_AVX2_ ## fun | | ------------------ ------------------ 63| 229| vec256_sq(out, out); ------------------ | | 14| 229|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 229|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119F_AVX2_ ## fun | | ------------------ ------------------ 64| 229| vec256_mul(out, out, tmp_1111); // ^111111111111 65| | 66| 229| vec256_sq(out, out); // ^1111111111110 ------------------ | | 14| 229|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 229|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119F_AVX2_ ## fun | | ------------------ ------------------ 67| 229|} PQCLEAN_MCELIECE8192128_AVX2_load_bits: 188| 91|void load_bits(vec128 bits_int[][32], const unsigned char *bits) { 189| 91| int i, j; 190| 91| const unsigned char *ptr = bits; 191| | 192| 91| vec128 buf[64]; 193| | 194| 364| for (i = 0; i <= 5; i += 2) { ------------------ | Branch (194:17): [True: 273, False: 91] ------------------ 195| 17.7k| for (j = 0; j < 64; j++) { ------------------ | Branch (195:21): [True: 17.4k, False: 273] ------------------ 196| 17.4k| buf[j] = vec128_set2x(load8(ptr), load8(ptr + 512)); 197| 17.4k| ptr += 8; 198| 17.4k| } 199| | 200| 273| transpose_64x128_sp( buf ); 201| | 202| 9.00k| for (j = 0; j < 32; j++) { ------------------ | Branch (202:21): [True: 8.73k, False: 273] ------------------ 203| 8.73k| bits_int[i + 0][j] = vec128_unpack_low(buf[j], buf[j + 32]); 204| 8.73k| bits_int[i + 1][j] = vec128_unpack_high(buf[j], buf[j + 32]); 205| 8.73k| } 206| | 207| 273| ptr += 512; 208| 273| } 209| | 210| 1.27k| for (i = 6; i <= 18; i++) { ------------------ | Branch (210:17): [True: 1.18k, False: 91] ------------------ 211| 39.0k| for (j = 0; j < 32; j++) { ------------------ | Branch (211:21): [True: 37.8k, False: 1.18k] ------------------ 212| 37.8k| bits_int[i][j] = load16(ptr); 213| 37.8k| ptr += 16; 214| 37.8k| } 215| 1.18k| } 216| | 217| 364| for (i = 19; i < 25; i += 2) { ------------------ | Branch (217:18): [True: 273, False: 91] ------------------ 218| 17.7k| for (j = 0; j < 64; j++) { ------------------ | Branch (218:21): [True: 17.4k, False: 273] ------------------ 219| 17.4k| buf[j] = vec128_set2x(load8(ptr), load8(ptr + 512)); 220| 17.4k| ptr += 8; 221| 17.4k| } 222| | 223| 273| transpose_64x128_sp( buf ); 224| | 225| 9.00k| for (j = 0; j < 32; j++) { ------------------ | Branch (225:21): [True: 8.73k, False: 273] ------------------ 226| 8.73k| bits_int[i + 0][j] = vec128_unpack_low(buf[j], buf[j + 32]); 227| 8.73k| bits_int[i + 1][j] = vec128_unpack_high(buf[j], buf[j + 32]); 228| 8.73k| } 229| | 230| 273| ptr += 512; 231| 273| } 232| 91|} PQCLEAN_MCELIECE8192128_AVX2_benes: 238| 182|void benes(vec128 *r, vec128 b[][32], int rev) { 239| 182| int inc; 240| | 241| 182| vec128 *b_ptr; 242| | 243| 182| if (rev == 0) { ------------------ | Branch (243:9): [True: 91, False: 91] ------------------ 244| 91| inc = 32; 245| 91| b_ptr = b[ 0]; 246| 91| } else { 247| 91| inc = -32; 248| 91| b_ptr = b[24]; 249| 91| } 250| | 251| | // 252| | 253| 182| transpose_64x128_sp( r ); 254| | 255| 182| layer_0(r, b_ptr); 256| 182| b_ptr += inc; 257| 182| layer_1(r, b_ptr); 258| 182| b_ptr += inc; 259| 182| layer_2(r, b_ptr); 260| 182| b_ptr += inc; 261| 182| layer_3(r, b_ptr); 262| 182| b_ptr += inc; 263| 182| layer_4(r, b_ptr); 264| 182| b_ptr += inc; 265| 182| layer_5(r, b_ptr); 266| 182| b_ptr += inc; 267| | 268| 182| transpose_64x128_sp( r ); 269| | 270| 182| layer_x(r, b_ptr); 271| 182| b_ptr += inc; 272| 182| layer_0(r, b_ptr); 273| 182| b_ptr += inc; 274| 182| layer_1(r, b_ptr); 275| 182| b_ptr += inc; 276| 182| layer_2(r, b_ptr); 277| 182| b_ptr += inc; 278| 182| layer_3(r, b_ptr); 279| 182| b_ptr += inc; 280| 182| layer_4(r, b_ptr); 281| 182| b_ptr += inc; 282| 182| layer_5(r, b_ptr); 283| 182| b_ptr += inc; 284| 182| layer_4(r, b_ptr); 285| 182| b_ptr += inc; 286| 182| layer_3(r, b_ptr); 287| 182| b_ptr += inc; 288| 182| layer_2(r, b_ptr); 289| 182| b_ptr += inc; 290| 182| layer_1(r, b_ptr); 291| 182| b_ptr += inc; 292| 182| layer_0(r, b_ptr); 293| 182| b_ptr += inc; 294| 182| layer_x(r, b_ptr); 295| 182| b_ptr += inc; 296| | 297| 182| transpose_64x128_sp( r ); 298| | 299| 182| layer_5(r, b_ptr); 300| 182| b_ptr += inc; 301| 182| layer_4(r, b_ptr); 302| 182| b_ptr += inc; 303| 182| layer_3(r, b_ptr); 304| 182| b_ptr += inc; 305| 182| layer_2(r, b_ptr); 306| 182| b_ptr += inc; 307| 182| layer_1(r, b_ptr); 308| 182| b_ptr += inc; 309| 182| layer_0(r, b_ptr); 310| | 311| 182| transpose_64x128_sp( r ); 312| 182|} PQCLEAN_MCELIECE8192128_AVX2_bm: 147| 91|void bm(vec128 *out, vec256 *in) { 148| 91| int i; 149| 91| uint16_t N, L; 150| 91| uint16_t mask; 151| 91| uint64_t one = 1, t; 152| | 153| 91| vec128 prod[ GFBITS ]; 154| 91| vec128 interval[GFBITS]; 155| | 156| 91| typedef union { 157| 91| vec128 v[GFBITS][2]; 158| 91| vec256 V[GFBITS]; 159| 91| } db_t; 160| | 161| 91| db_t db; 162| 91| db_t BC_tmp; 163| 91| db_t BC; 164| | 165| 91| gf d, b, c0 = 1; 166| 91| gf coefs[256]; 167| | 168| | // initialization 169| | 170| 91| get_coefs(coefs, in); 171| | 172| 91| BC.v[0][0] = vec128_set2x(0, one << 63); 173| 91| BC.v[0][1] = vec128_setzero(); 174| | 175| 1.18k| for (i = 1; i < GFBITS; i++) { ------------------ | | 6| 1.18k|#define GFBITS 13 ------------------ | Branch (175:17): [True: 1.09k, False: 91] ------------------ 176| 1.09k| BC.v[i][0] = BC.v[i][1] = vec128_setzero(); 177| 1.09k| } 178| | 179| 91| b = 1; 180| 91| L = 0; 181| | 182| | // 183| | 184| 1.27k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 1.27k|#define GFBITS 13 ------------------ | Branch (184:17): [True: 1.18k, False: 91] ------------------ 185| 1.18k| interval[i] = vec128_setzero(); 186| 1.18k| } 187| | 188| 23.3k| for (N = 0; N < 256; N++) { ------------------ | Branch (188:17): [True: 23.2k, False: 91] ------------------ 189| 23.2k| vec128_mul_asm(prod, interval, BC.v[0] + 1, 32); ------------------ | | 10| 23.2k|#define vec128_mul_asm CRYPTO_NAMESPACE(vec128_mul_asm) | | ------------------ | | | | 4| 23.2k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128_AVX2_ ## fun | | ------------------ ------------------ 190| 23.2k| update_asm(interval, coefs[N], 16); ------------------ | | 1| 23.2k|#define update_asm CRYPTO_NAMESPACE(update_asm) | | ------------------ | | | | 4| 23.2k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128_AVX2_ ## fun | | ------------------ ------------------ 191| | 192| 23.2k| d = vec_reduce_asm(prod); ------------------ | | 3| 23.2k|#define vec_reduce_asm CRYPTO_NAMESPACE(vec_reduce_asm) | | ------------------ | | | | 4| 23.2k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128_AVX2_ ## fun | | ------------------ ------------------ 193| | 194| 23.2k| t = gf_mul2(c0, coefs[N], b); ------------------ | | 13| 23.2k|#define gf_mul2 CRYPTO_NAMESPACE(gf_mul2) | | ------------------ | | | | 4| 23.2k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128_AVX2_ ## fun | | ------------------ ------------------ 195| 23.2k| d ^= t & 0xFFFFFFFF; 196| | 197| 23.2k| mask = mask_nonzero(d) & mask_leq(L * 2, N); 198| | 199| 326k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 326k|#define GFBITS 13 ------------------ | Branch (199:21): [True: 302k, False: 23.2k] ------------------ 200| 302k| db.v[i][0] = vec128_setbits((d >> i) & 1); 201| 302k| db.v[i][1] = vec128_setbits((b >> i) & 1); 202| 302k| } 203| | 204| 23.2k| vec256_mul((vec256 *) BC_tmp.V, (vec256 *) db.V, (vec256 *) BC.V); 205| | 206| 23.2k| vec128_cmov(BC.v, mask); 207| 23.2k| update_asm(BC.v, c0 & mask, 32); ------------------ | | 1| 23.2k|#define update_asm CRYPTO_NAMESPACE(update_asm) | | ------------------ | | | | 4| 23.2k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128_AVX2_ ## fun | | ------------------ ------------------ 208| | 209| 326k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 326k|#define GFBITS 13 ------------------ | Branch (209:21): [True: 302k, False: 23.2k] ------------------ 210| 302k| BC.v[i][1] = vec128_xor(BC_tmp.v[i][0], BC_tmp.v[i][1]); 211| 302k| } 212| | 213| 23.2k| c0 = t >> 32; 214| 23.2k| b = (d & mask) | (b & ~mask); 215| 23.2k| L = ((N + 1 - L) & mask) | (L & ~mask); 216| 23.2k| } 217| | 218| 91| c0 = gf_inv(c0); ------------------ | | 11| 91|#define gf_inv CRYPTO_NAMESPACE(gf_inv) | | ------------------ | | | | 4| 91|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128_AVX2_ ## fun | | ------------------ ------------------ 219| | 220| 1.27k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 1.27k|#define GFBITS 13 ------------------ | Branch (220:17): [True: 1.18k, False: 91] ------------------ 221| 1.18k| prod[i] = vec128_setbits((c0 >> i) & 1); 222| 1.18k| } 223| | 224| 91| vec128_mul_asm(out, prod, BC.v[0] + 1, 32); ------------------ | | 10| 91|#define vec128_mul_asm CRYPTO_NAMESPACE(vec128_mul_asm) | | ------------------ | | | | 4| 91|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128_AVX2_ ## fun | | ------------------ ------------------ 225| 91|} PQCLEAN_MCELIECE8192128_AVX2_controlbitsfrompermutation: 205| 91|void controlbitsfrompermutation(unsigned char *out, const int16 *pi, long long w, long long n) { 206| 91| PQCLEAN_VLA(int32, temp, (size_t)(2 * n)); ------------------ | | 57| 91|# define PQCLEAN_VLA(__t,__x,__s) __t __x[__s] ------------------ 207| 91| PQCLEAN_VLA(int16, pi_test, (size_t)n); ------------------ | | 57| 91|# define PQCLEAN_VLA(__t,__x,__s) __t __x[__s] ------------------ 208| 91| int16 diff; 209| 91| int i; 210| 91| unsigned char *ptr; 211| | 212| 91| OQS_MEM_cleanse(temp, (size_t)n * 2); 213| 91| OQS_MEM_cleanse(pi_test, (size_t)n); 214| | 215| 91| while (1) { ------------------ | Branch (215:12): [True: 91, Folded] ------------------ 216| 91| OQS_MEM_cleanse(out, (size_t)((((2 * w - 1)*n / 2) + 7) / 8)); 217| 91| cbrecursion(out, 0, 1, pi, w, n, temp); 218| | 219| | // check for correctness 220| | 221| 745k| for (i = 0; i < n; i++) { ------------------ | Branch (221:21): [True: 745k, False: 91] ------------------ 222| 745k| pi_test[i] = (int16)i; 223| 745k| } 224| | 225| 91| ptr = out; 226| 1.27k| for (i = 0; i < w; i++) { ------------------ | Branch (226:21): [True: 1.18k, False: 91] ------------------ 227| 1.18k| layer(pi_test, ptr, i, (int32)n); 228| 1.18k| ptr += n >> 4; 229| 1.18k| } 230| | 231| 1.18k| for (i = (int)(w - 2); i >= 0; i--) { ------------------ | Branch (231:32): [True: 1.09k, False: 91] ------------------ 232| 1.09k| layer(pi_test, ptr, i, (int32)n); 233| 1.09k| ptr += n >> 4; 234| 1.09k| } 235| | 236| 91| diff = 0; 237| 745k| for (i = 0; i < n; i++) { ------------------ | Branch (237:21): [True: 745k, False: 91] ------------------ 238| 745k| diff |= pi[i] ^ pi_test[i]; 239| 745k| } 240| | 241| 91| diff = crypto_int16_nonzero_mask(diff); ------------------ | | 12| 91|#define crypto_int16_nonzero_mask CRYPTO_NAMESPACE(crypto_int16_nonzero_mask) | | ------------------ | | | | 4| 91|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128_AVX2_ ## fun | | ------------------ ------------------ 242| 91| crypto_declassify(&diff, sizeof diff); 243| 91| if (diff == 0) { ------------------ | Branch (243:13): [True: 91, False: 0] ------------------ 244| 91| break; 245| 91| } 246| 91| } 247| 91|} PQCLEAN_MCELIECE8192128_AVX2_crypto_int16_negative_mask: 3| 182|crypto_int16 crypto_int16_negative_mask(crypto_int16 crypto_int16_x) { 4| 182| return crypto_int16_x >> 15; 5| 182|} PQCLEAN_MCELIECE8192128_AVX2_crypto_int16_nonzero_mask: 7| 91|crypto_int16 crypto_int16_nonzero_mask(crypto_int16 crypto_int16_x) { 8| 91| return crypto_int16_negative_mask(crypto_int16_x) | crypto_int16_negative_mask(-crypto_int16_x); ------------------ | | 10| 91|#define crypto_int16_negative_mask CRYPTO_NAMESPACE(crypto_int16_negative_mask) | | ------------------ | | | | 4| 91|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128_AVX2_ ## fun | | ------------------ ------------------ return crypto_int16_negative_mask(crypto_int16_x) | crypto_int16_negative_mask(-crypto_int16_x); ------------------ | | 10| 91|#define crypto_int16_negative_mask CRYPTO_NAMESPACE(crypto_int16_negative_mask) | | ------------------ | | | | 4| 91|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128_AVX2_ ## fun | | ------------------ ------------------ 9| 91|} PQCLEAN_MCELIECE8192128_AVX2_crypto_int32_negative_mask: 3| 58.1M|crypto_int32 crypto_int32_negative_mask(crypto_int32 crypto_int32_x) { 4| 58.1M| return crypto_int32_x >> 31; 5| 58.1M|} PQCLEAN_MCELIECE8192128_AVX2_crypto_int32_min: 37| 58.1M|crypto_int32 crypto_int32_min(crypto_int32 crypto_int32_x, crypto_int32 crypto_int32_y) { 38| 58.1M| crypto_int32 crypto_int32_xy = crypto_int32_y ^ crypto_int32_x; 39| 58.1M| crypto_int32 crypto_int32_z = crypto_int32_y - crypto_int32_x; 40| 58.1M| crypto_int32_z ^= crypto_int32_xy & (crypto_int32_z ^ crypto_int32_y); 41| 58.1M| crypto_int32_z = crypto_int32_negative_mask(crypto_int32_z); ------------------ | | 9| 58.1M|#define crypto_int32_negative_mask CRYPTO_NAMESPACE(crypto_int32_negative_mask) | | ------------------ | | | | 4| 58.1M|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128_AVX2_ ## fun | | ------------------ ------------------ 42| 58.1M| crypto_int32_z &= crypto_int32_xy; 43| 58.1M| return crypto_int32_x ^ crypto_int32_z; 44| 58.1M|} PQCLEAN_MCELIECE8192128_AVX2_crypto_uint16_signed_negative_mask: 3| 200k|crypto_uint16_signed crypto_uint16_signed_negative_mask(crypto_uint16_signed crypto_uint16_signed_x) { 4| 200k| return crypto_uint16_signed_x >> 15; 5| 200k|} PQCLEAN_MCELIECE8192128_AVX2_crypto_uint16_nonzero_mask: 7| 100k|crypto_uint16 crypto_uint16_nonzero_mask(crypto_uint16 crypto_uint16_x) { 8| 100k| return crypto_uint16_signed_negative_mask(crypto_uint16_x) | crypto_uint16_signed_negative_mask(-crypto_uint16_x); ------------------ | | 11| 100k|#define crypto_uint16_signed_negative_mask CRYPTO_NAMESPACE(crypto_uint16_signed_negative_mask) | | ------------------ | | | | 4| 100k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128_AVX2_ ## fun | | ------------------ ------------------ return crypto_uint16_signed_negative_mask(crypto_uint16_x) | crypto_uint16_signed_negative_mask(-crypto_uint16_x); ------------------ | | 11| 100k|#define crypto_uint16_signed_negative_mask CRYPTO_NAMESPACE(crypto_uint16_signed_negative_mask) | | ------------------ | | | | 4| 100k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128_AVX2_ ## fun | | ------------------ ------------------ 9| 100k|} PQCLEAN_MCELIECE8192128_AVX2_crypto_uint16_zero_mask: 11| 100k|crypto_uint16 crypto_uint16_zero_mask(crypto_uint16 crypto_uint16_x) { 12| 100k| return ~crypto_uint16_nonzero_mask(crypto_uint16_x); ------------------ | | 13| 100k|#define crypto_uint16_nonzero_mask CRYPTO_NAMESPACE(crypto_uint16_nonzero_mask) | | ------------------ | | | | 4| 100k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128_AVX2_ ## fun | | ------------------ ------------------ 13| 100k|} PQCLEAN_MCELIECE8192128_AVX2_crypto_uint32_signed_negative_mask: 3| 96.2k|crypto_uint32_signed crypto_uint32_signed_negative_mask(crypto_uint32_signed crypto_uint32_signed_x) { 4| 96.2k| return crypto_uint32_signed_x >> 31; 5| 96.2k|} PQCLEAN_MCELIECE8192128_AVX2_crypto_uint32_nonzero_mask: 7| 48.1k|crypto_uint32 crypto_uint32_nonzero_mask(crypto_uint32 crypto_uint32_x) { 8| 48.1k| return crypto_uint32_signed_negative_mask(crypto_uint32_x) | crypto_uint32_signed_negative_mask(-crypto_uint32_x); ------------------ | | 11| 48.1k|#define crypto_uint32_signed_negative_mask CRYPTO_NAMESPACE(crypto_uint32_signed_negative_mask) | | ------------------ | | | | 4| 48.1k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128_AVX2_ ## fun | | ------------------ ------------------ return crypto_uint32_signed_negative_mask(crypto_uint32_x) | crypto_uint32_signed_negative_mask(-crypto_uint32_x); ------------------ | | 11| 48.1k|#define crypto_uint32_signed_negative_mask CRYPTO_NAMESPACE(crypto_uint32_signed_negative_mask) | | ------------------ | | | | 4| 48.1k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128_AVX2_ ## fun | | ------------------ ------------------ 9| 48.1k|} PQCLEAN_MCELIECE8192128_AVX2_crypto_uint32_unequal_mask: 15| 48.1k|crypto_uint32 crypto_uint32_unequal_mask(crypto_uint32 crypto_uint32_x, crypto_uint32 crypto_uint32_y) { 16| 48.1k| crypto_uint32 crypto_uint32_xy = crypto_uint32_x ^ crypto_uint32_y; 17| 48.1k| return crypto_uint32_nonzero_mask(crypto_uint32_xy); ------------------ | | 13| 48.1k|#define crypto_uint32_nonzero_mask CRYPTO_NAMESPACE(crypto_uint32_nonzero_mask) | | ------------------ | | | | 4| 48.1k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128_AVX2_ ## fun | | ------------------ ------------------ 18| 48.1k|} PQCLEAN_MCELIECE8192128_AVX2_crypto_uint32_equal_mask: 20| 48.1k|crypto_uint32 crypto_uint32_equal_mask(crypto_uint32 crypto_uint32_x, crypto_uint32 crypto_uint32_y) { 21| 48.1k| return ~crypto_uint32_unequal_mask(crypto_uint32_x, crypto_uint32_y); ------------------ | | 17| 48.1k|#define crypto_uint32_unequal_mask CRYPTO_NAMESPACE(crypto_uint32_unequal_mask) | | ------------------ | | | | 4| 48.1k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128_AVX2_ ## fun | | ------------------ ------------------ 22| 48.1k|} PQCLEAN_MCELIECE8192128_AVX2_crypto_uint64_signed_negative_mask: 3| 15.0M|crypto_uint64_signed crypto_uint64_signed_negative_mask(crypto_uint64_signed crypto_uint64_signed_x) { 4| 15.0M| return crypto_uint64_signed_x >> 63; 5| 15.0M|} PQCLEAN_MCELIECE8192128_AVX2_crypto_uint64_nonzero_mask: 7| 7.50M|crypto_uint64 crypto_uint64_nonzero_mask(crypto_uint64 crypto_uint64_x) { 8| 7.50M| return crypto_uint64_signed_negative_mask(crypto_uint64_x) | crypto_uint64_signed_negative_mask(-crypto_uint64_x); ------------------ | | 11| 7.50M|#define crypto_uint64_signed_negative_mask CRYPTO_NAMESPACE(crypto_uint64_signed_negative_mask) | | ------------------ | | | | 4| 7.50M|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128_AVX2_ ## fun | | ------------------ ------------------ return crypto_uint64_signed_negative_mask(crypto_uint64_x) | crypto_uint64_signed_negative_mask(-crypto_uint64_x); ------------------ | | 11| 7.50M|#define crypto_uint64_signed_negative_mask CRYPTO_NAMESPACE(crypto_uint64_signed_negative_mask) | | ------------------ | | | | 4| 7.50M|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128_AVX2_ ## fun | | ------------------ ------------------ 9| 7.50M|} PQCLEAN_MCELIECE8192128_AVX2_crypto_uint64_zero_mask: 11| 1.24M|crypto_uint64 crypto_uint64_zero_mask(crypto_uint64 crypto_uint64_x) { 12| 1.24M| return ~crypto_uint64_nonzero_mask(crypto_uint64_x); ------------------ | | 13| 1.24M|#define crypto_uint64_nonzero_mask CRYPTO_NAMESPACE(crypto_uint64_nonzero_mask) | | ------------------ | | | | 4| 1.24M|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128_AVX2_ ## fun | | ------------------ ------------------ 13| 1.24M|} PQCLEAN_MCELIECE8192128_AVX2_crypto_uint64_unequal_mask: 15| 6.26M|crypto_uint64 crypto_uint64_unequal_mask(crypto_uint64 crypto_uint64_x, crypto_uint64 crypto_uint64_y) { 16| 6.26M| crypto_uint64 crypto_uint64_xy = crypto_uint64_x ^ crypto_uint64_y; 17| 6.26M| return crypto_uint64_nonzero_mask(crypto_uint64_xy); ------------------ | | 13| 6.26M|#define crypto_uint64_nonzero_mask CRYPTO_NAMESPACE(crypto_uint64_nonzero_mask) | | ------------------ | | | | 4| 6.26M|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128_AVX2_ ## fun | | ------------------ ------------------ 18| 6.26M|} PQCLEAN_MCELIECE8192128_AVX2_crypto_uint64_equal_mask: 20| 6.26M|crypto_uint64 crypto_uint64_equal_mask(crypto_uint64 crypto_uint64_x, crypto_uint64 crypto_uint64_y) { 21| 6.26M| return ~crypto_uint64_unequal_mask(crypto_uint64_x, crypto_uint64_y); ------------------ | | 17| 6.26M|#define crypto_uint64_unequal_mask CRYPTO_NAMESPACE(crypto_uint64_unequal_mask) | | ------------------ | | | | 4| 6.26M|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128_AVX2_ ## fun | | ------------------ ------------------ 22| 6.26M|} PQCLEAN_MCELIECE8192128_AVX2_decrypt: 141| 91|int decrypt(unsigned char *e, const unsigned char *sk, const unsigned char *s) { 142| 91| int i; 143| | 144| 91| uint16_t check_synd; 145| 91| uint16_t check_weight; 146| | 147| 91| vec256 inv[ 64 ][ GFBITS ]; 148| 91| vec256 scaled[ 64 ][ GFBITS ]; 149| 91| vec256 eval[ 64 ][ GFBITS ]; 150| | 151| 91| vec128 error128[ 64 ]; 152| 91| vec256 error256[ 32 ]; 153| | 154| 91| vec256 s_priv[ GFBITS ]; 155| 91| vec256 s_priv_cmp[ GFBITS ]; 156| 91| vec128 locator[ GFBITS ]; 157| | 158| 91| vec128 recv128[ 64 ]; 159| 91| vec256 recv256[ 32 ]; 160| 91| vec256 allone; 161| | 162| 91| vec128 bits_int[25][32]; 163| | 164| | // Berlekamp decoder 165| | 166| 91| preprocess(recv128, s); 167| | 168| 91| load_bits(bits_int, sk + IRR_BYTES); ------------------ | | 10| 91|#define load_bits CRYPTO_NAMESPACE(load_bits) | | ------------------ | | | | 4| 91|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128_AVX2_ ## fun | | ------------------ ------------------ load_bits(bits_int, sk + IRR_BYTES); ------------------ | | 11| 91|#define IRR_BYTES (SYS_T * 2) | | ------------------ | | | | 8| 91|#define SYS_T 128 | | ------------------ ------------------ 169| 91| benes(recv128, bits_int, 1); ------------------ | | 9| 91|#define benes CRYPTO_NAMESPACE(benes) | | ------------------ | | | | 4| 91|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128_AVX2_ ## fun | | ------------------ ------------------ 170| 91| reformat_128to256(recv256, recv128); 171| | 172| 91| scaling(scaled, inv, sk, recv256); // scaling 173| 91| fft_tr(s_priv, scaled); // transposed FFT ------------------ | | 9| 91|#define fft_tr CRYPTO_NAMESPACE(fft_tr) | | ------------------ | | | | 4| 91|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128_AVX2_ ## fun | | ------------------ ------------------ 174| 91| bm(locator, s_priv); // Berlekamp Massey ------------------ | | 10| 91|#define bm CRYPTO_NAMESPACE(bm) | | ------------------ | | | | 4| 91|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128_AVX2_ ## fun | | ------------------ ------------------ 175| | 176| 91| fft(eval, locator); // FFT ------------------ | | 10| 91|#define fft CRYPTO_NAMESPACE(fft) | | ------------------ | | | | 4| 91|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128_AVX2_ ## fun | | ------------------ ------------------ 177| | 178| | // reencryption and weight check 179| | 180| 91| allone = vec256_set1_16b(0xFFFF); 181| | 182| 3.00k| for (i = 0; i < 32; i++) { ------------------ | Branch (182:17): [True: 2.91k, False: 91] ------------------ 183| 2.91k| error256[i] = vec256_or_reduce(eval[i]); 184| 2.91k| error256[i] = vec256_xor(error256[i], allone); 185| 2.91k| } 186| | 187| 91| check_weight = weight(error256) ^ SYS_T; ------------------ | | 8| 91|#define SYS_T 128 ------------------ 188| 91| check_weight -= 1; 189| 91| check_weight >>= 15; 190| | 191| 91| scaling_inv(scaled, inv, error256); 192| 91| fft_tr(s_priv_cmp, scaled); ------------------ | | 9| 91|#define fft_tr CRYPTO_NAMESPACE(fft_tr) | | ------------------ | | | | 4| 91|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128_AVX2_ ## fun | | ------------------ ------------------ 193| | 194| 91| check_synd = synd_cmp(s_priv, s_priv_cmp); 195| | 196| | // 197| | 198| 91| reformat_256to128(error128, error256); 199| 91| benes(error128, bits_int, 0); ------------------ | | 9| 91|#define benes CRYPTO_NAMESPACE(benes) | | ------------------ | | | | 4| 91|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128_AVX2_ ## fun | | ------------------ ------------------ 200| | 201| 5.91k| for (i = 0; i < 64; i++) { ------------------ | Branch (201:17): [True: 5.82k, False: 91] ------------------ 202| 5.82k| store16(e + i * 16, error128[i]); 203| 5.82k| } 204| | 205| 91| return 1 - (check_synd & check_weight); 206| 91|} decrypt.c:weight: 81| 160|static int weight(vec256 *v) { 82| 160| int i, w = 0; 83| | 84| 5.28k| for (i = 0; i < 32; i++) { ------------------ | Branch (84:17): [True: 5.12k, False: 160] ------------------ 85| 5.12k| w += __builtin_popcountll( vec256_extract(v[i], 0) ); ------------------ | | 39| 5.12k|#define vec256_extract(a,i) ((uint64_t) _mm256_extract_epi64((vec256) (a),(i))) ------------------ 86| 5.12k| w += __builtin_popcountll( vec256_extract(v[i], 1) ); ------------------ | | 39| 5.12k|#define vec256_extract(a,i) ((uint64_t) _mm256_extract_epi64((vec256) (a),(i))) ------------------ 87| 5.12k| w += __builtin_popcountll( vec256_extract(v[i], 2) ); ------------------ | | 39| 5.12k|#define vec256_extract(a,i) ((uint64_t) _mm256_extract_epi64((vec256) (a),(i))) ------------------ 88| 5.12k| w += __builtin_popcountll( vec256_extract(v[i], 3) ); ------------------ | | 39| 5.12k|#define vec256_extract(a,i) ((uint64_t) _mm256_extract_epi64((vec256) (a),(i))) ------------------ 89| 5.12k| } 90| | 91| 160| return w; 92| 160|} PQCLEAN_MCELIECE8192128_AVX2_encrypt: 87| 91|void encrypt(unsigned char *s, const unsigned char *pk, unsigned char *e) { 88| 91| gen_e(e); 89| | 90| 91| syndrome_asm(s, pk, e); ------------------ | | 1| 91|#define syndrome_asm CRYPTO_NAMESPACE(syndrome_asm) | | ------------------ | | | | 4| 91|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128_AVX2_ ## fun | | ------------------ ------------------ 91| 91|} PQCLEAN_MCELIECE8192128_AVX2_fft: 277| 965|void fft(vec256 out[][GFBITS], vec128 *in) { 278| 965| radix_conversions(in); 279| 965| butterflies(out, in); 280| 965|} PQCLEAN_MCELIECE8192128_AVX2_fft_tr: 380| 182|void fft_tr(vec256 *out, vec256 in[][ GFBITS ]) { 381| 182| butterflies_tr(out, in); 382| 182| radix_conversions_tr(out); 383| 182|} PQCLEAN_MCELIECE8192128_AVX2_gf_mul: 12| 12.8M|gf gf_mul(gf in0, gf in1) { 13| 12.8M| int i; 14| | 15| 12.8M| uint64_t tmp; 16| 12.8M| uint64_t t0; 17| 12.8M| uint64_t t1; 18| 12.8M| uint64_t t; 19| | 20| 12.8M| t0 = in0; 21| 12.8M| t1 = in1; 22| | 23| 12.8M| tmp = t0 * (t1 & 1); 24| | 25| 166M| for (i = 1; i < GFBITS; i++) { ------------------ | | 6| 166M|#define GFBITS 13 ------------------ | Branch (25:17): [True: 153M, False: 12.8M] ------------------ 26| 153M| tmp ^= (t0 * (t1 & (1 << i))); 27| 153M| } 28| | 29| | // 30| | 31| 12.8M| t = tmp & 0x1FF0000; 32| 12.8M| tmp ^= (t >> 9) ^ (t >> 10) ^ (t >> 12) ^ (t >> 13); 33| | 34| 12.8M| t = tmp & 0x000E000; 35| 12.8M| tmp ^= (t >> 9) ^ (t >> 10) ^ (t >> 12) ^ (t >> 13); 36| | 37| 12.8M| return tmp & GFMASK; ------------------ | | 19| 12.8M|#define GFMASK ((1 << GFBITS) - 1) | | ------------------ | | | | 6| 12.8M|#define GFBITS 13 | | ------------------ ------------------ 38| 12.8M|} PQCLEAN_MCELIECE8192128_AVX2_gf_frac: 148| 100k|gf gf_frac(gf den, gf num) { 149| 100k| gf tmp_11; 150| 100k| gf tmp_1111; 151| 100k| gf out; 152| | 153| 100k| tmp_11 = gf_sqmul(den, den); // 11 154| 100k| tmp_1111 = gf_sq2mul(tmp_11, tmp_11); // 1111 155| 100k| out = gf_sq2(tmp_1111); 156| 100k| out = gf_sq2mul(out, tmp_1111); // 11111111 157| 100k| out = gf_sq2(out); 158| 100k| out = gf_sq2mul(out, tmp_1111); // 111111111111 159| | 160| 100k| return gf_sqmul(out, num); // 1111111111110 161| 100k|} PQCLEAN_MCELIECE8192128_AVX2_gf_inv: 164| 100k|gf gf_inv(gf den) { 165| 100k| return gf_frac(den, ((gf) 1)); ------------------ | | 10| 100k|#define gf_frac CRYPTO_NAMESPACE(gf_frac) | | ------------------ | | | | 4| 100k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128_AVX2_ ## fun | | ------------------ ------------------ 166| 100k|} bm.c:PQCLEAN_MCELIECE8192128_AVX2_gf_mul2: 31| 23.2k|static inline uint64_t gf_mul2(gf a, gf b0, gf b1) { 32| 23.2k| int i; 33| | 34| 23.2k| uint64_t tmp = 0; 35| 23.2k| uint64_t t0; 36| 23.2k| uint64_t t1; 37| 23.2k| uint64_t t; 38| 23.2k| uint64_t mask = 0x0000000100000001; 39| | 40| 23.2k| t0 = a; 41| 23.2k| t1 = b1; 42| 23.2k| t1 = (t1 << 32) | b0; 43| | 44| 326k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 326k|#define GFBITS 13 ------------------ | Branch (44:17): [True: 302k, False: 23.2k] ------------------ 45| 302k| tmp ^= t0 * (t1 & mask); 46| 302k| mask += mask; 47| 302k| } 48| | 49| | // 50| | 51| 23.2k| t = tmp & 0x01FF000001FF0000; 52| 23.2k| tmp ^= (t >> 9) ^ (t >> 10) ^ (t >> 12) ^ (t >> 13); 53| | 54| 23.2k| t = tmp & 0x0000E0000000E000; 55| 23.2k| tmp ^= (t >> 9) ^ (t >> 10) ^ (t >> 12) ^ (t >> 13); 56| | 57| 23.2k| return tmp & 0x00001FFF00001FFF; 58| 23.2k|} pk_gen.c:PQCLEAN_MCELIECE8192128_AVX2_int32_sort: 21| 91|static void int32_sort(int32_t *x, long long n) { 22| 91| long long top, p, q, r, i; 23| | 24| 91| if (n < 2) { ------------------ | Branch (24:9): [True: 0, False: 91] ------------------ 25| 0| return; 26| 0| } 27| 91| top = 1; 28| 1.00k| while (top < n - top) { ------------------ | Branch (28:12): [True: 910, False: 91] ------------------ 29| 910| top += top; 30| 910| } 31| | 32| 1.09k| for (p = top; p > 0; p >>= 1) { ------------------ | Branch (32:19): [True: 1.00k, False: 91] ------------------ 33| 1.48M| for (i = 0; i < n - p; ++i) { ------------------ | Branch (33:21): [True: 1.47M, False: 1.00k] ------------------ 34| 1.47M| if (!(i & p)) { ------------------ | Branch (34:17): [True: 786k, False: 693k] ------------------ 35| 786k| int32_MINMAX(x[i], x[i + p]); ------------------ | | 11| 786k| do { \ | | 12| 786k| int32_t ab = (b) ^ (a); \ | | 13| 786k| int32_t c = (b) - (a); \ | | 14| 786k| c ^= ab & ((c) ^ (b)); \ | | 15| 786k| c >>= 31; \ | | 16| 786k| c &= ab; \ | | 17| 786k| (a) ^= c; \ | | 18| 786k| (b) ^= c; \ | | 19| 786k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 786k] | | ------------------ ------------------ 36| 786k| } 37| 1.47M| } 38| 1.00k| i = 0; 39| 6.00k| for (q = top; q > p; q >>= 1) { ------------------ | Branch (39:23): [True: 5.00k, False: 1.00k] ------------------ 40| 1.33M| for (; i < n - q; ++i) { ------------------ | Branch (40:20): [True: 1.32M, False: 5.00k] ------------------ 41| 1.32M| if (!(i & p)) { ------------------ | Branch (41:21): [True: 693k, False: 634k] ------------------ 42| 693k| int32_t a = x[i + p]; 43| 4.06M| for (r = q; r > p; r >>= 1) { ------------------ | Branch (43:33): [True: 3.37M, False: 693k] ------------------ 44| 3.37M| int32_MINMAX(a, x[i + r]); ------------------ | | 11| 3.37M| do { \ | | 12| 3.37M| int32_t ab = (b) ^ (a); \ | | 13| 3.37M| int32_t c = (b) - (a); \ | | 14| 3.37M| c ^= ab & ((c) ^ (b)); \ | | 15| 3.37M| c >>= 31; \ | | 16| 3.37M| c &= ab; \ | | 17| 3.37M| (a) ^= c; \ | | 18| 3.37M| (b) ^= c; \ | | 19| 3.37M| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 3.37M] | | ------------------ ------------------ 45| 3.37M| } 46| 693k| x[i + p] = a; 47| 693k| } 48| 1.32M| } 49| 5.00k| } 50| 1.00k| } 51| 91|} controlbits.c:PQCLEAN_MCELIECE8192128_AVX2_int32_sort: 21| 2.98M|static void int32_sort(int32_t *x, long long n) { 22| 2.98M| long long top, p, q, r, i; 23| | 24| 2.98M| if (n < 2) { ------------------ | Branch (24:9): [True: 0, False: 2.98M] ------------------ 25| 0| return; 26| 0| } 27| 2.98M| top = 1; 28| 10.4M| while (top < n - top) { ------------------ | Branch (28:12): [True: 7.47M, False: 2.98M] ------------------ 29| 7.47M| top += top; 30| 7.47M| } 31| | 32| 13.4M| for (p = top; p > 0; p >>= 1) { ------------------ | Branch (32:19): [True: 10.4M, False: 2.98M] ------------------ 33| 1.43G| for (i = 0; i < n - p; ++i) { ------------------ | Branch (33:21): [True: 1.42G, False: 10.4M] ------------------ 34| 1.42G| if (!(i & p)) { ------------------ | Branch (34:17): [True: 798M, False: 629M] ------------------ 35| 798M| int32_MINMAX(x[i], x[i + p]); ------------------ | | 11| 798M| do { \ | | 12| 798M| int32_t ab = (b) ^ (a); \ | | 13| 798M| int32_t c = (b) - (a); \ | | 14| 798M| c ^= ab & ((c) ^ (b)); \ | | 15| 798M| c >>= 31; \ | | 16| 798M| c &= ab; \ | | 17| 798M| (a) ^= c; \ | | 18| 798M| (b) ^= c; \ | | 19| 798M| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 798M] | | ------------------ ------------------ 36| 798M| } 37| 1.42G| } 38| 10.4M| i = 0; 39| 28.3M| for (q = top; q > p; q >>= 1) { ------------------ | Branch (39:23): [True: 17.9M, False: 10.4M] ------------------ 40| 1.27G| for (; i < n - q; ++i) { ------------------ | Branch (40:20): [True: 1.25G, False: 17.9M] ------------------ 41| 1.25G| if (!(i & p)) { ------------------ | Branch (41:21): [True: 629M, False: 629M] ------------------ 42| 629M| int32_t a = x[i + p]; 43| 3.72G| for (r = q; r > p; r >>= 1) { ------------------ | Branch (43:33): [True: 3.09G, False: 629M] ------------------ 44| 3.09G| int32_MINMAX(a, x[i + r]); ------------------ | | 11| 3.09G| do { \ | | 12| 3.09G| int32_t ab = (b) ^ (a); \ | | 13| 3.09G| int32_t c = (b) - (a); \ | | 14| 3.09G| c ^= ab & ((c) ^ (b)); \ | | 15| 3.09G| c >>= 31; \ | | 16| 3.09G| c &= ab; \ | | 17| 3.09G| (a) ^= c; \ | | 18| 3.09G| (b) ^= c; \ | | 19| 3.09G| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 3.09G] | | ------------------ ------------------ 45| 3.09G| } 46| 629M| x[i + p] = a; 47| 629M| } 48| 1.25G| } 49| 17.9M| } 50| 10.4M| } 51| 2.98M|} encrypt.c:PQCLEAN_MCELIECE8192128_AVX2_int32_sort: 21| 379|static void int32_sort(int32_t *x, long long n) { 22| 379| long long top, p, q, r, i; 23| | 24| 379| if (n < 2) { ------------------ | Branch (24:9): [True: 0, False: 379] ------------------ 25| 0| return; 26| 0| } 27| 379| top = 1; 28| 2.65k| while (top < n - top) { ------------------ | Branch (28:12): [True: 2.27k, False: 379] ------------------ 29| 2.27k| top += top; 30| 2.27k| } 31| | 32| 3.03k| for (p = top; p > 0; p >>= 1) { ------------------ | Branch (32:19): [True: 2.65k, False: 379] ------------------ 33| 294k| for (i = 0; i < n - p; ++i) { ------------------ | Branch (33:21): [True: 291k, False: 2.65k] ------------------ 34| 291k| if (!(i & p)) { ------------------ | Branch (34:17): [True: 169k, False: 121k] ------------------ 35| 169k| int32_MINMAX(x[i], x[i + p]); ------------------ | | 11| 169k| do { \ | | 12| 169k| int32_t ab = (b) ^ (a); \ | | 13| 169k| int32_t c = (b) - (a); \ | | 14| 169k| c ^= ab & ((c) ^ (b)); \ | | 15| 169k| c >>= 31; \ | | 16| 169k| c &= ab; \ | | 17| 169k| (a) ^= c; \ | | 18| 169k| (b) ^= c; \ | | 19| 169k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 169k] | | ------------------ ------------------ 36| 169k| } 37| 291k| } 38| 2.65k| i = 0; 39| 10.6k| for (q = top; q > p; q >>= 1) { ------------------ | Branch (39:23): [True: 7.95k, False: 2.65k] ------------------ 40| 251k| for (; i < n - q; ++i) { ------------------ | Branch (40:20): [True: 243k, False: 7.95k] ------------------ 41| 243k| if (!(i & p)) { ------------------ | Branch (41:21): [True: 121k, False: 121k] ------------------ 42| 121k| int32_t a = x[i + p]; 43| 509k| for (r = q; r > p; r >>= 1) { ------------------ | Branch (43:33): [True: 387k, False: 121k] ------------------ 44| 387k| int32_MINMAX(a, x[i + r]); ------------------ | | 11| 387k| do { \ | | 12| 387k| int32_t ab = (b) ^ (a); \ | | 13| 387k| int32_t c = (b) - (a); \ | | 14| 387k| c ^= ab & ((c) ^ (b)); \ | | 15| 387k| c >>= 31; \ | | 16| 387k| c &= ab; \ | | 17| 387k| (a) ^= c; \ | | 18| 387k| (b) ^= c; \ | | 19| 387k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 387k] | | ------------------ ------------------ 45| 387k| } 46| 121k| x[i + p] = a; 47| 121k| } 48| 243k| } 49| 7.95k| } 50| 2.65k| } 51| 379|} PQCLEAN_MCELIECE8192128_AVX2_crypto_kem_enc: 22| 91|) { 23| 91| unsigned char e[ SYS_N / 8 ]; 24| 91| unsigned char one_ec[ 1 + SYS_N / 8 + SYND_BYTES ] = {1}; 25| | 26| | // 27| | 28| 91| encrypt(c, pk, e); ------------------ | | 9| 91|#define encrypt CRYPTO_NAMESPACE(encrypt) | | ------------------ | | | | 4| 91|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128_AVX2_ ## fun | | ------------------ ------------------ 29| | 30| 91| memcpy(one_ec + 1, e, SYS_N / 8); ------------------ | | 7| 91|#define SYS_N 8192 ------------------ 31| 91| memcpy(one_ec + 1 + SYS_N / 8, c, SYND_BYTES); ------------------ | | 7| 91|#define SYS_N 8192 ------------------ memcpy(one_ec + 1 + SYS_N / 8, c, SYND_BYTES); ------------------ | | 17| 91|#define SYND_BYTES ((PK_NROWS + 7)/8) | | ------------------ | | | | 13| 91|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 91|#define SYS_T 128 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 91|#define GFBITS 13 | | | | ------------------ | | ------------------ ------------------ 32| | 33| 91| crypto_hash_32b(key, one_ec, sizeof(one_ec)); ------------------ | | 7| 91| shake256(out, 32, in, inlen) | | ------------------ | | | | 12| 91|#define shake256 OQS_SHA3_shake256 | | ------------------ ------------------ 34| | 35| 91| return 0; 36| 91|} PQCLEAN_MCELIECE8192128_AVX2_crypto_kem_dec: 42| 91|) { 43| 91| int i; 44| | 45| 91| unsigned char ret_decrypt = 0; 46| | 47| 91| uint16_t m; 48| | 49| 91| unsigned char e[ SYS_N / 8 ]; 50| 91| unsigned char preimage[ 1 + SYS_N / 8 + SYND_BYTES ]; 51| 91| unsigned char *x = preimage; 52| 91| const unsigned char *s = sk + 40 + IRR_BYTES + COND_BYTES; ------------------ | | 11| 91|#define IRR_BYTES (SYS_T * 2) | | ------------------ | | | | 8| 91|#define SYS_T 128 | | ------------------ ------------------ const unsigned char *s = sk + 40 + IRR_BYTES + COND_BYTES; ------------------ | | 10| 91|#define COND_BYTES ((1 << (GFBITS-4))*(2*GFBITS - 1)) | | ------------------ | | | | 6| 91|#define GFBITS 13 | | ------------------ | | #define COND_BYTES ((1 << (GFBITS-4))*(2*GFBITS - 1)) | | ------------------ | | | | 6| 91|#define GFBITS 13 | | ------------------ ------------------ 53| | 54| | // 55| | 56| 91| ret_decrypt = (unsigned char)decrypt(e, sk + 40, c); ------------------ | | 9| 91|#define decrypt CRYPTO_NAMESPACE(decrypt) | | ------------------ | | | | 4| 91|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128_AVX2_ ## fun | | ------------------ ------------------ 57| | 58| 91| m = ret_decrypt; 59| 91| m -= 1; 60| 91| m >>= 8; 61| | 62| 91| *x++ = m & 1; 63| 93.2k| for (i = 0; i < SYS_N / 8; i++) { ------------------ | | 7| 93.2k|#define SYS_N 8192 ------------------ | Branch (63:17): [True: 93.1k, False: 91] ------------------ 64| 93.1k| *x++ = (~m & s[i]) | (m & e[i]); 65| 93.1k| } 66| | 67| 19.0k| for (i = 0; i < SYND_BYTES; i++) { ------------------ | | 17| 19.0k|#define SYND_BYTES ((PK_NROWS + 7)/8) | | ------------------ | | | | 13| 19.0k|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 19.0k|#define SYS_T 128 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 19.0k|#define GFBITS 13 | | | | ------------------ | | ------------------ ------------------ | Branch (67:17): [True: 18.9k, False: 91] ------------------ 68| 18.9k| *x++ = c[i]; 69| 18.9k| } 70| | 71| 91| crypto_hash_32b(key, preimage, sizeof(preimage)); ------------------ | | 7| 91| shake256(out, 32, in, inlen) | | ------------------ | | | | 12| 91|#define shake256 OQS_SHA3_shake256 | | ------------------ ------------------ 72| | 73| 91| return 0; 74| 91|} PQCLEAN_MCELIECE8192128_AVX2_crypto_kem_keypair: 80| 91|) { 81| 91| int i; 82| 91| unsigned char seed[ 33 ] = {64}; 83| 91| unsigned char r[ SYS_N / 8 + (1 << GFBITS)*sizeof(uint32_t) + SYS_T * 2 + 32 ]; 84| 91| unsigned char *rp, *skp; 85| | 86| 91| gf f[ SYS_T ]; // element in GF(2^mt) 87| 91| gf irr[ SYS_T ]; // Goppa polynomial 88| 91| uint32_t perm[ 1 << GFBITS ]; // random permutation as 32-bit integers 89| 91| int16_t pi[ 1 << GFBITS ]; // random permutation 90| | 91| 91| randombytes(seed + 1, 32); ------------------ | | 8| 91|#define randombytes OQS_randombytes ------------------ 92| | 93| 783| while (1) { ------------------ | Branch (93:12): [True: 783, Folded] ------------------ 94| 783| rp = &r[ sizeof(r) - 32 ]; 95| 783| skp = sk; 96| | 97| | // expanding and updating the seed 98| | 99| 783| shake(r, sizeof(r), seed, 33); ------------------ | | 10| 783| shake256(out, outlen, in, inlen) | | ------------------ | | | | 12| 783|#define shake256 OQS_SHA3_shake256 | | ------------------ ------------------ 100| 783| memcpy(skp, seed + 1, 32); 101| 783| skp += 32 + 8; 102| 783| memcpy(seed + 1, &r[ sizeof(r) - 32 ], 32); 103| | 104| | // generating irreducible polynomial 105| | 106| 783| rp -= sizeof(f); 107| | 108| 101k| for (i = 0; i < SYS_T; i++) { ------------------ | | 8| 101k|#define SYS_T 128 ------------------ | Branch (108:21): [True: 100k, False: 783] ------------------ 109| 100k| f[i] = load_gf(rp + i * 2); 110| 100k| } 111| | 112| 783| if (genpoly_gen(irr, f)) { ------------------ | | 9| 783|#define genpoly_gen CRYPTO_NAMESPACE(genpoly_gen) | | ------------------ | | | | 4| 783|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128_AVX2_ ## fun | | ------------------ ------------------ | Branch (112:13): [True: 0, False: 783] ------------------ 113| 0| continue; 114| 0| } 115| | 116| 101k| for (i = 0; i < SYS_T; i++) { ------------------ | | 8| 101k|#define SYS_T 128 ------------------ | Branch (116:21): [True: 100k, False: 783] ------------------ 117| 100k| store_gf(skp + i * 2, irr[i]); 118| 100k| } 119| | 120| 783| skp += IRR_BYTES; ------------------ | | 11| 783|#define IRR_BYTES (SYS_T * 2) | | ------------------ | | | | 8| 783|#define SYS_T 128 | | ------------------ ------------------ 121| | 122| | // generating permutation 123| | 124| 783| rp -= sizeof(perm); 125| | 126| 6.41M| for (i = 0; i < (1 << GFBITS); i++) { ------------------ | | 6| 6.41M|#define GFBITS 13 ------------------ | Branch (126:21): [True: 6.41M, False: 783] ------------------ 127| 6.41M| perm[i] = load4(rp + i * 4); 128| 6.41M| } 129| | 130| 783| if (pk_gen(pk, skp - IRR_BYTES, perm, pi)) { ------------------ | | 9| 783|#define pk_gen CRYPTO_NAMESPACE(pk_gen) | | ------------------ | | | | 4| 783|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128_AVX2_ ## fun | | ------------------ ------------------ if (pk_gen(pk, skp - IRR_BYTES, perm, pi)) { ------------------ | | 11| 783|#define IRR_BYTES (SYS_T * 2) | | ------------------ | | | | 8| 783|#define SYS_T 128 | | ------------------ ------------------ | Branch (130:13): [True: 692, False: 91] ------------------ 131| 692| continue; 132| 692| } 133| | 134| 91| controlbitsfrompermutation(skp, pi, GFBITS, 1 << GFBITS); ------------------ | | 10| 91|#define controlbitsfrompermutation CRYPTO_NAMESPACE(controlbitsfrompermutation) | | ------------------ | | | | 4| 91|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128_AVX2_ ## fun | | ------------------ ------------------ controlbitsfrompermutation(skp, pi, GFBITS, 1 << GFBITS); ------------------ | | 6| 91|#define GFBITS 13 ------------------ controlbitsfrompermutation(skp, pi, GFBITS, 1 << GFBITS); ------------------ | | 6| 91|#define GFBITS 13 ------------------ 135| 91| skp += COND_BYTES; ------------------ | | 10| 91|#define COND_BYTES ((1 << (GFBITS-4))*(2*GFBITS - 1)) | | ------------------ | | | | 6| 91|#define GFBITS 13 | | ------------------ | | #define COND_BYTES ((1 << (GFBITS-4))*(2*GFBITS - 1)) | | ------------------ | | | | 6| 91|#define GFBITS 13 | | ------------------ ------------------ 136| | 137| | // storing the random string s 138| | 139| 91| rp -= SYS_N / 8; ------------------ | | 7| 91|#define SYS_N 8192 ------------------ 140| 91| memcpy(skp, rp, SYS_N / 8); ------------------ | | 7| 91|#define SYS_N 8192 ------------------ 141| | 142| | // storing positions of the 32 pivots 143| | 144| 91| store8(sk + 32, 0xFFFFFFFF); 145| | 146| 91| break; 147| 783| } 148| | 149| 91| return 0; 150| 91|} PQCLEAN_MCELIECE8192128_AVX2_pk_gen: 199| 783|int pk_gen(unsigned char *pk, const unsigned char *irr, const uint32_t *perm, int16_t *pi) { 200| 783|#define nBlocks_I ((PK_NROWS + 255) / 256) 201| | 202| 783| int i, j, k, b; 203| 783| int row, c; 204| | 205| 783| union { 206| 783| uint64_t w[ PK_NROWS ][ nBlocks_I * 4 ]; 207| 783| vec256 v[ PK_NROWS ][ nBlocks_I ]; 208| 783| } mat; 209| | 210| 783| union { 211| 783| uint64_t w[ PK_NROWS ][ par_width * 4 ]; 212| 783| vec256 v[ PK_NROWS ][ par_width ]; 213| 783| } par; 214| | 215| 783| uint16_t m; 216| 783| vec256 mm; 217| | 218| 783| vec128 sk_int[ GFBITS ]; 219| | 220| 783| vec256 consts[ 32 ][ GFBITS ]; 221| 783| vec256 eval[ 32 ][ GFBITS ]; 222| 783| vec256 prod[ 32 ][ GFBITS ]; 223| 783| vec256 tmp[ GFBITS ]; 224| | 225| 783| uint64_t list[1 << GFBITS]; 226| 783| uint64_t one = 1; 227| 783| uint64_t t; 228| | 229| 783| uint16_t ind[ PK_NROWS ]; 230| 783| uint16_t ind_inv[ PK_NROWS ]; 231| | 232| | // compute the inverses 233| | 234| 783| irr_load(sk_int, irr); 235| | 236| 783| fft(eval, sk_int); ------------------ | | 10| 783|#define fft CRYPTO_NAMESPACE(fft) | | ------------------ | | | | 4| 783|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128_AVX2_ ## fun | | ------------------ ------------------ 237| | 238| 783| vec256_copy(prod[0], eval[0]); 239| | 240| 25.0k| for (i = 1; i < 32; i++) { ------------------ | Branch (240:17): [True: 24.2k, False: 783] ------------------ 241| 24.2k| vec256_mul(prod[i], prod[i - 1], eval[i]); 242| 24.2k| } 243| | 244| 783| vec256_inv(tmp, prod[31]); ------------------ | | 11| 783|#define vec256_inv CRYPTO_NAMESPACE(vec256_inv) | | ------------------ | | | | 4| 783|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128_AVX2_ ## fun | | ------------------ ------------------ 245| | 246| 25.0k| for (i = 30; i >= 0; i--) { ------------------ | Branch (246:18): [True: 24.2k, False: 783] ------------------ 247| 24.2k| vec256_mul(prod[i + 1], prod[i], tmp); 248| 24.2k| vec256_mul(tmp, tmp, eval[i + 1]); 249| 24.2k| } 250| | 251| 783| vec256_copy(prod[0], tmp); 252| | 253| | // fill matrix 254| | 255| 783| de_bitslicing(list, prod); 256| | 257| 6.41M| for (i = 0; i < (1 << GFBITS); i++) { ------------------ | | 6| 6.41M|#define GFBITS 13 ------------------ | Branch (257:17): [True: 6.41M, False: 783] ------------------ 258| 6.41M| list[i] <<= GFBITS; ------------------ | | 6| 6.41M|#define GFBITS 13 ------------------ 259| 6.41M| list[i] |= i; 260| 6.41M| list[i] |= ((uint64_t) perm[i]) << 31; 261| 6.41M| } 262| | 263| 783| uint64_sort(list, 1 << GFBITS); ------------------ | | 6| 783|#define GFBITS 13 ------------------ 264| | 265| 6.26M| for (i = 1; i < (1 << GFBITS); i++) { ------------------ | | 6| 6.26M|#define GFBITS 13 ------------------ | Branch (265:17): [True: 6.26M, False: 749] ------------------ 266| 6.26M| if (uint64_is_equal_declassify(list[i - 1] >> 31, list[i] >> 31)) { ------------------ | Branch (266:13): [True: 34, False: 6.26M] ------------------ 267| 34| return -1; 268| 34| } 269| 6.26M| } 270| | 271| 749| to_bitslicing_2x(consts, prod, list); 272| | 273| 6.13M| for (i = 0; i < (1 << GFBITS); i++) { ------------------ | | 6| 6.13M|#define GFBITS 13 ------------------ | Branch (273:17): [True: 6.13M, False: 749] ------------------ 274| 6.13M| pi[i] = list[i] & GFMASK; ------------------ | | 19| 6.13M|#define GFMASK ((1 << GFBITS) - 1) | | ------------------ | | | | 6| 6.13M|#define GFBITS 13 | | ------------------ ------------------ 275| 6.13M| } 276| | 277| 5.99k| for (j = 0; j < nBlocks_I; j++) { ------------------ | | 200| 5.99k|#define nBlocks_I ((PK_NROWS + 255) / 256) | | ------------------ | | | | 13| 5.99k|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 5.99k|#define SYS_T 128 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 5.99k|#define GFBITS 13 | | | | ------------------ | | ------------------ ------------------ | Branch (277:17): [True: 5.24k, False: 749] ------------------ 278| 73.4k| for (k = 0; k < GFBITS; k++) { ------------------ | | 6| 73.4k|#define GFBITS 13 ------------------ | Branch (278:21): [True: 68.1k, False: 5.24k] ------------------ 279| 68.1k| mat.v[ k ][ j ] = prod[ j ][ k ]; 280| 68.1k| } 281| 5.24k| } 282| | 283| 95.8k| for (i = 1; i < SYS_T; i++) { ------------------ | | 8| 95.8k|#define SYS_T 128 ------------------ | Branch (283:17): [True: 95.1k, False: 749] ------------------ 284| 760k| for (j = 0; j < nBlocks_I; j++) { ------------------ | | 200| 760k|#define nBlocks_I ((PK_NROWS + 255) / 256) | | ------------------ | | | | 13| 760k|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 760k|#define SYS_T 128 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 760k|#define GFBITS 13 | | | | ------------------ | | ------------------ ------------------ | Branch (284:21): [True: 665k, False: 95.1k] ------------------ 285| 665k| vec256_mul(prod[j], prod[j], consts[j]); 286| | 287| 9.32M| for (k = 0; k < GFBITS; k++) { ------------------ | | 6| 9.32M|#define GFBITS 13 ------------------ | Branch (287:25): [True: 8.65M, False: 665k] ------------------ 288| 8.65M| mat.v[ i * GFBITS + k ][ j ] = prod[ j ][ k ]; ------------------ | | 6| 8.65M|#define GFBITS 13 ------------------ 289| 8.65M| } 290| 665k| } 291| 95.1k| } 292| | 293| | // gaussian elimination to obtain L, U, and P such that LP M = U 294| | // L and U are stored in the space of M 295| | // P is stored in ind 296| | 297| 1.24M| for (i = 0; i < PK_NROWS; i++) { ------------------ | | 13| 1.24M|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 1.24M|#define SYS_T 128 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 1.24M|#define GFBITS 13 | | ------------------ ------------------ | Branch (297:17): [True: 1.24M, False: 749] ------------------ 298| 1.24M| ind_inv[i] = ind[ i ] = i; 299| 1.24M| } 300| | 301| 1.24M| for (row = 0; row < PK_NROWS; row++) { ------------------ | | 13| 1.24M|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 1.24M|#define SYS_T 128 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 1.24M|#define GFBITS 13 | | ------------------ ------------------ | Branch (301:19): [True: 1.24M, False: 91] ------------------ 302| 1.24M| i = row >> 6; 303| 1.24M| j = row & 63; 304| | 305| 1.03G| for (k = row + 1; k < PK_NROWS; k++) { ------------------ | | 13| 1.03G|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 1.03G|#define SYS_T 128 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 1.03G|#define GFBITS 13 | | ------------------ ------------------ | Branch (305:27): [True: 1.03G, False: 1.24M] ------------------ 306| 1.03G| extract_01_masks(&m, mat.w[ row ], mat.w[ k ], row); 307| 1.03G| uint16_cswap(&ind[row], &ind[k], m); 308| | 309| 1.03G| mm = vec256_set1_16b(m); 310| 8.29G| for (c = 0; c < nBlocks_I; c++) { ------------------ | | 200| 8.29G|#define nBlocks_I ((PK_NROWS + 255) / 256) | | ------------------ | | | | 13| 8.29G|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 8.29G|#define SYS_T 128 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 8.29G|#define GFBITS 13 | | | | ------------------ | | ------------------ ------------------ | Branch (310:25): [True: 7.25G, False: 1.03G] ------------------ 311| 7.25G| vec256_cswap(&mat.v[ row ][ c ], &mat.v[ k ][ c ], mm); 312| 7.25G| } 313| 1.03G| } 314| | 315| 1.24M| if ( uint64_is_zero_declassify((mat.w[ row ][ i ] >> j) & 1) ) { // return if not systematic ------------------ | Branch (315:14): [True: 658, False: 1.24M] ------------------ 316| 658| return -1; 317| 658| } 318| | 319| 1.03G| for (k = row + 1; k < PK_NROWS; k++) { ------------------ | | 13| 1.03G|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 1.03G|#define SYS_T 128 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 1.03G|#define GFBITS 13 | | ------------------ ------------------ | Branch (319:27): [True: 1.03G, False: 1.24M] ------------------ 320| 1.03G| t = mat.w[ k ][ i ] & (one << j); 321| 1.03G| mm = extract_mask256(mat.w[k], row); 322| | 323| 8.29G| for (c = 0; c < nBlocks_I; c++) { ------------------ | | 200| 8.29G|#define nBlocks_I ((PK_NROWS + 255) / 256) | | ------------------ | | | | 13| 8.29G|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 8.29G|#define SYS_T 128 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 8.29G|#define GFBITS 13 | | | | ------------------ | | ------------------ ------------------ | Branch (323:25): [True: 7.25G, False: 1.03G] ------------------ 324| 7.25G| mat.v[ k ][ c ] ^= mat.v[ row ][ c ] & mm; 325| 7.25G| } 326| | 327| 1.03G| mat.w[ k ][ i ] |= t; 328| 1.03G| } 329| 1.24M| } 330| | 331| | // apply M^-1 to the remaining columns 332| | 333| 91| composeinv(PK_NROWS, ind_inv, ind_inv, ind); ------------------ | | 13| 91|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 91|#define SYS_T 128 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 91|#define GFBITS 13 | | ------------------ ------------------ 334| | 335| 273| for (j = 6; j < 32; j += par_width) { ------------------ | | 30| 182|#define par_width 13 ------------------ | Branch (335:17): [True: 182, False: 91] ------------------ 336| 2.54k| for (k = 0; k < GFBITS; k++) { ------------------ | | 6| 2.54k|#define GFBITS 13 ------------------ | Branch (336:21): [True: 2.36k, False: 182] ------------------ 337| 33.1k| for (b = 0; b < par_width; b++) { ------------------ | | 30| 33.1k|#define par_width 13 ------------------ | Branch (337:25): [True: 30.7k, False: 2.36k] ------------------ 338| 30.7k| par.v[ k ][ b ] = prod[ j + b ][ k ]; 339| 30.7k| } 340| 2.36k| } 341| | 342| 23.2k| for (i = 1; i < SYS_T; i++) { ------------------ | | 8| 23.2k|#define SYS_T 128 ------------------ | Branch (342:21): [True: 23.1k, False: 182] ------------------ 343| 323k| for (b = 0; b < par_width; b++) { ------------------ | | 30| 323k|#define par_width 13 ------------------ | Branch (343:25): [True: 300k, False: 23.1k] ------------------ 344| 300k| vec256_mul(prod[j + b], prod[j + b], consts[j + b]); 345| 300k| } 346| | 347| 323k| for (k = 0; k < GFBITS; k++) { ------------------ | | 6| 323k|#define GFBITS 13 ------------------ | Branch (347:25): [True: 300k, False: 23.1k] ------------------ 348| 4.20M| for (b = 0; b < par_width; b++) { ------------------ | | 30| 4.20M|#define par_width 13 ------------------ | Branch (348:29): [True: 3.90M, False: 300k] ------------------ 349| 3.90M| par.v[ i * GFBITS + k ][ b ] = prod[ j + b ][ k ]; ------------------ | | 6| 3.90M|#define GFBITS 13 ------------------ 350| 3.90M| } 351| 300k| } 352| 23.1k| } 353| | 354| | // apply P 355| | 356| 303k| for (i = 0; i < PK_NROWS; i++) { ------------------ | | 13| 303k|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 303k|#define SYS_T 128 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 303k|#define GFBITS 13 | | ------------------ ------------------ | Branch (356:21): [True: 302k, False: 182] ------------------ 357| 302k| ind[i] = ind_inv[i]; 358| 302k| } 359| | 360| 182| sort_rows((1 << GFBITS) / 4, PK_NROWS, ind, par.v, 0); ------------------ | | 6| 182|#define GFBITS 13 ------------------ sort_rows((1 << GFBITS) / 4, PK_NROWS, ind, par.v, 0); ------------------ | | 13| 182|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 182|#define SYS_T 128 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 182|#define GFBITS 13 | | ------------------ ------------------ 361| | 362| | // apply L 363| | 364| 303k| for (row = PK_NROWS - 1; row >= 0; row--) { ------------------ | | 13| 182|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 182|#define SYS_T 128 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 182|#define GFBITS 13 | | ------------------ ------------------ | Branch (364:34): [True: 302k, False: 182] ------------------ 365| 252M| for (i = row - 1; i >= 0; i--) { ------------------ | Branch (365:31): [True: 251M, False: 302k] ------------------ 366| 251M| mm = extract_mask256(mat.w[row], i); 367| | 368| 3.52G| for (k = 0; k < par_width; k++) { ------------------ | | 30| 3.52G|#define par_width 13 ------------------ | Branch (368:29): [True: 3.27G, False: 251M] ------------------ 369| 3.27G| par.v[ row ][ k ] ^= par.v[ i ][ k ] & mm; 370| 3.27G| } 371| 251M| } 372| 302k| } 373| | 374| | // apply U^-1 375| | 376| 182| if (j == 6) { ------------------ | Branch (376:13): [True: 91, False: 91] ------------------ 377| 151k| for (i = 0; i < PK_NROWS; i++) { ------------------ | | 13| 151k|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 151k|#define SYS_T 128 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 151k|#define GFBITS 13 | | ------------------ ------------------ | Branch (377:25): [True: 151k, False: 91] ------------------ 378| 151k| par.v[i][0] = mat.v[i][nBlocks_I - 1]; ------------------ | | 200| 151k|#define nBlocks_I ((PK_NROWS + 255) / 256) | | ------------------ | | | | 13| 151k|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 151k|#define SYS_T 128 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 151k|#define GFBITS 13 | | | | ------------------ | | ------------------ ------------------ 379| 151k| } 380| 91| } 381| | 382| 303k| for (row = PK_NROWS - 1; row >= 0; row--) { ------------------ | | 13| 182|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 182|#define SYS_T 128 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 182|#define GFBITS 13 | | ------------------ ------------------ | Branch (382:34): [True: 302k, False: 182] ------------------ 383| 252M| for (i = PK_NROWS - 1; i > row; i--) { ------------------ | | 13| 302k|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 302k|#define SYS_T 128 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 302k|#define GFBITS 13 | | ------------------ ------------------ | Branch (383:36): [True: 251M, False: 302k] ------------------ 384| 251M| mm = extract_mask256(mat.w[row], i); 385| | 386| 3.52G| for (k = 0; k < par_width; k++) { ------------------ | | 30| 3.52G|#define par_width 13 ------------------ | Branch (386:29): [True: 3.27G, False: 251M] ------------------ 387| 3.27G| par.v[ row ][ k ] ^= par.v[ i ][ k ] & mm; 388| 3.27G| } 389| 251M| } 390| 302k| } 391| | 392| 182| if (j == 6) { ------------------ | Branch (392:13): [True: 91, False: 91] ------------------ 393| 151k| for (row = 0; row < PK_NROWS; row++) { ------------------ | | 13| 151k|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 151k|#define SYS_T 128 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 151k|#define GFBITS 13 | | ------------------ ------------------ | Branch (393:27): [True: 151k, False: 91] ------------------ 394| 7.72M| for (k = 2; k < par_width * 4; k++) { ------------------ | | 30| 7.72M|#define par_width 13 ------------------ | Branch (394:29): [True: 7.57M, False: 151k] ------------------ 395| 7.57M| store8(pk + PK_ROW_BYTES * row + j * 32 + k * 8 - 13 * 16, par.w[row][k]); ------------------ | | 15| 7.57M|#define PK_ROW_BYTES ((PK_NCOLS + 7)/8) | | ------------------ | | | | 14| 7.57M|#define PK_NCOLS (SYS_N - PK_NROWS) | | | | ------------------ | | | | | | 7| 7.57M|#define SYS_N 8192 | | | | ------------------ | | | | #define PK_NCOLS (SYS_N - PK_NROWS) | | | | ------------------ | | | | | | 13| 7.57M|#define PK_NROWS (SYS_T*GFBITS) | | | | | | ------------------ | | | | | | | | 8| 7.57M|#define SYS_T 128 | | | | | | ------------------ | | | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | | | ------------------ | | | | | | | | 6| 7.57M|#define GFBITS 13 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 396| 7.57M| } 397| 151k| } 398| 91| } else { 399| 151k| for (row = 0; row < PK_NROWS; row++) { ------------------ | | 13| 151k|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 151k|#define SYS_T 128 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 151k|#define GFBITS 13 | | ------------------ ------------------ | Branch (399:27): [True: 151k, False: 91] ------------------ 400| 8.02M| for (k = 0; k < par_width * 4; k++) { ------------------ | | 30| 8.02M|#define par_width 13 ------------------ | Branch (400:29): [True: 7.87M, False: 151k] ------------------ 401| 7.87M| store8(pk + PK_ROW_BYTES * row + j * 32 + k * 8 - 13 * 16, par.w[row][k]); ------------------ | | 15| 7.87M|#define PK_ROW_BYTES ((PK_NCOLS + 7)/8) | | ------------------ | | | | 14| 7.87M|#define PK_NCOLS (SYS_N - PK_NROWS) | | | | ------------------ | | | | | | 7| 7.87M|#define SYS_N 8192 | | | | ------------------ | | | | #define PK_NCOLS (SYS_N - PK_NROWS) | | | | ------------------ | | | | | | 13| 7.87M|#define PK_NROWS (SYS_T*GFBITS) | | | | | | ------------------ | | | | | | | | 8| 7.87M|#define SYS_T 128 | | | | | | ------------------ | | | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | | | ------------------ | | | | | | | | 6| 7.87M|#define GFBITS 13 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 402| 7.87M| } 403| 151k| } 404| 91| } 405| 182| } 406| | 407| | // 408| | 409| 91| return 0; 410| 749|} PQCLEAN_MCELIECE8192128_AVX2_genpoly_gen: 88| 783|int genpoly_gen(gf *out, gf *f) { 89| 783| int i, j, k; 90| | 91| 783| gf t, inv; 92| | 93| 783| uint64_t m; 94| 783| vec128 mask; 95| | 96| 783| union { 97| 783| uint64_t d[ GFBITS ][ 128 ][2]; 98| 783| vec128 v[ GFBITS ][ 128 ]; 99| 783| } buf; 100| | 101| 783| union { 102| 783| uint64_t d[GFBITS][2]; 103| 783| vec128 v[GFBITS]; 104| 783| } v; 105| | 106| 783| union { 107| 783| uint64_t d[SYS_T][GFBITS][2]; 108| 783| vec128 v[SYS_T][GFBITS]; 109| 783| } mat; 110| | 111| | // fill matrix 112| | 113| 783| buf.v[0][0] = vec128_set2x(1, 0); 114| 10.1k| for (i = 1; i < GFBITS; i++) { ------------------ | | 6| 10.1k|#define GFBITS 13 ------------------ | Branch (114:17): [True: 9.39k, False: 783] ------------------ 115| 9.39k| buf.v[i][0] = vec128_setzero(); 116| 9.39k| } 117| | 118| 10.9k| for (j = 0; j < GFBITS; j++) { ------------------ | | 6| 10.9k|#define GFBITS 13 ------------------ | Branch (118:17): [True: 10.1k, False: 783] ------------------ 119| 10.1k| v.v[j] = vec128_setzero(); 120| | 121| 1.31M| for (i = SYS_T - 1; i >= 0; i--) { ------------------ | | 8| 10.1k|#define SYS_T 128 ------------------ | Branch (121:29): [True: 1.30M, False: 10.1k] ------------------ 122| 1.30M| v.d[j][1] <<= 1; 123| 1.30M| v.d[j][1] |= v.d[j][0] >> 63; 124| 1.30M| v.d[j][0] <<= 1; 125| 1.30M| v.d[j][0] |= (f[i] >> j) & 1; 126| 1.30M| } 127| 10.1k| } 128| | 129| 10.9k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 10.9k|#define GFBITS 13 ------------------ | Branch (129:17): [True: 10.1k, False: 783] ------------------ 130| 10.1k| buf.v[i][1] = v.v[i]; 131| 10.1k| } 132| | 133| 100k| for (k = 2; k <= SYS_T; k++) { ------------------ | | 8| 100k|#define SYS_T 128 ------------------ | Branch (133:17): [True: 99.4k, False: 783] ------------------ 134| 99.4k| vec128_mul_GF(v.v, v.v, f); ------------------ | | 11| 99.4k|#define vec128_mul_GF CRYPTO_NAMESPACE(vec128_mul_GF) | | ------------------ | | | | 4| 99.4k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128_AVX2_ ## fun | | ------------------ ------------------ 135| | 136| 99.4k| if (k < SYS_T) { ------------------ | | 8| 99.4k|#define SYS_T 128 ------------------ | Branch (136:13): [True: 98.6k, False: 783] ------------------ 137| 1.38M| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 1.38M|#define GFBITS 13 ------------------ | Branch (137:25): [True: 1.28M, False: 98.6k] ------------------ 138| 1.28M| buf.v[i][k] = v.v[i]; 139| 1.28M| } 140| 98.6k| } else { 141| 101k| for (i = 0; i < SYS_T; i++) { ------------------ | | 8| 101k|#define SYS_T 128 ------------------ | Branch (141:25): [True: 100k, False: 783] ------------------ 142| 100k| out[i] = extract_gf(v.d, i); 143| 100k| } 144| 783| } 145| 99.4k| } 146| | 147| 10.9k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 10.9k|#define GFBITS 13 ------------------ | Branch (147:17): [True: 10.1k, False: 783] ------------------ 148| 10.1k| transpose_128x128(buf.d[i]); 149| 10.1k| } 150| | 151| 101k| for (j = 0; j < SYS_T; j++) { ------------------ | | 8| 101k|#define SYS_T 128 ------------------ | Branch (151:17): [True: 100k, False: 783] ------------------ 152| 1.40M| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 1.40M|#define GFBITS 13 ------------------ | Branch (152:21): [True: 1.30M, False: 100k] ------------------ 153| 1.30M| mat.v[j][i] = buf.v[i][j]; 154| 1.30M| } 155| 100k| } 156| | 157| | // gaussian 158| | 159| 101k| for (i = 0; i < SYS_T; i++) { ------------------ | | 8| 101k|#define SYS_T 128 ------------------ | Branch (159:17): [True: 100k, False: 783] ------------------ 160| 6.46M| for (j = i + 1; j < SYS_T; j++) { ------------------ | | 8| 6.46M|#define SYS_T 128 ------------------ | Branch (160:25): [True: 6.36M, False: 100k] ------------------ 161| 6.36M| m = extract_bit(mat.d[i], i); 162| 6.36M| m -= 1; 163| 6.36M| mask = vec128_set2x(m, m); 164| | 165| 89.0M| for (k = 0; k < GFBITS; k++) { ------------------ | | 6| 89.0M|#define GFBITS 13 ------------------ | Branch (165:25): [True: 82.7M, False: 6.36M] ------------------ 166| 82.7M| mat.v[i][k] ^= mat.v[j][k] & mask; 167| 82.7M| } 168| | 169| 6.36M| out[i] ^= out[j] & m; 170| 6.36M| } 171| | 172| | // 173| | 174| 100k| t = extract_gf(mat.d[i], i); 175| | 176| 100k| if (gf_is_zero_declassify(t)) { ------------------ | Branch (176:13): [True: 0, False: 100k] ------------------ 177| 0| return -1; // return if not systematic 178| 0| } 179| | 180| | // 181| | 182| 100k| inv = gf_inv(t); ------------------ | | 11| 100k|#define gf_inv CRYPTO_NAMESPACE(gf_inv) | | ------------------ | | | | 4| 100k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128_AVX2_ ## fun | | ------------------ ------------------ 183| 100k| vec128_mul_gf(mat.v[i], mat.v[i], inv); 184| | 185| 100k| out[i] = gf_mul(out[i], inv); ------------------ | | 14| 100k|#define gf_mul CRYPTO_NAMESPACE(gf_mul) | | ------------------ | | | | 4| 100k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128_AVX2_ ## fun | | ------------------ ------------------ 186| | 187| 12.9M| for (j = 0; j < SYS_T; j++) { ------------------ | | 8| 12.9M|#define SYS_T 128 ------------------ | Branch (187:21): [True: 12.8M, False: 100k] ------------------ 188| 12.8M| if (j != i) { ------------------ | Branch (188:17): [True: 12.7M, False: 100k] ------------------ 189| 12.7M| t = extract_gf(mat.d[j], i); 190| | 191| 12.7M| vec128_mul_gf(v.v, mat.v[i], t); 192| 12.7M| vec128_add(mat.v[j], mat.v[j], v.v); 193| | 194| 12.7M| out[j] ^= gf_mul(out[i], t); ------------------ | | 14| 12.7M|#define gf_mul CRYPTO_NAMESPACE(gf_mul) | | ------------------ | | | | 4| 12.7M|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128_AVX2_ ## fun | | ------------------ ------------------ 195| 12.7M| } 196| 12.8M| } 197| 100k| } 198| | 199| 783| return 0; 200| 783|} decrypt.c:store16: 90| 10.2k|static inline void store16(unsigned char *out, vec128 in) { 91| 10.2k| store8(out + 0, vec128_extract(in, 0)); ------------------ | | 29| 10.2k|#define vec128_extract(a, i) ((uint64_t) _mm_extract_epi64((vec128) (a), (i))) ------------------ 92| | store8(out + 8, vec128_extract(in, 1)); ------------------ | | 29| 10.2k|#define vec128_extract(a, i) ((uint64_t) _mm_extract_epi64((vec128) (a), (i))) ------------------ 93| 10.2k|} PQCLEAN_MCELIECE8192128_AVX2_vec128_mul_GF: 6| 99.4k|void vec128_mul_GF(vec128 out[ GFBITS ], vec128 v[ GFBITS ], gf a[ SYS_T ]) { 7| 99.4k| int i, j; 8| 99.4k| uint64_t buf[GFBITS][4]; 9| 99.4k| vec128 prod[GFBITS]; 10| 99.4k| uint64_t p[GFBITS]; 11| | 12| | // polynomial multiplication 13| | 14| 1.39M| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 1.39M|#define GFBITS 13 ------------------ | Branch (14:17): [True: 1.29M, False: 99.4k] ------------------ 15| 1.29M| buf[i][0] = 0; 16| 1.29M| buf[i][1] = 0; 17| 1.29M| buf[i][2] = 0; 18| 1.29M| buf[i][3] = 0; 19| 1.29M| } 20| | 21| 12.8M| for (i = SYS_T - 1; i >= 0; i--) { ------------------ | | 8| 99.4k|#define SYS_T 128 ------------------ | Branch (21:25): [True: 12.7M, False: 99.4k] ------------------ 22| 178M| for (j = 0; j < GFBITS; j++) { ------------------ | | 6| 178M|#define GFBITS 13 ------------------ | Branch (22:21): [True: 165M, False: 12.7M] ------------------ 23| 165M| buf[j][3] <<= 1; 24| 165M| buf[j][3] |= buf[j][2] >> 63; 25| 165M| buf[j][2] <<= 1; 26| 165M| buf[j][2] |= buf[j][1] >> 63; 27| 165M| buf[j][1] <<= 1; 28| 165M| buf[j][1] |= buf[j][0] >> 63; 29| 165M| buf[j][0] <<= 1; 30| 165M| } 31| | 32| 12.7M| vec128_mul_gf(prod, v, a[i]); 33| | 34| 178M| for (j = 0; j < GFBITS; j++) { ------------------ | | 6| 178M|#define GFBITS 13 ------------------ | Branch (34:21): [True: 165M, False: 12.7M] ------------------ 35| 165M| buf[j][0] ^= vec128_extract(prod[j], 0); ------------------ | | 29| 165M|#define vec128_extract(a, i) ((uint64_t) _mm_extract_epi64((vec128) (a), (i))) ------------------ 36| 165M| buf[j][1] ^= vec128_extract(prod[j], 1); ------------------ | | 29| 165M|#define vec128_extract(a, i) ((uint64_t) _mm_extract_epi64((vec128) (a), (i))) ------------------ 37| 165M| } 38| 12.7M| } 39| | 40| | // reduction modulo y^128+y^7+y^2+y+1 41| | 42| 1.39M| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 1.39M|#define GFBITS 13 ------------------ | Branch (42:17): [True: 1.29M, False: 99.4k] ------------------ 43| 1.29M| p[i] = buf[i][3]; 44| | 45| 1.29M| buf[i][2] ^= p[i] >> (SYS_T - 7 - 64); ------------------ | | 8| 1.29M|#define SYS_T 128 ------------------ 46| 1.29M| buf[i][1] ^= p[i] << (64 - (SYS_T - 7 - 64)); ------------------ | | 8| 1.29M|#define SYS_T 128 ------------------ 47| 1.29M| buf[i][2] ^= p[i] >> (SYS_T - 2 - 64); ------------------ | | 8| 1.29M|#define SYS_T 128 ------------------ 48| 1.29M| buf[i][1] ^= p[i] << (64 - (SYS_T - 2 - 64)); ------------------ | | 8| 1.29M|#define SYS_T 128 ------------------ 49| 1.29M| buf[i][2] ^= p[i] >> (SYS_T - 1 - 64); ------------------ | | 8| 1.29M|#define SYS_T 128 ------------------ 50| 1.29M| buf[i][1] ^= p[i] << (64 - (SYS_T - 1 - 64)); ------------------ | | 8| 1.29M|#define SYS_T 128 ------------------ 51| 1.29M| buf[i][1] ^= p[i]; 52| 1.29M| } 53| | 54| | // 55| | 56| 1.39M| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 1.39M|#define GFBITS 13 ------------------ | Branch (56:17): [True: 1.29M, False: 99.4k] ------------------ 57| 1.29M| p[i] = buf[i][2]; 58| | 59| 1.29M| buf[i][1] ^= p[i] >> (SYS_T - 7 - 64); ------------------ | | 8| 1.29M|#define SYS_T 128 ------------------ 60| 1.29M| buf[i][0] ^= p[i] << (64 - (SYS_T - 7 - 64)); ------------------ | | 8| 1.29M|#define SYS_T 128 ------------------ 61| 1.29M| buf[i][1] ^= p[i] >> (SYS_T - 2 - 64); ------------------ | | 8| 1.29M|#define SYS_T 128 ------------------ 62| 1.29M| buf[i][0] ^= p[i] << (64 - (SYS_T - 2 - 64)); ------------------ | | 8| 1.29M|#define SYS_T 128 ------------------ 63| 1.29M| buf[i][1] ^= p[i] >> (SYS_T - 1 - 64); ------------------ | | 8| 1.29M|#define SYS_T 128 ------------------ 64| 1.29M| buf[i][0] ^= p[i] << (64 - (SYS_T - 1 - 64)); ------------------ | | 8| 1.29M|#define SYS_T 128 ------------------ 65| 1.29M| buf[i][0] ^= p[i]; 66| 1.29M| } 67| | 68| | // 69| | 70| 1.39M| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 1.39M|#define GFBITS 13 ------------------ | Branch (70:17): [True: 1.29M, False: 99.4k] ------------------ 71| 1.29M| out[i] = vec128_set2x(buf[i][0], buf[i][1]); 72| 1.29M| } 73| 99.4k|} decrypt.c:vec128_setbits: 58| 160|static inline vec128 vec128_setbits(uint64_t a) { 59| 160| return _mm_set1_epi64x(-a); 60| 160|} PQCLEAN_MCELIECE8192128_AVX2_vec256_sq: 9| 13.4k|void vec256_sq(vec256 *out, vec256 *in) { 10| 13.4k| int i; 11| 13.4k| vec256 result[GFBITS], t; 12| | 13| 13.4k| t = vec256_xor(in[11], in[12]); 14| | 15| 13.4k| result[0] = vec256_xor(in[0], in[11]); 16| 13.4k| result[1] = vec256_xor(in[7], t); 17| 13.4k| result[2] = vec256_xor(in[1], in[7]); 18| 13.4k| result[3] = vec256_xor(in[8], t); 19| 13.4k| result[4] = vec256_xor(in[2], in[7]); 20| 13.4k| result[4] = vec256_xor(result[4], in[8]); 21| 13.4k| result[4] = vec256_xor(result[4], t); 22| 13.4k| result[5] = vec256_xor(in[7], in[9]); 23| 13.4k| result[6] = vec256_xor(in[3], in[8]); 24| 13.4k| result[6] = vec256_xor(result[6], in[9]); 25| 13.4k| result[6] = vec256_xor(result[6], in[12]); 26| 13.4k| result[7] = vec256_xor(in[8], in[10]); 27| 13.4k| result[8] = vec256_xor(in[4], in[9]); 28| 13.4k| result[8] = vec256_xor(result[8], in[10]); 29| 13.4k| result[9] = vec256_xor(in[9], in[11]); 30| 13.4k| result[10] = vec256_xor(in[5], in[10]); 31| 13.4k| result[10] = vec256_xor(result[10], in[11]); 32| 13.4k| result[11] = vec256_xor(in[10], in[12]); 33| 13.4k| result[12] = vec256_xor(in[6], t); 34| | 35| 187k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 187k|#define GFBITS 13 ------------------ | Branch (35:17): [True: 174k, False: 13.4k] ------------------ 36| 174k| out[i] = result[i]; 37| 174k| } 38| 13.4k|} PQCLEAN_MCELIECE8192128_AVX2_vec256_inv: 41| 874|void vec256_inv(vec256 *out, vec256 *in) { 42| 874| vec256 tmp_11[ GFBITS ]; 43| 874| vec256 tmp_1111[ GFBITS ]; 44| | 45| 874| vec256_copy(out, in); 46| | 47| 874| vec256_sq(out, out); ------------------ | | 14| 874|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 874|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128_AVX2_ ## fun | | ------------------ ------------------ 48| 874| vec256_mul(tmp_11, out, in); // ^11 49| | 50| 874| vec256_sq(out, tmp_11); ------------------ | | 14| 874|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 874|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128_AVX2_ ## fun | | ------------------ ------------------ 51| 874| vec256_sq(out, out); ------------------ | | 14| 874|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 874|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128_AVX2_ ## fun | | ------------------ ------------------ 52| 874| vec256_mul(tmp_1111, out, tmp_11); // ^1111 53| | 54| 874| vec256_sq(out, tmp_1111); ------------------ | | 14| 874|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 874|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128_AVX2_ ## fun | | ------------------ ------------------ 55| 874| vec256_sq(out, out); ------------------ | | 14| 874|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 874|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128_AVX2_ ## fun | | ------------------ ------------------ 56| 874| vec256_sq(out, out); ------------------ | | 14| 874|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 874|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128_AVX2_ ## fun | | ------------------ ------------------ 57| 874| vec256_sq(out, out); ------------------ | | 14| 874|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 874|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128_AVX2_ ## fun | | ------------------ ------------------ 58| 874| vec256_mul(out, out, tmp_1111); // ^11111111 59| | 60| 874| vec256_sq(out, out); ------------------ | | 14| 874|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 874|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128_AVX2_ ## fun | | ------------------ ------------------ 61| 874| vec256_sq(out, out); ------------------ | | 14| 874|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 874|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128_AVX2_ ## fun | | ------------------ ------------------ 62| 874| vec256_sq(out, out); ------------------ | | 14| 874|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 874|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128_AVX2_ ## fun | | ------------------ ------------------ 63| 874| vec256_sq(out, out); ------------------ | | 14| 874|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 874|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128_AVX2_ ## fun | | ------------------ ------------------ 64| 874| vec256_mul(out, out, tmp_1111); // ^111111111111 65| | 66| 874| vec256_sq(out, out); // ^1111111111110 ------------------ | | 14| 874|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 874|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128_AVX2_ ## fun | | ------------------ ------------------ 67| 874|} PQCLEAN_MCELIECE8192128F_AVX2_load_bits: 188| 69|void load_bits(vec128 bits_int[][32], const unsigned char *bits) { 189| 69| int i, j; 190| 69| const unsigned char *ptr = bits; 191| | 192| 69| vec128 buf[64]; 193| | 194| 276| for (i = 0; i <= 5; i += 2) { ------------------ | Branch (194:17): [True: 207, False: 69] ------------------ 195| 13.4k| for (j = 0; j < 64; j++) { ------------------ | Branch (195:21): [True: 13.2k, False: 207] ------------------ 196| 13.2k| buf[j] = vec128_set2x(load8(ptr), load8(ptr + 512)); 197| 13.2k| ptr += 8; 198| 13.2k| } 199| | 200| 207| transpose_64x128_sp( buf ); 201| | 202| 6.83k| for (j = 0; j < 32; j++) { ------------------ | Branch (202:21): [True: 6.62k, False: 207] ------------------ 203| 6.62k| bits_int[i + 0][j] = vec128_unpack_low(buf[j], buf[j + 32]); 204| 6.62k| bits_int[i + 1][j] = vec128_unpack_high(buf[j], buf[j + 32]); 205| 6.62k| } 206| | 207| 207| ptr += 512; 208| 207| } 209| | 210| 966| for (i = 6; i <= 18; i++) { ------------------ | Branch (210:17): [True: 897, False: 69] ------------------ 211| 29.6k| for (j = 0; j < 32; j++) { ------------------ | Branch (211:21): [True: 28.7k, False: 897] ------------------ 212| 28.7k| bits_int[i][j] = load16(ptr); 213| 28.7k| ptr += 16; 214| 28.7k| } 215| 897| } 216| | 217| 276| for (i = 19; i < 25; i += 2) { ------------------ | Branch (217:18): [True: 207, False: 69] ------------------ 218| 13.4k| for (j = 0; j < 64; j++) { ------------------ | Branch (218:21): [True: 13.2k, False: 207] ------------------ 219| 13.2k| buf[j] = vec128_set2x(load8(ptr), load8(ptr + 512)); 220| 13.2k| ptr += 8; 221| 13.2k| } 222| | 223| 207| transpose_64x128_sp( buf ); 224| | 225| 6.83k| for (j = 0; j < 32; j++) { ------------------ | Branch (225:21): [True: 6.62k, False: 207] ------------------ 226| 6.62k| bits_int[i + 0][j] = vec128_unpack_low(buf[j], buf[j + 32]); 227| 6.62k| bits_int[i + 1][j] = vec128_unpack_high(buf[j], buf[j + 32]); 228| 6.62k| } 229| | 230| 207| ptr += 512; 231| 207| } 232| 69|} PQCLEAN_MCELIECE8192128F_AVX2_benes: 238| 138|void benes(vec128 *r, vec128 b[][32], int rev) { 239| 138| int inc; 240| | 241| 138| vec128 *b_ptr; 242| | 243| 138| if (rev == 0) { ------------------ | Branch (243:9): [True: 69, False: 69] ------------------ 244| 69| inc = 32; 245| 69| b_ptr = b[ 0]; 246| 69| } else { 247| 69| inc = -32; 248| 69| b_ptr = b[24]; 249| 69| } 250| | 251| | // 252| | 253| 138| transpose_64x128_sp( r ); 254| | 255| 138| layer_0(r, b_ptr); 256| 138| b_ptr += inc; 257| 138| layer_1(r, b_ptr); 258| 138| b_ptr += inc; 259| 138| layer_2(r, b_ptr); 260| 138| b_ptr += inc; 261| 138| layer_3(r, b_ptr); 262| 138| b_ptr += inc; 263| 138| layer_4(r, b_ptr); 264| 138| b_ptr += inc; 265| 138| layer_5(r, b_ptr); 266| 138| b_ptr += inc; 267| | 268| 138| transpose_64x128_sp( r ); 269| | 270| 138| layer_x(r, b_ptr); 271| 138| b_ptr += inc; 272| 138| layer_0(r, b_ptr); 273| 138| b_ptr += inc; 274| 138| layer_1(r, b_ptr); 275| 138| b_ptr += inc; 276| 138| layer_2(r, b_ptr); 277| 138| b_ptr += inc; 278| 138| layer_3(r, b_ptr); 279| 138| b_ptr += inc; 280| 138| layer_4(r, b_ptr); 281| 138| b_ptr += inc; 282| 138| layer_5(r, b_ptr); 283| 138| b_ptr += inc; 284| 138| layer_4(r, b_ptr); 285| 138| b_ptr += inc; 286| 138| layer_3(r, b_ptr); 287| 138| b_ptr += inc; 288| 138| layer_2(r, b_ptr); 289| 138| b_ptr += inc; 290| 138| layer_1(r, b_ptr); 291| 138| b_ptr += inc; 292| 138| layer_0(r, b_ptr); 293| 138| b_ptr += inc; 294| 138| layer_x(r, b_ptr); 295| 138| b_ptr += inc; 296| | 297| 138| transpose_64x128_sp( r ); 298| | 299| 138| layer_5(r, b_ptr); 300| 138| b_ptr += inc; 301| 138| layer_4(r, b_ptr); 302| 138| b_ptr += inc; 303| 138| layer_3(r, b_ptr); 304| 138| b_ptr += inc; 305| 138| layer_2(r, b_ptr); 306| 138| b_ptr += inc; 307| 138| layer_1(r, b_ptr); 308| 138| b_ptr += inc; 309| 138| layer_0(r, b_ptr); 310| | 311| 138| transpose_64x128_sp( r ); 312| 138|} PQCLEAN_MCELIECE8192128F_AVX2_bm: 147| 69|void bm(vec128 *out, vec256 *in) { 148| 69| int i; 149| 69| uint16_t N, L; 150| 69| uint16_t mask; 151| 69| uint64_t one = 1, t; 152| | 153| 69| vec128 prod[ GFBITS ]; 154| 69| vec128 interval[GFBITS]; 155| | 156| 69| typedef union { 157| 69| vec128 v[GFBITS][2]; 158| 69| vec256 V[GFBITS]; 159| 69| } db_t; 160| | 161| 69| db_t db; 162| 69| db_t BC_tmp; 163| 69| db_t BC; 164| | 165| 69| gf d, b, c0 = 1; 166| 69| gf coefs[256]; 167| | 168| | // initialization 169| | 170| 69| get_coefs(coefs, in); 171| | 172| 69| BC.v[0][0] = vec128_set2x(0, one << 63); 173| 69| BC.v[0][1] = vec128_setzero(); 174| | 175| 897| for (i = 1; i < GFBITS; i++) { ------------------ | | 6| 897|#define GFBITS 13 ------------------ | Branch (175:17): [True: 828, False: 69] ------------------ 176| 828| BC.v[i][0] = BC.v[i][1] = vec128_setzero(); 177| 828| } 178| | 179| 69| b = 1; 180| 69| L = 0; 181| | 182| | // 183| | 184| 966| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 966|#define GFBITS 13 ------------------ | Branch (184:17): [True: 897, False: 69] ------------------ 185| 897| interval[i] = vec128_setzero(); 186| 897| } 187| | 188| 17.7k| for (N = 0; N < 256; N++) { ------------------ | Branch (188:17): [True: 17.6k, False: 69] ------------------ 189| 17.6k| vec128_mul_asm(prod, interval, BC.v[0] + 1, 32); ------------------ | | 10| 17.6k|#define vec128_mul_asm CRYPTO_NAMESPACE(vec128_mul_asm) | | ------------------ | | | | 4| 17.6k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128F_AVX2_ ## fun | | ------------------ ------------------ 190| 17.6k| update_asm(interval, coefs[N], 16); ------------------ | | 1| 17.6k|#define update_asm CRYPTO_NAMESPACE(update_asm) | | ------------------ | | | | 4| 17.6k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128F_AVX2_ ## fun | | ------------------ ------------------ 191| | 192| 17.6k| d = vec_reduce_asm(prod); ------------------ | | 3| 17.6k|#define vec_reduce_asm CRYPTO_NAMESPACE(vec_reduce_asm) | | ------------------ | | | | 4| 17.6k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128F_AVX2_ ## fun | | ------------------ ------------------ 193| | 194| 17.6k| t = gf_mul2(c0, coefs[N], b); ------------------ | | 13| 17.6k|#define gf_mul2 CRYPTO_NAMESPACE(gf_mul2) | | ------------------ | | | | 4| 17.6k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128F_AVX2_ ## fun | | ------------------ ------------------ 195| 17.6k| d ^= t & 0xFFFFFFFF; 196| | 197| 17.6k| mask = mask_nonzero(d) & mask_leq(L * 2, N); 198| | 199| 247k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 247k|#define GFBITS 13 ------------------ | Branch (199:21): [True: 229k, False: 17.6k] ------------------ 200| 229k| db.v[i][0] = vec128_setbits((d >> i) & 1); 201| 229k| db.v[i][1] = vec128_setbits((b >> i) & 1); 202| 229k| } 203| | 204| 17.6k| vec256_mul((vec256 *) BC_tmp.V, (vec256 *) db.V, (vec256 *) BC.V); 205| | 206| 17.6k| vec128_cmov(BC.v, mask); 207| 17.6k| update_asm(BC.v, c0 & mask, 32); ------------------ | | 1| 17.6k|#define update_asm CRYPTO_NAMESPACE(update_asm) | | ------------------ | | | | 4| 17.6k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128F_AVX2_ ## fun | | ------------------ ------------------ 208| | 209| 247k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 247k|#define GFBITS 13 ------------------ | Branch (209:21): [True: 229k, False: 17.6k] ------------------ 210| 229k| BC.v[i][1] = vec128_xor(BC_tmp.v[i][0], BC_tmp.v[i][1]); 211| 229k| } 212| | 213| 17.6k| c0 = t >> 32; 214| 17.6k| b = (d & mask) | (b & ~mask); 215| 17.6k| L = ((N + 1 - L) & mask) | (L & ~mask); 216| 17.6k| } 217| | 218| 69| c0 = gf_inv(c0); ------------------ | | 11| 69|#define gf_inv CRYPTO_NAMESPACE(gf_inv) | | ------------------ | | | | 4| 69|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128F_AVX2_ ## fun | | ------------------ ------------------ 219| | 220| 966| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 966|#define GFBITS 13 ------------------ | Branch (220:17): [True: 897, False: 69] ------------------ 221| 897| prod[i] = vec128_setbits((c0 >> i) & 1); 222| 897| } 223| | 224| 69| vec128_mul_asm(out, prod, BC.v[0] + 1, 32); ------------------ | | 10| 69|#define vec128_mul_asm CRYPTO_NAMESPACE(vec128_mul_asm) | | ------------------ | | | | 4| 69|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128F_AVX2_ ## fun | | ------------------ ------------------ 225| 69|} PQCLEAN_MCELIECE8192128F_AVX2_controlbitsfrompermutation: 205| 69|void controlbitsfrompermutation(unsigned char *out, const int16 *pi, long long w, long long n) { 206| 69| PQCLEAN_VLA(int32, temp, (size_t)(2 * n)); ------------------ | | 57| 69|# define PQCLEAN_VLA(__t,__x,__s) __t __x[__s] ------------------ 207| 69| PQCLEAN_VLA(int16, pi_test, (size_t)n); ------------------ | | 57| 69|# define PQCLEAN_VLA(__t,__x,__s) __t __x[__s] ------------------ 208| 69| int16 diff; 209| 69| int i; 210| 69| unsigned char *ptr; 211| | 212| 69| OQS_MEM_cleanse(temp, (size_t)n * 2); 213| 69| OQS_MEM_cleanse(pi_test, (size_t)n); 214| | 215| 69| while (1) { ------------------ | Branch (215:12): [True: 69, Folded] ------------------ 216| 69| OQS_MEM_cleanse(out, (size_t)((((2 * w - 1)*n / 2) + 7) / 8)); 217| 69| cbrecursion(out, 0, 1, pi, w, n, temp); 218| | 219| | // check for correctness 220| | 221| 565k| for (i = 0; i < n; i++) { ------------------ | Branch (221:21): [True: 565k, False: 69] ------------------ 222| 565k| pi_test[i] = (int16)i; 223| 565k| } 224| | 225| 69| ptr = out; 226| 966| for (i = 0; i < w; i++) { ------------------ | Branch (226:21): [True: 897, False: 69] ------------------ 227| 897| layer(pi_test, ptr, i, (int32)n); 228| 897| ptr += n >> 4; 229| 897| } 230| | 231| 897| for (i = (int)(w - 2); i >= 0; i--) { ------------------ | Branch (231:32): [True: 828, False: 69] ------------------ 232| 828| layer(pi_test, ptr, i, (int32)n); 233| 828| ptr += n >> 4; 234| 828| } 235| | 236| 69| diff = 0; 237| 565k| for (i = 0; i < n; i++) { ------------------ | Branch (237:21): [True: 565k, False: 69] ------------------ 238| 565k| diff |= pi[i] ^ pi_test[i]; 239| 565k| } 240| | 241| 69| diff = crypto_int16_nonzero_mask(diff); ------------------ | | 12| 69|#define crypto_int16_nonzero_mask CRYPTO_NAMESPACE(crypto_int16_nonzero_mask) | | ------------------ | | | | 4| 69|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128F_AVX2_ ## fun | | ------------------ ------------------ 242| 69| crypto_declassify(&diff, sizeof diff); 243| 69| if (diff == 0) { ------------------ | Branch (243:13): [True: 69, False: 0] ------------------ 244| 69| break; 245| 69| } 246| 69| } 247| 69|} PQCLEAN_MCELIECE8192128F_AVX2_crypto_int16_negative_mask: 3| 138|crypto_int16 crypto_int16_negative_mask(crypto_int16 crypto_int16_x) { 4| 138| return crypto_int16_x >> 15; 5| 138|} PQCLEAN_MCELIECE8192128F_AVX2_crypto_int16_nonzero_mask: 7| 69|crypto_int16 crypto_int16_nonzero_mask(crypto_int16 crypto_int16_x) { 8| 69| return crypto_int16_negative_mask(crypto_int16_x) | crypto_int16_negative_mask(-crypto_int16_x); ------------------ | | 10| 69|#define crypto_int16_negative_mask CRYPTO_NAMESPACE(crypto_int16_negative_mask) | | ------------------ | | | | 4| 69|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128F_AVX2_ ## fun | | ------------------ ------------------ return crypto_int16_negative_mask(crypto_int16_x) | crypto_int16_negative_mask(-crypto_int16_x); ------------------ | | 10| 69|#define crypto_int16_negative_mask CRYPTO_NAMESPACE(crypto_int16_negative_mask) | | ------------------ | | | | 4| 69|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128F_AVX2_ ## fun | | ------------------ ------------------ 9| 69|} PQCLEAN_MCELIECE8192128F_AVX2_crypto_int32_negative_mask: 3| 44.0M|crypto_int32 crypto_int32_negative_mask(crypto_int32 crypto_int32_x) { 4| 44.0M| return crypto_int32_x >> 31; 5| 44.0M|} PQCLEAN_MCELIECE8192128F_AVX2_crypto_int32_min: 37| 44.0M|crypto_int32 crypto_int32_min(crypto_int32 crypto_int32_x, crypto_int32 crypto_int32_y) { 38| 44.0M| crypto_int32 crypto_int32_xy = crypto_int32_y ^ crypto_int32_x; 39| 44.0M| crypto_int32 crypto_int32_z = crypto_int32_y - crypto_int32_x; 40| 44.0M| crypto_int32_z ^= crypto_int32_xy & (crypto_int32_z ^ crypto_int32_y); 41| 44.0M| crypto_int32_z = crypto_int32_negative_mask(crypto_int32_z); ------------------ | | 9| 44.0M|#define crypto_int32_negative_mask CRYPTO_NAMESPACE(crypto_int32_negative_mask) | | ------------------ | | | | 4| 44.0M|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128F_AVX2_ ## fun | | ------------------ ------------------ 42| 44.0M| crypto_int32_z &= crypto_int32_xy; 43| 44.0M| return crypto_int32_x ^ crypto_int32_z; 44| 44.0M|} PQCLEAN_MCELIECE8192128F_AVX2_crypto_uint16_signed_negative_mask: 3| 21.5k|crypto_uint16_signed crypto_uint16_signed_negative_mask(crypto_uint16_signed crypto_uint16_signed_x) { 4| 21.5k| return crypto_uint16_signed_x >> 15; 5| 21.5k|} PQCLEAN_MCELIECE8192128F_AVX2_crypto_uint16_nonzero_mask: 7| 10.7k|crypto_uint16 crypto_uint16_nonzero_mask(crypto_uint16 crypto_uint16_x) { 8| 10.7k| return crypto_uint16_signed_negative_mask(crypto_uint16_x) | crypto_uint16_signed_negative_mask(-crypto_uint16_x); ------------------ | | 11| 10.7k|#define crypto_uint16_signed_negative_mask CRYPTO_NAMESPACE(crypto_uint16_signed_negative_mask) | | ------------------ | | | | 4| 10.7k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128F_AVX2_ ## fun | | ------------------ ------------------ return crypto_uint16_signed_negative_mask(crypto_uint16_x) | crypto_uint16_signed_negative_mask(-crypto_uint16_x); ------------------ | | 11| 10.7k|#define crypto_uint16_signed_negative_mask CRYPTO_NAMESPACE(crypto_uint16_signed_negative_mask) | | ------------------ | | | | 4| 10.7k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128F_AVX2_ ## fun | | ------------------ ------------------ 9| 10.7k|} PQCLEAN_MCELIECE8192128F_AVX2_crypto_uint16_zero_mask: 11| 10.7k|crypto_uint16 crypto_uint16_zero_mask(crypto_uint16 crypto_uint16_x) { 12| 10.7k| return ~crypto_uint16_nonzero_mask(crypto_uint16_x); ------------------ | | 13| 10.7k|#define crypto_uint16_nonzero_mask CRYPTO_NAMESPACE(crypto_uint16_nonzero_mask) | | ------------------ | | | | 4| 10.7k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128F_AVX2_ ## fun | | ------------------ ------------------ 13| 10.7k|} PQCLEAN_MCELIECE8192128F_AVX2_crypto_uint32_signed_negative_mask: 3| 79.7k|crypto_uint32_signed crypto_uint32_signed_negative_mask(crypto_uint32_signed crypto_uint32_signed_x) { 4| 79.7k| return crypto_uint32_signed_x >> 31; 5| 79.7k|} PQCLEAN_MCELIECE8192128F_AVX2_crypto_uint32_nonzero_mask: 7| 39.8k|crypto_uint32 crypto_uint32_nonzero_mask(crypto_uint32 crypto_uint32_x) { 8| 39.8k| return crypto_uint32_signed_negative_mask(crypto_uint32_x) | crypto_uint32_signed_negative_mask(-crypto_uint32_x); ------------------ | | 11| 39.8k|#define crypto_uint32_signed_negative_mask CRYPTO_NAMESPACE(crypto_uint32_signed_negative_mask) | | ------------------ | | | | 4| 39.8k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128F_AVX2_ ## fun | | ------------------ ------------------ return crypto_uint32_signed_negative_mask(crypto_uint32_x) | crypto_uint32_signed_negative_mask(-crypto_uint32_x); ------------------ | | 11| 39.8k|#define crypto_uint32_signed_negative_mask CRYPTO_NAMESPACE(crypto_uint32_signed_negative_mask) | | ------------------ | | | | 4| 39.8k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128F_AVX2_ ## fun | | ------------------ ------------------ 9| 39.8k|} PQCLEAN_MCELIECE8192128F_AVX2_crypto_uint32_unequal_mask: 15| 39.8k|crypto_uint32 crypto_uint32_unequal_mask(crypto_uint32 crypto_uint32_x, crypto_uint32 crypto_uint32_y) { 16| 39.8k| crypto_uint32 crypto_uint32_xy = crypto_uint32_x ^ crypto_uint32_y; 17| 39.8k| return crypto_uint32_nonzero_mask(crypto_uint32_xy); ------------------ | | 13| 39.8k|#define crypto_uint32_nonzero_mask CRYPTO_NAMESPACE(crypto_uint32_nonzero_mask) | | ------------------ | | | | 4| 39.8k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128F_AVX2_ ## fun | | ------------------ ------------------ 18| 39.8k|} PQCLEAN_MCELIECE8192128F_AVX2_crypto_uint32_equal_mask: 20| 39.8k|crypto_uint32 crypto_uint32_equal_mask(crypto_uint32 crypto_uint32_x, crypto_uint32 crypto_uint32_y) { 21| 39.8k| return ~crypto_uint32_unequal_mask(crypto_uint32_x, crypto_uint32_y); ------------------ | | 17| 39.8k|#define crypto_uint32_unequal_mask CRYPTO_NAMESPACE(crypto_uint32_unequal_mask) | | ------------------ | | | | 4| 39.8k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128F_AVX2_ ## fun | | ------------------ ------------------ 22| 39.8k|} PQCLEAN_MCELIECE8192128F_AVX2_crypto_uint64_signed_negative_mask: 3| 1.47M|crypto_uint64_signed crypto_uint64_signed_negative_mask(crypto_uint64_signed crypto_uint64_signed_x) { 4| 1.47M| return crypto_uint64_signed_x >> 63; 5| 1.47M|} PQCLEAN_MCELIECE8192128F_AVX2_crypto_uint64_nonzero_mask: 7| 736k|crypto_uint64 crypto_uint64_nonzero_mask(crypto_uint64 crypto_uint64_x) { 8| 736k| return crypto_uint64_signed_negative_mask(crypto_uint64_x) | crypto_uint64_signed_negative_mask(-crypto_uint64_x); ------------------ | | 11| 736k|#define crypto_uint64_signed_negative_mask CRYPTO_NAMESPACE(crypto_uint64_signed_negative_mask) | | ------------------ | | | | 4| 736k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128F_AVX2_ ## fun | | ------------------ ------------------ return crypto_uint64_signed_negative_mask(crypto_uint64_x) | crypto_uint64_signed_negative_mask(-crypto_uint64_x); ------------------ | | 11| 736k|#define crypto_uint64_signed_negative_mask CRYPTO_NAMESPACE(crypto_uint64_signed_negative_mask) | | ------------------ | | | | 4| 736k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128F_AVX2_ ## fun | | ------------------ ------------------ 9| 736k|} PQCLEAN_MCELIECE8192128F_AVX2_crypto_uint64_zero_mask: 11| 117k|crypto_uint64 crypto_uint64_zero_mask(crypto_uint64 crypto_uint64_x) { 12| 117k| return ~crypto_uint64_nonzero_mask(crypto_uint64_x); ------------------ | | 13| 117k|#define crypto_uint64_nonzero_mask CRYPTO_NAMESPACE(crypto_uint64_nonzero_mask) | | ------------------ | | | | 4| 117k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128F_AVX2_ ## fun | | ------------------ ------------------ 13| 117k|} PQCLEAN_MCELIECE8192128F_AVX2_crypto_uint64_unequal_mask: 15| 619k|crypto_uint64 crypto_uint64_unequal_mask(crypto_uint64 crypto_uint64_x, crypto_uint64 crypto_uint64_y) { 16| 619k| crypto_uint64 crypto_uint64_xy = crypto_uint64_x ^ crypto_uint64_y; 17| 619k| return crypto_uint64_nonzero_mask(crypto_uint64_xy); ------------------ | | 13| 619k|#define crypto_uint64_nonzero_mask CRYPTO_NAMESPACE(crypto_uint64_nonzero_mask) | | ------------------ | | | | 4| 619k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128F_AVX2_ ## fun | | ------------------ ------------------ 18| 619k|} PQCLEAN_MCELIECE8192128F_AVX2_crypto_uint64_equal_mask: 20| 619k|crypto_uint64 crypto_uint64_equal_mask(crypto_uint64 crypto_uint64_x, crypto_uint64 crypto_uint64_y) { 21| 619k| return ~crypto_uint64_unequal_mask(crypto_uint64_x, crypto_uint64_y); ------------------ | | 17| 619k|#define crypto_uint64_unequal_mask CRYPTO_NAMESPACE(crypto_uint64_unequal_mask) | | ------------------ | | | | 4| 619k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128F_AVX2_ ## fun | | ------------------ ------------------ 22| 619k|} PQCLEAN_MCELIECE8192128F_AVX2_decrypt: 141| 69|int decrypt(unsigned char *e, const unsigned char *sk, const unsigned char *s) { 142| 69| int i; 143| | 144| 69| uint16_t check_synd; 145| 69| uint16_t check_weight; 146| | 147| 69| vec256 inv[ 64 ][ GFBITS ]; 148| 69| vec256 scaled[ 64 ][ GFBITS ]; 149| 69| vec256 eval[ 64 ][ GFBITS ]; 150| | 151| 69| vec128 error128[ 64 ]; 152| 69| vec256 error256[ 32 ]; 153| | 154| 69| vec256 s_priv[ GFBITS ]; 155| 69| vec256 s_priv_cmp[ GFBITS ]; 156| 69| vec128 locator[ GFBITS ]; 157| | 158| 69| vec128 recv128[ 64 ]; 159| 69| vec256 recv256[ 32 ]; 160| 69| vec256 allone; 161| | 162| 69| vec128 bits_int[25][32]; 163| | 164| | // Berlekamp decoder 165| | 166| 69| preprocess(recv128, s); 167| | 168| 69| load_bits(bits_int, sk + IRR_BYTES); ------------------ | | 10| 69|#define load_bits CRYPTO_NAMESPACE(load_bits) | | ------------------ | | | | 4| 69|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128F_AVX2_ ## fun | | ------------------ ------------------ load_bits(bits_int, sk + IRR_BYTES); ------------------ | | 11| 69|#define IRR_BYTES (SYS_T * 2) | | ------------------ | | | | 8| 69|#define SYS_T 128 | | ------------------ ------------------ 169| 69| benes(recv128, bits_int, 1); ------------------ | | 9| 69|#define benes CRYPTO_NAMESPACE(benes) | | ------------------ | | | | 4| 69|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128F_AVX2_ ## fun | | ------------------ ------------------ 170| 69| reformat_128to256(recv256, recv128); 171| | 172| 69| scaling(scaled, inv, sk, recv256); // scaling 173| 69| fft_tr(s_priv, scaled); // transposed FFT ------------------ | | 9| 69|#define fft_tr CRYPTO_NAMESPACE(fft_tr) | | ------------------ | | | | 4| 69|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128F_AVX2_ ## fun | | ------------------ ------------------ 174| 69| bm(locator, s_priv); // Berlekamp Massey ------------------ | | 10| 69|#define bm CRYPTO_NAMESPACE(bm) | | ------------------ | | | | 4| 69|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128F_AVX2_ ## fun | | ------------------ ------------------ 175| | 176| 69| fft(eval, locator); // FFT ------------------ | | 10| 69|#define fft CRYPTO_NAMESPACE(fft) | | ------------------ | | | | 4| 69|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128F_AVX2_ ## fun | | ------------------ ------------------ 177| | 178| | // reencryption and weight check 179| | 180| 69| allone = vec256_set1_16b(0xFFFF); 181| | 182| 2.27k| for (i = 0; i < 32; i++) { ------------------ | Branch (182:17): [True: 2.20k, False: 69] ------------------ 183| 2.20k| error256[i] = vec256_or_reduce(eval[i]); 184| 2.20k| error256[i] = vec256_xor(error256[i], allone); 185| 2.20k| } 186| | 187| 69| check_weight = weight(error256) ^ SYS_T; ------------------ | | 8| 69|#define SYS_T 128 ------------------ 188| 69| check_weight -= 1; 189| 69| check_weight >>= 15; 190| | 191| 69| scaling_inv(scaled, inv, error256); 192| 69| fft_tr(s_priv_cmp, scaled); ------------------ | | 9| 69|#define fft_tr CRYPTO_NAMESPACE(fft_tr) | | ------------------ | | | | 4| 69|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128F_AVX2_ ## fun | | ------------------ ------------------ 193| | 194| 69| check_synd = synd_cmp(s_priv, s_priv_cmp); 195| | 196| | // 197| | 198| 69| reformat_256to128(error128, error256); 199| 69| benes(error128, bits_int, 0); ------------------ | | 9| 69|#define benes CRYPTO_NAMESPACE(benes) | | ------------------ | | | | 4| 69|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128F_AVX2_ ## fun | | ------------------ ------------------ 200| | 201| 4.48k| for (i = 0; i < 64; i++) { ------------------ | Branch (201:17): [True: 4.41k, False: 69] ------------------ 202| 4.41k| store16(e + i * 16, error128[i]); 203| 4.41k| } 204| | 205| 69| return 1 - (check_synd & check_weight); 206| 69|} PQCLEAN_MCELIECE8192128F_AVX2_encrypt: 87| 69|void encrypt(unsigned char *s, const unsigned char *pk, unsigned char *e) { 88| 69| gen_e(e); 89| | 90| 69| syndrome_asm(s, pk, e); ------------------ | | 1| 69|#define syndrome_asm CRYPTO_NAMESPACE(syndrome_asm) | | ------------------ | | | | 4| 69|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128F_AVX2_ ## fun | | ------------------ ------------------ 91| 69|} PQCLEAN_MCELIECE8192128F_AVX2_fft: 277| 222|void fft(vec256 out[][GFBITS], vec128 *in) { 278| 222| radix_conversions(in); 279| 222| butterflies(out, in); 280| 222|} PQCLEAN_MCELIECE8192128F_AVX2_fft_tr: 380| 138|void fft_tr(vec256 *out, vec256 in[][ GFBITS ]) { 381| 138| butterflies_tr(out, in); 382| 138| radix_conversions_tr(out); 383| 138|} PQCLEAN_MCELIECE8192128F_AVX2_gf_mul: 12| 1.37M|gf gf_mul(gf in0, gf in1) { 13| 1.37M| int i; 14| | 15| 1.37M| uint64_t tmp; 16| 1.37M| uint64_t t0; 17| 1.37M| uint64_t t1; 18| 1.37M| uint64_t t; 19| | 20| 1.37M| t0 = in0; 21| 1.37M| t1 = in1; 22| | 23| 1.37M| tmp = t0 * (t1 & 1); 24| | 25| 17.8M| for (i = 1; i < GFBITS; i++) { ------------------ | | 6| 17.8M|#define GFBITS 13 ------------------ | Branch (25:17): [True: 16.5M, False: 1.37M] ------------------ 26| 16.5M| tmp ^= (t0 * (t1 & (1 << i))); 27| 16.5M| } 28| | 29| | // 30| | 31| 1.37M| t = tmp & 0x1FF0000; 32| 1.37M| tmp ^= (t >> 9) ^ (t >> 10) ^ (t >> 12) ^ (t >> 13); 33| | 34| 1.37M| t = tmp & 0x000E000; 35| 1.37M| tmp ^= (t >> 9) ^ (t >> 10) ^ (t >> 12) ^ (t >> 13); 36| | 37| 1.37M| return tmp & GFMASK; ------------------ | | 19| 1.37M|#define GFMASK ((1 << GFBITS) - 1) | | ------------------ | | | | 6| 1.37M|#define GFBITS 13 | | ------------------ ------------------ 38| 1.37M|} PQCLEAN_MCELIECE8192128F_AVX2_gf_frac: 148| 10.8k|gf gf_frac(gf den, gf num) { 149| 10.8k| gf tmp_11; 150| 10.8k| gf tmp_1111; 151| 10.8k| gf out; 152| | 153| 10.8k| tmp_11 = gf_sqmul(den, den); // 11 154| 10.8k| tmp_1111 = gf_sq2mul(tmp_11, tmp_11); // 1111 155| 10.8k| out = gf_sq2(tmp_1111); 156| 10.8k| out = gf_sq2mul(out, tmp_1111); // 11111111 157| 10.8k| out = gf_sq2(out); 158| 10.8k| out = gf_sq2mul(out, tmp_1111); // 111111111111 159| | 160| 10.8k| return gf_sqmul(out, num); // 1111111111110 161| 10.8k|} PQCLEAN_MCELIECE8192128F_AVX2_gf_inv: 164| 10.8k|gf gf_inv(gf den) { 165| 10.8k| return gf_frac(den, ((gf) 1)); ------------------ | | 10| 10.8k|#define gf_frac CRYPTO_NAMESPACE(gf_frac) | | ------------------ | | | | 4| 10.8k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128F_AVX2_ ## fun | | ------------------ ------------------ 166| 10.8k|} bm.c:PQCLEAN_MCELIECE8192128F_AVX2_gf_mul2: 31| 17.6k|static inline uint64_t gf_mul2(gf a, gf b0, gf b1) { 32| 17.6k| int i; 33| | 34| 17.6k| uint64_t tmp = 0; 35| 17.6k| uint64_t t0; 36| 17.6k| uint64_t t1; 37| 17.6k| uint64_t t; 38| 17.6k| uint64_t mask = 0x0000000100000001; 39| | 40| 17.6k| t0 = a; 41| 17.6k| t1 = b1; 42| 17.6k| t1 = (t1 << 32) | b0; 43| | 44| 247k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 247k|#define GFBITS 13 ------------------ | Branch (44:17): [True: 229k, False: 17.6k] ------------------ 45| 229k| tmp ^= t0 * (t1 & mask); 46| 229k| mask += mask; 47| 229k| } 48| | 49| | // 50| | 51| 17.6k| t = tmp & 0x01FF000001FF0000; 52| 17.6k| tmp ^= (t >> 9) ^ (t >> 10) ^ (t >> 12) ^ (t >> 13); 53| | 54| 17.6k| t = tmp & 0x0000E0000000E000; 55| 17.6k| tmp ^= (t >> 9) ^ (t >> 10) ^ (t >> 12) ^ (t >> 13); 56| | 57| 17.6k| return tmp & 0x00001FFF00001FFF; 58| 17.6k|} pk_gen.c:PQCLEAN_MCELIECE8192128F_AVX2_int32_sort: 21| 69|static void int32_sort(int32_t *x, long long n) { 22| 69| long long top, p, q, r, i; 23| | 24| 69| if (n < 2) { ------------------ | Branch (24:9): [True: 0, False: 69] ------------------ 25| 0| return; 26| 0| } 27| 69| top = 1; 28| 759| while (top < n - top) { ------------------ | Branch (28:12): [True: 690, False: 69] ------------------ 29| 690| top += top; 30| 690| } 31| | 32| 828| for (p = top; p > 0; p >>= 1) { ------------------ | Branch (32:19): [True: 759, False: 69] ------------------ 33| 1.12M| for (i = 0; i < n - p; ++i) { ------------------ | Branch (33:21): [True: 1.12M, False: 759] ------------------ 34| 1.12M| if (!(i & p)) { ------------------ | Branch (34:17): [True: 596k, False: 525k] ------------------ 35| 596k| int32_MINMAX(x[i], x[i + p]); ------------------ | | 11| 596k| do { \ | | 12| 596k| int32_t ab = (b) ^ (a); \ | | 13| 596k| int32_t c = (b) - (a); \ | | 14| 596k| c ^= ab & ((c) ^ (b)); \ | | 15| 596k| c >>= 31; \ | | 16| 596k| c &= ab; \ | | 17| 596k| (a) ^= c; \ | | 18| 596k| (b) ^= c; \ | | 19| 596k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 596k] | | ------------------ ------------------ 36| 596k| } 37| 1.12M| } 38| 759| i = 0; 39| 4.55k| for (q = top; q > p; q >>= 1) { ------------------ | Branch (39:23): [True: 3.79k, False: 759] ------------------ 40| 1.01M| for (; i < n - q; ++i) { ------------------ | Branch (40:20): [True: 1.00M, False: 3.79k] ------------------ 41| 1.00M| if (!(i & p)) { ------------------ | Branch (41:21): [True: 525k, False: 481k] ------------------ 42| 525k| int32_t a = x[i + p]; 43| 3.08M| for (r = q; r > p; r >>= 1) { ------------------ | Branch (43:33): [True: 2.55M, False: 525k] ------------------ 44| 2.55M| int32_MINMAX(a, x[i + r]); ------------------ | | 11| 2.55M| do { \ | | 12| 2.55M| int32_t ab = (b) ^ (a); \ | | 13| 2.55M| int32_t c = (b) - (a); \ | | 14| 2.55M| c ^= ab & ((c) ^ (b)); \ | | 15| 2.55M| c >>= 31; \ | | 16| 2.55M| c &= ab; \ | | 17| 2.55M| (a) ^= c; \ | | 18| 2.55M| (b) ^= c; \ | | 19| 2.55M| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 2.55M] | | ------------------ ------------------ 45| 2.55M| } 46| 525k| x[i + p] = a; 47| 525k| } 48| 1.00M| } 49| 3.79k| } 50| 759| } 51| 69|} controlbits.c:PQCLEAN_MCELIECE8192128F_AVX2_int32_sort: 21| 2.26M|static void int32_sort(int32_t *x, long long n) { 22| 2.26M| long long top, p, q, r, i; 23| | 24| 2.26M| if (n < 2) { ------------------ | Branch (24:9): [True: 0, False: 2.26M] ------------------ 25| 0| return; 26| 0| } 27| 2.26M| top = 1; 28| 7.92M| while (top < n - top) { ------------------ | Branch (28:12): [True: 5.66M, False: 2.26M] ------------------ 29| 5.66M| top += top; 30| 5.66M| } 31| | 32| 10.1M| for (p = top; p > 0; p >>= 1) { ------------------ | Branch (32:19): [True: 7.92M, False: 2.26M] ------------------ 33| 1.09G| for (i = 0; i < n - p; ++i) { ------------------ | Branch (33:21): [True: 1.08G, False: 7.92M] ------------------ 34| 1.08G| if (!(i & p)) { ------------------ | Branch (34:17): [True: 605M, False: 477M] ------------------ 35| 605M| int32_MINMAX(x[i], x[i + p]); ------------------ | | 11| 605M| do { \ | | 12| 605M| int32_t ab = (b) ^ (a); \ | | 13| 605M| int32_t c = (b) - (a); \ | | 14| 605M| c ^= ab & ((c) ^ (b)); \ | | 15| 605M| c >>= 31; \ | | 16| 605M| c &= ab; \ | | 17| 605M| (a) ^= c; \ | | 18| 605M| (b) ^= c; \ | | 19| 605M| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 605M] | | ------------------ ------------------ 36| 605M| } 37| 1.08G| } 38| 7.92M| i = 0; 39| 21.5M| for (q = top; q > p; q >>= 1) { ------------------ | Branch (39:23): [True: 13.5M, False: 7.92M] ------------------ 40| 967M| for (; i < n - q; ++i) { ------------------ | Branch (40:20): [True: 954M, False: 13.5M] ------------------ 41| 954M| if (!(i & p)) { ------------------ | Branch (41:21): [True: 477M, False: 477M] ------------------ 42| 477M| int32_t a = x[i + p]; 43| 2.82G| for (r = q; r > p; r >>= 1) { ------------------ | Branch (43:33): [True: 2.35G, False: 477M] ------------------ 44| 2.35G| int32_MINMAX(a, x[i + r]); ------------------ | | 11| 2.35G| do { \ | | 12| 2.35G| int32_t ab = (b) ^ (a); \ | | 13| 2.35G| int32_t c = (b) - (a); \ | | 14| 2.35G| c ^= ab & ((c) ^ (b)); \ | | 15| 2.35G| c >>= 31; \ | | 16| 2.35G| c &= ab; \ | | 17| 2.35G| (a) ^= c; \ | | 18| 2.35G| (b) ^= c; \ | | 19| 2.35G| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 2.35G] | | ------------------ ------------------ 45| 2.35G| } 46| 477M| x[i + p] = a; 47| 477M| } 48| 954M| } 49| 13.5M| } 50| 7.92M| } 51| 2.26M|} encrypt.c:PQCLEAN_MCELIECE8192128F_AVX2_int32_sort: 21| 314|static void int32_sort(int32_t *x, long long n) { 22| 314| long long top, p, q, r, i; 23| | 24| 314| if (n < 2) { ------------------ | Branch (24:9): [True: 0, False: 314] ------------------ 25| 0| return; 26| 0| } 27| 314| top = 1; 28| 2.19k| while (top < n - top) { ------------------ | Branch (28:12): [True: 1.88k, False: 314] ------------------ 29| 1.88k| top += top; 30| 1.88k| } 31| | 32| 2.51k| for (p = top; p > 0; p >>= 1) { ------------------ | Branch (32:19): [True: 2.19k, False: 314] ------------------ 33| 243k| for (i = 0; i < n - p; ++i) { ------------------ | Branch (33:21): [True: 241k, False: 2.19k] ------------------ 34| 241k| if (!(i & p)) { ------------------ | Branch (34:17): [True: 140k, False: 100k] ------------------ 35| 140k| int32_MINMAX(x[i], x[i + p]); ------------------ | | 11| 140k| do { \ | | 12| 140k| int32_t ab = (b) ^ (a); \ | | 13| 140k| int32_t c = (b) - (a); \ | | 14| 140k| c ^= ab & ((c) ^ (b)); \ | | 15| 140k| c >>= 31; \ | | 16| 140k| c &= ab; \ | | 17| 140k| (a) ^= c; \ | | 18| 140k| (b) ^= c; \ | | 19| 140k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 140k] | | ------------------ ------------------ 36| 140k| } 37| 241k| } 38| 2.19k| i = 0; 39| 8.79k| for (q = top; q > p; q >>= 1) { ------------------ | Branch (39:23): [True: 6.59k, False: 2.19k] ------------------ 40| 208k| for (; i < n - q; ++i) { ------------------ | Branch (40:20): [True: 201k, False: 6.59k] ------------------ 41| 201k| if (!(i & p)) { ------------------ | Branch (41:21): [True: 100k, False: 100k] ------------------ 42| 100k| int32_t a = x[i + p]; 43| 422k| for (r = q; r > p; r >>= 1) { ------------------ | Branch (43:33): [True: 321k, False: 100k] ------------------ 44| 321k| int32_MINMAX(a, x[i + r]); ------------------ | | 11| 321k| do { \ | | 12| 321k| int32_t ab = (b) ^ (a); \ | | 13| 321k| int32_t c = (b) - (a); \ | | 14| 321k| c ^= ab & ((c) ^ (b)); \ | | 15| 321k| c >>= 31; \ | | 16| 321k| c &= ab; \ | | 17| 321k| (a) ^= c; \ | | 18| 321k| (b) ^= c; \ | | 19| 321k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 321k] | | ------------------ ------------------ 45| 321k| } 46| 100k| x[i + p] = a; 47| 100k| } 48| 201k| } 49| 6.59k| } 50| 2.19k| } 51| 314|} PQCLEAN_MCELIECE8192128F_AVX2_crypto_kem_enc: 22| 69|) { 23| 69| unsigned char e[ SYS_N / 8 ]; 24| 69| unsigned char one_ec[ 1 + SYS_N / 8 + SYND_BYTES ] = {1}; 25| | 26| | // 27| | 28| 69| encrypt(c, pk, e); ------------------ | | 9| 69|#define encrypt CRYPTO_NAMESPACE(encrypt) | | ------------------ | | | | 4| 69|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128F_AVX2_ ## fun | | ------------------ ------------------ 29| | 30| 69| memcpy(one_ec + 1, e, SYS_N / 8); ------------------ | | 7| 69|#define SYS_N 8192 ------------------ 31| 69| memcpy(one_ec + 1 + SYS_N / 8, c, SYND_BYTES); ------------------ | | 7| 69|#define SYS_N 8192 ------------------ memcpy(one_ec + 1 + SYS_N / 8, c, SYND_BYTES); ------------------ | | 17| 69|#define SYND_BYTES ((PK_NROWS + 7)/8) | | ------------------ | | | | 13| 69|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 69|#define SYS_T 128 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 69|#define GFBITS 13 | | | | ------------------ | | ------------------ ------------------ 32| | 33| 69| crypto_hash_32b(key, one_ec, sizeof(one_ec)); ------------------ | | 7| 69| shake256(out, 32, in, inlen) | | ------------------ | | | | 12| 69|#define shake256 OQS_SHA3_shake256 | | ------------------ ------------------ 34| | 35| 69| return 0; 36| 69|} PQCLEAN_MCELIECE8192128F_AVX2_crypto_kem_dec: 42| 69|) { 43| 69| int i; 44| | 45| 69| unsigned char ret_decrypt = 0; 46| | 47| 69| uint16_t m; 48| | 49| 69| unsigned char e[ SYS_N / 8 ]; 50| 69| unsigned char preimage[ 1 + SYS_N / 8 + SYND_BYTES ]; 51| 69| unsigned char *x = preimage; 52| 69| const unsigned char *s = sk + 40 + IRR_BYTES + COND_BYTES; ------------------ | | 11| 69|#define IRR_BYTES (SYS_T * 2) | | ------------------ | | | | 8| 69|#define SYS_T 128 | | ------------------ ------------------ const unsigned char *s = sk + 40 + IRR_BYTES + COND_BYTES; ------------------ | | 10| 69|#define COND_BYTES ((1 << (GFBITS-4))*(2*GFBITS - 1)) | | ------------------ | | | | 6| 69|#define GFBITS 13 | | ------------------ | | #define COND_BYTES ((1 << (GFBITS-4))*(2*GFBITS - 1)) | | ------------------ | | | | 6| 69|#define GFBITS 13 | | ------------------ ------------------ 53| | 54| | // 55| | 56| 69| ret_decrypt = (unsigned char)decrypt(e, sk + 40, c); ------------------ | | 9| 69|#define decrypt CRYPTO_NAMESPACE(decrypt) | | ------------------ | | | | 4| 69|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128F_AVX2_ ## fun | | ------------------ ------------------ 57| | 58| 69| m = ret_decrypt; 59| 69| m -= 1; 60| 69| m >>= 8; 61| | 62| 69| *x++ = m & 1; 63| 70.7k| for (i = 0; i < SYS_N / 8; i++) { ------------------ | | 7| 70.7k|#define SYS_N 8192 ------------------ | Branch (63:17): [True: 70.6k, False: 69] ------------------ 64| 70.6k| *x++ = (~m & s[i]) | (m & e[i]); 65| 70.6k| } 66| | 67| 14.4k| for (i = 0; i < SYND_BYTES; i++) { ------------------ | | 17| 14.4k|#define SYND_BYTES ((PK_NROWS + 7)/8) | | ------------------ | | | | 13| 14.4k|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 14.4k|#define SYS_T 128 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 14.4k|#define GFBITS 13 | | | | ------------------ | | ------------------ ------------------ | Branch (67:17): [True: 14.3k, False: 69] ------------------ 68| 14.3k| *x++ = c[i]; 69| 14.3k| } 70| | 71| 69| crypto_hash_32b(key, preimage, sizeof(preimage)); ------------------ | | 7| 69| shake256(out, 32, in, inlen) | | ------------------ | | | | 12| 69|#define shake256 OQS_SHA3_shake256 | | ------------------ ------------------ 72| | 73| 69| return 0; 74| 69|} PQCLEAN_MCELIECE8192128F_AVX2_crypto_kem_keypair: 80| 69|) { 81| 69| int i; 82| 69| unsigned char seed[ 33 ] = {64}; 83| 69| unsigned char r[ SYS_N / 8 + (1 << GFBITS)*sizeof(uint32_t) + SYS_T * 2 + 32 ]; 84| 69| unsigned char *rp, *skp; 85| 69| uint64_t pivots; 86| | 87| 69| gf f[ SYS_T ]; // element in GF(2^mt) 88| 69| gf irr[ SYS_T ]; // Goppa polynomial 89| 69| uint32_t perm[ 1 << GFBITS ]; // random permutation as 32-bit integers 90| 69| int16_t pi[ 1 << GFBITS ]; // random permutation 91| | 92| 69| randombytes(seed + 1, 32); ------------------ | | 8| 69|#define randombytes OQS_randombytes ------------------ 93| | 94| 84| while (1) { ------------------ | Branch (94:12): [True: 84, Folded] ------------------ 95| 84| rp = &r[ sizeof(r) - 32 ]; 96| 84| skp = sk; 97| | 98| | // expanding and updating the seed 99| | 100| 84| shake(r, sizeof(r), seed, 33); ------------------ | | 10| 84| shake256(out, outlen, in, inlen) | | ------------------ | | | | 12| 84|#define shake256 OQS_SHA3_shake256 | | ------------------ ------------------ 101| 84| memcpy(skp, seed + 1, 32); 102| 84| skp += 32 + 8; 103| 84| memcpy(seed + 1, &r[ sizeof(r) - 32 ], 32); 104| | 105| | // generating irreducible polynomial 106| | 107| 84| rp -= sizeof(f); 108| | 109| 10.8k| for (i = 0; i < SYS_T; i++) { ------------------ | | 8| 10.8k|#define SYS_T 128 ------------------ | Branch (109:21): [True: 10.7k, False: 84] ------------------ 110| 10.7k| f[i] = load_gf(rp + i * 2); 111| 10.7k| } 112| | 113| 84| if (genpoly_gen(irr, f)) { ------------------ | | 9| 84|#define genpoly_gen CRYPTO_NAMESPACE(genpoly_gen) | | ------------------ | | | | 4| 84|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128F_AVX2_ ## fun | | ------------------ ------------------ | Branch (113:13): [True: 0, False: 84] ------------------ 114| 0| continue; 115| 0| } 116| | 117| 10.8k| for (i = 0; i < SYS_T; i++) { ------------------ | | 8| 10.8k|#define SYS_T 128 ------------------ | Branch (117:21): [True: 10.7k, False: 84] ------------------ 118| 10.7k| store_gf(skp + i * 2, irr[i]); 119| 10.7k| } 120| | 121| 84| skp += IRR_BYTES; ------------------ | | 11| 84|#define IRR_BYTES (SYS_T * 2) | | ------------------ | | | | 8| 84|#define SYS_T 128 | | ------------------ ------------------ 122| | 123| | // generating permutation 124| | 125| 84| rp -= sizeof(perm); 126| | 127| 688k| for (i = 0; i < (1 << GFBITS); i++) { ------------------ | | 6| 688k|#define GFBITS 13 ------------------ | Branch (127:21): [True: 688k, False: 84] ------------------ 128| 688k| perm[i] = load4(rp + i * 4); 129| 688k| } 130| | 131| 84| if (pk_gen(pk, skp - IRR_BYTES, perm, pi, &pivots)) { ------------------ | | 9| 84|#define pk_gen CRYPTO_NAMESPACE(pk_gen) | | ------------------ | | | | 4| 84|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128F_AVX2_ ## fun | | ------------------ ------------------ if (pk_gen(pk, skp - IRR_BYTES, perm, pi, &pivots)) { ------------------ | | 11| 84|#define IRR_BYTES (SYS_T * 2) | | ------------------ | | | | 8| 84|#define SYS_T 128 | | ------------------ ------------------ | Branch (131:13): [True: 15, False: 69] ------------------ 132| 15| continue; 133| 15| } 134| | 135| 69| controlbitsfrompermutation(skp, pi, GFBITS, 1 << GFBITS); ------------------ | | 10| 69|#define controlbitsfrompermutation CRYPTO_NAMESPACE(controlbitsfrompermutation) | | ------------------ | | | | 4| 69|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128F_AVX2_ ## fun | | ------------------ ------------------ controlbitsfrompermutation(skp, pi, GFBITS, 1 << GFBITS); ------------------ | | 6| 69|#define GFBITS 13 ------------------ controlbitsfrompermutation(skp, pi, GFBITS, 1 << GFBITS); ------------------ | | 6| 69|#define GFBITS 13 ------------------ 136| 69| skp += COND_BYTES; ------------------ | | 10| 69|#define COND_BYTES ((1 << (GFBITS-4))*(2*GFBITS - 1)) | | ------------------ | | | | 6| 69|#define GFBITS 13 | | ------------------ | | #define COND_BYTES ((1 << (GFBITS-4))*(2*GFBITS - 1)) | | ------------------ | | | | 6| 69|#define GFBITS 13 | | ------------------ ------------------ 137| | 138| | // storing the random string s 139| | 140| 69| rp -= SYS_N / 8; ------------------ | | 7| 69|#define SYS_N 8192 ------------------ 141| 69| memcpy(skp, rp, SYS_N / 8); ------------------ | | 7| 69|#define SYS_N 8192 ------------------ 142| | 143| | // storing positions of the 32 pivots 144| | 145| 69| store8(sk + 32, pivots); 146| | 147| 69| break; 148| 84| } 149| | 150| 69| return 0; 151| 69|} PQCLEAN_MCELIECE8192128F_AVX2_pk_gen: 315| 84|int pk_gen(unsigned char *pk, const unsigned char *irr, const uint32_t *perm, int16_t *pi, uint64_t *pivots) { 316| 84| int i, j, k, b; 317| 84| int row, c; 318| | 319| 84| union { 320| 84| uint64_t w[ PK_NROWS ][ nBlocks_I * 4 ]; 321| 84| vec256 v[ PK_NROWS ][ nBlocks_I ]; 322| 84| } mat; 323| | 324| 84| union { 325| 84| uint64_t w[ PK_NROWS ][ 52 ]; 326| 84| vec256 v[ PK_NROWS ][ 13 ]; 327| 84| } par; 328| | 329| 84| uint16_t m; 330| 84| vec256 mm; 331| | 332| 84| vec128 sk_int[ GFBITS ]; 333| | 334| 84| vec256 consts[ 32 ][ GFBITS ]; 335| 84| vec256 eval[ 32 ][ GFBITS ]; 336| 84| vec256 prod[ 32 ][ GFBITS ]; 337| 84| vec256 tmp[ GFBITS ]; 338| | 339| 84| uint64_t list[1 << GFBITS]; 340| 84| uint64_t one = 1; 341| 84| uint64_t t; 342| | 343| 84| uint16_t ind[ PK_NROWS ]; 344| 84| uint16_t ind_inv[ PK_NROWS ]; 345| | 346| | // compute the inverses 347| | 348| 84| irr_load(sk_int, irr); 349| | 350| 84| fft(eval, sk_int); ------------------ | | 10| 84|#define fft CRYPTO_NAMESPACE(fft) | | ------------------ | | | | 4| 84|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128F_AVX2_ ## fun | | ------------------ ------------------ 351| | 352| 84| vec256_copy(prod[0], eval[0]); 353| | 354| 2.68k| for (i = 1; i < 32; i++) { ------------------ | Branch (354:17): [True: 2.60k, False: 84] ------------------ 355| 2.60k| vec256_mul(prod[i], prod[i - 1], eval[i]); 356| 2.60k| } 357| | 358| 84| vec256_inv(tmp, prod[31]); ------------------ | | 11| 84|#define vec256_inv CRYPTO_NAMESPACE(vec256_inv) | | ------------------ | | | | 4| 84|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128F_AVX2_ ## fun | | ------------------ ------------------ 359| | 360| 2.68k| for (i = 30; i >= 0; i--) { ------------------ | Branch (360:18): [True: 2.60k, False: 84] ------------------ 361| 2.60k| vec256_mul(prod[i + 1], prod[i], tmp); 362| 2.60k| vec256_mul(tmp, tmp, eval[i + 1]); 363| 2.60k| } 364| | 365| 84| vec256_copy(prod[0], tmp); 366| | 367| | // fill matrix 368| | 369| 84| de_bitslicing(list, prod); 370| | 371| 688k| for (i = 0; i < (1 << GFBITS); i++) { ------------------ | | 6| 688k|#define GFBITS 13 ------------------ | Branch (371:17): [True: 688k, False: 84] ------------------ 372| 688k| list[i] <<= GFBITS; ------------------ | | 6| 688k|#define GFBITS 13 ------------------ 373| 688k| list[i] |= i; 374| 688k| list[i] |= ((uint64_t) perm[i]) << 31; 375| 688k| } 376| | 377| 84| uint64_sort(list, 1 << GFBITS); ------------------ | | 6| 84|#define GFBITS 13 ------------------ 378| | 379| 619k| for (i = 1; i < (1 << GFBITS); i++) { ------------------ | | 6| 619k|#define GFBITS 13 ------------------ | Branch (379:17): [True: 619k, False: 69] ------------------ 380| 619k| if (uint64_is_equal_declassify(list[i - 1] >> 31, list[i] >> 31)) { ------------------ | Branch (380:13): [True: 15, False: 619k] ------------------ 381| 15| return -1; 382| 15| } 383| 619k| } 384| | 385| 69| to_bitslicing_2x(consts, prod, list); 386| | 387| 565k| for (i = 0; i < (1 << GFBITS); i++) { ------------------ | | 6| 565k|#define GFBITS 13 ------------------ | Branch (387:17): [True: 565k, False: 69] ------------------ 388| 565k| pi[i] = list[i] & GFMASK; ------------------ | | 19| 565k|#define GFMASK ((1 << GFBITS) - 1) | | ------------------ | | | | 6| 565k|#define GFBITS 13 | | ------------------ ------------------ 389| 565k| } 390| | 391| 552| for (j = 0; j < nBlocks_I; j++) { ------------------ | | 32| 552|#define nBlocks_I ((PK_NROWS + 255) / 256) | | ------------------ | | | | 13| 552|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 552|#define SYS_T 128 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 552|#define GFBITS 13 | | | | ------------------ | | ------------------ ------------------ | Branch (391:17): [True: 483, False: 69] ------------------ 392| 6.76k| for (k = 0; k < GFBITS; k++) { ------------------ | | 6| 6.76k|#define GFBITS 13 ------------------ | Branch (392:21): [True: 6.27k, False: 483] ------------------ 393| 6.27k| mat.v[ k ][ j ] = prod[ j ][ k ]; 394| 6.27k| } 395| 483| } 396| | 397| 8.83k| for (i = 1; i < SYS_T; i++) { ------------------ | | 8| 8.83k|#define SYS_T 128 ------------------ | Branch (397:17): [True: 8.76k, False: 69] ------------------ 398| 70.1k| for (j = 0; j < nBlocks_I; j++) { ------------------ | | 32| 70.1k|#define nBlocks_I ((PK_NROWS + 255) / 256) | | ------------------ | | | | 13| 70.1k|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 70.1k|#define SYS_T 128 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 70.1k|#define GFBITS 13 | | | | ------------------ | | ------------------ ------------------ | Branch (398:21): [True: 61.3k, False: 8.76k] ------------------ 399| 61.3k| vec256_mul(prod[j], prod[j], consts[j]); 400| | 401| 858k| for (k = 0; k < GFBITS; k++) { ------------------ | | 6| 858k|#define GFBITS 13 ------------------ | Branch (401:25): [True: 797k, False: 61.3k] ------------------ 402| 797k| mat.v[ i * GFBITS + k ][ j ] = prod[ j ][ k ]; ------------------ | | 6| 797k|#define GFBITS 13 ------------------ 403| 797k| } 404| 61.3k| } 405| 8.76k| } 406| | 407| | // gaussian elimination to obtain L, U, and P such that LP M = U 408| | // L and U are stored in the space of M 409| | // P is stored in ind 410| | 411| 114k| for (i = 0; i < PK_NROWS; i++) { ------------------ | | 13| 114k|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 114k|#define SYS_T 128 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 114k|#define GFBITS 13 | | ------------------ ------------------ | Branch (411:17): [True: 114k, False: 69] ------------------ 412| 114k| ind_inv[i] = ind[ i ] = i; 413| 114k| } 414| | 415| 114k| for (row = 0; row < PK_NROWS; row++) { ------------------ | | 13| 114k|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 114k|#define SYS_T 128 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 114k|#define GFBITS 13 | | ------------------ ------------------ | Branch (415:19): [True: 114k, False: 69] ------------------ 416| 114k| i = row >> 6; 417| 114k| j = row & 63; 418| | 419| 114k| if (row == PK_NROWS - 32) { ------------------ | | 13| 114k|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 114k|#define SYS_T 128 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 114k|#define GFBITS 13 | | ------------------ ------------------ | Branch (419:13): [True: 69, False: 114k] ------------------ 420| 69| if (mov_columns(mat.w, pi, pivots)) { ------------------ | Branch (420:17): [True: 0, False: 69] ------------------ 421| 0| return -1; 422| 0| } 423| 69| } 424| | 425| 95.5M| for (k = row + 1; k < PK_NROWS; k++) { ------------------ | | 13| 95.5M|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 95.5M|#define SYS_T 128 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 95.5M|#define GFBITS 13 | | ------------------ ------------------ | Branch (425:27): [True: 95.4M, False: 114k] ------------------ 426| 95.4M| extract_01_masks(&m, mat.w[ row ], mat.w[ k ], row); 427| | 428| 95.4M| uint16_cswap(&ind[row], &ind[k], m); 429| | 430| 95.4M| mm = vec256_set1_16b(m); 431| 763M| for (c = 0; c < nBlocks_I; c++) { ------------------ | | 32| 763M|#define nBlocks_I ((PK_NROWS + 255) / 256) | | ------------------ | | | | 13| 763M|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 763M|#define SYS_T 128 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 763M|#define GFBITS 13 | | | | ------------------ | | ------------------ ------------------ | Branch (431:25): [True: 668M, False: 95.4M] ------------------ 432| 668M| vec256_cswap(&mat.v[ row ][ c ], &mat.v[ k ][ c ], mm); 433| 668M| } 434| 95.4M| } 435| | 436| 114k| if ( uint64_is_zero_declassify((mat.w[ row ][ i ] >> j) & 1) ) { // return if not systematic ------------------ | Branch (436:14): [True: 0, False: 114k] ------------------ 437| 0| return -1; 438| 0| } 439| | 440| 95.5M| for (k = row + 1; k < PK_NROWS; k++) { ------------------ | | 13| 95.5M|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 95.5M|#define SYS_T 128 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 95.5M|#define GFBITS 13 | | ------------------ ------------------ | Branch (440:27): [True: 95.4M, False: 114k] ------------------ 441| 95.4M| t = mat.w[ k ][ i ] & (one << j); 442| 95.4M| mm = extract_mask256(mat.w[k], row); 443| | 444| 763M| for (c = 0; c < nBlocks_I; c++) { ------------------ | | 32| 763M|#define nBlocks_I ((PK_NROWS + 255) / 256) | | ------------------ | | | | 13| 763M|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 763M|#define SYS_T 128 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 763M|#define GFBITS 13 | | | | ------------------ | | ------------------ ------------------ | Branch (444:25): [True: 668M, False: 95.4M] ------------------ 445| 668M| mat.v[ k ][ c ] ^= mat.v[ row ][ c ] & mm; 446| 668M| } 447| | 448| 95.4M| mat.w[ k ][ i ] |= t; 449| 95.4M| } 450| 114k| } 451| | 452| | // apply M^-1 to the remaining columns 453| | 454| 69| composeinv(PK_NROWS, ind_inv, ind_inv, ind); ------------------ | | 13| 69|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 69|#define SYS_T 128 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 69|#define GFBITS 13 | | ------------------ ------------------ 455| | 456| 207| for (j = 6; j < 32; j += 13) { ------------------ | Branch (456:17): [True: 138, False: 69] ------------------ 457| 1.93k| for (k = 0; k < GFBITS; k++) { ------------------ | | 6| 1.93k|#define GFBITS 13 ------------------ | Branch (457:21): [True: 1.79k, False: 138] ------------------ 458| 25.1k| for (b = 0; b < 13; b++) { ------------------ | Branch (458:25): [True: 23.3k, False: 1.79k] ------------------ 459| 23.3k| par.v[ k ][ b ] = prod[ j + b ][ k ]; 460| 23.3k| } 461| 1.79k| } 462| | 463| 17.6k| for (i = 1; i < SYS_T; i++) { ------------------ | | 8| 17.6k|#define SYS_T 128 ------------------ | Branch (463:21): [True: 17.5k, False: 138] ------------------ 464| 245k| for (b = 0; b < 13; b++) { ------------------ | Branch (464:25): [True: 227k, False: 17.5k] ------------------ 465| 227k| vec256_mul(prod[j + b], prod[j + b], consts[j + b]); 466| 227k| } 467| | 468| 245k| for (k = 0; k < GFBITS; k++) { ------------------ | | 6| 245k|#define GFBITS 13 ------------------ | Branch (468:25): [True: 227k, False: 17.5k] ------------------ 469| 3.18M| for (b = 0; b < 13; b++) { ------------------ | Branch (469:29): [True: 2.96M, False: 227k] ------------------ 470| 2.96M| par.v[ i * GFBITS + k ][ b ] = prod[ j + b ][ k ]; ------------------ | | 6| 2.96M|#define GFBITS 13 ------------------ 471| 2.96M| } 472| 227k| } 473| 17.5k| } 474| | 475| | // apply P 476| | 477| 229k| for (i = 0; i < PK_NROWS; i++) { ------------------ | | 13| 229k|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 229k|#define SYS_T 128 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 229k|#define GFBITS 13 | | ------------------ ------------------ | Branch (477:21): [True: 229k, False: 138] ------------------ 478| 229k| ind[i] = ind_inv[i]; 479| 229k| } 480| | 481| 138| sort_rows((1 << GFBITS) / 4, PK_NROWS, ind, par.v, 0); ------------------ | | 6| 138|#define GFBITS 13 ------------------ sort_rows((1 << GFBITS) / 4, PK_NROWS, ind, par.v, 0); ------------------ | | 13| 138|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 138|#define SYS_T 128 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 138|#define GFBITS 13 | | ------------------ ------------------ 482| | 483| | // apply L 484| | 485| 229k| for (row = PK_NROWS - 1; row >= 0; row--) { ------------------ | | 13| 138|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 138|#define SYS_T 128 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 138|#define GFBITS 13 | | ------------------ ------------------ | Branch (485:34): [True: 229k, False: 138] ------------------ 486| 191M| for (i = row - 1; i >= 0; i--) { ------------------ | Branch (486:31): [True: 190M, False: 229k] ------------------ 487| 190M| mm = extract_mask256(mat.w[row], i); 488| | 489| 2.67G| for (k = 0; k < 13; k++) { ------------------ | Branch (489:29): [True: 2.48G, False: 190M] ------------------ 490| 2.48G| par.v[ row ][ k ] ^= par.v[ i ][ k ] & mm; 491| 2.48G| } 492| 190M| } 493| 229k| } 494| | 495| | // apply U^-1 496| | 497| 138| if (j == 6) { ------------------ | Branch (497:13): [True: 69, False: 69] ------------------ 498| 114k| for (i = 0; i < PK_NROWS; i++) { ------------------ | | 13| 114k|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 114k|#define SYS_T 128 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 114k|#define GFBITS 13 | | ------------------ ------------------ | Branch (498:25): [True: 114k, False: 69] ------------------ 499| 114k| par.v[i][0] = mat.v[ i ][ nBlocks_I - 1 ]; ------------------ | | 32| 114k|#define nBlocks_I ((PK_NROWS + 255) / 256) | | ------------------ | | | | 13| 114k|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 114k|#define SYS_T 128 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 114k|#define GFBITS 13 | | | | ------------------ | | ------------------ ------------------ 500| 114k| } 501| 69| } 502| | 503| 229k| for (row = PK_NROWS - 1; row >= 0; row--) { ------------------ | | 13| 138|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 138|#define SYS_T 128 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 138|#define GFBITS 13 | | ------------------ ------------------ | Branch (503:34): [True: 229k, False: 138] ------------------ 504| 191M| for (i = PK_NROWS - 1; i > row; i--) { ------------------ | | 13| 229k|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 229k|#define SYS_T 128 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 229k|#define GFBITS 13 | | ------------------ ------------------ | Branch (504:36): [True: 190M, False: 229k] ------------------ 505| 190M| mm = extract_mask256(mat.w[row], i); 506| | 507| 2.67G| for (k = 0; k < 13; k++) { ------------------ | Branch (507:29): [True: 2.48G, False: 190M] ------------------ 508| 2.48G| par.v[ row ][ k ] ^= par.v[ i ][ k ] & mm; 509| 2.48G| } 510| 190M| } 511| 229k| } 512| | 513| 138| if (j == 6) { ------------------ | Branch (513:13): [True: 69, False: 69] ------------------ 514| 114k| for (row = 0; row < PK_NROWS; row++) { ------------------ | | 13| 114k|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 114k|#define SYS_T 128 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 114k|#define GFBITS 13 | | ------------------ ------------------ | Branch (514:27): [True: 114k, False: 69] ------------------ 515| 5.85M| for (k = 2; k < 52; k++) { ------------------ | Branch (515:29): [True: 5.74M, False: 114k] ------------------ 516| 5.74M| store8(pk + PK_ROW_BYTES * row + j * 32 + k * 8 - 13 * 16, par.w[row][k]); ------------------ | | 15| 5.74M|#define PK_ROW_BYTES ((PK_NCOLS + 7)/8) | | ------------------ | | | | 14| 5.74M|#define PK_NCOLS (SYS_N - PK_NROWS) | | | | ------------------ | | | | | | 7| 5.74M|#define SYS_N 8192 | | | | ------------------ | | | | #define PK_NCOLS (SYS_N - PK_NROWS) | | | | ------------------ | | | | | | 13| 5.74M|#define PK_NROWS (SYS_T*GFBITS) | | | | | | ------------------ | | | | | | | | 8| 5.74M|#define SYS_T 128 | | | | | | ------------------ | | | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | | | ------------------ | | | | | | | | 6| 5.74M|#define GFBITS 13 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 517| 5.74M| } 518| 114k| } 519| 69| } else { 520| 114k| for (row = 0; row < PK_NROWS; row++) { ------------------ | | 13| 114k|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 114k|#define SYS_T 128 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 114k|#define GFBITS 13 | | ------------------ ------------------ | Branch (520:27): [True: 114k, False: 69] ------------------ 521| 6.08M| for (k = 0; k < 52; k++) { ------------------ | Branch (521:29): [True: 5.97M, False: 114k] ------------------ 522| 5.97M| store8(pk + PK_ROW_BYTES * row + j * 32 + k * 8 - 13 * 16, par.w[row][k]); ------------------ | | 15| 5.97M|#define PK_ROW_BYTES ((PK_NCOLS + 7)/8) | | ------------------ | | | | 14| 5.97M|#define PK_NCOLS (SYS_N - PK_NROWS) | | | | ------------------ | | | | | | 7| 5.97M|#define SYS_N 8192 | | | | ------------------ | | | | #define PK_NCOLS (SYS_N - PK_NROWS) | | | | ------------------ | | | | | | 13| 5.97M|#define PK_NROWS (SYS_T*GFBITS) | | | | | | ------------------ | | | | | | | | 8| 5.97M|#define SYS_T 128 | | | | | | ------------------ | | | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | | | ------------------ | | | | | | | | 6| 5.97M|#define GFBITS 13 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 523| 5.97M| } 524| 114k| } 525| 69| } 526| 138| } 527| | 528| | // 529| | 530| 69| return 0; 531| 69|} PQCLEAN_MCELIECE8192128F_AVX2_genpoly_gen: 88| 84|int genpoly_gen(gf *out, gf *f) { 89| 84| int i, j, k; 90| | 91| 84| gf t, inv; 92| | 93| 84| uint64_t m; 94| 84| vec128 mask; 95| | 96| 84| union { 97| 84| uint64_t d[ GFBITS ][ 128 ][2]; 98| 84| vec128 v[ GFBITS ][ 128 ]; 99| 84| } buf; 100| | 101| 84| union { 102| 84| uint64_t d[GFBITS][2]; 103| 84| vec128 v[GFBITS]; 104| 84| } v; 105| | 106| 84| union { 107| 84| uint64_t d[SYS_T][GFBITS][2]; 108| 84| vec128 v[SYS_T][GFBITS]; 109| 84| } mat; 110| | 111| | // fill matrix 112| | 113| 84| buf.v[0][0] = vec128_set2x(1, 0); 114| 1.09k| for (i = 1; i < GFBITS; i++) { ------------------ | | 6| 1.09k|#define GFBITS 13 ------------------ | Branch (114:17): [True: 1.00k, False: 84] ------------------ 115| 1.00k| buf.v[i][0] = vec128_setzero(); 116| 1.00k| } 117| | 118| 1.17k| for (j = 0; j < GFBITS; j++) { ------------------ | | 6| 1.17k|#define GFBITS 13 ------------------ | Branch (118:17): [True: 1.09k, False: 84] ------------------ 119| 1.09k| v.v[j] = vec128_setzero(); 120| | 121| 140k| for (i = SYS_T - 1; i >= 0; i--) { ------------------ | | 8| 1.09k|#define SYS_T 128 ------------------ | Branch (121:29): [True: 139k, False: 1.09k] ------------------ 122| 139k| v.d[j][1] <<= 1; 123| 139k| v.d[j][1] |= v.d[j][0] >> 63; 124| 139k| v.d[j][0] <<= 1; 125| 139k| v.d[j][0] |= (f[i] >> j) & 1; 126| 139k| } 127| 1.09k| } 128| | 129| 1.17k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 1.17k|#define GFBITS 13 ------------------ | Branch (129:17): [True: 1.09k, False: 84] ------------------ 130| 1.09k| buf.v[i][1] = v.v[i]; 131| 1.09k| } 132| | 133| 10.7k| for (k = 2; k <= SYS_T; k++) { ------------------ | | 8| 10.7k|#define SYS_T 128 ------------------ | Branch (133:17): [True: 10.6k, False: 84] ------------------ 134| 10.6k| vec128_mul_GF(v.v, v.v, f); ------------------ | | 11| 10.6k|#define vec128_mul_GF CRYPTO_NAMESPACE(vec128_mul_GF) | | ------------------ | | | | 4| 10.6k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128F_AVX2_ ## fun | | ------------------ ------------------ 135| | 136| 10.6k| if (k < SYS_T) { ------------------ | | 8| 10.6k|#define SYS_T 128 ------------------ | Branch (136:13): [True: 10.5k, False: 84] ------------------ 137| 148k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 148k|#define GFBITS 13 ------------------ | Branch (137:25): [True: 137k, False: 10.5k] ------------------ 138| 137k| buf.v[i][k] = v.v[i]; 139| 137k| } 140| 10.5k| } else { 141| 10.8k| for (i = 0; i < SYS_T; i++) { ------------------ | | 8| 10.8k|#define SYS_T 128 ------------------ | Branch (141:25): [True: 10.7k, False: 84] ------------------ 142| 10.7k| out[i] = extract_gf(v.d, i); 143| 10.7k| } 144| 84| } 145| 10.6k| } 146| | 147| 1.17k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 1.17k|#define GFBITS 13 ------------------ | Branch (147:17): [True: 1.09k, False: 84] ------------------ 148| 1.09k| transpose_128x128(buf.d[i]); 149| 1.09k| } 150| | 151| 10.8k| for (j = 0; j < SYS_T; j++) { ------------------ | | 8| 10.8k|#define SYS_T 128 ------------------ | Branch (151:17): [True: 10.7k, False: 84] ------------------ 152| 150k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 150k|#define GFBITS 13 ------------------ | Branch (152:21): [True: 139k, False: 10.7k] ------------------ 153| 139k| mat.v[j][i] = buf.v[i][j]; 154| 139k| } 155| 10.7k| } 156| | 157| | // gaussian 158| | 159| 10.8k| for (i = 0; i < SYS_T; i++) { ------------------ | | 8| 10.8k|#define SYS_T 128 ------------------ | Branch (159:17): [True: 10.7k, False: 84] ------------------ 160| 693k| for (j = i + 1; j < SYS_T; j++) { ------------------ | | 8| 693k|#define SYS_T 128 ------------------ | Branch (160:25): [True: 682k, False: 10.7k] ------------------ 161| 682k| m = extract_bit(mat.d[i], i); 162| 682k| m -= 1; 163| 682k| mask = vec128_set2x(m, m); 164| | 165| 9.55M| for (k = 0; k < GFBITS; k++) { ------------------ | | 6| 9.55M|#define GFBITS 13 ------------------ | Branch (165:25): [True: 8.87M, False: 682k] ------------------ 166| 8.87M| mat.v[i][k] ^= mat.v[j][k] & mask; 167| 8.87M| } 168| | 169| 682k| out[i] ^= out[j] & m; 170| 682k| } 171| | 172| | // 173| | 174| 10.7k| t = extract_gf(mat.d[i], i); 175| | 176| 10.7k| if (gf_is_zero_declassify(t)) { ------------------ | Branch (176:13): [True: 0, False: 10.7k] ------------------ 177| 0| return -1; // return if not systematic 178| 0| } 179| | 180| | // 181| | 182| 10.7k| inv = gf_inv(t); ------------------ | | 11| 10.7k|#define gf_inv CRYPTO_NAMESPACE(gf_inv) | | ------------------ | | | | 4| 10.7k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128F_AVX2_ ## fun | | ------------------ ------------------ 183| 10.7k| vec128_mul_gf(mat.v[i], mat.v[i], inv); 184| | 185| 10.7k| out[i] = gf_mul(out[i], inv); ------------------ | | 14| 10.7k|#define gf_mul CRYPTO_NAMESPACE(gf_mul) | | ------------------ | | | | 4| 10.7k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128F_AVX2_ ## fun | | ------------------ ------------------ 186| | 187| 1.38M| for (j = 0; j < SYS_T; j++) { ------------------ | | 8| 1.38M|#define SYS_T 128 ------------------ | Branch (187:21): [True: 1.37M, False: 10.7k] ------------------ 188| 1.37M| if (j != i) { ------------------ | Branch (188:17): [True: 1.36M, False: 10.7k] ------------------ 189| 1.36M| t = extract_gf(mat.d[j], i); 190| | 191| 1.36M| vec128_mul_gf(v.v, mat.v[i], t); 192| 1.36M| vec128_add(mat.v[j], mat.v[j], v.v); 193| | 194| 1.36M| out[j] ^= gf_mul(out[i], t); ------------------ | | 14| 1.36M|#define gf_mul CRYPTO_NAMESPACE(gf_mul) | | ------------------ | | | | 4| 1.36M|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128F_AVX2_ ## fun | | ------------------ ------------------ 195| 1.36M| } 196| 1.37M| } 197| 10.7k| } 198| | 199| 84| return 0; 200| 84|} PQCLEAN_MCELIECE8192128F_AVX2_vec128_mul_GF: 6| 10.6k|void vec128_mul_GF(vec128 out[ GFBITS ], vec128 v[ GFBITS ], gf a[ SYS_T ]) { 7| 10.6k| int i, j; 8| 10.6k| uint64_t buf[GFBITS][4]; 9| 10.6k| vec128 prod[GFBITS]; 10| 10.6k| uint64_t p[GFBITS]; 11| | 12| | // polynomial multiplication 13| | 14| 149k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 149k|#define GFBITS 13 ------------------ | Branch (14:17): [True: 138k, False: 10.6k] ------------------ 15| 138k| buf[i][0] = 0; 16| 138k| buf[i][1] = 0; 17| 138k| buf[i][2] = 0; 18| 138k| buf[i][3] = 0; 19| 138k| } 20| | 21| 1.37M| for (i = SYS_T - 1; i >= 0; i--) { ------------------ | | 8| 10.6k|#define SYS_T 128 ------------------ | Branch (21:25): [True: 1.36M, False: 10.6k] ------------------ 22| 19.1M| for (j = 0; j < GFBITS; j++) { ------------------ | | 6| 19.1M|#define GFBITS 13 ------------------ | Branch (22:21): [True: 17.7M, False: 1.36M] ------------------ 23| 17.7M| buf[j][3] <<= 1; 24| 17.7M| buf[j][3] |= buf[j][2] >> 63; 25| 17.7M| buf[j][2] <<= 1; 26| 17.7M| buf[j][2] |= buf[j][1] >> 63; 27| 17.7M| buf[j][1] <<= 1; 28| 17.7M| buf[j][1] |= buf[j][0] >> 63; 29| 17.7M| buf[j][0] <<= 1; 30| 17.7M| } 31| | 32| 1.36M| vec128_mul_gf(prod, v, a[i]); 33| | 34| 19.1M| for (j = 0; j < GFBITS; j++) { ------------------ | | 6| 19.1M|#define GFBITS 13 ------------------ | Branch (34:21): [True: 17.7M, False: 1.36M] ------------------ 35| 17.7M| buf[j][0] ^= vec128_extract(prod[j], 0); ------------------ | | 29| 17.7M|#define vec128_extract(a, i) ((uint64_t) _mm_extract_epi64((vec128) (a), (i))) ------------------ 36| 17.7M| buf[j][1] ^= vec128_extract(prod[j], 1); ------------------ | | 29| 17.7M|#define vec128_extract(a, i) ((uint64_t) _mm_extract_epi64((vec128) (a), (i))) ------------------ 37| 17.7M| } 38| 1.36M| } 39| | 40| | // reduction modulo y^128+y^7+y^2+y+1 41| | 42| 149k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 149k|#define GFBITS 13 ------------------ | Branch (42:17): [True: 138k, False: 10.6k] ------------------ 43| 138k| p[i] = buf[i][3]; 44| | 45| 138k| buf[i][2] ^= p[i] >> (SYS_T - 7 - 64); ------------------ | | 8| 138k|#define SYS_T 128 ------------------ 46| 138k| buf[i][1] ^= p[i] << (64 - (SYS_T - 7 - 64)); ------------------ | | 8| 138k|#define SYS_T 128 ------------------ 47| 138k| buf[i][2] ^= p[i] >> (SYS_T - 2 - 64); ------------------ | | 8| 138k|#define SYS_T 128 ------------------ 48| 138k| buf[i][1] ^= p[i] << (64 - (SYS_T - 2 - 64)); ------------------ | | 8| 138k|#define SYS_T 128 ------------------ 49| 138k| buf[i][2] ^= p[i] >> (SYS_T - 1 - 64); ------------------ | | 8| 138k|#define SYS_T 128 ------------------ 50| 138k| buf[i][1] ^= p[i] << (64 - (SYS_T - 1 - 64)); ------------------ | | 8| 138k|#define SYS_T 128 ------------------ 51| 138k| buf[i][1] ^= p[i]; 52| 138k| } 53| | 54| | // 55| | 56| 149k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 149k|#define GFBITS 13 ------------------ | Branch (56:17): [True: 138k, False: 10.6k] ------------------ 57| 138k| p[i] = buf[i][2]; 58| | 59| 138k| buf[i][1] ^= p[i] >> (SYS_T - 7 - 64); ------------------ | | 8| 138k|#define SYS_T 128 ------------------ 60| 138k| buf[i][0] ^= p[i] << (64 - (SYS_T - 7 - 64)); ------------------ | | 8| 138k|#define SYS_T 128 ------------------ 61| 138k| buf[i][1] ^= p[i] >> (SYS_T - 2 - 64); ------------------ | | 8| 138k|#define SYS_T 128 ------------------ 62| 138k| buf[i][0] ^= p[i] << (64 - (SYS_T - 2 - 64)); ------------------ | | 8| 138k|#define SYS_T 128 ------------------ 63| 138k| buf[i][1] ^= p[i] >> (SYS_T - 1 - 64); ------------------ | | 8| 138k|#define SYS_T 128 ------------------ 64| 138k| buf[i][0] ^= p[i] << (64 - (SYS_T - 1 - 64)); ------------------ | | 8| 138k|#define SYS_T 128 ------------------ 65| 138k| buf[i][0] ^= p[i]; 66| 138k| } 67| | 68| | // 69| | 70| 149k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 149k|#define GFBITS 13 ------------------ | Branch (70:17): [True: 138k, False: 10.6k] ------------------ 71| 138k| out[i] = vec128_set2x(buf[i][0], buf[i][1]); 72| 138k| } 73| 10.6k|} PQCLEAN_MCELIECE8192128F_AVX2_vec256_sq: 9| 4.04k|void vec256_sq(vec256 *out, vec256 *in) { 10| 4.04k| int i; 11| 4.04k| vec256 result[GFBITS], t; 12| | 13| 4.04k| t = vec256_xor(in[11], in[12]); 14| | 15| 4.04k| result[0] = vec256_xor(in[0], in[11]); 16| 4.04k| result[1] = vec256_xor(in[7], t); 17| 4.04k| result[2] = vec256_xor(in[1], in[7]); 18| 4.04k| result[3] = vec256_xor(in[8], t); 19| 4.04k| result[4] = vec256_xor(in[2], in[7]); 20| 4.04k| result[4] = vec256_xor(result[4], in[8]); 21| 4.04k| result[4] = vec256_xor(result[4], t); 22| 4.04k| result[5] = vec256_xor(in[7], in[9]); 23| 4.04k| result[6] = vec256_xor(in[3], in[8]); 24| 4.04k| result[6] = vec256_xor(result[6], in[9]); 25| 4.04k| result[6] = vec256_xor(result[6], in[12]); 26| 4.04k| result[7] = vec256_xor(in[8], in[10]); 27| 4.04k| result[8] = vec256_xor(in[4], in[9]); 28| 4.04k| result[8] = vec256_xor(result[8], in[10]); 29| 4.04k| result[9] = vec256_xor(in[9], in[11]); 30| 4.04k| result[10] = vec256_xor(in[5], in[10]); 31| 4.04k| result[10] = vec256_xor(result[10], in[11]); 32| 4.04k| result[11] = vec256_xor(in[10], in[12]); 33| 4.04k| result[12] = vec256_xor(in[6], t); 34| | 35| 56.6k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 56.6k|#define GFBITS 13 ------------------ | Branch (35:17): [True: 52.5k, False: 4.04k] ------------------ 36| 52.5k| out[i] = result[i]; 37| 52.5k| } 38| 4.04k|} PQCLEAN_MCELIECE8192128F_AVX2_vec256_inv: 41| 153|void vec256_inv(vec256 *out, vec256 *in) { 42| 153| vec256 tmp_11[ GFBITS ]; 43| 153| vec256 tmp_1111[ GFBITS ]; 44| | 45| 153| vec256_copy(out, in); 46| | 47| 153| vec256_sq(out, out); ------------------ | | 14| 153|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 153|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128F_AVX2_ ## fun | | ------------------ ------------------ 48| 153| vec256_mul(tmp_11, out, in); // ^11 49| | 50| 153| vec256_sq(out, tmp_11); ------------------ | | 14| 153|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 153|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128F_AVX2_ ## fun | | ------------------ ------------------ 51| 153| vec256_sq(out, out); ------------------ | | 14| 153|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 153|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128F_AVX2_ ## fun | | ------------------ ------------------ 52| 153| vec256_mul(tmp_1111, out, tmp_11); // ^1111 53| | 54| 153| vec256_sq(out, tmp_1111); ------------------ | | 14| 153|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 153|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128F_AVX2_ ## fun | | ------------------ ------------------ 55| 153| vec256_sq(out, out); ------------------ | | 14| 153|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 153|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128F_AVX2_ ## fun | | ------------------ ------------------ 56| 153| vec256_sq(out, out); ------------------ | | 14| 153|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 153|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128F_AVX2_ ## fun | | ------------------ ------------------ 57| 153| vec256_sq(out, out); ------------------ | | 14| 153|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 153|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128F_AVX2_ ## fun | | ------------------ ------------------ 58| 153| vec256_mul(out, out, tmp_1111); // ^11111111 59| | 60| 153| vec256_sq(out, out); ------------------ | | 14| 153|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 153|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128F_AVX2_ ## fun | | ------------------ ------------------ 61| 153| vec256_sq(out, out); ------------------ | | 14| 153|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 153|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128F_AVX2_ ## fun | | ------------------ ------------------ 62| 153| vec256_sq(out, out); ------------------ | | 14| 153|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 153|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128F_AVX2_ ## fun | | ------------------ ------------------ 63| 153| vec256_sq(out, out); ------------------ | | 14| 153|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 153|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128F_AVX2_ ## fun | | ------------------ ------------------ 64| 153| vec256_mul(out, out, tmp_1111); // ^111111111111 65| | 66| 153| vec256_sq(out, out); // ^1111111111110 ------------------ | | 14| 153|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 153|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128F_AVX2_ ## fun | | ------------------ ------------------ 67| 153|} OQS_KEM_efrodokem_640_aes_keypair: 19| 4|{ // FrodoKEM's key generation 20| | // Outputs: public key pk = pk_seedA||pk_b ( BYTES_SEED_A + (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8 bytes) 21| | // secret key sk = sk_s||pk_seedA||pk_b||sk_S||sk_pkh (CRYPTO_BYTES + BYTES_SEED_A + (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8 + 2*PARAMS_N*PARAMS_NBAR + BYTES_PKHASH bytes) 22| 4| uint8_t *pk_seedA = &pk[0]; 23| 4| uint8_t *pk_b = &pk[BYTES_SEED_A]; ------------------ | | 18| 4|#define BYTES_SEED_A 16 ------------------ 24| 4| uint8_t *sk_s = &sk[0]; 25| 4| uint8_t *sk_pk = &sk[CRYPTO_BYTES]; ------------------ | | 6| 4|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_aes_length_shared_secret | | ------------------ | | | | 102| 4|#define OQS_KEM_efrodokem_640_aes_length_shared_secret 16 | | ------------------ ------------------ 26| 4| uint8_t *sk_S = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES]; ------------------ | | 6| 4|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_aes_length_shared_secret | | ------------------ | | | | 102| 4|#define OQS_KEM_efrodokem_640_aes_length_shared_secret 16 | | ------------------ ------------------ uint8_t *sk_S = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES]; ------------------ | | 3| 4|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_efrodokem_640_aes_length_public_key | | ------------------ | | | | 99| 4|#define OQS_KEM_efrodokem_640_aes_length_public_key 9616 | | ------------------ ------------------ 27| 4| uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 6| 4|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_aes_length_shared_secret | | ------------------ | | | | 102| 4|#define OQS_KEM_efrodokem_640_aes_length_shared_secret 16 | | ------------------ ------------------ uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 3| 4|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_efrodokem_640_aes_length_public_key | | ------------------ | | | | 99| 4|#define OQS_KEM_efrodokem_640_aes_length_public_key 9616 | | ------------------ ------------------ uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 11| 4|#define PARAMS_N 640 ------------------ uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 12| 4|#define PARAMS_NBAR 8 ------------------ 28| 4| uint16_t B[PARAMS_N*PARAMS_NBAR] = {0}; 29| 4| uint16_t S[2*PARAMS_N*PARAMS_NBAR] = {0}; // contains secret data 30| 4| uint16_t *E = (uint16_t *)&S[PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 11| 4|#define PARAMS_N 640 ------------------ uint16_t *E = (uint16_t *)&S[PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 12| 4|#define PARAMS_NBAR 8 ------------------ 31| 4| uint8_t randomness[2*CRYPTO_BYTES + BYTES_SEED_A]; // contains secret data via randomness_s and randomness_seedSE 32| 4| uint8_t *randomness_s = &randomness[0]; // contains secret data 33| 4| uint8_t *randomness_seedSE = &randomness[CRYPTO_BYTES]; // contains secret data ------------------ | | 6| 4|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_aes_length_shared_secret | | ------------------ | | | | 102| 4|#define OQS_KEM_efrodokem_640_aes_length_shared_secret 16 | | ------------------ ------------------ 34| 4| uint8_t *randomness_z = &randomness[2*CRYPTO_BYTES]; ------------------ | | 6| 4|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_aes_length_shared_secret | | ------------------ | | | | 102| 4|#define OQS_KEM_efrodokem_640_aes_length_shared_secret 16 | | ------------------ ------------------ 35| 4| uint8_t shake_input_seedSE[1 + CRYPTO_BYTES]; // contains secret data 36| | 37| | // Generate the secret value s, the seed for S and E, and the seed for the seed for A. Add seed_A to the public key 38| 4| randombytes(randomness, CRYPTO_BYTES + CRYPTO_BYTES + BYTES_SEED_A); ------------------ | | 26| 4|#define randombytes OQS_randombytes ------------------ randombytes(randomness, CRYPTO_BYTES + CRYPTO_BYTES + BYTES_SEED_A); ------------------ | | 6| 4|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_aes_length_shared_secret | | ------------------ | | | | 102| 4|#define OQS_KEM_efrodokem_640_aes_length_shared_secret 16 | | ------------------ ------------------ randombytes(randomness, CRYPTO_BYTES + CRYPTO_BYTES + BYTES_SEED_A); ------------------ | | 6| 4|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_aes_length_shared_secret | | ------------------ | | | | 102| 4|#define OQS_KEM_efrodokem_640_aes_length_shared_secret 16 | | ------------------ ------------------ randombytes(randomness, CRYPTO_BYTES + CRYPTO_BYTES + BYTES_SEED_A); ------------------ | | 18| 4|#define BYTES_SEED_A 16 ------------------ 39| 4| shake(pk_seedA, BYTES_SEED_A, randomness_z, BYTES_SEED_A); ------------------ | | 29| 4|#define shake OQS_SHA3_shake128 ------------------ shake(pk_seedA, BYTES_SEED_A, randomness_z, BYTES_SEED_A); ------------------ | | 18| 4|#define BYTES_SEED_A 16 ------------------ shake(pk_seedA, BYTES_SEED_A, randomness_z, BYTES_SEED_A); ------------------ | | 18| 4|#define BYTES_SEED_A 16 ------------------ 40| | 41| | // Generate S and E, and compute B = A*S + E. Generate A on-the-fly 42| 4| shake_input_seedSE[0] = 0x5F; 43| 4| memcpy(&shake_input_seedSE[1], randomness_seedSE, CRYPTO_BYTES); ------------------ | | 6| 4|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_aes_length_shared_secret | | ------------------ | | | | 102| 4|#define OQS_KEM_efrodokem_640_aes_length_shared_secret 16 | | ------------------ ------------------ 44| 4| shake((uint8_t*)S, 2*PARAMS_N*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + CRYPTO_BYTES); ------------------ | | 29| 4|#define shake OQS_SHA3_shake128 ------------------ shake((uint8_t*)S, 2*PARAMS_N*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + CRYPTO_BYTES); ------------------ | | 11| 4|#define PARAMS_N 640 ------------------ shake((uint8_t*)S, 2*PARAMS_N*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + CRYPTO_BYTES); ------------------ | | 12| 4|#define PARAMS_NBAR 8 ------------------ shake((uint8_t*)S, 2*PARAMS_N*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + CRYPTO_BYTES); ------------------ | | 6| 4|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_aes_length_shared_secret | | ------------------ | | | | 102| 4|#define OQS_KEM_efrodokem_640_aes_length_shared_secret 16 | | ------------------ ------------------ 45| 40.9k| for (size_t i = 0; i < 2 * PARAMS_N * PARAMS_NBAR; i++) { ------------------ | | 11| 40.9k|#define PARAMS_N 640 ------------------ for (size_t i = 0; i < 2 * PARAMS_N * PARAMS_NBAR; i++) { ------------------ | | 12| 40.9k|#define PARAMS_NBAR 8 ------------------ | Branch (45:24): [True: 40.9k, False: 4] ------------------ 46| 40.9k| S[i] = LE_TO_UINT16(S[i]); ------------------ | | 34| 40.9k| #define LE_TO_UINT16(n) (n) ------------------ 47| 40.9k| } 48| 4| frodo_sample_n(S, PARAMS_N*PARAMS_NBAR); ------------------ | | 38| 4|#define frodo_sample_n oqs_kem_efrodokem_640_aes_sample_n ------------------ frodo_sample_n(S, PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 4|#define PARAMS_N 640 ------------------ frodo_sample_n(S, PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 4|#define PARAMS_NBAR 8 ------------------ 49| 4| frodo_sample_n(E, PARAMS_N*PARAMS_NBAR); ------------------ | | 38| 4|#define frodo_sample_n oqs_kem_efrodokem_640_aes_sample_n ------------------ frodo_sample_n(E, PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 4|#define PARAMS_N 640 ------------------ frodo_sample_n(E, PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 4|#define PARAMS_NBAR 8 ------------------ 50| 4| frodo_mul_add_as_plus_e(B, S, E, pk); ------------------ | | 44| 4|#define frodo_mul_add_as_plus_e oqs_kem_efrodokem_640_aes_mul_add_as_plus_e ------------------ 51| | 52| | // Encode the second part of the public key 53| 4| frodo_pack(pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, B, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 39| 4|#define frodo_pack oqs_kem_efrodokem_640_aes_pack ------------------ frodo_pack(pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, B, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 3| 4|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_efrodokem_640_aes_length_public_key | | ------------------ | | | | 99| 4|#define OQS_KEM_efrodokem_640_aes_length_public_key 9616 | | ------------------ ------------------ frodo_pack(pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, B, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 18| 4|#define BYTES_SEED_A 16 ------------------ frodo_pack(pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, B, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 11| 4|#define PARAMS_N 640 ------------------ frodo_pack(pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, B, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 4|#define PARAMS_NBAR 8 ------------------ frodo_pack(pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, B, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 13| 4|#define PARAMS_LOGQ 15 ------------------ 54| | 55| | // Add s, pk and S to the secret key 56| 4| memcpy(sk_s, randomness_s, CRYPTO_BYTES); ------------------ | | 6| 4|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_aes_length_shared_secret | | ------------------ | | | | 102| 4|#define OQS_KEM_efrodokem_640_aes_length_shared_secret 16 | | ------------------ ------------------ 57| 4| memcpy(sk_pk, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 3| 4|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_efrodokem_640_aes_length_public_key | | ------------------ | | | | 99| 4|#define OQS_KEM_efrodokem_640_aes_length_public_key 9616 | | ------------------ ------------------ 58| 20.4k| for (size_t i = 0; i < PARAMS_N * PARAMS_NBAR; i++) { ------------------ | | 11| 20.4k|#define PARAMS_N 640 ------------------ for (size_t i = 0; i < PARAMS_N * PARAMS_NBAR; i++) { ------------------ | | 12| 20.4k|#define PARAMS_NBAR 8 ------------------ | Branch (58:24): [True: 20.4k, False: 4] ------------------ 59| 20.4k| S[i] = UINT16_TO_LE(S[i]); ------------------ | | 35| 20.4k| #define UINT16_TO_LE(n) (n) ------------------ 60| 20.4k| } 61| 4| memcpy(sk_S, S, 2*PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 4|#define PARAMS_N 640 ------------------ memcpy(sk_S, S, 2*PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 4|#define PARAMS_NBAR 8 ------------------ 62| | 63| | // Add H(pk) to the secret key 64| 4| shake(sk_pkh, BYTES_PKHASH, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 29| 4|#define shake OQS_SHA3_shake128 ------------------ shake(sk_pkh, BYTES_PKHASH, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 20| 4|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 4|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_aes_length_shared_secret | | | | ------------------ | | | | | | 102| 4|#define OQS_KEM_efrodokem_640_aes_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ shake(sk_pkh, BYTES_PKHASH, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 3| 4|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_efrodokem_640_aes_length_public_key | | ------------------ | | | | 99| 4|#define OQS_KEM_efrodokem_640_aes_length_public_key 9616 | | ------------------ ------------------ 65| | 66| | // Cleanup: 67| 4| clear_bytes((uint8_t *)S, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 27| 4|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)S, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 4|#define PARAMS_N 640 ------------------ clear_bytes((uint8_t *)S, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 4|#define PARAMS_NBAR 8 ------------------ 68| 4| clear_bytes((uint8_t *)E, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 27| 4|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)E, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 4|#define PARAMS_N 640 ------------------ clear_bytes((uint8_t *)E, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 4|#define PARAMS_NBAR 8 ------------------ 69| 4| clear_bytes(randomness, 2*CRYPTO_BYTES); ------------------ | | 27| 4|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(randomness, 2*CRYPTO_BYTES); ------------------ | | 6| 4|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_aes_length_shared_secret | | ------------------ | | | | 102| 4|#define OQS_KEM_efrodokem_640_aes_length_shared_secret 16 | | ------------------ ------------------ 70| 4| clear_bytes(shake_input_seedSE, 1 + CRYPTO_BYTES); ------------------ | | 27| 4|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(shake_input_seedSE, 1 + CRYPTO_BYTES); ------------------ | | 6| 4|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_aes_length_shared_secret | | ------------------ | | | | 102| 4|#define OQS_KEM_efrodokem_640_aes_length_shared_secret 16 | | ------------------ ------------------ 71| 4| return OQS_SUCCESS; 72| 4|} OQS_KEM_efrodokem_640_aes_encaps: 86| 4|{ // FrodoKEM's key encapsulation 87| | // Input: public key pk = pk_seedA||pk_b (BYTES_SEED_A + (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8 bytes) 88| | // Outputs: ciphertext ct = ct_c1||ct_c2 ( (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8 + (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8 bytes) 89| | // shared key ss (CRYPTO_BYTES bytes) 90| 4| const uint8_t *pk_seedA = &pk[0]; 91| 4| const uint8_t *pk_b = &pk[BYTES_SEED_A]; ------------------ | | 18| 4|#define BYTES_SEED_A 16 ------------------ 92| 4| uint8_t *ct_c1 = &ct[0]; 93| 4| uint8_t *ct_c2 = &ct[(PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8]; ------------------ | | 13| 4|#define PARAMS_LOGQ 15 ------------------ uint8_t *ct_c2 = &ct[(PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8]; ------------------ | | 11| 4|#define PARAMS_N 640 ------------------ uint8_t *ct_c2 = &ct[(PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8]; ------------------ | | 12| 4|#define PARAMS_NBAR 8 ------------------ 94| 4| uint16_t B[PARAMS_N*PARAMS_NBAR] = {0}; 95| 4| uint16_t V[PARAMS_NBAR*PARAMS_NBAR]= {0}; // contains secret data 96| 4| uint16_t C[PARAMS_NBAR*PARAMS_NBAR] = {0}; 97| 4| ALIGN_HEADER(32) uint16_t Bp[PARAMS_N*PARAMS_NBAR] ALIGN_FOOTER(32) = {0}; 98| 4| ALIGN_HEADER(32) uint16_t Sp[(2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR] ALIGN_FOOTER(32) = {0}; // contains secret data 99| 4| uint16_t *Ep = (uint16_t *)&Sp[PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 11| 4|#define PARAMS_N 640 ------------------ uint16_t *Ep = (uint16_t *)&Sp[PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 12| 4|#define PARAMS_NBAR 8 ------------------ 100| 4| uint16_t *Epp = (uint16_t *)&Sp[2*PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 11| 4|#define PARAMS_N 640 ------------------ uint16_t *Epp = (uint16_t *)&Sp[2*PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 12| 4|#define PARAMS_NBAR 8 ------------------ 101| 4| uint8_t G2in[BYTES_PKHASH + BYTES_MU]; // contains secret data via mu 102| 4| uint8_t *pkh = &G2in[0]; 103| 4| uint8_t *mu = &G2in[BYTES_PKHASH]; // contains secret data ------------------ | | 20| 4|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 4|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_aes_length_shared_secret | | | | ------------------ | | | | | | 102| 4|#define OQS_KEM_efrodokem_640_aes_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ 104| 4| uint8_t G2out[2*CRYPTO_BYTES]; // contains secret data 105| 4| uint8_t *seedSE = &G2out[0]; // contains secret data 106| 4| uint8_t *k = &G2out[CRYPTO_BYTES]; // contains secret data ------------------ | | 6| 4|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_aes_length_shared_secret | | ------------------ | | | | 102| 4|#define OQS_KEM_efrodokem_640_aes_length_shared_secret 16 | | ------------------ ------------------ 107| 4| uint8_t Fin[CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES]; // contains secret data via Fin_k 108| 4| uint8_t *Fin_ct = &Fin[0]; 109| 4| uint8_t *Fin_k = &Fin[CRYPTO_CIPHERTEXTBYTES]; // contains secret data ------------------ | | 5| 4|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_efrodokem_640_aes_length_ciphertext | | ------------------ | | | | 101| 4|#define OQS_KEM_efrodokem_640_aes_length_ciphertext 9720 | | ------------------ ------------------ 110| 4| uint8_t shake_input_seedSE[1 + CRYPTO_BYTES]; // contains secret data 111| | 112| | // pkh <- G_1(pk), generate random mu, compute (seedSE || k) = G_2(pkh || mu) 113| 4| shake(pkh, BYTES_PKHASH, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 29| 4|#define shake OQS_SHA3_shake128 ------------------ shake(pkh, BYTES_PKHASH, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 20| 4|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 4|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_aes_length_shared_secret | | | | ------------------ | | | | | | 102| 4|#define OQS_KEM_efrodokem_640_aes_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ shake(pkh, BYTES_PKHASH, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 3| 4|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_efrodokem_640_aes_length_public_key | | ------------------ | | | | 99| 4|#define OQS_KEM_efrodokem_640_aes_length_public_key 9616 | | ------------------ ------------------ 114| 4| randombytes(mu, BYTES_MU); ------------------ | | 26| 4|#define randombytes OQS_randombytes ------------------ randombytes(mu, BYTES_MU); ------------------ | | 19| 4|#define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 15| 4|#define PARAMS_EXTRACTED_BITS 2 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 4|#define PARAMS_NBAR 8 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 4|#define PARAMS_NBAR 8 | | ------------------ ------------------ 115| 4| shake(G2out, CRYPTO_BYTES + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU); ------------------ | | 29| 4|#define shake OQS_SHA3_shake128 ------------------ shake(G2out, CRYPTO_BYTES + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU); ------------------ | | 6| 4|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_aes_length_shared_secret | | ------------------ | | | | 102| 4|#define OQS_KEM_efrodokem_640_aes_length_shared_secret 16 | | ------------------ ------------------ shake(G2out, CRYPTO_BYTES + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU); ------------------ | | 6| 4|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_aes_length_shared_secret | | ------------------ | | | | 102| 4|#define OQS_KEM_efrodokem_640_aes_length_shared_secret 16 | | ------------------ ------------------ shake(G2out, CRYPTO_BYTES + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU); ------------------ | | 20| 4|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 4|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_aes_length_shared_secret | | | | ------------------ | | | | | | 102| 4|#define OQS_KEM_efrodokem_640_aes_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ shake(G2out, CRYPTO_BYTES + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU); ------------------ | | 19| 4|#define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 15| 4|#define PARAMS_EXTRACTED_BITS 2 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 4|#define PARAMS_NBAR 8 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 4|#define PARAMS_NBAR 8 | | ------------------ ------------------ 116| | 117| | // Generate Sp and Ep, and compute Bp = Sp*A + Ep. Generate A on-the-fly 118| 4| shake_input_seedSE[0] = 0x96; 119| 4| memcpy(&shake_input_seedSE[1], seedSE, CRYPTO_BYTES); ------------------ | | 6| 4|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_aes_length_shared_secret | | ------------------ | | | | 102| 4|#define OQS_KEM_efrodokem_640_aes_length_shared_secret 16 | | ------------------ ------------------ 120| 4| shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + CRYPTO_BYTES); ------------------ | | 29| 4|#define shake OQS_SHA3_shake128 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + CRYPTO_BYTES); ------------------ | | 11| 4|#define PARAMS_N 640 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + CRYPTO_BYTES); ------------------ | | 12| 4|#define PARAMS_NBAR 8 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + CRYPTO_BYTES); ------------------ | | 12| 4|#define PARAMS_NBAR 8 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + CRYPTO_BYTES); ------------------ | | 6| 4|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_aes_length_shared_secret | | ------------------ | | | | 102| 4|#define OQS_KEM_efrodokem_640_aes_length_shared_secret 16 | | ------------------ ------------------ 121| 41.2k| for (size_t i = 0; i < (2 * PARAMS_N + PARAMS_NBAR) * PARAMS_NBAR; i++) { ------------------ | | 11| 41.2k|#define PARAMS_N 640 ------------------ for (size_t i = 0; i < (2 * PARAMS_N + PARAMS_NBAR) * PARAMS_NBAR; i++) { ------------------ | | 12| 41.2k|#define PARAMS_NBAR 8 ------------------ for (size_t i = 0; i < (2 * PARAMS_N + PARAMS_NBAR) * PARAMS_NBAR; i++) { ------------------ | | 12| 41.2k|#define PARAMS_NBAR 8 ------------------ | Branch (121:24): [True: 41.2k, False: 4] ------------------ 122| 41.2k| Sp[i] = LE_TO_UINT16(Sp[i]); ------------------ | | 34| 41.2k| #define LE_TO_UINT16(n) (n) ------------------ 123| 41.2k| } 124| 4| frodo_sample_n(Sp, PARAMS_N*PARAMS_NBAR); ------------------ | | 38| 4|#define frodo_sample_n oqs_kem_efrodokem_640_aes_sample_n ------------------ frodo_sample_n(Sp, PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 4|#define PARAMS_N 640 ------------------ frodo_sample_n(Sp, PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 4|#define PARAMS_NBAR 8 ------------------ 125| 4| frodo_sample_n(Ep, PARAMS_N*PARAMS_NBAR); ------------------ | | 38| 4|#define frodo_sample_n oqs_kem_efrodokem_640_aes_sample_n ------------------ frodo_sample_n(Ep, PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 4|#define PARAMS_N 640 ------------------ frodo_sample_n(Ep, PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 4|#define PARAMS_NBAR 8 ------------------ 126| 4| frodo_mul_add_sa_plus_e(Bp, Sp, Ep, pk_seedA); ------------------ | | 47| 4|#define frodo_mul_add_sa_plus_e oqs_kem_efrodokem_640_aes_mul_add_sa_plus_e ------------------ 127| 4| frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 39| 4|#define frodo_pack oqs_kem_efrodokem_640_aes_pack ------------------ frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 13| 4|#define PARAMS_LOGQ 15 ------------------ frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 11| 4|#define PARAMS_N 640 ------------------ frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 4|#define PARAMS_NBAR 8 ------------------ frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 11| 4|#define PARAMS_N 640 ------------------ frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 4|#define PARAMS_NBAR 8 ------------------ frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 13| 4|#define PARAMS_LOGQ 15 ------------------ 128| | 129| | // Generate Epp, and compute V = Sp*B + Epp 130| 4| frodo_sample_n(Epp, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 38| 4|#define frodo_sample_n oqs_kem_efrodokem_640_aes_sample_n ------------------ frodo_sample_n(Epp, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 4|#define PARAMS_NBAR 8 ------------------ frodo_sample_n(Epp, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 4|#define PARAMS_NBAR 8 ------------------ 131| 4| frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 40| 4|#define frodo_unpack oqs_kem_efrodokem_640_aes_unpack ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 11| 4|#define PARAMS_N 640 ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 12| 4|#define PARAMS_NBAR 8 ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 3| 4|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_efrodokem_640_aes_length_public_key | | ------------------ | | | | 99| 4|#define OQS_KEM_efrodokem_640_aes_length_public_key 9616 | | ------------------ ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 18| 4|#define BYTES_SEED_A 16 ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 13| 4|#define PARAMS_LOGQ 15 ------------------ 132| 4| frodo_mul_add_sb_plus_e(V, B, Sp, Epp); ------------------ | | 50| 4|#define frodo_mul_add_sb_plus_e oqs_kem_efrodokem_640_aes_mul_add_sb_plus_e ------------------ 133| | 134| | // Encode mu, and compute C = V + enc(mu) (mod q) 135| 4| frodo_key_encode(C, (uint16_t*)mu); ------------------ | | 55| 4|#define frodo_key_encode oqs_kem_efrodokem_640_aes_key_encode ------------------ 136| 4| frodo_add(C, V, C); ------------------ | | 53| 4|#define frodo_add oqs_kem_efrodokem_640_aes_add ------------------ 137| 4| frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 39| 4|#define frodo_pack oqs_kem_efrodokem_640_aes_pack ------------------ frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 13| 4|#define PARAMS_LOGQ 15 ------------------ frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 4|#define PARAMS_NBAR 8 ------------------ frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 4|#define PARAMS_NBAR 8 ------------------ frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 4|#define PARAMS_NBAR 8 ------------------ frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 4|#define PARAMS_NBAR 8 ------------------ frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 13| 4|#define PARAMS_LOGQ 15 ------------------ 138| | 139| | // Compute ss = F(ct||KK) 140| 4| memcpy(Fin_ct, ct, CRYPTO_CIPHERTEXTBYTES); ------------------ | | 5| 4|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_efrodokem_640_aes_length_ciphertext | | ------------------ | | | | 101| 4|#define OQS_KEM_efrodokem_640_aes_length_ciphertext 9720 | | ------------------ ------------------ 141| 4| memcpy(Fin_k, k, CRYPTO_BYTES); ------------------ | | 6| 4|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_aes_length_shared_secret | | ------------------ | | | | 102| 4|#define OQS_KEM_efrodokem_640_aes_length_shared_secret 16 | | ------------------ ------------------ 142| 4| shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 29| 4|#define shake OQS_SHA3_shake128 ------------------ shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 6| 4|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_aes_length_shared_secret | | ------------------ | | | | 102| 4|#define OQS_KEM_efrodokem_640_aes_length_shared_secret 16 | | ------------------ ------------------ shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 5| 4|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_efrodokem_640_aes_length_ciphertext | | ------------------ | | | | 101| 4|#define OQS_KEM_efrodokem_640_aes_length_ciphertext 9720 | | ------------------ ------------------ shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 6| 4|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_aes_length_shared_secret | | ------------------ | | | | 102| 4|#define OQS_KEM_efrodokem_640_aes_length_shared_secret 16 | | ------------------ ------------------ 143| | 144| | // Cleanup: 145| 4| clear_bytes((uint8_t *)V, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 27| 4|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)V, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 4|#define PARAMS_NBAR 8 ------------------ clear_bytes((uint8_t *)V, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 4|#define PARAMS_NBAR 8 ------------------ 146| 4| clear_bytes((uint8_t *)Sp, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 27| 4|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)Sp, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 4|#define PARAMS_N 640 ------------------ clear_bytes((uint8_t *)Sp, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 4|#define PARAMS_NBAR 8 ------------------ 147| 4| clear_bytes((uint8_t *)Ep, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 27| 4|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)Ep, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 4|#define PARAMS_N 640 ------------------ clear_bytes((uint8_t *)Ep, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 4|#define PARAMS_NBAR 8 ------------------ 148| 4| clear_bytes((uint8_t *)Epp, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 27| 4|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)Epp, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 4|#define PARAMS_NBAR 8 ------------------ clear_bytes((uint8_t *)Epp, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 4|#define PARAMS_NBAR 8 ------------------ 149| 4| clear_bytes(mu, BYTES_MU); ------------------ | | 27| 4|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(mu, BYTES_MU); ------------------ | | 19| 4|#define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 15| 4|#define PARAMS_EXTRACTED_BITS 2 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 4|#define PARAMS_NBAR 8 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 4|#define PARAMS_NBAR 8 | | ------------------ ------------------ 150| 4| clear_bytes(G2out, 2*CRYPTO_BYTES); ------------------ | | 27| 4|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(G2out, 2*CRYPTO_BYTES); ------------------ | | 6| 4|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_aes_length_shared_secret | | ------------------ | | | | 102| 4|#define OQS_KEM_efrodokem_640_aes_length_shared_secret 16 | | ------------------ ------------------ 151| 4| clear_bytes(Fin_k, CRYPTO_BYTES); ------------------ | | 27| 4|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(Fin_k, CRYPTO_BYTES); ------------------ | | 6| 4|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_aes_length_shared_secret | | ------------------ | | | | 102| 4|#define OQS_KEM_efrodokem_640_aes_length_shared_secret 16 | | ------------------ ------------------ 152| 4| clear_bytes(shake_input_seedSE, 1 + CRYPTO_BYTES); ------------------ | | 27| 4|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(shake_input_seedSE, 1 + CRYPTO_BYTES); ------------------ | | 6| 4|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_aes_length_shared_secret | | ------------------ | | | | 102| 4|#define OQS_KEM_efrodokem_640_aes_length_shared_secret 16 | | ------------------ ------------------ 153| 4| return OQS_SUCCESS; 154| 4|} OQS_KEM_efrodokem_640_aes_decaps: 158| 4|{ // FrodoKEM's key decapsulation 159| | // Inputs: ciphertext ct = ct_c1||ct_c2 ( (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8 + (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8 bytes) 160| | // secret key sk = sk_s||pk_seedA||pk_b||sk_S||sk_pkh (CRYPTO_BYTES + BYTES_SEED_A + (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8 + 2*PARAMS_N*PARAMS_NBAR + BYTES_PKHASH bytes) 161| | // Output: shared key ss (CRYPTO_BYTES bytes) 162| 4| uint16_t B[PARAMS_N*PARAMS_NBAR] = {0}; 163| 4| uint16_t Bp[PARAMS_N*PARAMS_NBAR] = {0}; 164| 4| uint16_t W[PARAMS_NBAR*PARAMS_NBAR] = {0}; // contains secret data 165| 4| uint16_t C[PARAMS_NBAR*PARAMS_NBAR] = {0}; 166| 4| uint16_t CC[PARAMS_NBAR*PARAMS_NBAR] = {0}; 167| 4| ALIGN_HEADER(32) uint16_t BBp[PARAMS_N*PARAMS_NBAR] ALIGN_FOOTER(32) = {0}; 168| 4| ALIGN_HEADER(32) uint16_t Sp[(2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR] ALIGN_FOOTER(32) = {0}; // contains secret data 169| 4| uint16_t *Ep = (uint16_t *)&Sp[PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 11| 4|#define PARAMS_N 640 ------------------ uint16_t *Ep = (uint16_t *)&Sp[PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 12| 4|#define PARAMS_NBAR 8 ------------------ 170| 4| uint16_t *Epp = (uint16_t *)&Sp[2*PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 11| 4|#define PARAMS_N 640 ------------------ uint16_t *Epp = (uint16_t *)&Sp[2*PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 12| 4|#define PARAMS_NBAR 8 ------------------ 171| 4| const uint8_t *ct_c1 = &ct[0]; 172| 4| const uint8_t *ct_c2 = &ct[(PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8]; ------------------ | | 13| 4|#define PARAMS_LOGQ 15 ------------------ const uint8_t *ct_c2 = &ct[(PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8]; ------------------ | | 11| 4|#define PARAMS_N 640 ------------------ const uint8_t *ct_c2 = &ct[(PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8]; ------------------ | | 12| 4|#define PARAMS_NBAR 8 ------------------ 173| 4| const uint8_t *sk_s = &sk[0]; 174| 4| const uint8_t *sk_pk = &sk[CRYPTO_BYTES]; ------------------ | | 6| 4|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_aes_length_shared_secret | | ------------------ | | | | 102| 4|#define OQS_KEM_efrodokem_640_aes_length_shared_secret 16 | | ------------------ ------------------ 175| 4| const uint16_t *sk_S = (uint16_t *) &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES]; ------------------ | | 6| 4|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_aes_length_shared_secret | | ------------------ | | | | 102| 4|#define OQS_KEM_efrodokem_640_aes_length_shared_secret 16 | | ------------------ ------------------ const uint16_t *sk_S = (uint16_t *) &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES]; ------------------ | | 3| 4|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_efrodokem_640_aes_length_public_key | | ------------------ | | | | 99| 4|#define OQS_KEM_efrodokem_640_aes_length_public_key 9616 | | ------------------ ------------------ 176| 4| uint16_t S[PARAMS_N * PARAMS_NBAR]; // contains secret data 177| 4| const uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 6| 4|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_aes_length_shared_secret | | ------------------ | | | | 102| 4|#define OQS_KEM_efrodokem_640_aes_length_shared_secret 16 | | ------------------ ------------------ const uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 3| 4|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_efrodokem_640_aes_length_public_key | | ------------------ | | | | 99| 4|#define OQS_KEM_efrodokem_640_aes_length_public_key 9616 | | ------------------ ------------------ const uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 11| 4|#define PARAMS_N 640 ------------------ const uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 12| 4|#define PARAMS_NBAR 8 ------------------ 178| 4| const uint8_t *pk_seedA = &sk_pk[0]; 179| 4| const uint8_t *pk_b = &sk_pk[BYTES_SEED_A]; ------------------ | | 18| 4|#define BYTES_SEED_A 16 ------------------ 180| 4| uint8_t G2in[BYTES_PKHASH + BYTES_MU]; // contains secret data via muprime 181| 4| uint8_t *pkh = &G2in[0]; 182| 4| uint8_t *muprime = &G2in[BYTES_PKHASH]; // contains secret data ------------------ | | 20| 4|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 4|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_aes_length_shared_secret | | | | ------------------ | | | | | | 102| 4|#define OQS_KEM_efrodokem_640_aes_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ 183| 4| uint8_t G2out[2*CRYPTO_BYTES]; // contains secret data 184| 4| uint8_t *seedSEprime = &G2out[0]; // contains secret data 185| 4| uint8_t *kprime = &G2out[CRYPTO_BYTES]; // contains secret data ------------------ | | 6| 4|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_aes_length_shared_secret | | ------------------ | | | | 102| 4|#define OQS_KEM_efrodokem_640_aes_length_shared_secret 16 | | ------------------ ------------------ 186| 4| uint8_t Fin[CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES]; // contains secret data via Fin_k 187| 4| uint8_t *Fin_ct = &Fin[0]; 188| 4| uint8_t *Fin_k = &Fin[CRYPTO_CIPHERTEXTBYTES]; // contains secret data ------------------ | | 5| 4|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_efrodokem_640_aes_length_ciphertext | | ------------------ | | | | 101| 4|#define OQS_KEM_efrodokem_640_aes_length_ciphertext 9720 | | ------------------ ------------------ 189| 4| uint8_t shake_input_seedSEprime[1 + CRYPTO_BYTES]; // contains secret data 190| | 191| 20.4k| for (size_t i = 0; i < PARAMS_N * PARAMS_NBAR; i++) { ------------------ | | 11| 20.4k|#define PARAMS_N 640 ------------------ for (size_t i = 0; i < PARAMS_N * PARAMS_NBAR; i++) { ------------------ | | 12| 20.4k|#define PARAMS_NBAR 8 ------------------ | Branch (191:24): [True: 20.4k, False: 4] ------------------ 192| 20.4k| S[i] = LE_TO_UINT16(sk_S[i]); ------------------ | | 34| 20.4k| #define LE_TO_UINT16(n) (n) ------------------ 193| 20.4k| } 194| | 195| | // Compute W = C - Bp*S (mod q), and decode the randomness mu 196| 4| frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 40| 4|#define frodo_unpack oqs_kem_efrodokem_640_aes_unpack ------------------ frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 11| 4|#define PARAMS_N 640 ------------------ frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 12| 4|#define PARAMS_NBAR 8 ------------------ frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 13| 4|#define PARAMS_LOGQ 15 ------------------ frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 11| 4|#define PARAMS_N 640 ------------------ frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 12| 4|#define PARAMS_NBAR 8 ------------------ frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 13| 4|#define PARAMS_LOGQ 15 ------------------ 197| 4| frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 40| 4|#define frodo_unpack oqs_kem_efrodokem_640_aes_unpack ------------------ frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 12| 4|#define PARAMS_NBAR 8 ------------------ frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 12| 4|#define PARAMS_NBAR 8 ------------------ frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 13| 4|#define PARAMS_LOGQ 15 ------------------ frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 12| 4|#define PARAMS_NBAR 8 ------------------ frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 12| 4|#define PARAMS_NBAR 8 ------------------ frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 13| 4|#define PARAMS_LOGQ 15 ------------------ 198| 4| frodo_mul_bs(W, Bp, S); ------------------ | | 51| 4|#define frodo_mul_bs oqs_kem_efrodokem_640_aes_mul_bs ------------------ 199| 4| frodo_sub(W, C, W); ------------------ | | 54| 4|#define frodo_sub oqs_kem_efrodokem_640_aes_sub ------------------ 200| 4| frodo_key_decode((uint16_t*)muprime, W); ------------------ | | 56| 4|#define frodo_key_decode oqs_kem_efrodokem_640_aes_key_decode ------------------ 201| | 202| | // Generate (seedSE' || k') = G_2(pkh || mu') 203| 4| memcpy(pkh, sk_pkh, BYTES_PKHASH); ------------------ | | 20| 4|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 4|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_aes_length_shared_secret | | | | ------------------ | | | | | | 102| 4|#define OQS_KEM_efrodokem_640_aes_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ 204| 4| shake(G2out, CRYPTO_BYTES + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU); ------------------ | | 29| 4|#define shake OQS_SHA3_shake128 ------------------ shake(G2out, CRYPTO_BYTES + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU); ------------------ | | 6| 4|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_aes_length_shared_secret | | ------------------ | | | | 102| 4|#define OQS_KEM_efrodokem_640_aes_length_shared_secret 16 | | ------------------ ------------------ shake(G2out, CRYPTO_BYTES + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU); ------------------ | | 6| 4|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_aes_length_shared_secret | | ------------------ | | | | 102| 4|#define OQS_KEM_efrodokem_640_aes_length_shared_secret 16 | | ------------------ ------------------ shake(G2out, CRYPTO_BYTES + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU); ------------------ | | 20| 4|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 4|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_aes_length_shared_secret | | | | ------------------ | | | | | | 102| 4|#define OQS_KEM_efrodokem_640_aes_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ shake(G2out, CRYPTO_BYTES + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU); ------------------ | | 19| 4|#define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 15| 4|#define PARAMS_EXTRACTED_BITS 2 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 4|#define PARAMS_NBAR 8 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 4|#define PARAMS_NBAR 8 | | ------------------ ------------------ 205| | 206| | // Generate Sp and Ep, and compute BBp = Sp*A + Ep. Generate A on-the-fly 207| 4| shake_input_seedSEprime[0] = 0x96; 208| 4| memcpy(&shake_input_seedSEprime[1], seedSEprime, CRYPTO_BYTES); ------------------ | | 6| 4|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_aes_length_shared_secret | | ------------------ | | | | 102| 4|#define OQS_KEM_efrodokem_640_aes_length_shared_secret 16 | | ------------------ ------------------ 209| 4| shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSEprime, 1 + CRYPTO_BYTES); ------------------ | | 29| 4|#define shake OQS_SHA3_shake128 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSEprime, 1 + CRYPTO_BYTES); ------------------ | | 11| 4|#define PARAMS_N 640 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSEprime, 1 + CRYPTO_BYTES); ------------------ | | 12| 4|#define PARAMS_NBAR 8 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSEprime, 1 + CRYPTO_BYTES); ------------------ | | 12| 4|#define PARAMS_NBAR 8 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSEprime, 1 + CRYPTO_BYTES); ------------------ | | 6| 4|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_aes_length_shared_secret | | ------------------ | | | | 102| 4|#define OQS_KEM_efrodokem_640_aes_length_shared_secret 16 | | ------------------ ------------------ 210| 41.2k| for (size_t i = 0; i < (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR; i++) { ------------------ | | 11| 41.2k|#define PARAMS_N 640 ------------------ for (size_t i = 0; i < (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR; i++) { ------------------ | | 12| 41.2k|#define PARAMS_NBAR 8 ------------------ for (size_t i = 0; i < (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR; i++) { ------------------ | | 12| 41.2k|#define PARAMS_NBAR 8 ------------------ | Branch (210:24): [True: 41.2k, False: 4] ------------------ 211| 41.2k| Sp[i] = LE_TO_UINT16(Sp[i]); ------------------ | | 34| 41.2k| #define LE_TO_UINT16(n) (n) ------------------ 212| 41.2k| } 213| 4| frodo_sample_n(Sp, PARAMS_N*PARAMS_NBAR); ------------------ | | 38| 4|#define frodo_sample_n oqs_kem_efrodokem_640_aes_sample_n ------------------ frodo_sample_n(Sp, PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 4|#define PARAMS_N 640 ------------------ frodo_sample_n(Sp, PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 4|#define PARAMS_NBAR 8 ------------------ 214| 4| frodo_sample_n(Ep, PARAMS_N*PARAMS_NBAR); ------------------ | | 38| 4|#define frodo_sample_n oqs_kem_efrodokem_640_aes_sample_n ------------------ frodo_sample_n(Ep, PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 4|#define PARAMS_N 640 ------------------ frodo_sample_n(Ep, PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 4|#define PARAMS_NBAR 8 ------------------ 215| 4| frodo_mul_add_sa_plus_e(BBp, Sp, Ep, pk_seedA); ------------------ | | 47| 4|#define frodo_mul_add_sa_plus_e oqs_kem_efrodokem_640_aes_mul_add_sa_plus_e ------------------ 216| | 217| | // Generate Epp, and compute W = Sp*B + Epp 218| 4| frodo_sample_n(Epp, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 38| 4|#define frodo_sample_n oqs_kem_efrodokem_640_aes_sample_n ------------------ frodo_sample_n(Epp, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 4|#define PARAMS_NBAR 8 ------------------ frodo_sample_n(Epp, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 4|#define PARAMS_NBAR 8 ------------------ 219| 4| frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 40| 4|#define frodo_unpack oqs_kem_efrodokem_640_aes_unpack ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 11| 4|#define PARAMS_N 640 ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 12| 4|#define PARAMS_NBAR 8 ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 3| 4|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_efrodokem_640_aes_length_public_key | | ------------------ | | | | 99| 4|#define OQS_KEM_efrodokem_640_aes_length_public_key 9616 | | ------------------ ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 18| 4|#define BYTES_SEED_A 16 ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 13| 4|#define PARAMS_LOGQ 15 ------------------ 220| 4| frodo_mul_add_sb_plus_e(W, B, Sp, Epp); ------------------ | | 50| 4|#define frodo_mul_add_sb_plus_e oqs_kem_efrodokem_640_aes_mul_add_sb_plus_e ------------------ 221| | 222| | // Encode mu, and compute CC = W + enc(mu') (mod q) 223| 4| frodo_key_encode(CC, (uint16_t*)muprime); ------------------ | | 55| 4|#define frodo_key_encode oqs_kem_efrodokem_640_aes_key_encode ------------------ 224| 4| frodo_add(CC, W, CC); ------------------ | | 53| 4|#define frodo_add oqs_kem_efrodokem_640_aes_add ------------------ 225| | 226| | // Prepare input to F 227| 4| memcpy(Fin_ct, ct, CRYPTO_CIPHERTEXTBYTES); ------------------ | | 5| 4|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_efrodokem_640_aes_length_ciphertext | | ------------------ | | | | 101| 4|#define OQS_KEM_efrodokem_640_aes_length_ciphertext 9720 | | ------------------ ------------------ 228| | 229| | // Reducing BBp modulo q 230| 20.4k| for (int i = 0; i < PARAMS_N*PARAMS_NBAR; i++) BBp[i] = BBp[i] & ((1 << PARAMS_LOGQ)-1); ------------------ | | 11| 20.4k|#define PARAMS_N 640 ------------------ for (int i = 0; i < PARAMS_N*PARAMS_NBAR; i++) BBp[i] = BBp[i] & ((1 << PARAMS_LOGQ)-1); ------------------ | | 12| 20.4k|#define PARAMS_NBAR 8 ------------------ for (int i = 0; i < PARAMS_N*PARAMS_NBAR; i++) BBp[i] = BBp[i] & ((1 << PARAMS_LOGQ)-1); ------------------ | | 13| 20.4k|#define PARAMS_LOGQ 15 ------------------ | Branch (230:21): [True: 20.4k, False: 4] ------------------ 231| | 232| | // Needs to avoid branching on secret data using constant-time implementation. 233| 4| int8_t selector = ct_verify(Bp, BBp, PARAMS_N*PARAMS_NBAR) | ct_verify(C, CC, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 42| 4|#define ct_verify oqs_kem_efrodokem_640_aes_ct_verify ------------------ int8_t selector = ct_verify(Bp, BBp, PARAMS_N*PARAMS_NBAR) | ct_verify(C, CC, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 11| 4|#define PARAMS_N 640 ------------------ int8_t selector = ct_verify(Bp, BBp, PARAMS_N*PARAMS_NBAR) | ct_verify(C, CC, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 4|#define PARAMS_NBAR 8 ------------------ int8_t selector = ct_verify(Bp, BBp, PARAMS_N*PARAMS_NBAR) | ct_verify(C, CC, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 42| 4|#define ct_verify oqs_kem_efrodokem_640_aes_ct_verify ------------------ int8_t selector = ct_verify(Bp, BBp, PARAMS_N*PARAMS_NBAR) | ct_verify(C, CC, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 4|#define PARAMS_NBAR 8 ------------------ int8_t selector = ct_verify(Bp, BBp, PARAMS_N*PARAMS_NBAR) | ct_verify(C, CC, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 4|#define PARAMS_NBAR 8 ------------------ 234| | // If (selector == 0) then load k' to do ss = F(ct || k'), else if (selector == -1) load s to do ss = F(ct || s) 235| 4| ct_select((uint8_t*)Fin_k, (uint8_t*)kprime, (uint8_t*)sk_s, CRYPTO_BYTES, selector); ------------------ | | 41| 4|#define ct_select oqs_kem_efrodokem_640_aes_ct_select ------------------ ct_select((uint8_t*)Fin_k, (uint8_t*)kprime, (uint8_t*)sk_s, CRYPTO_BYTES, selector); ------------------ | | 6| 4|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_aes_length_shared_secret | | ------------------ | | | | 102| 4|#define OQS_KEM_efrodokem_640_aes_length_shared_secret 16 | | ------------------ ------------------ 236| 4| shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 29| 4|#define shake OQS_SHA3_shake128 ------------------ shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 6| 4|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_aes_length_shared_secret | | ------------------ | | | | 102| 4|#define OQS_KEM_efrodokem_640_aes_length_shared_secret 16 | | ------------------ ------------------ shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 5| 4|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_efrodokem_640_aes_length_ciphertext | | ------------------ | | | | 101| 4|#define OQS_KEM_efrodokem_640_aes_length_ciphertext 9720 | | ------------------ ------------------ shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 6| 4|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_aes_length_shared_secret | | ------------------ | | | | 102| 4|#define OQS_KEM_efrodokem_640_aes_length_shared_secret 16 | | ------------------ ------------------ 237| | 238| | // Cleanup: 239| 4| clear_bytes((uint8_t *)W, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 27| 4|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)W, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 4|#define PARAMS_NBAR 8 ------------------ clear_bytes((uint8_t *)W, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 4|#define PARAMS_NBAR 8 ------------------ 240| 4| clear_bytes((uint8_t *)Sp, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 27| 4|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)Sp, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 4|#define PARAMS_N 640 ------------------ clear_bytes((uint8_t *)Sp, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 4|#define PARAMS_NBAR 8 ------------------ 241| 4| clear_bytes((uint8_t *)S, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 27| 4|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)S, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 4|#define PARAMS_N 640 ------------------ clear_bytes((uint8_t *)S, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 4|#define PARAMS_NBAR 8 ------------------ 242| 4| clear_bytes((uint8_t *)Ep, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 27| 4|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)Ep, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 4|#define PARAMS_N 640 ------------------ clear_bytes((uint8_t *)Ep, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 4|#define PARAMS_NBAR 8 ------------------ 243| 4| clear_bytes((uint8_t *)Epp, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 27| 4|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)Epp, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 4|#define PARAMS_NBAR 8 ------------------ clear_bytes((uint8_t *)Epp, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 4|#define PARAMS_NBAR 8 ------------------ 244| 4| clear_bytes(muprime, BYTES_MU); ------------------ | | 27| 4|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(muprime, BYTES_MU); ------------------ | | 19| 4|#define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 15| 4|#define PARAMS_EXTRACTED_BITS 2 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 4|#define PARAMS_NBAR 8 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 4|#define PARAMS_NBAR 8 | | ------------------ ------------------ 245| 4| clear_bytes(G2out, 2*CRYPTO_BYTES); ------------------ | | 27| 4|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(G2out, 2*CRYPTO_BYTES); ------------------ | | 6| 4|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_aes_length_shared_secret | | ------------------ | | | | 102| 4|#define OQS_KEM_efrodokem_640_aes_length_shared_secret 16 | | ------------------ ------------------ 246| 4| clear_bytes(Fin_k, CRYPTO_BYTES); ------------------ | | 27| 4|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(Fin_k, CRYPTO_BYTES); ------------------ | | 6| 4|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_aes_length_shared_secret | | ------------------ | | | | 102| 4|#define OQS_KEM_efrodokem_640_aes_length_shared_secret 16 | | ------------------ ------------------ 247| 4| clear_bytes(shake_input_seedSEprime, 1 + CRYPTO_BYTES); ------------------ | | 27| 4|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(shake_input_seedSEprime, 1 + CRYPTO_BYTES); ------------------ | | 6| 4|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_aes_length_shared_secret | | ------------------ | | | | 102| 4|#define OQS_KEM_efrodokem_640_aes_length_shared_secret 16 | | ------------------ ------------------ 248| 4| return OQS_SUCCESS; 249| 4|} OQS_KEM_efrodokem_640_shake_keypair: 19| 2|{ // FrodoKEM's key generation 20| | // Outputs: public key pk = pk_seedA||pk_b ( BYTES_SEED_A + (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8 bytes) 21| | // secret key sk = sk_s||pk_seedA||pk_b||sk_S||sk_pkh (CRYPTO_BYTES + BYTES_SEED_A + (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8 + 2*PARAMS_N*PARAMS_NBAR + BYTES_PKHASH bytes) 22| 2| uint8_t *pk_seedA = &pk[0]; 23| 2| uint8_t *pk_b = &pk[BYTES_SEED_A]; ------------------ | | 18| 2|#define BYTES_SEED_A 16 ------------------ 24| 2| uint8_t *sk_s = &sk[0]; 25| 2| uint8_t *sk_pk = &sk[CRYPTO_BYTES]; ------------------ | | 6| 2|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_shake_length_shared_secret | | ------------------ | | | | 117| 2|#define OQS_KEM_efrodokem_640_shake_length_shared_secret 16 | | ------------------ ------------------ 26| 2| uint8_t *sk_S = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES]; ------------------ | | 6| 2|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_shake_length_shared_secret | | ------------------ | | | | 117| 2|#define OQS_KEM_efrodokem_640_shake_length_shared_secret 16 | | ------------------ ------------------ uint8_t *sk_S = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES]; ------------------ | | 3| 2|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_efrodokem_640_shake_length_public_key | | ------------------ | | | | 114| 2|#define OQS_KEM_efrodokem_640_shake_length_public_key 9616 | | ------------------ ------------------ 27| 2| uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 6| 2|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_shake_length_shared_secret | | ------------------ | | | | 117| 2|#define OQS_KEM_efrodokem_640_shake_length_shared_secret 16 | | ------------------ ------------------ uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 3| 2|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_efrodokem_640_shake_length_public_key | | ------------------ | | | | 114| 2|#define OQS_KEM_efrodokem_640_shake_length_public_key 9616 | | ------------------ ------------------ uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 11| 2|#define PARAMS_N 640 ------------------ uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ 28| 2| uint16_t B[PARAMS_N*PARAMS_NBAR] = {0}; 29| 2| uint16_t S[2*PARAMS_N*PARAMS_NBAR] = {0}; // contains secret data 30| 2| uint16_t *E = (uint16_t *)&S[PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 11| 2|#define PARAMS_N 640 ------------------ uint16_t *E = (uint16_t *)&S[PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ 31| 2| uint8_t randomness[2*CRYPTO_BYTES + BYTES_SEED_A]; // contains secret data via randomness_s and randomness_seedSE 32| 2| uint8_t *randomness_s = &randomness[0]; // contains secret data 33| 2| uint8_t *randomness_seedSE = &randomness[CRYPTO_BYTES]; // contains secret data ------------------ | | 6| 2|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_shake_length_shared_secret | | ------------------ | | | | 117| 2|#define OQS_KEM_efrodokem_640_shake_length_shared_secret 16 | | ------------------ ------------------ 34| 2| uint8_t *randomness_z = &randomness[2*CRYPTO_BYTES]; ------------------ | | 6| 2|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_shake_length_shared_secret | | ------------------ | | | | 117| 2|#define OQS_KEM_efrodokem_640_shake_length_shared_secret 16 | | ------------------ ------------------ 35| 2| uint8_t shake_input_seedSE[1 + CRYPTO_BYTES]; // contains secret data 36| | 37| | // Generate the secret value s, the seed for S and E, and the seed for the seed for A. Add seed_A to the public key 38| 2| randombytes(randomness, CRYPTO_BYTES + CRYPTO_BYTES + BYTES_SEED_A); ------------------ | | 26| 2|#define randombytes OQS_randombytes ------------------ randombytes(randomness, CRYPTO_BYTES + CRYPTO_BYTES + BYTES_SEED_A); ------------------ | | 6| 2|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_shake_length_shared_secret | | ------------------ | | | | 117| 2|#define OQS_KEM_efrodokem_640_shake_length_shared_secret 16 | | ------------------ ------------------ randombytes(randomness, CRYPTO_BYTES + CRYPTO_BYTES + BYTES_SEED_A); ------------------ | | 6| 2|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_shake_length_shared_secret | | ------------------ | | | | 117| 2|#define OQS_KEM_efrodokem_640_shake_length_shared_secret 16 | | ------------------ ------------------ randombytes(randomness, CRYPTO_BYTES + CRYPTO_BYTES + BYTES_SEED_A); ------------------ | | 18| 2|#define BYTES_SEED_A 16 ------------------ 39| 2| shake(pk_seedA, BYTES_SEED_A, randomness_z, BYTES_SEED_A); ------------------ | | 29| 2|#define shake OQS_SHA3_shake128 ------------------ shake(pk_seedA, BYTES_SEED_A, randomness_z, BYTES_SEED_A); ------------------ | | 18| 2|#define BYTES_SEED_A 16 ------------------ shake(pk_seedA, BYTES_SEED_A, randomness_z, BYTES_SEED_A); ------------------ | | 18| 2|#define BYTES_SEED_A 16 ------------------ 40| | 41| | // Generate S and E, and compute B = A*S + E. Generate A on-the-fly 42| 2| shake_input_seedSE[0] = 0x5F; 43| 2| memcpy(&shake_input_seedSE[1], randomness_seedSE, CRYPTO_BYTES); ------------------ | | 6| 2|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_shake_length_shared_secret | | ------------------ | | | | 117| 2|#define OQS_KEM_efrodokem_640_shake_length_shared_secret 16 | | ------------------ ------------------ 44| 2| shake((uint8_t*)S, 2*PARAMS_N*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + CRYPTO_BYTES); ------------------ | | 29| 2|#define shake OQS_SHA3_shake128 ------------------ shake((uint8_t*)S, 2*PARAMS_N*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + CRYPTO_BYTES); ------------------ | | 11| 2|#define PARAMS_N 640 ------------------ shake((uint8_t*)S, 2*PARAMS_N*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + CRYPTO_BYTES); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ shake((uint8_t*)S, 2*PARAMS_N*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + CRYPTO_BYTES); ------------------ | | 6| 2|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_shake_length_shared_secret | | ------------------ | | | | 117| 2|#define OQS_KEM_efrodokem_640_shake_length_shared_secret 16 | | ------------------ ------------------ 45| 20.4k| for (size_t i = 0; i < 2 * PARAMS_N * PARAMS_NBAR; i++) { ------------------ | | 11| 20.4k|#define PARAMS_N 640 ------------------ for (size_t i = 0; i < 2 * PARAMS_N * PARAMS_NBAR; i++) { ------------------ | | 12| 20.4k|#define PARAMS_NBAR 8 ------------------ | Branch (45:24): [True: 20.4k, False: 2] ------------------ 46| 20.4k| S[i] = LE_TO_UINT16(S[i]); ------------------ | | 34| 20.4k| #define LE_TO_UINT16(n) (n) ------------------ 47| 20.4k| } 48| 2| frodo_sample_n(S, PARAMS_N*PARAMS_NBAR); ------------------ | | 38| 2|#define frodo_sample_n oqs_kem_efrodokem_640_shake_sample_n ------------------ frodo_sample_n(S, PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 2|#define PARAMS_N 640 ------------------ frodo_sample_n(S, PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ 49| 2| frodo_sample_n(E, PARAMS_N*PARAMS_NBAR); ------------------ | | 38| 2|#define frodo_sample_n oqs_kem_efrodokem_640_shake_sample_n ------------------ frodo_sample_n(E, PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 2|#define PARAMS_N 640 ------------------ frodo_sample_n(E, PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ 50| 2| frodo_mul_add_as_plus_e(B, S, E, pk); ------------------ | | 44| 2|#define frodo_mul_add_as_plus_e oqs_kem_efrodokem_640_shake_mul_add_as_plus_e ------------------ 51| | 52| | // Encode the second part of the public key 53| 2| frodo_pack(pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, B, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 39| 2|#define frodo_pack oqs_kem_efrodokem_640_shake_pack ------------------ frodo_pack(pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, B, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 3| 2|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_efrodokem_640_shake_length_public_key | | ------------------ | | | | 114| 2|#define OQS_KEM_efrodokem_640_shake_length_public_key 9616 | | ------------------ ------------------ frodo_pack(pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, B, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 18| 2|#define BYTES_SEED_A 16 ------------------ frodo_pack(pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, B, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 11| 2|#define PARAMS_N 640 ------------------ frodo_pack(pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, B, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ frodo_pack(pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, B, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 13| 2|#define PARAMS_LOGQ 15 ------------------ 54| | 55| | // Add s, pk and S to the secret key 56| 2| memcpy(sk_s, randomness_s, CRYPTO_BYTES); ------------------ | | 6| 2|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_shake_length_shared_secret | | ------------------ | | | | 117| 2|#define OQS_KEM_efrodokem_640_shake_length_shared_secret 16 | | ------------------ ------------------ 57| 2| memcpy(sk_pk, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 3| 2|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_efrodokem_640_shake_length_public_key | | ------------------ | | | | 114| 2|#define OQS_KEM_efrodokem_640_shake_length_public_key 9616 | | ------------------ ------------------ 58| 10.2k| for (size_t i = 0; i < PARAMS_N * PARAMS_NBAR; i++) { ------------------ | | 11| 10.2k|#define PARAMS_N 640 ------------------ for (size_t i = 0; i < PARAMS_N * PARAMS_NBAR; i++) { ------------------ | | 12| 10.2k|#define PARAMS_NBAR 8 ------------------ | Branch (58:24): [True: 10.2k, False: 2] ------------------ 59| 10.2k| S[i] = UINT16_TO_LE(S[i]); ------------------ | | 35| 10.2k| #define UINT16_TO_LE(n) (n) ------------------ 60| 10.2k| } 61| 2| memcpy(sk_S, S, 2*PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 2|#define PARAMS_N 640 ------------------ memcpy(sk_S, S, 2*PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ 62| | 63| | // Add H(pk) to the secret key 64| 2| shake(sk_pkh, BYTES_PKHASH, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 29| 2|#define shake OQS_SHA3_shake128 ------------------ shake(sk_pkh, BYTES_PKHASH, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 20| 2|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 2|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_shake_length_shared_secret | | | | ------------------ | | | | | | 117| 2|#define OQS_KEM_efrodokem_640_shake_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ shake(sk_pkh, BYTES_PKHASH, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 3| 2|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_efrodokem_640_shake_length_public_key | | ------------------ | | | | 114| 2|#define OQS_KEM_efrodokem_640_shake_length_public_key 9616 | | ------------------ ------------------ 65| | 66| | // Cleanup: 67| 2| clear_bytes((uint8_t *)S, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 27| 2|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)S, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 2|#define PARAMS_N 640 ------------------ clear_bytes((uint8_t *)S, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ 68| 2| clear_bytes((uint8_t *)E, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 27| 2|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)E, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 2|#define PARAMS_N 640 ------------------ clear_bytes((uint8_t *)E, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ 69| 2| clear_bytes(randomness, 2*CRYPTO_BYTES); ------------------ | | 27| 2|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(randomness, 2*CRYPTO_BYTES); ------------------ | | 6| 2|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_shake_length_shared_secret | | ------------------ | | | | 117| 2|#define OQS_KEM_efrodokem_640_shake_length_shared_secret 16 | | ------------------ ------------------ 70| 2| clear_bytes(shake_input_seedSE, 1 + CRYPTO_BYTES); ------------------ | | 27| 2|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(shake_input_seedSE, 1 + CRYPTO_BYTES); ------------------ | | 6| 2|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_shake_length_shared_secret | | ------------------ | | | | 117| 2|#define OQS_KEM_efrodokem_640_shake_length_shared_secret 16 | | ------------------ ------------------ 71| 2| return OQS_SUCCESS; 72| 2|} OQS_KEM_efrodokem_640_shake_encaps: 86| 2|{ // FrodoKEM's key encapsulation 87| | // Input: public key pk = pk_seedA||pk_b (BYTES_SEED_A + (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8 bytes) 88| | // Outputs: ciphertext ct = ct_c1||ct_c2 ( (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8 + (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8 bytes) 89| | // shared key ss (CRYPTO_BYTES bytes) 90| 2| const uint8_t *pk_seedA = &pk[0]; 91| 2| const uint8_t *pk_b = &pk[BYTES_SEED_A]; ------------------ | | 18| 2|#define BYTES_SEED_A 16 ------------------ 92| 2| uint8_t *ct_c1 = &ct[0]; 93| 2| uint8_t *ct_c2 = &ct[(PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8]; ------------------ | | 13| 2|#define PARAMS_LOGQ 15 ------------------ uint8_t *ct_c2 = &ct[(PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8]; ------------------ | | 11| 2|#define PARAMS_N 640 ------------------ uint8_t *ct_c2 = &ct[(PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8]; ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ 94| 2| uint16_t B[PARAMS_N*PARAMS_NBAR] = {0}; 95| 2| uint16_t V[PARAMS_NBAR*PARAMS_NBAR]= {0}; // contains secret data 96| 2| uint16_t C[PARAMS_NBAR*PARAMS_NBAR] = {0}; 97| 2| ALIGN_HEADER(32) uint16_t Bp[PARAMS_N*PARAMS_NBAR] ALIGN_FOOTER(32) = {0}; 98| 2| ALIGN_HEADER(32) uint16_t Sp[(2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR] ALIGN_FOOTER(32) = {0}; // contains secret data 99| 2| uint16_t *Ep = (uint16_t *)&Sp[PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 11| 2|#define PARAMS_N 640 ------------------ uint16_t *Ep = (uint16_t *)&Sp[PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ 100| 2| uint16_t *Epp = (uint16_t *)&Sp[2*PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 11| 2|#define PARAMS_N 640 ------------------ uint16_t *Epp = (uint16_t *)&Sp[2*PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ 101| 2| uint8_t G2in[BYTES_PKHASH + BYTES_MU]; // contains secret data via mu 102| 2| uint8_t *pkh = &G2in[0]; 103| 2| uint8_t *mu = &G2in[BYTES_PKHASH]; // contains secret data ------------------ | | 20| 2|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 2|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_shake_length_shared_secret | | | | ------------------ | | | | | | 117| 2|#define OQS_KEM_efrodokem_640_shake_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ 104| 2| uint8_t G2out[2*CRYPTO_BYTES]; // contains secret data 105| 2| uint8_t *seedSE = &G2out[0]; // contains secret data 106| 2| uint8_t *k = &G2out[CRYPTO_BYTES]; // contains secret data ------------------ | | 6| 2|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_shake_length_shared_secret | | ------------------ | | | | 117| 2|#define OQS_KEM_efrodokem_640_shake_length_shared_secret 16 | | ------------------ ------------------ 107| 2| uint8_t Fin[CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES]; // contains secret data via Fin_k 108| 2| uint8_t *Fin_ct = &Fin[0]; 109| 2| uint8_t *Fin_k = &Fin[CRYPTO_CIPHERTEXTBYTES]; // contains secret data ------------------ | | 5| 2|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_efrodokem_640_shake_length_ciphertext | | ------------------ | | | | 116| 2|#define OQS_KEM_efrodokem_640_shake_length_ciphertext 9720 | | ------------------ ------------------ 110| 2| uint8_t shake_input_seedSE[1 + CRYPTO_BYTES]; // contains secret data 111| | 112| | // pkh <- G_1(pk), generate random mu, compute (seedSE || k) = G_2(pkh || mu) 113| 2| shake(pkh, BYTES_PKHASH, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 29| 2|#define shake OQS_SHA3_shake128 ------------------ shake(pkh, BYTES_PKHASH, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 20| 2|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 2|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_shake_length_shared_secret | | | | ------------------ | | | | | | 117| 2|#define OQS_KEM_efrodokem_640_shake_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ shake(pkh, BYTES_PKHASH, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 3| 2|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_efrodokem_640_shake_length_public_key | | ------------------ | | | | 114| 2|#define OQS_KEM_efrodokem_640_shake_length_public_key 9616 | | ------------------ ------------------ 114| 2| randombytes(mu, BYTES_MU); ------------------ | | 26| 2|#define randombytes OQS_randombytes ------------------ randombytes(mu, BYTES_MU); ------------------ | | 19| 2|#define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 15| 2|#define PARAMS_EXTRACTED_BITS 2 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 2|#define PARAMS_NBAR 8 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 2|#define PARAMS_NBAR 8 | | ------------------ ------------------ 115| 2| shake(G2out, CRYPTO_BYTES + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU); ------------------ | | 29| 2|#define shake OQS_SHA3_shake128 ------------------ shake(G2out, CRYPTO_BYTES + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU); ------------------ | | 6| 2|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_shake_length_shared_secret | | ------------------ | | | | 117| 2|#define OQS_KEM_efrodokem_640_shake_length_shared_secret 16 | | ------------------ ------------------ shake(G2out, CRYPTO_BYTES + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU); ------------------ | | 6| 2|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_shake_length_shared_secret | | ------------------ | | | | 117| 2|#define OQS_KEM_efrodokem_640_shake_length_shared_secret 16 | | ------------------ ------------------ shake(G2out, CRYPTO_BYTES + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU); ------------------ | | 20| 2|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 2|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_shake_length_shared_secret | | | | ------------------ | | | | | | 117| 2|#define OQS_KEM_efrodokem_640_shake_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ shake(G2out, CRYPTO_BYTES + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU); ------------------ | | 19| 2|#define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 15| 2|#define PARAMS_EXTRACTED_BITS 2 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 2|#define PARAMS_NBAR 8 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 2|#define PARAMS_NBAR 8 | | ------------------ ------------------ 116| | 117| | // Generate Sp and Ep, and compute Bp = Sp*A + Ep. Generate A on-the-fly 118| 2| shake_input_seedSE[0] = 0x96; 119| 2| memcpy(&shake_input_seedSE[1], seedSE, CRYPTO_BYTES); ------------------ | | 6| 2|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_shake_length_shared_secret | | ------------------ | | | | 117| 2|#define OQS_KEM_efrodokem_640_shake_length_shared_secret 16 | | ------------------ ------------------ 120| 2| shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + CRYPTO_BYTES); ------------------ | | 29| 2|#define shake OQS_SHA3_shake128 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + CRYPTO_BYTES); ------------------ | | 11| 2|#define PARAMS_N 640 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + CRYPTO_BYTES); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + CRYPTO_BYTES); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + CRYPTO_BYTES); ------------------ | | 6| 2|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_shake_length_shared_secret | | ------------------ | | | | 117| 2|#define OQS_KEM_efrodokem_640_shake_length_shared_secret 16 | | ------------------ ------------------ 121| 20.6k| for (size_t i = 0; i < (2 * PARAMS_N + PARAMS_NBAR) * PARAMS_NBAR; i++) { ------------------ | | 11| 20.6k|#define PARAMS_N 640 ------------------ for (size_t i = 0; i < (2 * PARAMS_N + PARAMS_NBAR) * PARAMS_NBAR; i++) { ------------------ | | 12| 20.6k|#define PARAMS_NBAR 8 ------------------ for (size_t i = 0; i < (2 * PARAMS_N + PARAMS_NBAR) * PARAMS_NBAR; i++) { ------------------ | | 12| 20.6k|#define PARAMS_NBAR 8 ------------------ | Branch (121:24): [True: 20.6k, False: 2] ------------------ 122| 20.6k| Sp[i] = LE_TO_UINT16(Sp[i]); ------------------ | | 34| 20.6k| #define LE_TO_UINT16(n) (n) ------------------ 123| 20.6k| } 124| 2| frodo_sample_n(Sp, PARAMS_N*PARAMS_NBAR); ------------------ | | 38| 2|#define frodo_sample_n oqs_kem_efrodokem_640_shake_sample_n ------------------ frodo_sample_n(Sp, PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 2|#define PARAMS_N 640 ------------------ frodo_sample_n(Sp, PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ 125| 2| frodo_sample_n(Ep, PARAMS_N*PARAMS_NBAR); ------------------ | | 38| 2|#define frodo_sample_n oqs_kem_efrodokem_640_shake_sample_n ------------------ frodo_sample_n(Ep, PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 2|#define PARAMS_N 640 ------------------ frodo_sample_n(Ep, PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ 126| 2| frodo_mul_add_sa_plus_e(Bp, Sp, Ep, pk_seedA); ------------------ | | 47| 2|#define frodo_mul_add_sa_plus_e oqs_kem_efrodokem_640_shake_mul_add_sa_plus_e ------------------ 127| 2| frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 39| 2|#define frodo_pack oqs_kem_efrodokem_640_shake_pack ------------------ frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 13| 2|#define PARAMS_LOGQ 15 ------------------ frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 11| 2|#define PARAMS_N 640 ------------------ frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 11| 2|#define PARAMS_N 640 ------------------ frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 13| 2|#define PARAMS_LOGQ 15 ------------------ 128| | 129| | // Generate Epp, and compute V = Sp*B + Epp 130| 2| frodo_sample_n(Epp, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 38| 2|#define frodo_sample_n oqs_kem_efrodokem_640_shake_sample_n ------------------ frodo_sample_n(Epp, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ frodo_sample_n(Epp, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ 131| 2| frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 40| 2|#define frodo_unpack oqs_kem_efrodokem_640_shake_unpack ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 11| 2|#define PARAMS_N 640 ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 3| 2|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_efrodokem_640_shake_length_public_key | | ------------------ | | | | 114| 2|#define OQS_KEM_efrodokem_640_shake_length_public_key 9616 | | ------------------ ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 18| 2|#define BYTES_SEED_A 16 ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 13| 2|#define PARAMS_LOGQ 15 ------------------ 132| 2| frodo_mul_add_sb_plus_e(V, B, Sp, Epp); ------------------ | | 50| 2|#define frodo_mul_add_sb_plus_e oqs_kem_efrodokem_640_shake_mul_add_sb_plus_e ------------------ 133| | 134| | // Encode mu, and compute C = V + enc(mu) (mod q) 135| 2| frodo_key_encode(C, (uint16_t*)mu); ------------------ | | 55| 2|#define frodo_key_encode oqs_kem_efrodokem_640_shake_key_encode ------------------ 136| 2| frodo_add(C, V, C); ------------------ | | 53| 2|#define frodo_add oqs_kem_efrodokem_640_shake_add ------------------ 137| 2| frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 39| 2|#define frodo_pack oqs_kem_efrodokem_640_shake_pack ------------------ frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 13| 2|#define PARAMS_LOGQ 15 ------------------ frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 13| 2|#define PARAMS_LOGQ 15 ------------------ 138| | 139| | // Compute ss = F(ct||KK) 140| 2| memcpy(Fin_ct, ct, CRYPTO_CIPHERTEXTBYTES); ------------------ | | 5| 2|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_efrodokem_640_shake_length_ciphertext | | ------------------ | | | | 116| 2|#define OQS_KEM_efrodokem_640_shake_length_ciphertext 9720 | | ------------------ ------------------ 141| 2| memcpy(Fin_k, k, CRYPTO_BYTES); ------------------ | | 6| 2|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_shake_length_shared_secret | | ------------------ | | | | 117| 2|#define OQS_KEM_efrodokem_640_shake_length_shared_secret 16 | | ------------------ ------------------ 142| 2| shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 29| 2|#define shake OQS_SHA3_shake128 ------------------ shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 6| 2|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_shake_length_shared_secret | | ------------------ | | | | 117| 2|#define OQS_KEM_efrodokem_640_shake_length_shared_secret 16 | | ------------------ ------------------ shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 5| 2|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_efrodokem_640_shake_length_ciphertext | | ------------------ | | | | 116| 2|#define OQS_KEM_efrodokem_640_shake_length_ciphertext 9720 | | ------------------ ------------------ shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 6| 2|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_shake_length_shared_secret | | ------------------ | | | | 117| 2|#define OQS_KEM_efrodokem_640_shake_length_shared_secret 16 | | ------------------ ------------------ 143| | 144| | // Cleanup: 145| 2| clear_bytes((uint8_t *)V, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 27| 2|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)V, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ clear_bytes((uint8_t *)V, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ 146| 2| clear_bytes((uint8_t *)Sp, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 27| 2|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)Sp, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 2|#define PARAMS_N 640 ------------------ clear_bytes((uint8_t *)Sp, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ 147| 2| clear_bytes((uint8_t *)Ep, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 27| 2|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)Ep, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 2|#define PARAMS_N 640 ------------------ clear_bytes((uint8_t *)Ep, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ 148| 2| clear_bytes((uint8_t *)Epp, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 27| 2|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)Epp, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ clear_bytes((uint8_t *)Epp, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ 149| 2| clear_bytes(mu, BYTES_MU); ------------------ | | 27| 2|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(mu, BYTES_MU); ------------------ | | 19| 2|#define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 15| 2|#define PARAMS_EXTRACTED_BITS 2 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 2|#define PARAMS_NBAR 8 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 2|#define PARAMS_NBAR 8 | | ------------------ ------------------ 150| 2| clear_bytes(G2out, 2*CRYPTO_BYTES); ------------------ | | 27| 2|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(G2out, 2*CRYPTO_BYTES); ------------------ | | 6| 2|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_shake_length_shared_secret | | ------------------ | | | | 117| 2|#define OQS_KEM_efrodokem_640_shake_length_shared_secret 16 | | ------------------ ------------------ 151| 2| clear_bytes(Fin_k, CRYPTO_BYTES); ------------------ | | 27| 2|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(Fin_k, CRYPTO_BYTES); ------------------ | | 6| 2|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_shake_length_shared_secret | | ------------------ | | | | 117| 2|#define OQS_KEM_efrodokem_640_shake_length_shared_secret 16 | | ------------------ ------------------ 152| 2| clear_bytes(shake_input_seedSE, 1 + CRYPTO_BYTES); ------------------ | | 27| 2|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(shake_input_seedSE, 1 + CRYPTO_BYTES); ------------------ | | 6| 2|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_shake_length_shared_secret | | ------------------ | | | | 117| 2|#define OQS_KEM_efrodokem_640_shake_length_shared_secret 16 | | ------------------ ------------------ 153| 2| return OQS_SUCCESS; 154| 2|} OQS_KEM_efrodokem_640_shake_decaps: 158| 2|{ // FrodoKEM's key decapsulation 159| | // Inputs: ciphertext ct = ct_c1||ct_c2 ( (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8 + (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8 bytes) 160| | // secret key sk = sk_s||pk_seedA||pk_b||sk_S||sk_pkh (CRYPTO_BYTES + BYTES_SEED_A + (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8 + 2*PARAMS_N*PARAMS_NBAR + BYTES_PKHASH bytes) 161| | // Output: shared key ss (CRYPTO_BYTES bytes) 162| 2| uint16_t B[PARAMS_N*PARAMS_NBAR] = {0}; 163| 2| uint16_t Bp[PARAMS_N*PARAMS_NBAR] = {0}; 164| 2| uint16_t W[PARAMS_NBAR*PARAMS_NBAR] = {0}; // contains secret data 165| 2| uint16_t C[PARAMS_NBAR*PARAMS_NBAR] = {0}; 166| 2| uint16_t CC[PARAMS_NBAR*PARAMS_NBAR] = {0}; 167| 2| ALIGN_HEADER(32) uint16_t BBp[PARAMS_N*PARAMS_NBAR] ALIGN_FOOTER(32) = {0}; 168| 2| ALIGN_HEADER(32) uint16_t Sp[(2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR] ALIGN_FOOTER(32) = {0}; // contains secret data 169| 2| uint16_t *Ep = (uint16_t *)&Sp[PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 11| 2|#define PARAMS_N 640 ------------------ uint16_t *Ep = (uint16_t *)&Sp[PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ 170| 2| uint16_t *Epp = (uint16_t *)&Sp[2*PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 11| 2|#define PARAMS_N 640 ------------------ uint16_t *Epp = (uint16_t *)&Sp[2*PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ 171| 2| const uint8_t *ct_c1 = &ct[0]; 172| 2| const uint8_t *ct_c2 = &ct[(PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8]; ------------------ | | 13| 2|#define PARAMS_LOGQ 15 ------------------ const uint8_t *ct_c2 = &ct[(PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8]; ------------------ | | 11| 2|#define PARAMS_N 640 ------------------ const uint8_t *ct_c2 = &ct[(PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8]; ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ 173| 2| const uint8_t *sk_s = &sk[0]; 174| 2| const uint8_t *sk_pk = &sk[CRYPTO_BYTES]; ------------------ | | 6| 2|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_shake_length_shared_secret | | ------------------ | | | | 117| 2|#define OQS_KEM_efrodokem_640_shake_length_shared_secret 16 | | ------------------ ------------------ 175| 2| const uint16_t *sk_S = (uint16_t *) &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES]; ------------------ | | 6| 2|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_shake_length_shared_secret | | ------------------ | | | | 117| 2|#define OQS_KEM_efrodokem_640_shake_length_shared_secret 16 | | ------------------ ------------------ const uint16_t *sk_S = (uint16_t *) &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES]; ------------------ | | 3| 2|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_efrodokem_640_shake_length_public_key | | ------------------ | | | | 114| 2|#define OQS_KEM_efrodokem_640_shake_length_public_key 9616 | | ------------------ ------------------ 176| 2| uint16_t S[PARAMS_N * PARAMS_NBAR]; // contains secret data 177| 2| const uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 6| 2|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_shake_length_shared_secret | | ------------------ | | | | 117| 2|#define OQS_KEM_efrodokem_640_shake_length_shared_secret 16 | | ------------------ ------------------ const uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 3| 2|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_efrodokem_640_shake_length_public_key | | ------------------ | | | | 114| 2|#define OQS_KEM_efrodokem_640_shake_length_public_key 9616 | | ------------------ ------------------ const uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 11| 2|#define PARAMS_N 640 ------------------ const uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ 178| 2| const uint8_t *pk_seedA = &sk_pk[0]; 179| 2| const uint8_t *pk_b = &sk_pk[BYTES_SEED_A]; ------------------ | | 18| 2|#define BYTES_SEED_A 16 ------------------ 180| 2| uint8_t G2in[BYTES_PKHASH + BYTES_MU]; // contains secret data via muprime 181| 2| uint8_t *pkh = &G2in[0]; 182| 2| uint8_t *muprime = &G2in[BYTES_PKHASH]; // contains secret data ------------------ | | 20| 2|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 2|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_shake_length_shared_secret | | | | ------------------ | | | | | | 117| 2|#define OQS_KEM_efrodokem_640_shake_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ 183| 2| uint8_t G2out[2*CRYPTO_BYTES]; // contains secret data 184| 2| uint8_t *seedSEprime = &G2out[0]; // contains secret data 185| 2| uint8_t *kprime = &G2out[CRYPTO_BYTES]; // contains secret data ------------------ | | 6| 2|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_shake_length_shared_secret | | ------------------ | | | | 117| 2|#define OQS_KEM_efrodokem_640_shake_length_shared_secret 16 | | ------------------ ------------------ 186| 2| uint8_t Fin[CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES]; // contains secret data via Fin_k 187| 2| uint8_t *Fin_ct = &Fin[0]; 188| 2| uint8_t *Fin_k = &Fin[CRYPTO_CIPHERTEXTBYTES]; // contains secret data ------------------ | | 5| 2|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_efrodokem_640_shake_length_ciphertext | | ------------------ | | | | 116| 2|#define OQS_KEM_efrodokem_640_shake_length_ciphertext 9720 | | ------------------ ------------------ 189| 2| uint8_t shake_input_seedSEprime[1 + CRYPTO_BYTES]; // contains secret data 190| | 191| 10.2k| for (size_t i = 0; i < PARAMS_N * PARAMS_NBAR; i++) { ------------------ | | 11| 10.2k|#define PARAMS_N 640 ------------------ for (size_t i = 0; i < PARAMS_N * PARAMS_NBAR; i++) { ------------------ | | 12| 10.2k|#define PARAMS_NBAR 8 ------------------ | Branch (191:24): [True: 10.2k, False: 2] ------------------ 192| 10.2k| S[i] = LE_TO_UINT16(sk_S[i]); ------------------ | | 34| 10.2k| #define LE_TO_UINT16(n) (n) ------------------ 193| 10.2k| } 194| | 195| | // Compute W = C - Bp*S (mod q), and decode the randomness mu 196| 2| frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 40| 2|#define frodo_unpack oqs_kem_efrodokem_640_shake_unpack ------------------ frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 11| 2|#define PARAMS_N 640 ------------------ frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 13| 2|#define PARAMS_LOGQ 15 ------------------ frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 11| 2|#define PARAMS_N 640 ------------------ frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 13| 2|#define PARAMS_LOGQ 15 ------------------ 197| 2| frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 40| 2|#define frodo_unpack oqs_kem_efrodokem_640_shake_unpack ------------------ frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 13| 2|#define PARAMS_LOGQ 15 ------------------ frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 13| 2|#define PARAMS_LOGQ 15 ------------------ 198| 2| frodo_mul_bs(W, Bp, S); ------------------ | | 51| 2|#define frodo_mul_bs oqs_kem_efrodokem_640_shake_mul_bs ------------------ 199| 2| frodo_sub(W, C, W); ------------------ | | 54| 2|#define frodo_sub oqs_kem_efrodokem_640_shake_sub ------------------ 200| 2| frodo_key_decode((uint16_t*)muprime, W); ------------------ | | 56| 2|#define frodo_key_decode oqs_kem_efrodokem_640_shake_key_decode ------------------ 201| | 202| | // Generate (seedSE' || k') = G_2(pkh || mu') 203| 2| memcpy(pkh, sk_pkh, BYTES_PKHASH); ------------------ | | 20| 2|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 2|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_shake_length_shared_secret | | | | ------------------ | | | | | | 117| 2|#define OQS_KEM_efrodokem_640_shake_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ 204| 2| shake(G2out, CRYPTO_BYTES + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU); ------------------ | | 29| 2|#define shake OQS_SHA3_shake128 ------------------ shake(G2out, CRYPTO_BYTES + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU); ------------------ | | 6| 2|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_shake_length_shared_secret | | ------------------ | | | | 117| 2|#define OQS_KEM_efrodokem_640_shake_length_shared_secret 16 | | ------------------ ------------------ shake(G2out, CRYPTO_BYTES + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU); ------------------ | | 6| 2|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_shake_length_shared_secret | | ------------------ | | | | 117| 2|#define OQS_KEM_efrodokem_640_shake_length_shared_secret 16 | | ------------------ ------------------ shake(G2out, CRYPTO_BYTES + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU); ------------------ | | 20| 2|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 2|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_shake_length_shared_secret | | | | ------------------ | | | | | | 117| 2|#define OQS_KEM_efrodokem_640_shake_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ shake(G2out, CRYPTO_BYTES + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU); ------------------ | | 19| 2|#define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 15| 2|#define PARAMS_EXTRACTED_BITS 2 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 2|#define PARAMS_NBAR 8 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 2|#define PARAMS_NBAR 8 | | ------------------ ------------------ 205| | 206| | // Generate Sp and Ep, and compute BBp = Sp*A + Ep. Generate A on-the-fly 207| 2| shake_input_seedSEprime[0] = 0x96; 208| 2| memcpy(&shake_input_seedSEprime[1], seedSEprime, CRYPTO_BYTES); ------------------ | | 6| 2|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_shake_length_shared_secret | | ------------------ | | | | 117| 2|#define OQS_KEM_efrodokem_640_shake_length_shared_secret 16 | | ------------------ ------------------ 209| 2| shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSEprime, 1 + CRYPTO_BYTES); ------------------ | | 29| 2|#define shake OQS_SHA3_shake128 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSEprime, 1 + CRYPTO_BYTES); ------------------ | | 11| 2|#define PARAMS_N 640 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSEprime, 1 + CRYPTO_BYTES); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSEprime, 1 + CRYPTO_BYTES); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSEprime, 1 + CRYPTO_BYTES); ------------------ | | 6| 2|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_shake_length_shared_secret | | ------------------ | | | | 117| 2|#define OQS_KEM_efrodokem_640_shake_length_shared_secret 16 | | ------------------ ------------------ 210| 20.6k| for (size_t i = 0; i < (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR; i++) { ------------------ | | 11| 20.6k|#define PARAMS_N 640 ------------------ for (size_t i = 0; i < (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR; i++) { ------------------ | | 12| 20.6k|#define PARAMS_NBAR 8 ------------------ for (size_t i = 0; i < (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR; i++) { ------------------ | | 12| 20.6k|#define PARAMS_NBAR 8 ------------------ | Branch (210:24): [True: 20.6k, False: 2] ------------------ 211| 20.6k| Sp[i] = LE_TO_UINT16(Sp[i]); ------------------ | | 34| 20.6k| #define LE_TO_UINT16(n) (n) ------------------ 212| 20.6k| } 213| 2| frodo_sample_n(Sp, PARAMS_N*PARAMS_NBAR); ------------------ | | 38| 2|#define frodo_sample_n oqs_kem_efrodokem_640_shake_sample_n ------------------ frodo_sample_n(Sp, PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 2|#define PARAMS_N 640 ------------------ frodo_sample_n(Sp, PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ 214| 2| frodo_sample_n(Ep, PARAMS_N*PARAMS_NBAR); ------------------ | | 38| 2|#define frodo_sample_n oqs_kem_efrodokem_640_shake_sample_n ------------------ frodo_sample_n(Ep, PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 2|#define PARAMS_N 640 ------------------ frodo_sample_n(Ep, PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ 215| 2| frodo_mul_add_sa_plus_e(BBp, Sp, Ep, pk_seedA); ------------------ | | 47| 2|#define frodo_mul_add_sa_plus_e oqs_kem_efrodokem_640_shake_mul_add_sa_plus_e ------------------ 216| | 217| | // Generate Epp, and compute W = Sp*B + Epp 218| 2| frodo_sample_n(Epp, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 38| 2|#define frodo_sample_n oqs_kem_efrodokem_640_shake_sample_n ------------------ frodo_sample_n(Epp, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ frodo_sample_n(Epp, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ 219| 2| frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 40| 2|#define frodo_unpack oqs_kem_efrodokem_640_shake_unpack ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 11| 2|#define PARAMS_N 640 ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 3| 2|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_efrodokem_640_shake_length_public_key | | ------------------ | | | | 114| 2|#define OQS_KEM_efrodokem_640_shake_length_public_key 9616 | | ------------------ ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 18| 2|#define BYTES_SEED_A 16 ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 13| 2|#define PARAMS_LOGQ 15 ------------------ 220| 2| frodo_mul_add_sb_plus_e(W, B, Sp, Epp); ------------------ | | 50| 2|#define frodo_mul_add_sb_plus_e oqs_kem_efrodokem_640_shake_mul_add_sb_plus_e ------------------ 221| | 222| | // Encode mu, and compute CC = W + enc(mu') (mod q) 223| 2| frodo_key_encode(CC, (uint16_t*)muprime); ------------------ | | 55| 2|#define frodo_key_encode oqs_kem_efrodokem_640_shake_key_encode ------------------ 224| 2| frodo_add(CC, W, CC); ------------------ | | 53| 2|#define frodo_add oqs_kem_efrodokem_640_shake_add ------------------ 225| | 226| | // Prepare input to F 227| 2| memcpy(Fin_ct, ct, CRYPTO_CIPHERTEXTBYTES); ------------------ | | 5| 2|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_efrodokem_640_shake_length_ciphertext | | ------------------ | | | | 116| 2|#define OQS_KEM_efrodokem_640_shake_length_ciphertext 9720 | | ------------------ ------------------ 228| | 229| | // Reducing BBp modulo q 230| 10.2k| for (int i = 0; i < PARAMS_N*PARAMS_NBAR; i++) BBp[i] = BBp[i] & ((1 << PARAMS_LOGQ)-1); ------------------ | | 11| 10.2k|#define PARAMS_N 640 ------------------ for (int i = 0; i < PARAMS_N*PARAMS_NBAR; i++) BBp[i] = BBp[i] & ((1 << PARAMS_LOGQ)-1); ------------------ | | 12| 10.2k|#define PARAMS_NBAR 8 ------------------ for (int i = 0; i < PARAMS_N*PARAMS_NBAR; i++) BBp[i] = BBp[i] & ((1 << PARAMS_LOGQ)-1); ------------------ | | 13| 10.2k|#define PARAMS_LOGQ 15 ------------------ | Branch (230:21): [True: 10.2k, False: 2] ------------------ 231| | 232| | // Needs to avoid branching on secret data using constant-time implementation. 233| 2| int8_t selector = ct_verify(Bp, BBp, PARAMS_N*PARAMS_NBAR) | ct_verify(C, CC, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 42| 2|#define ct_verify oqs_kem_efrodokem_640_shake_ct_verify ------------------ int8_t selector = ct_verify(Bp, BBp, PARAMS_N*PARAMS_NBAR) | ct_verify(C, CC, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 11| 2|#define PARAMS_N 640 ------------------ int8_t selector = ct_verify(Bp, BBp, PARAMS_N*PARAMS_NBAR) | ct_verify(C, CC, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ int8_t selector = ct_verify(Bp, BBp, PARAMS_N*PARAMS_NBAR) | ct_verify(C, CC, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 42| 2|#define ct_verify oqs_kem_efrodokem_640_shake_ct_verify ------------------ int8_t selector = ct_verify(Bp, BBp, PARAMS_N*PARAMS_NBAR) | ct_verify(C, CC, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ int8_t selector = ct_verify(Bp, BBp, PARAMS_N*PARAMS_NBAR) | ct_verify(C, CC, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ 234| | // If (selector == 0) then load k' to do ss = F(ct || k'), else if (selector == -1) load s to do ss = F(ct || s) 235| 2| ct_select((uint8_t*)Fin_k, (uint8_t*)kprime, (uint8_t*)sk_s, CRYPTO_BYTES, selector); ------------------ | | 41| 2|#define ct_select oqs_kem_efrodokem_640_shake_ct_select ------------------ ct_select((uint8_t*)Fin_k, (uint8_t*)kprime, (uint8_t*)sk_s, CRYPTO_BYTES, selector); ------------------ | | 6| 2|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_shake_length_shared_secret | | ------------------ | | | | 117| 2|#define OQS_KEM_efrodokem_640_shake_length_shared_secret 16 | | ------------------ ------------------ 236| 2| shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 29| 2|#define shake OQS_SHA3_shake128 ------------------ shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 6| 2|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_shake_length_shared_secret | | ------------------ | | | | 117| 2|#define OQS_KEM_efrodokem_640_shake_length_shared_secret 16 | | ------------------ ------------------ shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 5| 2|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_efrodokem_640_shake_length_ciphertext | | ------------------ | | | | 116| 2|#define OQS_KEM_efrodokem_640_shake_length_ciphertext 9720 | | ------------------ ------------------ shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 6| 2|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_shake_length_shared_secret | | ------------------ | | | | 117| 2|#define OQS_KEM_efrodokem_640_shake_length_shared_secret 16 | | ------------------ ------------------ 237| | 238| | // Cleanup: 239| 2| clear_bytes((uint8_t *)W, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 27| 2|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)W, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ clear_bytes((uint8_t *)W, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ 240| 2| clear_bytes((uint8_t *)Sp, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 27| 2|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)Sp, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 2|#define PARAMS_N 640 ------------------ clear_bytes((uint8_t *)Sp, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ 241| 2| clear_bytes((uint8_t *)S, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 27| 2|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)S, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 2|#define PARAMS_N 640 ------------------ clear_bytes((uint8_t *)S, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ 242| 2| clear_bytes((uint8_t *)Ep, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 27| 2|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)Ep, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 2|#define PARAMS_N 640 ------------------ clear_bytes((uint8_t *)Ep, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ 243| 2| clear_bytes((uint8_t *)Epp, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 27| 2|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)Epp, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ clear_bytes((uint8_t *)Epp, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ 244| 2| clear_bytes(muprime, BYTES_MU); ------------------ | | 27| 2|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(muprime, BYTES_MU); ------------------ | | 19| 2|#define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 15| 2|#define PARAMS_EXTRACTED_BITS 2 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 2|#define PARAMS_NBAR 8 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 2|#define PARAMS_NBAR 8 | | ------------------ ------------------ 245| 2| clear_bytes(G2out, 2*CRYPTO_BYTES); ------------------ | | 27| 2|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(G2out, 2*CRYPTO_BYTES); ------------------ | | 6| 2|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_shake_length_shared_secret | | ------------------ | | | | 117| 2|#define OQS_KEM_efrodokem_640_shake_length_shared_secret 16 | | ------------------ ------------------ 246| 2| clear_bytes(Fin_k, CRYPTO_BYTES); ------------------ | | 27| 2|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(Fin_k, CRYPTO_BYTES); ------------------ | | 6| 2|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_shake_length_shared_secret | | ------------------ | | | | 117| 2|#define OQS_KEM_efrodokem_640_shake_length_shared_secret 16 | | ------------------ ------------------ 247| 2| clear_bytes(shake_input_seedSEprime, 1 + CRYPTO_BYTES); ------------------ | | 27| 2|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(shake_input_seedSEprime, 1 + CRYPTO_BYTES); ------------------ | | 6| 2|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_shake_length_shared_secret | | ------------------ | | | | 117| 2|#define OQS_KEM_efrodokem_640_shake_length_shared_secret 16 | | ------------------ ------------------ 248| 2| return OQS_SUCCESS; 249| 2|} OQS_KEM_efrodokem_976_aes_keypair: 19| 12|{ // FrodoKEM's key generation 20| | // Outputs: public key pk = pk_seedA||pk_b ( BYTES_SEED_A + (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8 bytes) 21| | // secret key sk = sk_s||pk_seedA||pk_b||sk_S||sk_pkh (CRYPTO_BYTES + BYTES_SEED_A + (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8 + 2*PARAMS_N*PARAMS_NBAR + BYTES_PKHASH bytes) 22| 12| uint8_t *pk_seedA = &pk[0]; 23| 12| uint8_t *pk_b = &pk[BYTES_SEED_A]; ------------------ | | 18| 12|#define BYTES_SEED_A 16 ------------------ 24| 12| uint8_t *sk_s = &sk[0]; 25| 12| uint8_t *sk_pk = &sk[CRYPTO_BYTES]; ------------------ | | 6| 12|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_aes_length_shared_secret | | ------------------ | | | | 132| 12|#define OQS_KEM_efrodokem_976_aes_length_shared_secret 24 | | ------------------ ------------------ 26| 12| uint8_t *sk_S = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES]; ------------------ | | 6| 12|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_aes_length_shared_secret | | ------------------ | | | | 132| 12|#define OQS_KEM_efrodokem_976_aes_length_shared_secret 24 | | ------------------ ------------------ uint8_t *sk_S = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES]; ------------------ | | 3| 12|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_efrodokem_976_aes_length_public_key | | ------------------ | | | | 129| 12|#define OQS_KEM_efrodokem_976_aes_length_public_key 15632 | | ------------------ ------------------ 27| 12| uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 6| 12|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_aes_length_shared_secret | | ------------------ | | | | 132| 12|#define OQS_KEM_efrodokem_976_aes_length_shared_secret 24 | | ------------------ ------------------ uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 3| 12|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_efrodokem_976_aes_length_public_key | | ------------------ | | | | 129| 12|#define OQS_KEM_efrodokem_976_aes_length_public_key 15632 | | ------------------ ------------------ uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 11| 12|#define PARAMS_N 976 ------------------ uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 12| 12|#define PARAMS_NBAR 8 ------------------ 28| 12| uint16_t B[PARAMS_N*PARAMS_NBAR] = {0}; 29| 12| uint16_t S[2*PARAMS_N*PARAMS_NBAR] = {0}; // contains secret data 30| 12| uint16_t *E = (uint16_t *)&S[PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 11| 12|#define PARAMS_N 976 ------------------ uint16_t *E = (uint16_t *)&S[PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 12| 12|#define PARAMS_NBAR 8 ------------------ 31| 12| uint8_t randomness[2*CRYPTO_BYTES + BYTES_SEED_A]; // contains secret data via randomness_s and randomness_seedSE 32| 12| uint8_t *randomness_s = &randomness[0]; // contains secret data 33| 12| uint8_t *randomness_seedSE = &randomness[CRYPTO_BYTES]; // contains secret data ------------------ | | 6| 12|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_aes_length_shared_secret | | ------------------ | | | | 132| 12|#define OQS_KEM_efrodokem_976_aes_length_shared_secret 24 | | ------------------ ------------------ 34| 12| uint8_t *randomness_z = &randomness[2*CRYPTO_BYTES]; ------------------ | | 6| 12|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_aes_length_shared_secret | | ------------------ | | | | 132| 12|#define OQS_KEM_efrodokem_976_aes_length_shared_secret 24 | | ------------------ ------------------ 35| 12| uint8_t shake_input_seedSE[1 + CRYPTO_BYTES]; // contains secret data 36| | 37| | // Generate the secret value s, the seed for S and E, and the seed for the seed for A. Add seed_A to the public key 38| 12| randombytes(randomness, CRYPTO_BYTES + CRYPTO_BYTES + BYTES_SEED_A); ------------------ | | 26| 12|#define randombytes OQS_randombytes ------------------ randombytes(randomness, CRYPTO_BYTES + CRYPTO_BYTES + BYTES_SEED_A); ------------------ | | 6| 12|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_aes_length_shared_secret | | ------------------ | | | | 132| 12|#define OQS_KEM_efrodokem_976_aes_length_shared_secret 24 | | ------------------ ------------------ randombytes(randomness, CRYPTO_BYTES + CRYPTO_BYTES + BYTES_SEED_A); ------------------ | | 6| 12|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_aes_length_shared_secret | | ------------------ | | | | 132| 12|#define OQS_KEM_efrodokem_976_aes_length_shared_secret 24 | | ------------------ ------------------ randombytes(randomness, CRYPTO_BYTES + CRYPTO_BYTES + BYTES_SEED_A); ------------------ | | 18| 12|#define BYTES_SEED_A 16 ------------------ 39| 12| shake(pk_seedA, BYTES_SEED_A, randomness_z, BYTES_SEED_A); ------------------ | | 29| 12|#define shake OQS_SHA3_shake256 ------------------ shake(pk_seedA, BYTES_SEED_A, randomness_z, BYTES_SEED_A); ------------------ | | 18| 12|#define BYTES_SEED_A 16 ------------------ shake(pk_seedA, BYTES_SEED_A, randomness_z, BYTES_SEED_A); ------------------ | | 18| 12|#define BYTES_SEED_A 16 ------------------ 40| | 41| | // Generate S and E, and compute B = A*S + E. Generate A on-the-fly 42| 12| shake_input_seedSE[0] = 0x5F; 43| 12| memcpy(&shake_input_seedSE[1], randomness_seedSE, CRYPTO_BYTES); ------------------ | | 6| 12|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_aes_length_shared_secret | | ------------------ | | | | 132| 12|#define OQS_KEM_efrodokem_976_aes_length_shared_secret 24 | | ------------------ ------------------ 44| 12| shake((uint8_t*)S, 2*PARAMS_N*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + CRYPTO_BYTES); ------------------ | | 29| 12|#define shake OQS_SHA3_shake256 ------------------ shake((uint8_t*)S, 2*PARAMS_N*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + CRYPTO_BYTES); ------------------ | | 11| 12|#define PARAMS_N 976 ------------------ shake((uint8_t*)S, 2*PARAMS_N*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + CRYPTO_BYTES); ------------------ | | 12| 12|#define PARAMS_NBAR 8 ------------------ shake((uint8_t*)S, 2*PARAMS_N*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + CRYPTO_BYTES); ------------------ | | 6| 12|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_aes_length_shared_secret | | ------------------ | | | | 132| 12|#define OQS_KEM_efrodokem_976_aes_length_shared_secret 24 | | ------------------ ------------------ 45| 187k| for (size_t i = 0; i < 2 * PARAMS_N * PARAMS_NBAR; i++) { ------------------ | | 11| 187k|#define PARAMS_N 976 ------------------ for (size_t i = 0; i < 2 * PARAMS_N * PARAMS_NBAR; i++) { ------------------ | | 12| 187k|#define PARAMS_NBAR 8 ------------------ | Branch (45:24): [True: 187k, False: 12] ------------------ 46| 187k| S[i] = LE_TO_UINT16(S[i]); ------------------ | | 34| 187k| #define LE_TO_UINT16(n) (n) ------------------ 47| 187k| } 48| 12| frodo_sample_n(S, PARAMS_N*PARAMS_NBAR); ------------------ | | 38| 12|#define frodo_sample_n oqs_kem_efrodokem_976_aes_sample_n ------------------ frodo_sample_n(S, PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 12|#define PARAMS_N 976 ------------------ frodo_sample_n(S, PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 12|#define PARAMS_NBAR 8 ------------------ 49| 12| frodo_sample_n(E, PARAMS_N*PARAMS_NBAR); ------------------ | | 38| 12|#define frodo_sample_n oqs_kem_efrodokem_976_aes_sample_n ------------------ frodo_sample_n(E, PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 12|#define PARAMS_N 976 ------------------ frodo_sample_n(E, PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 12|#define PARAMS_NBAR 8 ------------------ 50| 12| frodo_mul_add_as_plus_e(B, S, E, pk); ------------------ | | 44| 12|#define frodo_mul_add_as_plus_e oqs_kem_efrodokem_976_aes_mul_add_as_plus_e ------------------ 51| | 52| | // Encode the second part of the public key 53| 12| frodo_pack(pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, B, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 39| 12|#define frodo_pack oqs_kem_efrodokem_976_aes_pack ------------------ frodo_pack(pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, B, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 3| 12|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_efrodokem_976_aes_length_public_key | | ------------------ | | | | 129| 12|#define OQS_KEM_efrodokem_976_aes_length_public_key 15632 | | ------------------ ------------------ frodo_pack(pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, B, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 18| 12|#define BYTES_SEED_A 16 ------------------ frodo_pack(pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, B, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 11| 12|#define PARAMS_N 976 ------------------ frodo_pack(pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, B, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 12|#define PARAMS_NBAR 8 ------------------ frodo_pack(pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, B, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 13| 12|#define PARAMS_LOGQ 16 ------------------ 54| | 55| | // Add s, pk and S to the secret key 56| 12| memcpy(sk_s, randomness_s, CRYPTO_BYTES); ------------------ | | 6| 12|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_aes_length_shared_secret | | ------------------ | | | | 132| 12|#define OQS_KEM_efrodokem_976_aes_length_shared_secret 24 | | ------------------ ------------------ 57| 12| memcpy(sk_pk, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 3| 12|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_efrodokem_976_aes_length_public_key | | ------------------ | | | | 129| 12|#define OQS_KEM_efrodokem_976_aes_length_public_key 15632 | | ------------------ ------------------ 58| 93.7k| for (size_t i = 0; i < PARAMS_N * PARAMS_NBAR; i++) { ------------------ | | 11| 93.7k|#define PARAMS_N 976 ------------------ for (size_t i = 0; i < PARAMS_N * PARAMS_NBAR; i++) { ------------------ | | 12| 93.7k|#define PARAMS_NBAR 8 ------------------ | Branch (58:24): [True: 93.6k, False: 12] ------------------ 59| 93.6k| S[i] = UINT16_TO_LE(S[i]); ------------------ | | 35| 93.6k| #define UINT16_TO_LE(n) (n) ------------------ 60| 93.6k| } 61| 12| memcpy(sk_S, S, 2*PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 12|#define PARAMS_N 976 ------------------ memcpy(sk_S, S, 2*PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 12|#define PARAMS_NBAR 8 ------------------ 62| | 63| | // Add H(pk) to the secret key 64| 12| shake(sk_pkh, BYTES_PKHASH, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 29| 12|#define shake OQS_SHA3_shake256 ------------------ shake(sk_pkh, BYTES_PKHASH, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 20| 12|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 12|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_aes_length_shared_secret | | | | ------------------ | | | | | | 132| 12|#define OQS_KEM_efrodokem_976_aes_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ shake(sk_pkh, BYTES_PKHASH, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 3| 12|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_efrodokem_976_aes_length_public_key | | ------------------ | | | | 129| 12|#define OQS_KEM_efrodokem_976_aes_length_public_key 15632 | | ------------------ ------------------ 65| | 66| | // Cleanup: 67| 12| clear_bytes((uint8_t *)S, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 27| 12|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)S, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 12|#define PARAMS_N 976 ------------------ clear_bytes((uint8_t *)S, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 12|#define PARAMS_NBAR 8 ------------------ 68| 12| clear_bytes((uint8_t *)E, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 27| 12|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)E, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 12|#define PARAMS_N 976 ------------------ clear_bytes((uint8_t *)E, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 12|#define PARAMS_NBAR 8 ------------------ 69| 12| clear_bytes(randomness, 2*CRYPTO_BYTES); ------------------ | | 27| 12|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(randomness, 2*CRYPTO_BYTES); ------------------ | | 6| 12|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_aes_length_shared_secret | | ------------------ | | | | 132| 12|#define OQS_KEM_efrodokem_976_aes_length_shared_secret 24 | | ------------------ ------------------ 70| 12| clear_bytes(shake_input_seedSE, 1 + CRYPTO_BYTES); ------------------ | | 27| 12|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(shake_input_seedSE, 1 + CRYPTO_BYTES); ------------------ | | 6| 12|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_aes_length_shared_secret | | ------------------ | | | | 132| 12|#define OQS_KEM_efrodokem_976_aes_length_shared_secret 24 | | ------------------ ------------------ 71| 12| return OQS_SUCCESS; 72| 12|} OQS_KEM_efrodokem_976_aes_encaps: 86| 12|{ // FrodoKEM's key encapsulation 87| | // Input: public key pk = pk_seedA||pk_b (BYTES_SEED_A + (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8 bytes) 88| | // Outputs: ciphertext ct = ct_c1||ct_c2 ( (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8 + (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8 bytes) 89| | // shared key ss (CRYPTO_BYTES bytes) 90| 12| const uint8_t *pk_seedA = &pk[0]; 91| 12| const uint8_t *pk_b = &pk[BYTES_SEED_A]; ------------------ | | 18| 12|#define BYTES_SEED_A 16 ------------------ 92| 12| uint8_t *ct_c1 = &ct[0]; 93| 12| uint8_t *ct_c2 = &ct[(PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8]; ------------------ | | 13| 12|#define PARAMS_LOGQ 16 ------------------ uint8_t *ct_c2 = &ct[(PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8]; ------------------ | | 11| 12|#define PARAMS_N 976 ------------------ uint8_t *ct_c2 = &ct[(PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8]; ------------------ | | 12| 12|#define PARAMS_NBAR 8 ------------------ 94| 12| uint16_t B[PARAMS_N*PARAMS_NBAR] = {0}; 95| 12| uint16_t V[PARAMS_NBAR*PARAMS_NBAR]= {0}; // contains secret data 96| 12| uint16_t C[PARAMS_NBAR*PARAMS_NBAR] = {0}; 97| 12| ALIGN_HEADER(32) uint16_t Bp[PARAMS_N*PARAMS_NBAR] ALIGN_FOOTER(32) = {0}; 98| 12| ALIGN_HEADER(32) uint16_t Sp[(2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR] ALIGN_FOOTER(32) = {0}; // contains secret data 99| 12| uint16_t *Ep = (uint16_t *)&Sp[PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 11| 12|#define PARAMS_N 976 ------------------ uint16_t *Ep = (uint16_t *)&Sp[PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 12| 12|#define PARAMS_NBAR 8 ------------------ 100| 12| uint16_t *Epp = (uint16_t *)&Sp[2*PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 11| 12|#define PARAMS_N 976 ------------------ uint16_t *Epp = (uint16_t *)&Sp[2*PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 12| 12|#define PARAMS_NBAR 8 ------------------ 101| 12| uint8_t G2in[BYTES_PKHASH + BYTES_MU]; // contains secret data via mu 102| 12| uint8_t *pkh = &G2in[0]; 103| 12| uint8_t *mu = &G2in[BYTES_PKHASH]; // contains secret data ------------------ | | 20| 12|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 12|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_aes_length_shared_secret | | | | ------------------ | | | | | | 132| 12|#define OQS_KEM_efrodokem_976_aes_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ 104| 12| uint8_t G2out[2*CRYPTO_BYTES]; // contains secret data 105| 12| uint8_t *seedSE = &G2out[0]; // contains secret data 106| 12| uint8_t *k = &G2out[CRYPTO_BYTES]; // contains secret data ------------------ | | 6| 12|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_aes_length_shared_secret | | ------------------ | | | | 132| 12|#define OQS_KEM_efrodokem_976_aes_length_shared_secret 24 | | ------------------ ------------------ 107| 12| uint8_t Fin[CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES]; // contains secret data via Fin_k 108| 12| uint8_t *Fin_ct = &Fin[0]; 109| 12| uint8_t *Fin_k = &Fin[CRYPTO_CIPHERTEXTBYTES]; // contains secret data ------------------ | | 5| 12|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_efrodokem_976_aes_length_ciphertext | | ------------------ | | | | 131| 12|#define OQS_KEM_efrodokem_976_aes_length_ciphertext 15744 | | ------------------ ------------------ 110| 12| uint8_t shake_input_seedSE[1 + CRYPTO_BYTES]; // contains secret data 111| | 112| | // pkh <- G_1(pk), generate random mu, compute (seedSE || k) = G_2(pkh || mu) 113| 12| shake(pkh, BYTES_PKHASH, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 29| 12|#define shake OQS_SHA3_shake256 ------------------ shake(pkh, BYTES_PKHASH, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 20| 12|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 12|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_aes_length_shared_secret | | | | ------------------ | | | | | | 132| 12|#define OQS_KEM_efrodokem_976_aes_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ shake(pkh, BYTES_PKHASH, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 3| 12|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_efrodokem_976_aes_length_public_key | | ------------------ | | | | 129| 12|#define OQS_KEM_efrodokem_976_aes_length_public_key 15632 | | ------------------ ------------------ 114| 12| randombytes(mu, BYTES_MU); ------------------ | | 26| 12|#define randombytes OQS_randombytes ------------------ randombytes(mu, BYTES_MU); ------------------ | | 19| 12|#define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 15| 12|#define PARAMS_EXTRACTED_BITS 3 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 12|#define PARAMS_NBAR 8 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 12|#define PARAMS_NBAR 8 | | ------------------ ------------------ 115| 12| shake(G2out, CRYPTO_BYTES + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU); ------------------ | | 29| 12|#define shake OQS_SHA3_shake256 ------------------ shake(G2out, CRYPTO_BYTES + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU); ------------------ | | 6| 12|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_aes_length_shared_secret | | ------------------ | | | | 132| 12|#define OQS_KEM_efrodokem_976_aes_length_shared_secret 24 | | ------------------ ------------------ shake(G2out, CRYPTO_BYTES + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU); ------------------ | | 6| 12|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_aes_length_shared_secret | | ------------------ | | | | 132| 12|#define OQS_KEM_efrodokem_976_aes_length_shared_secret 24 | | ------------------ ------------------ shake(G2out, CRYPTO_BYTES + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU); ------------------ | | 20| 12|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 12|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_aes_length_shared_secret | | | | ------------------ | | | | | | 132| 12|#define OQS_KEM_efrodokem_976_aes_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ shake(G2out, CRYPTO_BYTES + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU); ------------------ | | 19| 12|#define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 15| 12|#define PARAMS_EXTRACTED_BITS 3 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 12|#define PARAMS_NBAR 8 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 12|#define PARAMS_NBAR 8 | | ------------------ ------------------ 116| | 117| | // Generate Sp and Ep, and compute Bp = Sp*A + Ep. Generate A on-the-fly 118| 12| shake_input_seedSE[0] = 0x96; 119| 12| memcpy(&shake_input_seedSE[1], seedSE, CRYPTO_BYTES); ------------------ | | 6| 12|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_aes_length_shared_secret | | ------------------ | | | | 132| 12|#define OQS_KEM_efrodokem_976_aes_length_shared_secret 24 | | ------------------ ------------------ 120| 12| shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + CRYPTO_BYTES); ------------------ | | 29| 12|#define shake OQS_SHA3_shake256 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + CRYPTO_BYTES); ------------------ | | 11| 12|#define PARAMS_N 976 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + CRYPTO_BYTES); ------------------ | | 12| 12|#define PARAMS_NBAR 8 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + CRYPTO_BYTES); ------------------ | | 12| 12|#define PARAMS_NBAR 8 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + CRYPTO_BYTES); ------------------ | | 6| 12|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_aes_length_shared_secret | | ------------------ | | | | 132| 12|#define OQS_KEM_efrodokem_976_aes_length_shared_secret 24 | | ------------------ ------------------ 121| 188k| for (size_t i = 0; i < (2 * PARAMS_N + PARAMS_NBAR) * PARAMS_NBAR; i++) { ------------------ | | 11| 188k|#define PARAMS_N 976 ------------------ for (size_t i = 0; i < (2 * PARAMS_N + PARAMS_NBAR) * PARAMS_NBAR; i++) { ------------------ | | 12| 188k|#define PARAMS_NBAR 8 ------------------ for (size_t i = 0; i < (2 * PARAMS_N + PARAMS_NBAR) * PARAMS_NBAR; i++) { ------------------ | | 12| 188k|#define PARAMS_NBAR 8 ------------------ | Branch (121:24): [True: 188k, False: 12] ------------------ 122| 188k| Sp[i] = LE_TO_UINT16(Sp[i]); ------------------ | | 34| 188k| #define LE_TO_UINT16(n) (n) ------------------ 123| 188k| } 124| 12| frodo_sample_n(Sp, PARAMS_N*PARAMS_NBAR); ------------------ | | 38| 12|#define frodo_sample_n oqs_kem_efrodokem_976_aes_sample_n ------------------ frodo_sample_n(Sp, PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 12|#define PARAMS_N 976 ------------------ frodo_sample_n(Sp, PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 12|#define PARAMS_NBAR 8 ------------------ 125| 12| frodo_sample_n(Ep, PARAMS_N*PARAMS_NBAR); ------------------ | | 38| 12|#define frodo_sample_n oqs_kem_efrodokem_976_aes_sample_n ------------------ frodo_sample_n(Ep, PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 12|#define PARAMS_N 976 ------------------ frodo_sample_n(Ep, PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 12|#define PARAMS_NBAR 8 ------------------ 126| 12| frodo_mul_add_sa_plus_e(Bp, Sp, Ep, pk_seedA); ------------------ | | 47| 12|#define frodo_mul_add_sa_plus_e oqs_kem_efrodokem_976_aes_mul_add_sa_plus_e ------------------ 127| 12| frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 39| 12|#define frodo_pack oqs_kem_efrodokem_976_aes_pack ------------------ frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 13| 12|#define PARAMS_LOGQ 16 ------------------ frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 11| 12|#define PARAMS_N 976 ------------------ frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 12|#define PARAMS_NBAR 8 ------------------ frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 11| 12|#define PARAMS_N 976 ------------------ frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 12|#define PARAMS_NBAR 8 ------------------ frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 13| 12|#define PARAMS_LOGQ 16 ------------------ 128| | 129| | // Generate Epp, and compute V = Sp*B + Epp 130| 12| frodo_sample_n(Epp, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 38| 12|#define frodo_sample_n oqs_kem_efrodokem_976_aes_sample_n ------------------ frodo_sample_n(Epp, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 12|#define PARAMS_NBAR 8 ------------------ frodo_sample_n(Epp, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 12|#define PARAMS_NBAR 8 ------------------ 131| 12| frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 40| 12|#define frodo_unpack oqs_kem_efrodokem_976_aes_unpack ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 11| 12|#define PARAMS_N 976 ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 12| 12|#define PARAMS_NBAR 8 ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 3| 12|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_efrodokem_976_aes_length_public_key | | ------------------ | | | | 129| 12|#define OQS_KEM_efrodokem_976_aes_length_public_key 15632 | | ------------------ ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 18| 12|#define BYTES_SEED_A 16 ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 13| 12|#define PARAMS_LOGQ 16 ------------------ 132| 12| frodo_mul_add_sb_plus_e(V, B, Sp, Epp); ------------------ | | 50| 12|#define frodo_mul_add_sb_plus_e oqs_kem_efrodokem_976_aes_mul_add_sb_plus_e ------------------ 133| | 134| | // Encode mu, and compute C = V + enc(mu) (mod q) 135| 12| frodo_key_encode(C, (uint16_t*)mu); ------------------ | | 55| 12|#define frodo_key_encode oqs_kem_efrodokem_976_aes_key_encode ------------------ 136| 12| frodo_add(C, V, C); ------------------ | | 53| 12|#define frodo_add oqs_kem_efrodokem_976_aes_add ------------------ 137| 12| frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 39| 12|#define frodo_pack oqs_kem_efrodokem_976_aes_pack ------------------ frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 13| 12|#define PARAMS_LOGQ 16 ------------------ frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 12|#define PARAMS_NBAR 8 ------------------ frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 12|#define PARAMS_NBAR 8 ------------------ frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 12|#define PARAMS_NBAR 8 ------------------ frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 12|#define PARAMS_NBAR 8 ------------------ frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 13| 12|#define PARAMS_LOGQ 16 ------------------ 138| | 139| | // Compute ss = F(ct||KK) 140| 12| memcpy(Fin_ct, ct, CRYPTO_CIPHERTEXTBYTES); ------------------ | | 5| 12|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_efrodokem_976_aes_length_ciphertext | | ------------------ | | | | 131| 12|#define OQS_KEM_efrodokem_976_aes_length_ciphertext 15744 | | ------------------ ------------------ 141| 12| memcpy(Fin_k, k, CRYPTO_BYTES); ------------------ | | 6| 12|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_aes_length_shared_secret | | ------------------ | | | | 132| 12|#define OQS_KEM_efrodokem_976_aes_length_shared_secret 24 | | ------------------ ------------------ 142| 12| shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 29| 12|#define shake OQS_SHA3_shake256 ------------------ shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 6| 12|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_aes_length_shared_secret | | ------------------ | | | | 132| 12|#define OQS_KEM_efrodokem_976_aes_length_shared_secret 24 | | ------------------ ------------------ shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 5| 12|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_efrodokem_976_aes_length_ciphertext | | ------------------ | | | | 131| 12|#define OQS_KEM_efrodokem_976_aes_length_ciphertext 15744 | | ------------------ ------------------ shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 6| 12|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_aes_length_shared_secret | | ------------------ | | | | 132| 12|#define OQS_KEM_efrodokem_976_aes_length_shared_secret 24 | | ------------------ ------------------ 143| | 144| | // Cleanup: 145| 12| clear_bytes((uint8_t *)V, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 27| 12|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)V, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 12|#define PARAMS_NBAR 8 ------------------ clear_bytes((uint8_t *)V, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 12|#define PARAMS_NBAR 8 ------------------ 146| 12| clear_bytes((uint8_t *)Sp, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 27| 12|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)Sp, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 12|#define PARAMS_N 976 ------------------ clear_bytes((uint8_t *)Sp, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 12|#define PARAMS_NBAR 8 ------------------ 147| 12| clear_bytes((uint8_t *)Ep, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 27| 12|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)Ep, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 12|#define PARAMS_N 976 ------------------ clear_bytes((uint8_t *)Ep, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 12|#define PARAMS_NBAR 8 ------------------ 148| 12| clear_bytes((uint8_t *)Epp, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 27| 12|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)Epp, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 12|#define PARAMS_NBAR 8 ------------------ clear_bytes((uint8_t *)Epp, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 12|#define PARAMS_NBAR 8 ------------------ 149| 12| clear_bytes(mu, BYTES_MU); ------------------ | | 27| 12|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(mu, BYTES_MU); ------------------ | | 19| 12|#define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 15| 12|#define PARAMS_EXTRACTED_BITS 3 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 12|#define PARAMS_NBAR 8 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 12|#define PARAMS_NBAR 8 | | ------------------ ------------------ 150| 12| clear_bytes(G2out, 2*CRYPTO_BYTES); ------------------ | | 27| 12|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(G2out, 2*CRYPTO_BYTES); ------------------ | | 6| 12|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_aes_length_shared_secret | | ------------------ | | | | 132| 12|#define OQS_KEM_efrodokem_976_aes_length_shared_secret 24 | | ------------------ ------------------ 151| 12| clear_bytes(Fin_k, CRYPTO_BYTES); ------------------ | | 27| 12|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(Fin_k, CRYPTO_BYTES); ------------------ | | 6| 12|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_aes_length_shared_secret | | ------------------ | | | | 132| 12|#define OQS_KEM_efrodokem_976_aes_length_shared_secret 24 | | ------------------ ------------------ 152| 12| clear_bytes(shake_input_seedSE, 1 + CRYPTO_BYTES); ------------------ | | 27| 12|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(shake_input_seedSE, 1 + CRYPTO_BYTES); ------------------ | | 6| 12|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_aes_length_shared_secret | | ------------------ | | | | 132| 12|#define OQS_KEM_efrodokem_976_aes_length_shared_secret 24 | | ------------------ ------------------ 153| 12| return OQS_SUCCESS; 154| 12|} OQS_KEM_efrodokem_976_aes_decaps: 158| 12|{ // FrodoKEM's key decapsulation 159| | // Inputs: ciphertext ct = ct_c1||ct_c2 ( (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8 + (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8 bytes) 160| | // secret key sk = sk_s||pk_seedA||pk_b||sk_S||sk_pkh (CRYPTO_BYTES + BYTES_SEED_A + (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8 + 2*PARAMS_N*PARAMS_NBAR + BYTES_PKHASH bytes) 161| | // Output: shared key ss (CRYPTO_BYTES bytes) 162| 12| uint16_t B[PARAMS_N*PARAMS_NBAR] = {0}; 163| 12| uint16_t Bp[PARAMS_N*PARAMS_NBAR] = {0}; 164| 12| uint16_t W[PARAMS_NBAR*PARAMS_NBAR] = {0}; // contains secret data 165| 12| uint16_t C[PARAMS_NBAR*PARAMS_NBAR] = {0}; 166| 12| uint16_t CC[PARAMS_NBAR*PARAMS_NBAR] = {0}; 167| 12| ALIGN_HEADER(32) uint16_t BBp[PARAMS_N*PARAMS_NBAR] ALIGN_FOOTER(32) = {0}; 168| 12| ALIGN_HEADER(32) uint16_t Sp[(2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR] ALIGN_FOOTER(32) = {0}; // contains secret data 169| 12| uint16_t *Ep = (uint16_t *)&Sp[PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 11| 12|#define PARAMS_N 976 ------------------ uint16_t *Ep = (uint16_t *)&Sp[PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 12| 12|#define PARAMS_NBAR 8 ------------------ 170| 12| uint16_t *Epp = (uint16_t *)&Sp[2*PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 11| 12|#define PARAMS_N 976 ------------------ uint16_t *Epp = (uint16_t *)&Sp[2*PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 12| 12|#define PARAMS_NBAR 8 ------------------ 171| 12| const uint8_t *ct_c1 = &ct[0]; 172| 12| const uint8_t *ct_c2 = &ct[(PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8]; ------------------ | | 13| 12|#define PARAMS_LOGQ 16 ------------------ const uint8_t *ct_c2 = &ct[(PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8]; ------------------ | | 11| 12|#define PARAMS_N 976 ------------------ const uint8_t *ct_c2 = &ct[(PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8]; ------------------ | | 12| 12|#define PARAMS_NBAR 8 ------------------ 173| 12| const uint8_t *sk_s = &sk[0]; 174| 12| const uint8_t *sk_pk = &sk[CRYPTO_BYTES]; ------------------ | | 6| 12|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_aes_length_shared_secret | | ------------------ | | | | 132| 12|#define OQS_KEM_efrodokem_976_aes_length_shared_secret 24 | | ------------------ ------------------ 175| 12| const uint16_t *sk_S = (uint16_t *) &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES]; ------------------ | | 6| 12|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_aes_length_shared_secret | | ------------------ | | | | 132| 12|#define OQS_KEM_efrodokem_976_aes_length_shared_secret 24 | | ------------------ ------------------ const uint16_t *sk_S = (uint16_t *) &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES]; ------------------ | | 3| 12|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_efrodokem_976_aes_length_public_key | | ------------------ | | | | 129| 12|#define OQS_KEM_efrodokem_976_aes_length_public_key 15632 | | ------------------ ------------------ 176| 12| uint16_t S[PARAMS_N * PARAMS_NBAR]; // contains secret data 177| 12| const uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 6| 12|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_aes_length_shared_secret | | ------------------ | | | | 132| 12|#define OQS_KEM_efrodokem_976_aes_length_shared_secret 24 | | ------------------ ------------------ const uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 3| 12|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_efrodokem_976_aes_length_public_key | | ------------------ | | | | 129| 12|#define OQS_KEM_efrodokem_976_aes_length_public_key 15632 | | ------------------ ------------------ const uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 11| 12|#define PARAMS_N 976 ------------------ const uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 12| 12|#define PARAMS_NBAR 8 ------------------ 178| 12| const uint8_t *pk_seedA = &sk_pk[0]; 179| 12| const uint8_t *pk_b = &sk_pk[BYTES_SEED_A]; ------------------ | | 18| 12|#define BYTES_SEED_A 16 ------------------ 180| 12| uint8_t G2in[BYTES_PKHASH + BYTES_MU]; // contains secret data via muprime 181| 12| uint8_t *pkh = &G2in[0]; 182| 12| uint8_t *muprime = &G2in[BYTES_PKHASH]; // contains secret data ------------------ | | 20| 12|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 12|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_aes_length_shared_secret | | | | ------------------ | | | | | | 132| 12|#define OQS_KEM_efrodokem_976_aes_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ 183| 12| uint8_t G2out[2*CRYPTO_BYTES]; // contains secret data 184| 12| uint8_t *seedSEprime = &G2out[0]; // contains secret data 185| 12| uint8_t *kprime = &G2out[CRYPTO_BYTES]; // contains secret data ------------------ | | 6| 12|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_aes_length_shared_secret | | ------------------ | | | | 132| 12|#define OQS_KEM_efrodokem_976_aes_length_shared_secret 24 | | ------------------ ------------------ 186| 12| uint8_t Fin[CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES]; // contains secret data via Fin_k 187| 12| uint8_t *Fin_ct = &Fin[0]; 188| 12| uint8_t *Fin_k = &Fin[CRYPTO_CIPHERTEXTBYTES]; // contains secret data ------------------ | | 5| 12|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_efrodokem_976_aes_length_ciphertext | | ------------------ | | | | 131| 12|#define OQS_KEM_efrodokem_976_aes_length_ciphertext 15744 | | ------------------ ------------------ 189| 12| uint8_t shake_input_seedSEprime[1 + CRYPTO_BYTES]; // contains secret data 190| | 191| 93.7k| for (size_t i = 0; i < PARAMS_N * PARAMS_NBAR; i++) { ------------------ | | 11| 93.7k|#define PARAMS_N 976 ------------------ for (size_t i = 0; i < PARAMS_N * PARAMS_NBAR; i++) { ------------------ | | 12| 93.7k|#define PARAMS_NBAR 8 ------------------ | Branch (191:24): [True: 93.6k, False: 12] ------------------ 192| 93.6k| S[i] = LE_TO_UINT16(sk_S[i]); ------------------ | | 34| 93.6k| #define LE_TO_UINT16(n) (n) ------------------ 193| 93.6k| } 194| | 195| | // Compute W = C - Bp*S (mod q), and decode the randomness mu 196| 12| frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 40| 12|#define frodo_unpack oqs_kem_efrodokem_976_aes_unpack ------------------ frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 11| 12|#define PARAMS_N 976 ------------------ frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 12| 12|#define PARAMS_NBAR 8 ------------------ frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 13| 12|#define PARAMS_LOGQ 16 ------------------ frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 11| 12|#define PARAMS_N 976 ------------------ frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 12| 12|#define PARAMS_NBAR 8 ------------------ frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 13| 12|#define PARAMS_LOGQ 16 ------------------ 197| 12| frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 40| 12|#define frodo_unpack oqs_kem_efrodokem_976_aes_unpack ------------------ frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 12| 12|#define PARAMS_NBAR 8 ------------------ frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 12| 12|#define PARAMS_NBAR 8 ------------------ frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 13| 12|#define PARAMS_LOGQ 16 ------------------ frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 12| 12|#define PARAMS_NBAR 8 ------------------ frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 12| 12|#define PARAMS_NBAR 8 ------------------ frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 13| 12|#define PARAMS_LOGQ 16 ------------------ 198| 12| frodo_mul_bs(W, Bp, S); ------------------ | | 51| 12|#define frodo_mul_bs oqs_kem_efrodokem_976_aes_mul_bs ------------------ 199| 12| frodo_sub(W, C, W); ------------------ | | 54| 12|#define frodo_sub oqs_kem_efrodokem_976_aes_sub ------------------ 200| 12| frodo_key_decode((uint16_t*)muprime, W); ------------------ | | 56| 12|#define frodo_key_decode oqs_kem_efrodokem_976_aes_key_decode ------------------ 201| | 202| | // Generate (seedSE' || k') = G_2(pkh || mu') 203| 12| memcpy(pkh, sk_pkh, BYTES_PKHASH); ------------------ | | 20| 12|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 12|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_aes_length_shared_secret | | | | ------------------ | | | | | | 132| 12|#define OQS_KEM_efrodokem_976_aes_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ 204| 12| shake(G2out, CRYPTO_BYTES + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU); ------------------ | | 29| 12|#define shake OQS_SHA3_shake256 ------------------ shake(G2out, CRYPTO_BYTES + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU); ------------------ | | 6| 12|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_aes_length_shared_secret | | ------------------ | | | | 132| 12|#define OQS_KEM_efrodokem_976_aes_length_shared_secret 24 | | ------------------ ------------------ shake(G2out, CRYPTO_BYTES + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU); ------------------ | | 6| 12|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_aes_length_shared_secret | | ------------------ | | | | 132| 12|#define OQS_KEM_efrodokem_976_aes_length_shared_secret 24 | | ------------------ ------------------ shake(G2out, CRYPTO_BYTES + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU); ------------------ | | 20| 12|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 12|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_aes_length_shared_secret | | | | ------------------ | | | | | | 132| 12|#define OQS_KEM_efrodokem_976_aes_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ shake(G2out, CRYPTO_BYTES + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU); ------------------ | | 19| 12|#define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 15| 12|#define PARAMS_EXTRACTED_BITS 3 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 12|#define PARAMS_NBAR 8 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 12|#define PARAMS_NBAR 8 | | ------------------ ------------------ 205| | 206| | // Generate Sp and Ep, and compute BBp = Sp*A + Ep. Generate A on-the-fly 207| 12| shake_input_seedSEprime[0] = 0x96; 208| 12| memcpy(&shake_input_seedSEprime[1], seedSEprime, CRYPTO_BYTES); ------------------ | | 6| 12|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_aes_length_shared_secret | | ------------------ | | | | 132| 12|#define OQS_KEM_efrodokem_976_aes_length_shared_secret 24 | | ------------------ ------------------ 209| 12| shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSEprime, 1 + CRYPTO_BYTES); ------------------ | | 29| 12|#define shake OQS_SHA3_shake256 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSEprime, 1 + CRYPTO_BYTES); ------------------ | | 11| 12|#define PARAMS_N 976 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSEprime, 1 + CRYPTO_BYTES); ------------------ | | 12| 12|#define PARAMS_NBAR 8 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSEprime, 1 + CRYPTO_BYTES); ------------------ | | 12| 12|#define PARAMS_NBAR 8 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSEprime, 1 + CRYPTO_BYTES); ------------------ | | 6| 12|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_aes_length_shared_secret | | ------------------ | | | | 132| 12|#define OQS_KEM_efrodokem_976_aes_length_shared_secret 24 | | ------------------ ------------------ 210| 188k| for (size_t i = 0; i < (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR; i++) { ------------------ | | 11| 188k|#define PARAMS_N 976 ------------------ for (size_t i = 0; i < (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR; i++) { ------------------ | | 12| 188k|#define PARAMS_NBAR 8 ------------------ for (size_t i = 0; i < (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR; i++) { ------------------ | | 12| 188k|#define PARAMS_NBAR 8 ------------------ | Branch (210:24): [True: 188k, False: 12] ------------------ 211| 188k| Sp[i] = LE_TO_UINT16(Sp[i]); ------------------ | | 34| 188k| #define LE_TO_UINT16(n) (n) ------------------ 212| 188k| } 213| 12| frodo_sample_n(Sp, PARAMS_N*PARAMS_NBAR); ------------------ | | 38| 12|#define frodo_sample_n oqs_kem_efrodokem_976_aes_sample_n ------------------ frodo_sample_n(Sp, PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 12|#define PARAMS_N 976 ------------------ frodo_sample_n(Sp, PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 12|#define PARAMS_NBAR 8 ------------------ 214| 12| frodo_sample_n(Ep, PARAMS_N*PARAMS_NBAR); ------------------ | | 38| 12|#define frodo_sample_n oqs_kem_efrodokem_976_aes_sample_n ------------------ frodo_sample_n(Ep, PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 12|#define PARAMS_N 976 ------------------ frodo_sample_n(Ep, PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 12|#define PARAMS_NBAR 8 ------------------ 215| 12| frodo_mul_add_sa_plus_e(BBp, Sp, Ep, pk_seedA); ------------------ | | 47| 12|#define frodo_mul_add_sa_plus_e oqs_kem_efrodokem_976_aes_mul_add_sa_plus_e ------------------ 216| | 217| | // Generate Epp, and compute W = Sp*B + Epp 218| 12| frodo_sample_n(Epp, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 38| 12|#define frodo_sample_n oqs_kem_efrodokem_976_aes_sample_n ------------------ frodo_sample_n(Epp, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 12|#define PARAMS_NBAR 8 ------------------ frodo_sample_n(Epp, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 12|#define PARAMS_NBAR 8 ------------------ 219| 12| frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 40| 12|#define frodo_unpack oqs_kem_efrodokem_976_aes_unpack ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 11| 12|#define PARAMS_N 976 ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 12| 12|#define PARAMS_NBAR 8 ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 3| 12|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_efrodokem_976_aes_length_public_key | | ------------------ | | | | 129| 12|#define OQS_KEM_efrodokem_976_aes_length_public_key 15632 | | ------------------ ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 18| 12|#define BYTES_SEED_A 16 ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 13| 12|#define PARAMS_LOGQ 16 ------------------ 220| 12| frodo_mul_add_sb_plus_e(W, B, Sp, Epp); ------------------ | | 50| 12|#define frodo_mul_add_sb_plus_e oqs_kem_efrodokem_976_aes_mul_add_sb_plus_e ------------------ 221| | 222| | // Encode mu, and compute CC = W + enc(mu') (mod q) 223| 12| frodo_key_encode(CC, (uint16_t*)muprime); ------------------ | | 55| 12|#define frodo_key_encode oqs_kem_efrodokem_976_aes_key_encode ------------------ 224| 12| frodo_add(CC, W, CC); ------------------ | | 53| 12|#define frodo_add oqs_kem_efrodokem_976_aes_add ------------------ 225| | 226| | // Prepare input to F 227| 12| memcpy(Fin_ct, ct, CRYPTO_CIPHERTEXTBYTES); ------------------ | | 5| 12|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_efrodokem_976_aes_length_ciphertext | | ------------------ | | | | 131| 12|#define OQS_KEM_efrodokem_976_aes_length_ciphertext 15744 | | ------------------ ------------------ 228| | 229| | // Reducing BBp modulo q 230| 93.7k| for (int i = 0; i < PARAMS_N*PARAMS_NBAR; i++) BBp[i] = BBp[i] & ((1 << PARAMS_LOGQ)-1); ------------------ | | 11| 93.7k|#define PARAMS_N 976 ------------------ for (int i = 0; i < PARAMS_N*PARAMS_NBAR; i++) BBp[i] = BBp[i] & ((1 << PARAMS_LOGQ)-1); ------------------ | | 12| 93.7k|#define PARAMS_NBAR 8 ------------------ for (int i = 0; i < PARAMS_N*PARAMS_NBAR; i++) BBp[i] = BBp[i] & ((1 << PARAMS_LOGQ)-1); ------------------ | | 13| 93.6k|#define PARAMS_LOGQ 16 ------------------ | Branch (230:21): [True: 93.6k, False: 12] ------------------ 231| | 232| | // Needs to avoid branching on secret data using constant-time implementation. 233| 12| int8_t selector = ct_verify(Bp, BBp, PARAMS_N*PARAMS_NBAR) | ct_verify(C, CC, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 42| 12|#define ct_verify oqs_kem_efrodokem_976_aes_ct_verify ------------------ int8_t selector = ct_verify(Bp, BBp, PARAMS_N*PARAMS_NBAR) | ct_verify(C, CC, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 11| 12|#define PARAMS_N 976 ------------------ int8_t selector = ct_verify(Bp, BBp, PARAMS_N*PARAMS_NBAR) | ct_verify(C, CC, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 12|#define PARAMS_NBAR 8 ------------------ int8_t selector = ct_verify(Bp, BBp, PARAMS_N*PARAMS_NBAR) | ct_verify(C, CC, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 42| 12|#define ct_verify oqs_kem_efrodokem_976_aes_ct_verify ------------------ int8_t selector = ct_verify(Bp, BBp, PARAMS_N*PARAMS_NBAR) | ct_verify(C, CC, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 12|#define PARAMS_NBAR 8 ------------------ int8_t selector = ct_verify(Bp, BBp, PARAMS_N*PARAMS_NBAR) | ct_verify(C, CC, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 12|#define PARAMS_NBAR 8 ------------------ 234| | // If (selector == 0) then load k' to do ss = F(ct || k'), else if (selector == -1) load s to do ss = F(ct || s) 235| 12| ct_select((uint8_t*)Fin_k, (uint8_t*)kprime, (uint8_t*)sk_s, CRYPTO_BYTES, selector); ------------------ | | 41| 12|#define ct_select oqs_kem_efrodokem_976_aes_ct_select ------------------ ct_select((uint8_t*)Fin_k, (uint8_t*)kprime, (uint8_t*)sk_s, CRYPTO_BYTES, selector); ------------------ | | 6| 12|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_aes_length_shared_secret | | ------------------ | | | | 132| 12|#define OQS_KEM_efrodokem_976_aes_length_shared_secret 24 | | ------------------ ------------------ 236| 12| shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 29| 12|#define shake OQS_SHA3_shake256 ------------------ shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 6| 12|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_aes_length_shared_secret | | ------------------ | | | | 132| 12|#define OQS_KEM_efrodokem_976_aes_length_shared_secret 24 | | ------------------ ------------------ shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 5| 12|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_efrodokem_976_aes_length_ciphertext | | ------------------ | | | | 131| 12|#define OQS_KEM_efrodokem_976_aes_length_ciphertext 15744 | | ------------------ ------------------ shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 6| 12|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_aes_length_shared_secret | | ------------------ | | | | 132| 12|#define OQS_KEM_efrodokem_976_aes_length_shared_secret 24 | | ------------------ ------------------ 237| | 238| | // Cleanup: 239| 12| clear_bytes((uint8_t *)W, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 27| 12|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)W, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 12|#define PARAMS_NBAR 8 ------------------ clear_bytes((uint8_t *)W, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 12|#define PARAMS_NBAR 8 ------------------ 240| 12| clear_bytes((uint8_t *)Sp, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 27| 12|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)Sp, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 12|#define PARAMS_N 976 ------------------ clear_bytes((uint8_t *)Sp, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 12|#define PARAMS_NBAR 8 ------------------ 241| 12| clear_bytes((uint8_t *)S, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 27| 12|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)S, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 12|#define PARAMS_N 976 ------------------ clear_bytes((uint8_t *)S, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 12|#define PARAMS_NBAR 8 ------------------ 242| 12| clear_bytes((uint8_t *)Ep, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 27| 12|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)Ep, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 12|#define PARAMS_N 976 ------------------ clear_bytes((uint8_t *)Ep, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 12|#define PARAMS_NBAR 8 ------------------ 243| 12| clear_bytes((uint8_t *)Epp, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 27| 12|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)Epp, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 12|#define PARAMS_NBAR 8 ------------------ clear_bytes((uint8_t *)Epp, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 12|#define PARAMS_NBAR 8 ------------------ 244| 12| clear_bytes(muprime, BYTES_MU); ------------------ | | 27| 12|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(muprime, BYTES_MU); ------------------ | | 19| 12|#define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 15| 12|#define PARAMS_EXTRACTED_BITS 3 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 12|#define PARAMS_NBAR 8 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 12|#define PARAMS_NBAR 8 | | ------------------ ------------------ 245| 12| clear_bytes(G2out, 2*CRYPTO_BYTES); ------------------ | | 27| 12|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(G2out, 2*CRYPTO_BYTES); ------------------ | | 6| 12|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_aes_length_shared_secret | | ------------------ | | | | 132| 12|#define OQS_KEM_efrodokem_976_aes_length_shared_secret 24 | | ------------------ ------------------ 246| 12| clear_bytes(Fin_k, CRYPTO_BYTES); ------------------ | | 27| 12|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(Fin_k, CRYPTO_BYTES); ------------------ | | 6| 12|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_aes_length_shared_secret | | ------------------ | | | | 132| 12|#define OQS_KEM_efrodokem_976_aes_length_shared_secret 24 | | ------------------ ------------------ 247| 12| clear_bytes(shake_input_seedSEprime, 1 + CRYPTO_BYTES); ------------------ | | 27| 12|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(shake_input_seedSEprime, 1 + CRYPTO_BYTES); ------------------ | | 6| 12|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_aes_length_shared_secret | | ------------------ | | | | 132| 12|#define OQS_KEM_efrodokem_976_aes_length_shared_secret 24 | | ------------------ ------------------ 248| 12| return OQS_SUCCESS; 249| 12|} OQS_KEM_efrodokem_976_shake_keypair: 19| 12|{ // FrodoKEM's key generation 20| | // Outputs: public key pk = pk_seedA||pk_b ( BYTES_SEED_A + (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8 bytes) 21| | // secret key sk = sk_s||pk_seedA||pk_b||sk_S||sk_pkh (CRYPTO_BYTES + BYTES_SEED_A + (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8 + 2*PARAMS_N*PARAMS_NBAR + BYTES_PKHASH bytes) 22| 12| uint8_t *pk_seedA = &pk[0]; 23| 12| uint8_t *pk_b = &pk[BYTES_SEED_A]; ------------------ | | 18| 12|#define BYTES_SEED_A 16 ------------------ 24| 12| uint8_t *sk_s = &sk[0]; 25| 12| uint8_t *sk_pk = &sk[CRYPTO_BYTES]; ------------------ | | 6| 12|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_shake_length_shared_secret | | ------------------ | | | | 147| 12|#define OQS_KEM_efrodokem_976_shake_length_shared_secret 24 | | ------------------ ------------------ 26| 12| uint8_t *sk_S = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES]; ------------------ | | 6| 12|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_shake_length_shared_secret | | ------------------ | | | | 147| 12|#define OQS_KEM_efrodokem_976_shake_length_shared_secret 24 | | ------------------ ------------------ uint8_t *sk_S = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES]; ------------------ | | 3| 12|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_efrodokem_976_shake_length_public_key | | ------------------ | | | | 144| 12|#define OQS_KEM_efrodokem_976_shake_length_public_key 15632 | | ------------------ ------------------ 27| 12| uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 6| 12|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_shake_length_shared_secret | | ------------------ | | | | 147| 12|#define OQS_KEM_efrodokem_976_shake_length_shared_secret 24 | | ------------------ ------------------ uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 3| 12|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_efrodokem_976_shake_length_public_key | | ------------------ | | | | 144| 12|#define OQS_KEM_efrodokem_976_shake_length_public_key 15632 | | ------------------ ------------------ uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 11| 12|#define PARAMS_N 976 ------------------ uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 12| 12|#define PARAMS_NBAR 8 ------------------ 28| 12| uint16_t B[PARAMS_N*PARAMS_NBAR] = {0}; 29| 12| uint16_t S[2*PARAMS_N*PARAMS_NBAR] = {0}; // contains secret data 30| 12| uint16_t *E = (uint16_t *)&S[PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 11| 12|#define PARAMS_N 976 ------------------ uint16_t *E = (uint16_t *)&S[PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 12| 12|#define PARAMS_NBAR 8 ------------------ 31| 12| uint8_t randomness[2*CRYPTO_BYTES + BYTES_SEED_A]; // contains secret data via randomness_s and randomness_seedSE 32| 12| uint8_t *randomness_s = &randomness[0]; // contains secret data 33| 12| uint8_t *randomness_seedSE = &randomness[CRYPTO_BYTES]; // contains secret data ------------------ | | 6| 12|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_shake_length_shared_secret | | ------------------ | | | | 147| 12|#define OQS_KEM_efrodokem_976_shake_length_shared_secret 24 | | ------------------ ------------------ 34| 12| uint8_t *randomness_z = &randomness[2*CRYPTO_BYTES]; ------------------ | | 6| 12|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_shake_length_shared_secret | | ------------------ | | | | 147| 12|#define OQS_KEM_efrodokem_976_shake_length_shared_secret 24 | | ------------------ ------------------ 35| 12| uint8_t shake_input_seedSE[1 + CRYPTO_BYTES]; // contains secret data 36| | 37| | // Generate the secret value s, the seed for S and E, and the seed for the seed for A. Add seed_A to the public key 38| 12| randombytes(randomness, CRYPTO_BYTES + CRYPTO_BYTES + BYTES_SEED_A); ------------------ | | 26| 12|#define randombytes OQS_randombytes ------------------ randombytes(randomness, CRYPTO_BYTES + CRYPTO_BYTES + BYTES_SEED_A); ------------------ | | 6| 12|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_shake_length_shared_secret | | ------------------ | | | | 147| 12|#define OQS_KEM_efrodokem_976_shake_length_shared_secret 24 | | ------------------ ------------------ randombytes(randomness, CRYPTO_BYTES + CRYPTO_BYTES + BYTES_SEED_A); ------------------ | | 6| 12|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_shake_length_shared_secret | | ------------------ | | | | 147| 12|#define OQS_KEM_efrodokem_976_shake_length_shared_secret 24 | | ------------------ ------------------ randombytes(randomness, CRYPTO_BYTES + CRYPTO_BYTES + BYTES_SEED_A); ------------------ | | 18| 12|#define BYTES_SEED_A 16 ------------------ 39| 12| shake(pk_seedA, BYTES_SEED_A, randomness_z, BYTES_SEED_A); ------------------ | | 29| 12|#define shake OQS_SHA3_shake256 ------------------ shake(pk_seedA, BYTES_SEED_A, randomness_z, BYTES_SEED_A); ------------------ | | 18| 12|#define BYTES_SEED_A 16 ------------------ shake(pk_seedA, BYTES_SEED_A, randomness_z, BYTES_SEED_A); ------------------ | | 18| 12|#define BYTES_SEED_A 16 ------------------ 40| | 41| | // Generate S and E, and compute B = A*S + E. Generate A on-the-fly 42| 12| shake_input_seedSE[0] = 0x5F; 43| 12| memcpy(&shake_input_seedSE[1], randomness_seedSE, CRYPTO_BYTES); ------------------ | | 6| 12|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_shake_length_shared_secret | | ------------------ | | | | 147| 12|#define OQS_KEM_efrodokem_976_shake_length_shared_secret 24 | | ------------------ ------------------ 44| 12| shake((uint8_t*)S, 2*PARAMS_N*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + CRYPTO_BYTES); ------------------ | | 29| 12|#define shake OQS_SHA3_shake256 ------------------ shake((uint8_t*)S, 2*PARAMS_N*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + CRYPTO_BYTES); ------------------ | | 11| 12|#define PARAMS_N 976 ------------------ shake((uint8_t*)S, 2*PARAMS_N*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + CRYPTO_BYTES); ------------------ | | 12| 12|#define PARAMS_NBAR 8 ------------------ shake((uint8_t*)S, 2*PARAMS_N*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + CRYPTO_BYTES); ------------------ | | 6| 12|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_shake_length_shared_secret | | ------------------ | | | | 147| 12|#define OQS_KEM_efrodokem_976_shake_length_shared_secret 24 | | ------------------ ------------------ 45| 187k| for (size_t i = 0; i < 2 * PARAMS_N * PARAMS_NBAR; i++) { ------------------ | | 11| 187k|#define PARAMS_N 976 ------------------ for (size_t i = 0; i < 2 * PARAMS_N * PARAMS_NBAR; i++) { ------------------ | | 12| 187k|#define PARAMS_NBAR 8 ------------------ | Branch (45:24): [True: 187k, False: 12] ------------------ 46| 187k| S[i] = LE_TO_UINT16(S[i]); ------------------ | | 34| 187k| #define LE_TO_UINT16(n) (n) ------------------ 47| 187k| } 48| 12| frodo_sample_n(S, PARAMS_N*PARAMS_NBAR); ------------------ | | 38| 12|#define frodo_sample_n oqs_kem_efrodokem_976_shake_sample_n ------------------ frodo_sample_n(S, PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 12|#define PARAMS_N 976 ------------------ frodo_sample_n(S, PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 12|#define PARAMS_NBAR 8 ------------------ 49| 12| frodo_sample_n(E, PARAMS_N*PARAMS_NBAR); ------------------ | | 38| 12|#define frodo_sample_n oqs_kem_efrodokem_976_shake_sample_n ------------------ frodo_sample_n(E, PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 12|#define PARAMS_N 976 ------------------ frodo_sample_n(E, PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 12|#define PARAMS_NBAR 8 ------------------ 50| 12| frodo_mul_add_as_plus_e(B, S, E, pk); ------------------ | | 44| 12|#define frodo_mul_add_as_plus_e oqs_kem_efrodokem_976_shake_mul_add_as_plus_e ------------------ 51| | 52| | // Encode the second part of the public key 53| 12| frodo_pack(pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, B, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 39| 12|#define frodo_pack oqs_kem_efrodokem_976_shake_pack ------------------ frodo_pack(pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, B, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 3| 12|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_efrodokem_976_shake_length_public_key | | ------------------ | | | | 144| 12|#define OQS_KEM_efrodokem_976_shake_length_public_key 15632 | | ------------------ ------------------ frodo_pack(pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, B, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 18| 12|#define BYTES_SEED_A 16 ------------------ frodo_pack(pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, B, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 11| 12|#define PARAMS_N 976 ------------------ frodo_pack(pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, B, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 12|#define PARAMS_NBAR 8 ------------------ frodo_pack(pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, B, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 13| 12|#define PARAMS_LOGQ 16 ------------------ 54| | 55| | // Add s, pk and S to the secret key 56| 12| memcpy(sk_s, randomness_s, CRYPTO_BYTES); ------------------ | | 6| 12|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_shake_length_shared_secret | | ------------------ | | | | 147| 12|#define OQS_KEM_efrodokem_976_shake_length_shared_secret 24 | | ------------------ ------------------ 57| 12| memcpy(sk_pk, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 3| 12|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_efrodokem_976_shake_length_public_key | | ------------------ | | | | 144| 12|#define OQS_KEM_efrodokem_976_shake_length_public_key 15632 | | ------------------ ------------------ 58| 93.7k| for (size_t i = 0; i < PARAMS_N * PARAMS_NBAR; i++) { ------------------ | | 11| 93.7k|#define PARAMS_N 976 ------------------ for (size_t i = 0; i < PARAMS_N * PARAMS_NBAR; i++) { ------------------ | | 12| 93.7k|#define PARAMS_NBAR 8 ------------------ | Branch (58:24): [True: 93.6k, False: 12] ------------------ 59| 93.6k| S[i] = UINT16_TO_LE(S[i]); ------------------ | | 35| 93.6k| #define UINT16_TO_LE(n) (n) ------------------ 60| 93.6k| } 61| 12| memcpy(sk_S, S, 2*PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 12|#define PARAMS_N 976 ------------------ memcpy(sk_S, S, 2*PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 12|#define PARAMS_NBAR 8 ------------------ 62| | 63| | // Add H(pk) to the secret key 64| 12| shake(sk_pkh, BYTES_PKHASH, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 29| 12|#define shake OQS_SHA3_shake256 ------------------ shake(sk_pkh, BYTES_PKHASH, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 20| 12|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 12|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_shake_length_shared_secret | | | | ------------------ | | | | | | 147| 12|#define OQS_KEM_efrodokem_976_shake_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ shake(sk_pkh, BYTES_PKHASH, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 3| 12|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_efrodokem_976_shake_length_public_key | | ------------------ | | | | 144| 12|#define OQS_KEM_efrodokem_976_shake_length_public_key 15632 | | ------------------ ------------------ 65| | 66| | // Cleanup: 67| 12| clear_bytes((uint8_t *)S, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 27| 12|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)S, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 12|#define PARAMS_N 976 ------------------ clear_bytes((uint8_t *)S, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 12|#define PARAMS_NBAR 8 ------------------ 68| 12| clear_bytes((uint8_t *)E, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 27| 12|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)E, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 12|#define PARAMS_N 976 ------------------ clear_bytes((uint8_t *)E, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 12|#define PARAMS_NBAR 8 ------------------ 69| 12| clear_bytes(randomness, 2*CRYPTO_BYTES); ------------------ | | 27| 12|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(randomness, 2*CRYPTO_BYTES); ------------------ | | 6| 12|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_shake_length_shared_secret | | ------------------ | | | | 147| 12|#define OQS_KEM_efrodokem_976_shake_length_shared_secret 24 | | ------------------ ------------------ 70| 12| clear_bytes(shake_input_seedSE, 1 + CRYPTO_BYTES); ------------------ | | 27| 12|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(shake_input_seedSE, 1 + CRYPTO_BYTES); ------------------ | | 6| 12|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_shake_length_shared_secret | | ------------------ | | | | 147| 12|#define OQS_KEM_efrodokem_976_shake_length_shared_secret 24 | | ------------------ ------------------ 71| 12| return OQS_SUCCESS; 72| 12|} OQS_KEM_efrodokem_976_shake_encaps: 86| 12|{ // FrodoKEM's key encapsulation 87| | // Input: public key pk = pk_seedA||pk_b (BYTES_SEED_A + (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8 bytes) 88| | // Outputs: ciphertext ct = ct_c1||ct_c2 ( (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8 + (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8 bytes) 89| | // shared key ss (CRYPTO_BYTES bytes) 90| 12| const uint8_t *pk_seedA = &pk[0]; 91| 12| const uint8_t *pk_b = &pk[BYTES_SEED_A]; ------------------ | | 18| 12|#define BYTES_SEED_A 16 ------------------ 92| 12| uint8_t *ct_c1 = &ct[0]; 93| 12| uint8_t *ct_c2 = &ct[(PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8]; ------------------ | | 13| 12|#define PARAMS_LOGQ 16 ------------------ uint8_t *ct_c2 = &ct[(PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8]; ------------------ | | 11| 12|#define PARAMS_N 976 ------------------ uint8_t *ct_c2 = &ct[(PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8]; ------------------ | | 12| 12|#define PARAMS_NBAR 8 ------------------ 94| 12| uint16_t B[PARAMS_N*PARAMS_NBAR] = {0}; 95| 12| uint16_t V[PARAMS_NBAR*PARAMS_NBAR]= {0}; // contains secret data 96| 12| uint16_t C[PARAMS_NBAR*PARAMS_NBAR] = {0}; 97| 12| ALIGN_HEADER(32) uint16_t Bp[PARAMS_N*PARAMS_NBAR] ALIGN_FOOTER(32) = {0}; 98| 12| ALIGN_HEADER(32) uint16_t Sp[(2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR] ALIGN_FOOTER(32) = {0}; // contains secret data 99| 12| uint16_t *Ep = (uint16_t *)&Sp[PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 11| 12|#define PARAMS_N 976 ------------------ uint16_t *Ep = (uint16_t *)&Sp[PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 12| 12|#define PARAMS_NBAR 8 ------------------ 100| 12| uint16_t *Epp = (uint16_t *)&Sp[2*PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 11| 12|#define PARAMS_N 976 ------------------ uint16_t *Epp = (uint16_t *)&Sp[2*PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 12| 12|#define PARAMS_NBAR 8 ------------------ 101| 12| uint8_t G2in[BYTES_PKHASH + BYTES_MU]; // contains secret data via mu 102| 12| uint8_t *pkh = &G2in[0]; 103| 12| uint8_t *mu = &G2in[BYTES_PKHASH]; // contains secret data ------------------ | | 20| 12|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 12|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_shake_length_shared_secret | | | | ------------------ | | | | | | 147| 12|#define OQS_KEM_efrodokem_976_shake_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ 104| 12| uint8_t G2out[2*CRYPTO_BYTES]; // contains secret data 105| 12| uint8_t *seedSE = &G2out[0]; // contains secret data 106| 12| uint8_t *k = &G2out[CRYPTO_BYTES]; // contains secret data ------------------ | | 6| 12|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_shake_length_shared_secret | | ------------------ | | | | 147| 12|#define OQS_KEM_efrodokem_976_shake_length_shared_secret 24 | | ------------------ ------------------ 107| 12| uint8_t Fin[CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES]; // contains secret data via Fin_k 108| 12| uint8_t *Fin_ct = &Fin[0]; 109| 12| uint8_t *Fin_k = &Fin[CRYPTO_CIPHERTEXTBYTES]; // contains secret data ------------------ | | 5| 12|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_efrodokem_976_shake_length_ciphertext | | ------------------ | | | | 146| 12|#define OQS_KEM_efrodokem_976_shake_length_ciphertext 15744 | | ------------------ ------------------ 110| 12| uint8_t shake_input_seedSE[1 + CRYPTO_BYTES]; // contains secret data 111| | 112| | // pkh <- G_1(pk), generate random mu, compute (seedSE || k) = G_2(pkh || mu) 113| 12| shake(pkh, BYTES_PKHASH, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 29| 12|#define shake OQS_SHA3_shake256 ------------------ shake(pkh, BYTES_PKHASH, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 20| 12|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 12|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_shake_length_shared_secret | | | | ------------------ | | | | | | 147| 12|#define OQS_KEM_efrodokem_976_shake_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ shake(pkh, BYTES_PKHASH, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 3| 12|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_efrodokem_976_shake_length_public_key | | ------------------ | | | | 144| 12|#define OQS_KEM_efrodokem_976_shake_length_public_key 15632 | | ------------------ ------------------ 114| 12| randombytes(mu, BYTES_MU); ------------------ | | 26| 12|#define randombytes OQS_randombytes ------------------ randombytes(mu, BYTES_MU); ------------------ | | 19| 12|#define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 15| 12|#define PARAMS_EXTRACTED_BITS 3 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 12|#define PARAMS_NBAR 8 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 12|#define PARAMS_NBAR 8 | | ------------------ ------------------ 115| 12| shake(G2out, CRYPTO_BYTES + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU); ------------------ | | 29| 12|#define shake OQS_SHA3_shake256 ------------------ shake(G2out, CRYPTO_BYTES + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU); ------------------ | | 6| 12|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_shake_length_shared_secret | | ------------------ | | | | 147| 12|#define OQS_KEM_efrodokem_976_shake_length_shared_secret 24 | | ------------------ ------------------ shake(G2out, CRYPTO_BYTES + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU); ------------------ | | 6| 12|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_shake_length_shared_secret | | ------------------ | | | | 147| 12|#define OQS_KEM_efrodokem_976_shake_length_shared_secret 24 | | ------------------ ------------------ shake(G2out, CRYPTO_BYTES + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU); ------------------ | | 20| 12|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 12|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_shake_length_shared_secret | | | | ------------------ | | | | | | 147| 12|#define OQS_KEM_efrodokem_976_shake_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ shake(G2out, CRYPTO_BYTES + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU); ------------------ | | 19| 12|#define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 15| 12|#define PARAMS_EXTRACTED_BITS 3 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 12|#define PARAMS_NBAR 8 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 12|#define PARAMS_NBAR 8 | | ------------------ ------------------ 116| | 117| | // Generate Sp and Ep, and compute Bp = Sp*A + Ep. Generate A on-the-fly 118| 12| shake_input_seedSE[0] = 0x96; 119| 12| memcpy(&shake_input_seedSE[1], seedSE, CRYPTO_BYTES); ------------------ | | 6| 12|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_shake_length_shared_secret | | ------------------ | | | | 147| 12|#define OQS_KEM_efrodokem_976_shake_length_shared_secret 24 | | ------------------ ------------------ 120| 12| shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + CRYPTO_BYTES); ------------------ | | 29| 12|#define shake OQS_SHA3_shake256 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + CRYPTO_BYTES); ------------------ | | 11| 12|#define PARAMS_N 976 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + CRYPTO_BYTES); ------------------ | | 12| 12|#define PARAMS_NBAR 8 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + CRYPTO_BYTES); ------------------ | | 12| 12|#define PARAMS_NBAR 8 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + CRYPTO_BYTES); ------------------ | | 6| 12|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_shake_length_shared_secret | | ------------------ | | | | 147| 12|#define OQS_KEM_efrodokem_976_shake_length_shared_secret 24 | | ------------------ ------------------ 121| 188k| for (size_t i = 0; i < (2 * PARAMS_N + PARAMS_NBAR) * PARAMS_NBAR; i++) { ------------------ | | 11| 188k|#define PARAMS_N 976 ------------------ for (size_t i = 0; i < (2 * PARAMS_N + PARAMS_NBAR) * PARAMS_NBAR; i++) { ------------------ | | 12| 188k|#define PARAMS_NBAR 8 ------------------ for (size_t i = 0; i < (2 * PARAMS_N + PARAMS_NBAR) * PARAMS_NBAR; i++) { ------------------ | | 12| 188k|#define PARAMS_NBAR 8 ------------------ | Branch (121:24): [True: 188k, False: 12] ------------------ 122| 188k| Sp[i] = LE_TO_UINT16(Sp[i]); ------------------ | | 34| 188k| #define LE_TO_UINT16(n) (n) ------------------ 123| 188k| } 124| 12| frodo_sample_n(Sp, PARAMS_N*PARAMS_NBAR); ------------------ | | 38| 12|#define frodo_sample_n oqs_kem_efrodokem_976_shake_sample_n ------------------ frodo_sample_n(Sp, PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 12|#define PARAMS_N 976 ------------------ frodo_sample_n(Sp, PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 12|#define PARAMS_NBAR 8 ------------------ 125| 12| frodo_sample_n(Ep, PARAMS_N*PARAMS_NBAR); ------------------ | | 38| 12|#define frodo_sample_n oqs_kem_efrodokem_976_shake_sample_n ------------------ frodo_sample_n(Ep, PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 12|#define PARAMS_N 976 ------------------ frodo_sample_n(Ep, PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 12|#define PARAMS_NBAR 8 ------------------ 126| 12| frodo_mul_add_sa_plus_e(Bp, Sp, Ep, pk_seedA); ------------------ | | 47| 12|#define frodo_mul_add_sa_plus_e oqs_kem_efrodokem_976_shake_mul_add_sa_plus_e ------------------ 127| 12| frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 39| 12|#define frodo_pack oqs_kem_efrodokem_976_shake_pack ------------------ frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 13| 12|#define PARAMS_LOGQ 16 ------------------ frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 11| 12|#define PARAMS_N 976 ------------------ frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 12|#define PARAMS_NBAR 8 ------------------ frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 11| 12|#define PARAMS_N 976 ------------------ frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 12|#define PARAMS_NBAR 8 ------------------ frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 13| 12|#define PARAMS_LOGQ 16 ------------------ 128| | 129| | // Generate Epp, and compute V = Sp*B + Epp 130| 12| frodo_sample_n(Epp, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 38| 12|#define frodo_sample_n oqs_kem_efrodokem_976_shake_sample_n ------------------ frodo_sample_n(Epp, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 12|#define PARAMS_NBAR 8 ------------------ frodo_sample_n(Epp, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 12|#define PARAMS_NBAR 8 ------------------ 131| 12| frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 40| 12|#define frodo_unpack oqs_kem_efrodokem_976_shake_unpack ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 11| 12|#define PARAMS_N 976 ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 12| 12|#define PARAMS_NBAR 8 ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 3| 12|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_efrodokem_976_shake_length_public_key | | ------------------ | | | | 144| 12|#define OQS_KEM_efrodokem_976_shake_length_public_key 15632 | | ------------------ ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 18| 12|#define BYTES_SEED_A 16 ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 13| 12|#define PARAMS_LOGQ 16 ------------------ 132| 12| frodo_mul_add_sb_plus_e(V, B, Sp, Epp); ------------------ | | 50| 12|#define frodo_mul_add_sb_plus_e oqs_kem_efrodokem_976_shake_mul_add_sb_plus_e ------------------ 133| | 134| | // Encode mu, and compute C = V + enc(mu) (mod q) 135| 12| frodo_key_encode(C, (uint16_t*)mu); ------------------ | | 55| 12|#define frodo_key_encode oqs_kem_efrodokem_976_shake_key_encode ------------------ 136| 12| frodo_add(C, V, C); ------------------ | | 53| 12|#define frodo_add oqs_kem_efrodokem_976_shake_add ------------------ 137| 12| frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 39| 12|#define frodo_pack oqs_kem_efrodokem_976_shake_pack ------------------ frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 13| 12|#define PARAMS_LOGQ 16 ------------------ frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 12|#define PARAMS_NBAR 8 ------------------ frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 12|#define PARAMS_NBAR 8 ------------------ frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 12|#define PARAMS_NBAR 8 ------------------ frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 12|#define PARAMS_NBAR 8 ------------------ frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 13| 12|#define PARAMS_LOGQ 16 ------------------ 138| | 139| | // Compute ss = F(ct||KK) 140| 12| memcpy(Fin_ct, ct, CRYPTO_CIPHERTEXTBYTES); ------------------ | | 5| 12|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_efrodokem_976_shake_length_ciphertext | | ------------------ | | | | 146| 12|#define OQS_KEM_efrodokem_976_shake_length_ciphertext 15744 | | ------------------ ------------------ 141| 12| memcpy(Fin_k, k, CRYPTO_BYTES); ------------------ | | 6| 12|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_shake_length_shared_secret | | ------------------ | | | | 147| 12|#define OQS_KEM_efrodokem_976_shake_length_shared_secret 24 | | ------------------ ------------------ 142| 12| shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 29| 12|#define shake OQS_SHA3_shake256 ------------------ shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 6| 12|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_shake_length_shared_secret | | ------------------ | | | | 147| 12|#define OQS_KEM_efrodokem_976_shake_length_shared_secret 24 | | ------------------ ------------------ shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 5| 12|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_efrodokem_976_shake_length_ciphertext | | ------------------ | | | | 146| 12|#define OQS_KEM_efrodokem_976_shake_length_ciphertext 15744 | | ------------------ ------------------ shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 6| 12|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_shake_length_shared_secret | | ------------------ | | | | 147| 12|#define OQS_KEM_efrodokem_976_shake_length_shared_secret 24 | | ------------------ ------------------ 143| | 144| | // Cleanup: 145| 12| clear_bytes((uint8_t *)V, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 27| 12|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)V, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 12|#define PARAMS_NBAR 8 ------------------ clear_bytes((uint8_t *)V, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 12|#define PARAMS_NBAR 8 ------------------ 146| 12| clear_bytes((uint8_t *)Sp, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 27| 12|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)Sp, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 12|#define PARAMS_N 976 ------------------ clear_bytes((uint8_t *)Sp, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 12|#define PARAMS_NBAR 8 ------------------ 147| 12| clear_bytes((uint8_t *)Ep, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 27| 12|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)Ep, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 12|#define PARAMS_N 976 ------------------ clear_bytes((uint8_t *)Ep, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 12|#define PARAMS_NBAR 8 ------------------ 148| 12| clear_bytes((uint8_t *)Epp, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 27| 12|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)Epp, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 12|#define PARAMS_NBAR 8 ------------------ clear_bytes((uint8_t *)Epp, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 12|#define PARAMS_NBAR 8 ------------------ 149| 12| clear_bytes(mu, BYTES_MU); ------------------ | | 27| 12|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(mu, BYTES_MU); ------------------ | | 19| 12|#define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 15| 12|#define PARAMS_EXTRACTED_BITS 3 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 12|#define PARAMS_NBAR 8 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 12|#define PARAMS_NBAR 8 | | ------------------ ------------------ 150| 12| clear_bytes(G2out, 2*CRYPTO_BYTES); ------------------ | | 27| 12|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(G2out, 2*CRYPTO_BYTES); ------------------ | | 6| 12|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_shake_length_shared_secret | | ------------------ | | | | 147| 12|#define OQS_KEM_efrodokem_976_shake_length_shared_secret 24 | | ------------------ ------------------ 151| 12| clear_bytes(Fin_k, CRYPTO_BYTES); ------------------ | | 27| 12|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(Fin_k, CRYPTO_BYTES); ------------------ | | 6| 12|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_shake_length_shared_secret | | ------------------ | | | | 147| 12|#define OQS_KEM_efrodokem_976_shake_length_shared_secret 24 | | ------------------ ------------------ 152| 12| clear_bytes(shake_input_seedSE, 1 + CRYPTO_BYTES); ------------------ | | 27| 12|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(shake_input_seedSE, 1 + CRYPTO_BYTES); ------------------ | | 6| 12|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_shake_length_shared_secret | | ------------------ | | | | 147| 12|#define OQS_KEM_efrodokem_976_shake_length_shared_secret 24 | | ------------------ ------------------ 153| 12| return OQS_SUCCESS; 154| 12|} OQS_KEM_efrodokem_976_shake_decaps: 158| 12|{ // FrodoKEM's key decapsulation 159| | // Inputs: ciphertext ct = ct_c1||ct_c2 ( (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8 + (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8 bytes) 160| | // secret key sk = sk_s||pk_seedA||pk_b||sk_S||sk_pkh (CRYPTO_BYTES + BYTES_SEED_A + (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8 + 2*PARAMS_N*PARAMS_NBAR + BYTES_PKHASH bytes) 161| | // Output: shared key ss (CRYPTO_BYTES bytes) 162| 12| uint16_t B[PARAMS_N*PARAMS_NBAR] = {0}; 163| 12| uint16_t Bp[PARAMS_N*PARAMS_NBAR] = {0}; 164| 12| uint16_t W[PARAMS_NBAR*PARAMS_NBAR] = {0}; // contains secret data 165| 12| uint16_t C[PARAMS_NBAR*PARAMS_NBAR] = {0}; 166| 12| uint16_t CC[PARAMS_NBAR*PARAMS_NBAR] = {0}; 167| 12| ALIGN_HEADER(32) uint16_t BBp[PARAMS_N*PARAMS_NBAR] ALIGN_FOOTER(32) = {0}; 168| 12| ALIGN_HEADER(32) uint16_t Sp[(2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR] ALIGN_FOOTER(32) = {0}; // contains secret data 169| 12| uint16_t *Ep = (uint16_t *)&Sp[PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 11| 12|#define PARAMS_N 976 ------------------ uint16_t *Ep = (uint16_t *)&Sp[PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 12| 12|#define PARAMS_NBAR 8 ------------------ 170| 12| uint16_t *Epp = (uint16_t *)&Sp[2*PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 11| 12|#define PARAMS_N 976 ------------------ uint16_t *Epp = (uint16_t *)&Sp[2*PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 12| 12|#define PARAMS_NBAR 8 ------------------ 171| 12| const uint8_t *ct_c1 = &ct[0]; 172| 12| const uint8_t *ct_c2 = &ct[(PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8]; ------------------ | | 13| 12|#define PARAMS_LOGQ 16 ------------------ const uint8_t *ct_c2 = &ct[(PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8]; ------------------ | | 11| 12|#define PARAMS_N 976 ------------------ const uint8_t *ct_c2 = &ct[(PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8]; ------------------ | | 12| 12|#define PARAMS_NBAR 8 ------------------ 173| 12| const uint8_t *sk_s = &sk[0]; 174| 12| const uint8_t *sk_pk = &sk[CRYPTO_BYTES]; ------------------ | | 6| 12|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_shake_length_shared_secret | | ------------------ | | | | 147| 12|#define OQS_KEM_efrodokem_976_shake_length_shared_secret 24 | | ------------------ ------------------ 175| 12| const uint16_t *sk_S = (uint16_t *) &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES]; ------------------ | | 6| 12|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_shake_length_shared_secret | | ------------------ | | | | 147| 12|#define OQS_KEM_efrodokem_976_shake_length_shared_secret 24 | | ------------------ ------------------ const uint16_t *sk_S = (uint16_t *) &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES]; ------------------ | | 3| 12|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_efrodokem_976_shake_length_public_key | | ------------------ | | | | 144| 12|#define OQS_KEM_efrodokem_976_shake_length_public_key 15632 | | ------------------ ------------------ 176| 12| uint16_t S[PARAMS_N * PARAMS_NBAR]; // contains secret data 177| 12| const uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 6| 12|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_shake_length_shared_secret | | ------------------ | | | | 147| 12|#define OQS_KEM_efrodokem_976_shake_length_shared_secret 24 | | ------------------ ------------------ const uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 3| 12|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_efrodokem_976_shake_length_public_key | | ------------------ | | | | 144| 12|#define OQS_KEM_efrodokem_976_shake_length_public_key 15632 | | ------------------ ------------------ const uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 11| 12|#define PARAMS_N 976 ------------------ const uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 12| 12|#define PARAMS_NBAR 8 ------------------ 178| 12| const uint8_t *pk_seedA = &sk_pk[0]; 179| 12| const uint8_t *pk_b = &sk_pk[BYTES_SEED_A]; ------------------ | | 18| 12|#define BYTES_SEED_A 16 ------------------ 180| 12| uint8_t G2in[BYTES_PKHASH + BYTES_MU]; // contains secret data via muprime 181| 12| uint8_t *pkh = &G2in[0]; 182| 12| uint8_t *muprime = &G2in[BYTES_PKHASH]; // contains secret data ------------------ | | 20| 12|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 12|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_shake_length_shared_secret | | | | ------------------ | | | | | | 147| 12|#define OQS_KEM_efrodokem_976_shake_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ 183| 12| uint8_t G2out[2*CRYPTO_BYTES]; // contains secret data 184| 12| uint8_t *seedSEprime = &G2out[0]; // contains secret data 185| 12| uint8_t *kprime = &G2out[CRYPTO_BYTES]; // contains secret data ------------------ | | 6| 12|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_shake_length_shared_secret | | ------------------ | | | | 147| 12|#define OQS_KEM_efrodokem_976_shake_length_shared_secret 24 | | ------------------ ------------------ 186| 12| uint8_t Fin[CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES]; // contains secret data via Fin_k 187| 12| uint8_t *Fin_ct = &Fin[0]; 188| 12| uint8_t *Fin_k = &Fin[CRYPTO_CIPHERTEXTBYTES]; // contains secret data ------------------ | | 5| 12|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_efrodokem_976_shake_length_ciphertext | | ------------------ | | | | 146| 12|#define OQS_KEM_efrodokem_976_shake_length_ciphertext 15744 | | ------------------ ------------------ 189| 12| uint8_t shake_input_seedSEprime[1 + CRYPTO_BYTES]; // contains secret data 190| | 191| 93.7k| for (size_t i = 0; i < PARAMS_N * PARAMS_NBAR; i++) { ------------------ | | 11| 93.7k|#define PARAMS_N 976 ------------------ for (size_t i = 0; i < PARAMS_N * PARAMS_NBAR; i++) { ------------------ | | 12| 93.7k|#define PARAMS_NBAR 8 ------------------ | Branch (191:24): [True: 93.6k, False: 12] ------------------ 192| 93.6k| S[i] = LE_TO_UINT16(sk_S[i]); ------------------ | | 34| 93.6k| #define LE_TO_UINT16(n) (n) ------------------ 193| 93.6k| } 194| | 195| | // Compute W = C - Bp*S (mod q), and decode the randomness mu 196| 12| frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 40| 12|#define frodo_unpack oqs_kem_efrodokem_976_shake_unpack ------------------ frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 11| 12|#define PARAMS_N 976 ------------------ frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 12| 12|#define PARAMS_NBAR 8 ------------------ frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 13| 12|#define PARAMS_LOGQ 16 ------------------ frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 11| 12|#define PARAMS_N 976 ------------------ frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 12| 12|#define PARAMS_NBAR 8 ------------------ frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 13| 12|#define PARAMS_LOGQ 16 ------------------ 197| 12| frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 40| 12|#define frodo_unpack oqs_kem_efrodokem_976_shake_unpack ------------------ frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 12| 12|#define PARAMS_NBAR 8 ------------------ frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 12| 12|#define PARAMS_NBAR 8 ------------------ frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 13| 12|#define PARAMS_LOGQ 16 ------------------ frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 12| 12|#define PARAMS_NBAR 8 ------------------ frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 12| 12|#define PARAMS_NBAR 8 ------------------ frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 13| 12|#define PARAMS_LOGQ 16 ------------------ 198| 12| frodo_mul_bs(W, Bp, S); ------------------ | | 51| 12|#define frodo_mul_bs oqs_kem_efrodokem_976_shake_mul_bs ------------------ 199| 12| frodo_sub(W, C, W); ------------------ | | 54| 12|#define frodo_sub oqs_kem_efrodokem_976_shake_sub ------------------ 200| 12| frodo_key_decode((uint16_t*)muprime, W); ------------------ | | 56| 12|#define frodo_key_decode oqs_kem_efrodokem_976_shake_key_decode ------------------ 201| | 202| | // Generate (seedSE' || k') = G_2(pkh || mu') 203| 12| memcpy(pkh, sk_pkh, BYTES_PKHASH); ------------------ | | 20| 12|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 12|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_shake_length_shared_secret | | | | ------------------ | | | | | | 147| 12|#define OQS_KEM_efrodokem_976_shake_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ 204| 12| shake(G2out, CRYPTO_BYTES + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU); ------------------ | | 29| 12|#define shake OQS_SHA3_shake256 ------------------ shake(G2out, CRYPTO_BYTES + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU); ------------------ | | 6| 12|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_shake_length_shared_secret | | ------------------ | | | | 147| 12|#define OQS_KEM_efrodokem_976_shake_length_shared_secret 24 | | ------------------ ------------------ shake(G2out, CRYPTO_BYTES + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU); ------------------ | | 6| 12|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_shake_length_shared_secret | | ------------------ | | | | 147| 12|#define OQS_KEM_efrodokem_976_shake_length_shared_secret 24 | | ------------------ ------------------ shake(G2out, CRYPTO_BYTES + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU); ------------------ | | 20| 12|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 12|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_shake_length_shared_secret | | | | ------------------ | | | | | | 147| 12|#define OQS_KEM_efrodokem_976_shake_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ shake(G2out, CRYPTO_BYTES + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU); ------------------ | | 19| 12|#define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 15| 12|#define PARAMS_EXTRACTED_BITS 3 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 12|#define PARAMS_NBAR 8 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 12|#define PARAMS_NBAR 8 | | ------------------ ------------------ 205| | 206| | // Generate Sp and Ep, and compute BBp = Sp*A + Ep. Generate A on-the-fly 207| 12| shake_input_seedSEprime[0] = 0x96; 208| 12| memcpy(&shake_input_seedSEprime[1], seedSEprime, CRYPTO_BYTES); ------------------ | | 6| 12|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_shake_length_shared_secret | | ------------------ | | | | 147| 12|#define OQS_KEM_efrodokem_976_shake_length_shared_secret 24 | | ------------------ ------------------ 209| 12| shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSEprime, 1 + CRYPTO_BYTES); ------------------ | | 29| 12|#define shake OQS_SHA3_shake256 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSEprime, 1 + CRYPTO_BYTES); ------------------ | | 11| 12|#define PARAMS_N 976 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSEprime, 1 + CRYPTO_BYTES); ------------------ | | 12| 12|#define PARAMS_NBAR 8 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSEprime, 1 + CRYPTO_BYTES); ------------------ | | 12| 12|#define PARAMS_NBAR 8 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSEprime, 1 + CRYPTO_BYTES); ------------------ | | 6| 12|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_shake_length_shared_secret | | ------------------ | | | | 147| 12|#define OQS_KEM_efrodokem_976_shake_length_shared_secret 24 | | ------------------ ------------------ 210| 188k| for (size_t i = 0; i < (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR; i++) { ------------------ | | 11| 188k|#define PARAMS_N 976 ------------------ for (size_t i = 0; i < (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR; i++) { ------------------ | | 12| 188k|#define PARAMS_NBAR 8 ------------------ for (size_t i = 0; i < (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR; i++) { ------------------ | | 12| 188k|#define PARAMS_NBAR 8 ------------------ | Branch (210:24): [True: 188k, False: 12] ------------------ 211| 188k| Sp[i] = LE_TO_UINT16(Sp[i]); ------------------ | | 34| 188k| #define LE_TO_UINT16(n) (n) ------------------ 212| 188k| } 213| 12| frodo_sample_n(Sp, PARAMS_N*PARAMS_NBAR); ------------------ | | 38| 12|#define frodo_sample_n oqs_kem_efrodokem_976_shake_sample_n ------------------ frodo_sample_n(Sp, PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 12|#define PARAMS_N 976 ------------------ frodo_sample_n(Sp, PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 12|#define PARAMS_NBAR 8 ------------------ 214| 12| frodo_sample_n(Ep, PARAMS_N*PARAMS_NBAR); ------------------ | | 38| 12|#define frodo_sample_n oqs_kem_efrodokem_976_shake_sample_n ------------------ frodo_sample_n(Ep, PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 12|#define PARAMS_N 976 ------------------ frodo_sample_n(Ep, PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 12|#define PARAMS_NBAR 8 ------------------ 215| 12| frodo_mul_add_sa_plus_e(BBp, Sp, Ep, pk_seedA); ------------------ | | 47| 12|#define frodo_mul_add_sa_plus_e oqs_kem_efrodokem_976_shake_mul_add_sa_plus_e ------------------ 216| | 217| | // Generate Epp, and compute W = Sp*B + Epp 218| 12| frodo_sample_n(Epp, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 38| 12|#define frodo_sample_n oqs_kem_efrodokem_976_shake_sample_n ------------------ frodo_sample_n(Epp, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 12|#define PARAMS_NBAR 8 ------------------ frodo_sample_n(Epp, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 12|#define PARAMS_NBAR 8 ------------------ 219| 12| frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 40| 12|#define frodo_unpack oqs_kem_efrodokem_976_shake_unpack ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 11| 12|#define PARAMS_N 976 ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 12| 12|#define PARAMS_NBAR 8 ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 3| 12|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_efrodokem_976_shake_length_public_key | | ------------------ | | | | 144| 12|#define OQS_KEM_efrodokem_976_shake_length_public_key 15632 | | ------------------ ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 18| 12|#define BYTES_SEED_A 16 ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 13| 12|#define PARAMS_LOGQ 16 ------------------ 220| 12| frodo_mul_add_sb_plus_e(W, B, Sp, Epp); ------------------ | | 50| 12|#define frodo_mul_add_sb_plus_e oqs_kem_efrodokem_976_shake_mul_add_sb_plus_e ------------------ 221| | 222| | // Encode mu, and compute CC = W + enc(mu') (mod q) 223| 12| frodo_key_encode(CC, (uint16_t*)muprime); ------------------ | | 55| 12|#define frodo_key_encode oqs_kem_efrodokem_976_shake_key_encode ------------------ 224| 12| frodo_add(CC, W, CC); ------------------ | | 53| 12|#define frodo_add oqs_kem_efrodokem_976_shake_add ------------------ 225| | 226| | // Prepare input to F 227| 12| memcpy(Fin_ct, ct, CRYPTO_CIPHERTEXTBYTES); ------------------ | | 5| 12|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_efrodokem_976_shake_length_ciphertext | | ------------------ | | | | 146| 12|#define OQS_KEM_efrodokem_976_shake_length_ciphertext 15744 | | ------------------ ------------------ 228| | 229| | // Reducing BBp modulo q 230| 93.7k| for (int i = 0; i < PARAMS_N*PARAMS_NBAR; i++) BBp[i] = BBp[i] & ((1 << PARAMS_LOGQ)-1); ------------------ | | 11| 93.7k|#define PARAMS_N 976 ------------------ for (int i = 0; i < PARAMS_N*PARAMS_NBAR; i++) BBp[i] = BBp[i] & ((1 << PARAMS_LOGQ)-1); ------------------ | | 12| 93.7k|#define PARAMS_NBAR 8 ------------------ for (int i = 0; i < PARAMS_N*PARAMS_NBAR; i++) BBp[i] = BBp[i] & ((1 << PARAMS_LOGQ)-1); ------------------ | | 13| 93.6k|#define PARAMS_LOGQ 16 ------------------ | Branch (230:21): [True: 93.6k, False: 12] ------------------ 231| | 232| | // Needs to avoid branching on secret data using constant-time implementation. 233| 12| int8_t selector = ct_verify(Bp, BBp, PARAMS_N*PARAMS_NBAR) | ct_verify(C, CC, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 42| 12|#define ct_verify oqs_kem_efrodokem_976_shake_ct_verify ------------------ int8_t selector = ct_verify(Bp, BBp, PARAMS_N*PARAMS_NBAR) | ct_verify(C, CC, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 11| 12|#define PARAMS_N 976 ------------------ int8_t selector = ct_verify(Bp, BBp, PARAMS_N*PARAMS_NBAR) | ct_verify(C, CC, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 12|#define PARAMS_NBAR 8 ------------------ int8_t selector = ct_verify(Bp, BBp, PARAMS_N*PARAMS_NBAR) | ct_verify(C, CC, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 42| 12|#define ct_verify oqs_kem_efrodokem_976_shake_ct_verify ------------------ int8_t selector = ct_verify(Bp, BBp, PARAMS_N*PARAMS_NBAR) | ct_verify(C, CC, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 12|#define PARAMS_NBAR 8 ------------------ int8_t selector = ct_verify(Bp, BBp, PARAMS_N*PARAMS_NBAR) | ct_verify(C, CC, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 12|#define PARAMS_NBAR 8 ------------------ 234| | // If (selector == 0) then load k' to do ss = F(ct || k'), else if (selector == -1) load s to do ss = F(ct || s) 235| 12| ct_select((uint8_t*)Fin_k, (uint8_t*)kprime, (uint8_t*)sk_s, CRYPTO_BYTES, selector); ------------------ | | 41| 12|#define ct_select oqs_kem_efrodokem_976_shake_ct_select ------------------ ct_select((uint8_t*)Fin_k, (uint8_t*)kprime, (uint8_t*)sk_s, CRYPTO_BYTES, selector); ------------------ | | 6| 12|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_shake_length_shared_secret | | ------------------ | | | | 147| 12|#define OQS_KEM_efrodokem_976_shake_length_shared_secret 24 | | ------------------ ------------------ 236| 12| shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 29| 12|#define shake OQS_SHA3_shake256 ------------------ shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 6| 12|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_shake_length_shared_secret | | ------------------ | | | | 147| 12|#define OQS_KEM_efrodokem_976_shake_length_shared_secret 24 | | ------------------ ------------------ shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 5| 12|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_efrodokem_976_shake_length_ciphertext | | ------------------ | | | | 146| 12|#define OQS_KEM_efrodokem_976_shake_length_ciphertext 15744 | | ------------------ ------------------ shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 6| 12|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_shake_length_shared_secret | | ------------------ | | | | 147| 12|#define OQS_KEM_efrodokem_976_shake_length_shared_secret 24 | | ------------------ ------------------ 237| | 238| | // Cleanup: 239| 12| clear_bytes((uint8_t *)W, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 27| 12|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)W, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 12|#define PARAMS_NBAR 8 ------------------ clear_bytes((uint8_t *)W, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 12|#define PARAMS_NBAR 8 ------------------ 240| 12| clear_bytes((uint8_t *)Sp, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 27| 12|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)Sp, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 12|#define PARAMS_N 976 ------------------ clear_bytes((uint8_t *)Sp, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 12|#define PARAMS_NBAR 8 ------------------ 241| 12| clear_bytes((uint8_t *)S, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 27| 12|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)S, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 12|#define PARAMS_N 976 ------------------ clear_bytes((uint8_t *)S, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 12|#define PARAMS_NBAR 8 ------------------ 242| 12| clear_bytes((uint8_t *)Ep, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 27| 12|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)Ep, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 12|#define PARAMS_N 976 ------------------ clear_bytes((uint8_t *)Ep, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 12|#define PARAMS_NBAR 8 ------------------ 243| 12| clear_bytes((uint8_t *)Epp, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 27| 12|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)Epp, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 12|#define PARAMS_NBAR 8 ------------------ clear_bytes((uint8_t *)Epp, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 12|#define PARAMS_NBAR 8 ------------------ 244| 12| clear_bytes(muprime, BYTES_MU); ------------------ | | 27| 12|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(muprime, BYTES_MU); ------------------ | | 19| 12|#define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 15| 12|#define PARAMS_EXTRACTED_BITS 3 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 12|#define PARAMS_NBAR 8 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 12|#define PARAMS_NBAR 8 | | ------------------ ------------------ 245| 12| clear_bytes(G2out, 2*CRYPTO_BYTES); ------------------ | | 27| 12|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(G2out, 2*CRYPTO_BYTES); ------------------ | | 6| 12|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_shake_length_shared_secret | | ------------------ | | | | 147| 12|#define OQS_KEM_efrodokem_976_shake_length_shared_secret 24 | | ------------------ ------------------ 246| 12| clear_bytes(Fin_k, CRYPTO_BYTES); ------------------ | | 27| 12|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(Fin_k, CRYPTO_BYTES); ------------------ | | 6| 12|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_shake_length_shared_secret | | ------------------ | | | | 147| 12|#define OQS_KEM_efrodokem_976_shake_length_shared_secret 24 | | ------------------ ------------------ 247| 12| clear_bytes(shake_input_seedSEprime, 1 + CRYPTO_BYTES); ------------------ | | 27| 12|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(shake_input_seedSEprime, 1 + CRYPTO_BYTES); ------------------ | | 6| 12|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_shake_length_shared_secret | | ------------------ | | | | 147| 12|#define OQS_KEM_efrodokem_976_shake_length_shared_secret 24 | | ------------------ ------------------ 248| 12| return OQS_SUCCESS; 249| 12|} OQS_KEM_efrodokem_1344_aes_keypair: 19| 8|{ // FrodoKEM's key generation 20| | // Outputs: public key pk = pk_seedA||pk_b ( BYTES_SEED_A + (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8 bytes) 21| | // secret key sk = sk_s||pk_seedA||pk_b||sk_S||sk_pkh (CRYPTO_BYTES + BYTES_SEED_A + (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8 + 2*PARAMS_N*PARAMS_NBAR + BYTES_PKHASH bytes) 22| 8| uint8_t *pk_seedA = &pk[0]; 23| 8| uint8_t *pk_b = &pk[BYTES_SEED_A]; ------------------ | | 18| 8|#define BYTES_SEED_A 16 ------------------ 24| 8| uint8_t *sk_s = &sk[0]; 25| 8| uint8_t *sk_pk = &sk[CRYPTO_BYTES]; ------------------ | | 6| 8|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_aes_length_shared_secret | | ------------------ | | | | 162| 8|#define OQS_KEM_efrodokem_1344_aes_length_shared_secret 32 | | ------------------ ------------------ 26| 8| uint8_t *sk_S = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES]; ------------------ | | 6| 8|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_aes_length_shared_secret | | ------------------ | | | | 162| 8|#define OQS_KEM_efrodokem_1344_aes_length_shared_secret 32 | | ------------------ ------------------ uint8_t *sk_S = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES]; ------------------ | | 3| 8|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_efrodokem_1344_aes_length_public_key | | ------------------ | | | | 159| 8|#define OQS_KEM_efrodokem_1344_aes_length_public_key 21520 | | ------------------ ------------------ 27| 8| uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 6| 8|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_aes_length_shared_secret | | ------------------ | | | | 162| 8|#define OQS_KEM_efrodokem_1344_aes_length_shared_secret 32 | | ------------------ ------------------ uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 3| 8|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_efrodokem_1344_aes_length_public_key | | ------------------ | | | | 159| 8|#define OQS_KEM_efrodokem_1344_aes_length_public_key 21520 | | ------------------ ------------------ uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 11| 8|#define PARAMS_N 1344 ------------------ uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ 28| 8| uint16_t B[PARAMS_N*PARAMS_NBAR] = {0}; 29| 8| uint16_t S[2*PARAMS_N*PARAMS_NBAR] = {0}; // contains secret data 30| 8| uint16_t *E = (uint16_t *)&S[PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 11| 8|#define PARAMS_N 1344 ------------------ uint16_t *E = (uint16_t *)&S[PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ 31| 8| uint8_t randomness[2*CRYPTO_BYTES + BYTES_SEED_A]; // contains secret data via randomness_s and randomness_seedSE 32| 8| uint8_t *randomness_s = &randomness[0]; // contains secret data 33| 8| uint8_t *randomness_seedSE = &randomness[CRYPTO_BYTES]; // contains secret data ------------------ | | 6| 8|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_aes_length_shared_secret | | ------------------ | | | | 162| 8|#define OQS_KEM_efrodokem_1344_aes_length_shared_secret 32 | | ------------------ ------------------ 34| 8| uint8_t *randomness_z = &randomness[2*CRYPTO_BYTES]; ------------------ | | 6| 8|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_aes_length_shared_secret | | ------------------ | | | | 162| 8|#define OQS_KEM_efrodokem_1344_aes_length_shared_secret 32 | | ------------------ ------------------ 35| 8| uint8_t shake_input_seedSE[1 + CRYPTO_BYTES]; // contains secret data 36| | 37| | // Generate the secret value s, the seed for S and E, and the seed for the seed for A. Add seed_A to the public key 38| 8| randombytes(randomness, CRYPTO_BYTES + CRYPTO_BYTES + BYTES_SEED_A); ------------------ | | 26| 8|#define randombytes OQS_randombytes ------------------ randombytes(randomness, CRYPTO_BYTES + CRYPTO_BYTES + BYTES_SEED_A); ------------------ | | 6| 8|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_aes_length_shared_secret | | ------------------ | | | | 162| 8|#define OQS_KEM_efrodokem_1344_aes_length_shared_secret 32 | | ------------------ ------------------ randombytes(randomness, CRYPTO_BYTES + CRYPTO_BYTES + BYTES_SEED_A); ------------------ | | 6| 8|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_aes_length_shared_secret | | ------------------ | | | | 162| 8|#define OQS_KEM_efrodokem_1344_aes_length_shared_secret 32 | | ------------------ ------------------ randombytes(randomness, CRYPTO_BYTES + CRYPTO_BYTES + BYTES_SEED_A); ------------------ | | 18| 8|#define BYTES_SEED_A 16 ------------------ 39| 8| shake(pk_seedA, BYTES_SEED_A, randomness_z, BYTES_SEED_A); ------------------ | | 29| 8|#define shake OQS_SHA3_shake256 ------------------ shake(pk_seedA, BYTES_SEED_A, randomness_z, BYTES_SEED_A); ------------------ | | 18| 8|#define BYTES_SEED_A 16 ------------------ shake(pk_seedA, BYTES_SEED_A, randomness_z, BYTES_SEED_A); ------------------ | | 18| 8|#define BYTES_SEED_A 16 ------------------ 40| | 41| | // Generate S and E, and compute B = A*S + E. Generate A on-the-fly 42| 8| shake_input_seedSE[0] = 0x5F; 43| 8| memcpy(&shake_input_seedSE[1], randomness_seedSE, CRYPTO_BYTES); ------------------ | | 6| 8|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_aes_length_shared_secret | | ------------------ | | | | 162| 8|#define OQS_KEM_efrodokem_1344_aes_length_shared_secret 32 | | ------------------ ------------------ 44| 8| shake((uint8_t*)S, 2*PARAMS_N*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + CRYPTO_BYTES); ------------------ | | 29| 8|#define shake OQS_SHA3_shake256 ------------------ shake((uint8_t*)S, 2*PARAMS_N*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + CRYPTO_BYTES); ------------------ | | 11| 8|#define PARAMS_N 1344 ------------------ shake((uint8_t*)S, 2*PARAMS_N*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + CRYPTO_BYTES); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ shake((uint8_t*)S, 2*PARAMS_N*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + CRYPTO_BYTES); ------------------ | | 6| 8|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_aes_length_shared_secret | | ------------------ | | | | 162| 8|#define OQS_KEM_efrodokem_1344_aes_length_shared_secret 32 | | ------------------ ------------------ 45| 172k| for (size_t i = 0; i < 2 * PARAMS_N * PARAMS_NBAR; i++) { ------------------ | | 11| 172k|#define PARAMS_N 1344 ------------------ for (size_t i = 0; i < 2 * PARAMS_N * PARAMS_NBAR; i++) { ------------------ | | 12| 172k|#define PARAMS_NBAR 8 ------------------ | Branch (45:24): [True: 172k, False: 8] ------------------ 46| 172k| S[i] = LE_TO_UINT16(S[i]); ------------------ | | 34| 172k| #define LE_TO_UINT16(n) (n) ------------------ 47| 172k| } 48| 8| frodo_sample_n(S, PARAMS_N*PARAMS_NBAR); ------------------ | | 38| 8|#define frodo_sample_n oqs_kem_efrodokem_1344_aes_sample_n ------------------ frodo_sample_n(S, PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 8|#define PARAMS_N 1344 ------------------ frodo_sample_n(S, PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ 49| 8| frodo_sample_n(E, PARAMS_N*PARAMS_NBAR); ------------------ | | 38| 8|#define frodo_sample_n oqs_kem_efrodokem_1344_aes_sample_n ------------------ frodo_sample_n(E, PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 8|#define PARAMS_N 1344 ------------------ frodo_sample_n(E, PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ 50| 8| frodo_mul_add_as_plus_e(B, S, E, pk); ------------------ | | 44| 8|#define frodo_mul_add_as_plus_e oqs_kem_efrodokem_1344_aes_mul_add_as_plus_e ------------------ 51| | 52| | // Encode the second part of the public key 53| 8| frodo_pack(pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, B, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 39| 8|#define frodo_pack oqs_kem_efrodokem_1344_aes_pack ------------------ frodo_pack(pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, B, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 3| 8|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_efrodokem_1344_aes_length_public_key | | ------------------ | | | | 159| 8|#define OQS_KEM_efrodokem_1344_aes_length_public_key 21520 | | ------------------ ------------------ frodo_pack(pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, B, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 18| 8|#define BYTES_SEED_A 16 ------------------ frodo_pack(pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, B, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 11| 8|#define PARAMS_N 1344 ------------------ frodo_pack(pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, B, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ frodo_pack(pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, B, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 13| 8|#define PARAMS_LOGQ 16 ------------------ 54| | 55| | // Add s, pk and S to the secret key 56| 8| memcpy(sk_s, randomness_s, CRYPTO_BYTES); ------------------ | | 6| 8|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_aes_length_shared_secret | | ------------------ | | | | 162| 8|#define OQS_KEM_efrodokem_1344_aes_length_shared_secret 32 | | ------------------ ------------------ 57| 8| memcpy(sk_pk, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 3| 8|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_efrodokem_1344_aes_length_public_key | | ------------------ | | | | 159| 8|#define OQS_KEM_efrodokem_1344_aes_length_public_key 21520 | | ------------------ ------------------ 58| 86.0k| for (size_t i = 0; i < PARAMS_N * PARAMS_NBAR; i++) { ------------------ | | 11| 86.0k|#define PARAMS_N 1344 ------------------ for (size_t i = 0; i < PARAMS_N * PARAMS_NBAR; i++) { ------------------ | | 12| 86.0k|#define PARAMS_NBAR 8 ------------------ | Branch (58:24): [True: 86.0k, False: 8] ------------------ 59| 86.0k| S[i] = UINT16_TO_LE(S[i]); ------------------ | | 35| 86.0k| #define UINT16_TO_LE(n) (n) ------------------ 60| 86.0k| } 61| 8| memcpy(sk_S, S, 2*PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 8|#define PARAMS_N 1344 ------------------ memcpy(sk_S, S, 2*PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ 62| | 63| | // Add H(pk) to the secret key 64| 8| shake(sk_pkh, BYTES_PKHASH, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 29| 8|#define shake OQS_SHA3_shake256 ------------------ shake(sk_pkh, BYTES_PKHASH, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 20| 8|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 8|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_aes_length_shared_secret | | | | ------------------ | | | | | | 162| 8|#define OQS_KEM_efrodokem_1344_aes_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ shake(sk_pkh, BYTES_PKHASH, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 3| 8|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_efrodokem_1344_aes_length_public_key | | ------------------ | | | | 159| 8|#define OQS_KEM_efrodokem_1344_aes_length_public_key 21520 | | ------------------ ------------------ 65| | 66| | // Cleanup: 67| 8| clear_bytes((uint8_t *)S, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 27| 8|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)S, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 8|#define PARAMS_N 1344 ------------------ clear_bytes((uint8_t *)S, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ 68| 8| clear_bytes((uint8_t *)E, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 27| 8|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)E, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 8|#define PARAMS_N 1344 ------------------ clear_bytes((uint8_t *)E, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ 69| 8| clear_bytes(randomness, 2*CRYPTO_BYTES); ------------------ | | 27| 8|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(randomness, 2*CRYPTO_BYTES); ------------------ | | 6| 8|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_aes_length_shared_secret | | ------------------ | | | | 162| 8|#define OQS_KEM_efrodokem_1344_aes_length_shared_secret 32 | | ------------------ ------------------ 70| 8| clear_bytes(shake_input_seedSE, 1 + CRYPTO_BYTES); ------------------ | | 27| 8|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(shake_input_seedSE, 1 + CRYPTO_BYTES); ------------------ | | 6| 8|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_aes_length_shared_secret | | ------------------ | | | | 162| 8|#define OQS_KEM_efrodokem_1344_aes_length_shared_secret 32 | | ------------------ ------------------ 71| 8| return OQS_SUCCESS; 72| 8|} OQS_KEM_efrodokem_1344_aes_encaps: 86| 8|{ // FrodoKEM's key encapsulation 87| | // Input: public key pk = pk_seedA||pk_b (BYTES_SEED_A + (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8 bytes) 88| | // Outputs: ciphertext ct = ct_c1||ct_c2 ( (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8 + (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8 bytes) 89| | // shared key ss (CRYPTO_BYTES bytes) 90| 8| const uint8_t *pk_seedA = &pk[0]; 91| 8| const uint8_t *pk_b = &pk[BYTES_SEED_A]; ------------------ | | 18| 8|#define BYTES_SEED_A 16 ------------------ 92| 8| uint8_t *ct_c1 = &ct[0]; 93| 8| uint8_t *ct_c2 = &ct[(PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8]; ------------------ | | 13| 8|#define PARAMS_LOGQ 16 ------------------ uint8_t *ct_c2 = &ct[(PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8]; ------------------ | | 11| 8|#define PARAMS_N 1344 ------------------ uint8_t *ct_c2 = &ct[(PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8]; ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ 94| 8| uint16_t B[PARAMS_N*PARAMS_NBAR] = {0}; 95| 8| uint16_t V[PARAMS_NBAR*PARAMS_NBAR]= {0}; // contains secret data 96| 8| uint16_t C[PARAMS_NBAR*PARAMS_NBAR] = {0}; 97| 8| ALIGN_HEADER(32) uint16_t Bp[PARAMS_N*PARAMS_NBAR] ALIGN_FOOTER(32) = {0}; 98| 8| ALIGN_HEADER(32) uint16_t Sp[(2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR] ALIGN_FOOTER(32) = {0}; // contains secret data 99| 8| uint16_t *Ep = (uint16_t *)&Sp[PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 11| 8|#define PARAMS_N 1344 ------------------ uint16_t *Ep = (uint16_t *)&Sp[PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ 100| 8| uint16_t *Epp = (uint16_t *)&Sp[2*PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 11| 8|#define PARAMS_N 1344 ------------------ uint16_t *Epp = (uint16_t *)&Sp[2*PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ 101| 8| uint8_t G2in[BYTES_PKHASH + BYTES_MU]; // contains secret data via mu 102| 8| uint8_t *pkh = &G2in[0]; 103| 8| uint8_t *mu = &G2in[BYTES_PKHASH]; // contains secret data ------------------ | | 20| 8|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 8|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_aes_length_shared_secret | | | | ------------------ | | | | | | 162| 8|#define OQS_KEM_efrodokem_1344_aes_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ 104| 8| uint8_t G2out[2*CRYPTO_BYTES]; // contains secret data 105| 8| uint8_t *seedSE = &G2out[0]; // contains secret data 106| 8| uint8_t *k = &G2out[CRYPTO_BYTES]; // contains secret data ------------------ | | 6| 8|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_aes_length_shared_secret | | ------------------ | | | | 162| 8|#define OQS_KEM_efrodokem_1344_aes_length_shared_secret 32 | | ------------------ ------------------ 107| 8| uint8_t Fin[CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES]; // contains secret data via Fin_k 108| 8| uint8_t *Fin_ct = &Fin[0]; 109| 8| uint8_t *Fin_k = &Fin[CRYPTO_CIPHERTEXTBYTES]; // contains secret data ------------------ | | 5| 8|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_efrodokem_1344_aes_length_ciphertext | | ------------------ | | | | 161| 8|#define OQS_KEM_efrodokem_1344_aes_length_ciphertext 21632 | | ------------------ ------------------ 110| 8| uint8_t shake_input_seedSE[1 + CRYPTO_BYTES]; // contains secret data 111| | 112| | // pkh <- G_1(pk), generate random mu, compute (seedSE || k) = G_2(pkh || mu) 113| 8| shake(pkh, BYTES_PKHASH, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 29| 8|#define shake OQS_SHA3_shake256 ------------------ shake(pkh, BYTES_PKHASH, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 20| 8|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 8|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_aes_length_shared_secret | | | | ------------------ | | | | | | 162| 8|#define OQS_KEM_efrodokem_1344_aes_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ shake(pkh, BYTES_PKHASH, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 3| 8|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_efrodokem_1344_aes_length_public_key | | ------------------ | | | | 159| 8|#define OQS_KEM_efrodokem_1344_aes_length_public_key 21520 | | ------------------ ------------------ 114| 8| randombytes(mu, BYTES_MU); ------------------ | | 26| 8|#define randombytes OQS_randombytes ------------------ randombytes(mu, BYTES_MU); ------------------ | | 19| 8|#define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 15| 8|#define PARAMS_EXTRACTED_BITS 4 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 8|#define PARAMS_NBAR 8 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 8|#define PARAMS_NBAR 8 | | ------------------ ------------------ 115| 8| shake(G2out, CRYPTO_BYTES + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU); ------------------ | | 29| 8|#define shake OQS_SHA3_shake256 ------------------ shake(G2out, CRYPTO_BYTES + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU); ------------------ | | 6| 8|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_aes_length_shared_secret | | ------------------ | | | | 162| 8|#define OQS_KEM_efrodokem_1344_aes_length_shared_secret 32 | | ------------------ ------------------ shake(G2out, CRYPTO_BYTES + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU); ------------------ | | 6| 8|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_aes_length_shared_secret | | ------------------ | | | | 162| 8|#define OQS_KEM_efrodokem_1344_aes_length_shared_secret 32 | | ------------------ ------------------ shake(G2out, CRYPTO_BYTES + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU); ------------------ | | 20| 8|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 8|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_aes_length_shared_secret | | | | ------------------ | | | | | | 162| 8|#define OQS_KEM_efrodokem_1344_aes_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ shake(G2out, CRYPTO_BYTES + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU); ------------------ | | 19| 8|#define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 15| 8|#define PARAMS_EXTRACTED_BITS 4 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 8|#define PARAMS_NBAR 8 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 8|#define PARAMS_NBAR 8 | | ------------------ ------------------ 116| | 117| | // Generate Sp and Ep, and compute Bp = Sp*A + Ep. Generate A on-the-fly 118| 8| shake_input_seedSE[0] = 0x96; 119| 8| memcpy(&shake_input_seedSE[1], seedSE, CRYPTO_BYTES); ------------------ | | 6| 8|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_aes_length_shared_secret | | ------------------ | | | | 162| 8|#define OQS_KEM_efrodokem_1344_aes_length_shared_secret 32 | | ------------------ ------------------ 120| 8| shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + CRYPTO_BYTES); ------------------ | | 29| 8|#define shake OQS_SHA3_shake256 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + CRYPTO_BYTES); ------------------ | | 11| 8|#define PARAMS_N 1344 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + CRYPTO_BYTES); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + CRYPTO_BYTES); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + CRYPTO_BYTES); ------------------ | | 6| 8|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_aes_length_shared_secret | | ------------------ | | | | 162| 8|#define OQS_KEM_efrodokem_1344_aes_length_shared_secret 32 | | ------------------ ------------------ 121| 172k| for (size_t i = 0; i < (2 * PARAMS_N + PARAMS_NBAR) * PARAMS_NBAR; i++) { ------------------ | | 11| 172k|#define PARAMS_N 1344 ------------------ for (size_t i = 0; i < (2 * PARAMS_N + PARAMS_NBAR) * PARAMS_NBAR; i++) { ------------------ | | 12| 172k|#define PARAMS_NBAR 8 ------------------ for (size_t i = 0; i < (2 * PARAMS_N + PARAMS_NBAR) * PARAMS_NBAR; i++) { ------------------ | | 12| 172k|#define PARAMS_NBAR 8 ------------------ | Branch (121:24): [True: 172k, False: 8] ------------------ 122| 172k| Sp[i] = LE_TO_UINT16(Sp[i]); ------------------ | | 34| 172k| #define LE_TO_UINT16(n) (n) ------------------ 123| 172k| } 124| 8| frodo_sample_n(Sp, PARAMS_N*PARAMS_NBAR); ------------------ | | 38| 8|#define frodo_sample_n oqs_kem_efrodokem_1344_aes_sample_n ------------------ frodo_sample_n(Sp, PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 8|#define PARAMS_N 1344 ------------------ frodo_sample_n(Sp, PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ 125| 8| frodo_sample_n(Ep, PARAMS_N*PARAMS_NBAR); ------------------ | | 38| 8|#define frodo_sample_n oqs_kem_efrodokem_1344_aes_sample_n ------------------ frodo_sample_n(Ep, PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 8|#define PARAMS_N 1344 ------------------ frodo_sample_n(Ep, PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ 126| 8| frodo_mul_add_sa_plus_e(Bp, Sp, Ep, pk_seedA); ------------------ | | 47| 8|#define frodo_mul_add_sa_plus_e oqs_kem_efrodokem_1344_aes_mul_add_sa_plus_e ------------------ 127| 8| frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 39| 8|#define frodo_pack oqs_kem_efrodokem_1344_aes_pack ------------------ frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 13| 8|#define PARAMS_LOGQ 16 ------------------ frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 11| 8|#define PARAMS_N 1344 ------------------ frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 11| 8|#define PARAMS_N 1344 ------------------ frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 13| 8|#define PARAMS_LOGQ 16 ------------------ 128| | 129| | // Generate Epp, and compute V = Sp*B + Epp 130| 8| frodo_sample_n(Epp, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 38| 8|#define frodo_sample_n oqs_kem_efrodokem_1344_aes_sample_n ------------------ frodo_sample_n(Epp, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ frodo_sample_n(Epp, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ 131| 8| frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 40| 8|#define frodo_unpack oqs_kem_efrodokem_1344_aes_unpack ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 11| 8|#define PARAMS_N 1344 ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 3| 8|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_efrodokem_1344_aes_length_public_key | | ------------------ | | | | 159| 8|#define OQS_KEM_efrodokem_1344_aes_length_public_key 21520 | | ------------------ ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 18| 8|#define BYTES_SEED_A 16 ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 13| 8|#define PARAMS_LOGQ 16 ------------------ 132| 8| frodo_mul_add_sb_plus_e(V, B, Sp, Epp); ------------------ | | 50| 8|#define frodo_mul_add_sb_plus_e oqs_kem_efrodokem_1344_aes_mul_add_sb_plus_e ------------------ 133| | 134| | // Encode mu, and compute C = V + enc(mu) (mod q) 135| 8| frodo_key_encode(C, (uint16_t*)mu); ------------------ | | 55| 8|#define frodo_key_encode oqs_kem_efrodokem_1344_aes_key_encode ------------------ 136| 8| frodo_add(C, V, C); ------------------ | | 53| 8|#define frodo_add oqs_kem_efrodokem_1344_aes_add ------------------ 137| 8| frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 39| 8|#define frodo_pack oqs_kem_efrodokem_1344_aes_pack ------------------ frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 13| 8|#define PARAMS_LOGQ 16 ------------------ frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 13| 8|#define PARAMS_LOGQ 16 ------------------ 138| | 139| | // Compute ss = F(ct||KK) 140| 8| memcpy(Fin_ct, ct, CRYPTO_CIPHERTEXTBYTES); ------------------ | | 5| 8|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_efrodokem_1344_aes_length_ciphertext | | ------------------ | | | | 161| 8|#define OQS_KEM_efrodokem_1344_aes_length_ciphertext 21632 | | ------------------ ------------------ 141| 8| memcpy(Fin_k, k, CRYPTO_BYTES); ------------------ | | 6| 8|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_aes_length_shared_secret | | ------------------ | | | | 162| 8|#define OQS_KEM_efrodokem_1344_aes_length_shared_secret 32 | | ------------------ ------------------ 142| 8| shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 29| 8|#define shake OQS_SHA3_shake256 ------------------ shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 6| 8|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_aes_length_shared_secret | | ------------------ | | | | 162| 8|#define OQS_KEM_efrodokem_1344_aes_length_shared_secret 32 | | ------------------ ------------------ shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 5| 8|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_efrodokem_1344_aes_length_ciphertext | | ------------------ | | | | 161| 8|#define OQS_KEM_efrodokem_1344_aes_length_ciphertext 21632 | | ------------------ ------------------ shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 6| 8|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_aes_length_shared_secret | | ------------------ | | | | 162| 8|#define OQS_KEM_efrodokem_1344_aes_length_shared_secret 32 | | ------------------ ------------------ 143| | 144| | // Cleanup: 145| 8| clear_bytes((uint8_t *)V, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 27| 8|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)V, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ clear_bytes((uint8_t *)V, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ 146| 8| clear_bytes((uint8_t *)Sp, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 27| 8|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)Sp, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 8|#define PARAMS_N 1344 ------------------ clear_bytes((uint8_t *)Sp, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ 147| 8| clear_bytes((uint8_t *)Ep, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 27| 8|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)Ep, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 8|#define PARAMS_N 1344 ------------------ clear_bytes((uint8_t *)Ep, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ 148| 8| clear_bytes((uint8_t *)Epp, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 27| 8|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)Epp, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ clear_bytes((uint8_t *)Epp, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ 149| 8| clear_bytes(mu, BYTES_MU); ------------------ | | 27| 8|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(mu, BYTES_MU); ------------------ | | 19| 8|#define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 15| 8|#define PARAMS_EXTRACTED_BITS 4 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 8|#define PARAMS_NBAR 8 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 8|#define PARAMS_NBAR 8 | | ------------------ ------------------ 150| 8| clear_bytes(G2out, 2*CRYPTO_BYTES); ------------------ | | 27| 8|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(G2out, 2*CRYPTO_BYTES); ------------------ | | 6| 8|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_aes_length_shared_secret | | ------------------ | | | | 162| 8|#define OQS_KEM_efrodokem_1344_aes_length_shared_secret 32 | | ------------------ ------------------ 151| 8| clear_bytes(Fin_k, CRYPTO_BYTES); ------------------ | | 27| 8|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(Fin_k, CRYPTO_BYTES); ------------------ | | 6| 8|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_aes_length_shared_secret | | ------------------ | | | | 162| 8|#define OQS_KEM_efrodokem_1344_aes_length_shared_secret 32 | | ------------------ ------------------ 152| 8| clear_bytes(shake_input_seedSE, 1 + CRYPTO_BYTES); ------------------ | | 27| 8|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(shake_input_seedSE, 1 + CRYPTO_BYTES); ------------------ | | 6| 8|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_aes_length_shared_secret | | ------------------ | | | | 162| 8|#define OQS_KEM_efrodokem_1344_aes_length_shared_secret 32 | | ------------------ ------------------ 153| 8| return OQS_SUCCESS; 154| 8|} OQS_KEM_efrodokem_1344_aes_decaps: 158| 8|{ // FrodoKEM's key decapsulation 159| | // Inputs: ciphertext ct = ct_c1||ct_c2 ( (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8 + (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8 bytes) 160| | // secret key sk = sk_s||pk_seedA||pk_b||sk_S||sk_pkh (CRYPTO_BYTES + BYTES_SEED_A + (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8 + 2*PARAMS_N*PARAMS_NBAR + BYTES_PKHASH bytes) 161| | // Output: shared key ss (CRYPTO_BYTES bytes) 162| 8| uint16_t B[PARAMS_N*PARAMS_NBAR] = {0}; 163| 8| uint16_t Bp[PARAMS_N*PARAMS_NBAR] = {0}; 164| 8| uint16_t W[PARAMS_NBAR*PARAMS_NBAR] = {0}; // contains secret data 165| 8| uint16_t C[PARAMS_NBAR*PARAMS_NBAR] = {0}; 166| 8| uint16_t CC[PARAMS_NBAR*PARAMS_NBAR] = {0}; 167| 8| ALIGN_HEADER(32) uint16_t BBp[PARAMS_N*PARAMS_NBAR] ALIGN_FOOTER(32) = {0}; 168| 8| ALIGN_HEADER(32) uint16_t Sp[(2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR] ALIGN_FOOTER(32) = {0}; // contains secret data 169| 8| uint16_t *Ep = (uint16_t *)&Sp[PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 11| 8|#define PARAMS_N 1344 ------------------ uint16_t *Ep = (uint16_t *)&Sp[PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ 170| 8| uint16_t *Epp = (uint16_t *)&Sp[2*PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 11| 8|#define PARAMS_N 1344 ------------------ uint16_t *Epp = (uint16_t *)&Sp[2*PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ 171| 8| const uint8_t *ct_c1 = &ct[0]; 172| 8| const uint8_t *ct_c2 = &ct[(PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8]; ------------------ | | 13| 8|#define PARAMS_LOGQ 16 ------------------ const uint8_t *ct_c2 = &ct[(PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8]; ------------------ | | 11| 8|#define PARAMS_N 1344 ------------------ const uint8_t *ct_c2 = &ct[(PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8]; ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ 173| 8| const uint8_t *sk_s = &sk[0]; 174| 8| const uint8_t *sk_pk = &sk[CRYPTO_BYTES]; ------------------ | | 6| 8|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_aes_length_shared_secret | | ------------------ | | | | 162| 8|#define OQS_KEM_efrodokem_1344_aes_length_shared_secret 32 | | ------------------ ------------------ 175| 8| const uint16_t *sk_S = (uint16_t *) &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES]; ------------------ | | 6| 8|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_aes_length_shared_secret | | ------------------ | | | | 162| 8|#define OQS_KEM_efrodokem_1344_aes_length_shared_secret 32 | | ------------------ ------------------ const uint16_t *sk_S = (uint16_t *) &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES]; ------------------ | | 3| 8|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_efrodokem_1344_aes_length_public_key | | ------------------ | | | | 159| 8|#define OQS_KEM_efrodokem_1344_aes_length_public_key 21520 | | ------------------ ------------------ 176| 8| uint16_t S[PARAMS_N * PARAMS_NBAR]; // contains secret data 177| 8| const uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 6| 8|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_aes_length_shared_secret | | ------------------ | | | | 162| 8|#define OQS_KEM_efrodokem_1344_aes_length_shared_secret 32 | | ------------------ ------------------ const uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 3| 8|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_efrodokem_1344_aes_length_public_key | | ------------------ | | | | 159| 8|#define OQS_KEM_efrodokem_1344_aes_length_public_key 21520 | | ------------------ ------------------ const uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 11| 8|#define PARAMS_N 1344 ------------------ const uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ 178| 8| const uint8_t *pk_seedA = &sk_pk[0]; 179| 8| const uint8_t *pk_b = &sk_pk[BYTES_SEED_A]; ------------------ | | 18| 8|#define BYTES_SEED_A 16 ------------------ 180| 8| uint8_t G2in[BYTES_PKHASH + BYTES_MU]; // contains secret data via muprime 181| 8| uint8_t *pkh = &G2in[0]; 182| 8| uint8_t *muprime = &G2in[BYTES_PKHASH]; // contains secret data ------------------ | | 20| 8|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 8|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_aes_length_shared_secret | | | | ------------------ | | | | | | 162| 8|#define OQS_KEM_efrodokem_1344_aes_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ 183| 8| uint8_t G2out[2*CRYPTO_BYTES]; // contains secret data 184| 8| uint8_t *seedSEprime = &G2out[0]; // contains secret data 185| 8| uint8_t *kprime = &G2out[CRYPTO_BYTES]; // contains secret data ------------------ | | 6| 8|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_aes_length_shared_secret | | ------------------ | | | | 162| 8|#define OQS_KEM_efrodokem_1344_aes_length_shared_secret 32 | | ------------------ ------------------ 186| 8| uint8_t Fin[CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES]; // contains secret data via Fin_k 187| 8| uint8_t *Fin_ct = &Fin[0]; 188| 8| uint8_t *Fin_k = &Fin[CRYPTO_CIPHERTEXTBYTES]; // contains secret data ------------------ | | 5| 8|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_efrodokem_1344_aes_length_ciphertext | | ------------------ | | | | 161| 8|#define OQS_KEM_efrodokem_1344_aes_length_ciphertext 21632 | | ------------------ ------------------ 189| 8| uint8_t shake_input_seedSEprime[1 + CRYPTO_BYTES]; // contains secret data 190| | 191| 86.0k| for (size_t i = 0; i < PARAMS_N * PARAMS_NBAR; i++) { ------------------ | | 11| 86.0k|#define PARAMS_N 1344 ------------------ for (size_t i = 0; i < PARAMS_N * PARAMS_NBAR; i++) { ------------------ | | 12| 86.0k|#define PARAMS_NBAR 8 ------------------ | Branch (191:24): [True: 86.0k, False: 8] ------------------ 192| 86.0k| S[i] = LE_TO_UINT16(sk_S[i]); ------------------ | | 34| 86.0k| #define LE_TO_UINT16(n) (n) ------------------ 193| 86.0k| } 194| | 195| | // Compute W = C - Bp*S (mod q), and decode the randomness mu 196| 8| frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 40| 8|#define frodo_unpack oqs_kem_efrodokem_1344_aes_unpack ------------------ frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 11| 8|#define PARAMS_N 1344 ------------------ frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 13| 8|#define PARAMS_LOGQ 16 ------------------ frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 11| 8|#define PARAMS_N 1344 ------------------ frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 13| 8|#define PARAMS_LOGQ 16 ------------------ 197| 8| frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 40| 8|#define frodo_unpack oqs_kem_efrodokem_1344_aes_unpack ------------------ frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 13| 8|#define PARAMS_LOGQ 16 ------------------ frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 13| 8|#define PARAMS_LOGQ 16 ------------------ 198| 8| frodo_mul_bs(W, Bp, S); ------------------ | | 51| 8|#define frodo_mul_bs oqs_kem_efrodokem_1344_aes_mul_bs ------------------ 199| 8| frodo_sub(W, C, W); ------------------ | | 54| 8|#define frodo_sub oqs_kem_efrodokem_1344_aes_sub ------------------ 200| 8| frodo_key_decode((uint16_t*)muprime, W); ------------------ | | 56| 8|#define frodo_key_decode oqs_kem_efrodokem_1344_aes_key_decode ------------------ 201| | 202| | // Generate (seedSE' || k') = G_2(pkh || mu') 203| 8| memcpy(pkh, sk_pkh, BYTES_PKHASH); ------------------ | | 20| 8|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 8|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_aes_length_shared_secret | | | | ------------------ | | | | | | 162| 8|#define OQS_KEM_efrodokem_1344_aes_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ 204| 8| shake(G2out, CRYPTO_BYTES + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU); ------------------ | | 29| 8|#define shake OQS_SHA3_shake256 ------------------ shake(G2out, CRYPTO_BYTES + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU); ------------------ | | 6| 8|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_aes_length_shared_secret | | ------------------ | | | | 162| 8|#define OQS_KEM_efrodokem_1344_aes_length_shared_secret 32 | | ------------------ ------------------ shake(G2out, CRYPTO_BYTES + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU); ------------------ | | 6| 8|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_aes_length_shared_secret | | ------------------ | | | | 162| 8|#define OQS_KEM_efrodokem_1344_aes_length_shared_secret 32 | | ------------------ ------------------ shake(G2out, CRYPTO_BYTES + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU); ------------------ | | 20| 8|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 8|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_aes_length_shared_secret | | | | ------------------ | | | | | | 162| 8|#define OQS_KEM_efrodokem_1344_aes_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ shake(G2out, CRYPTO_BYTES + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU); ------------------ | | 19| 8|#define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 15| 8|#define PARAMS_EXTRACTED_BITS 4 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 8|#define PARAMS_NBAR 8 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 8|#define PARAMS_NBAR 8 | | ------------------ ------------------ 205| | 206| | // Generate Sp and Ep, and compute BBp = Sp*A + Ep. Generate A on-the-fly 207| 8| shake_input_seedSEprime[0] = 0x96; 208| 8| memcpy(&shake_input_seedSEprime[1], seedSEprime, CRYPTO_BYTES); ------------------ | | 6| 8|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_aes_length_shared_secret | | ------------------ | | | | 162| 8|#define OQS_KEM_efrodokem_1344_aes_length_shared_secret 32 | | ------------------ ------------------ 209| 8| shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSEprime, 1 + CRYPTO_BYTES); ------------------ | | 29| 8|#define shake OQS_SHA3_shake256 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSEprime, 1 + CRYPTO_BYTES); ------------------ | | 11| 8|#define PARAMS_N 1344 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSEprime, 1 + CRYPTO_BYTES); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSEprime, 1 + CRYPTO_BYTES); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSEprime, 1 + CRYPTO_BYTES); ------------------ | | 6| 8|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_aes_length_shared_secret | | ------------------ | | | | 162| 8|#define OQS_KEM_efrodokem_1344_aes_length_shared_secret 32 | | ------------------ ------------------ 210| 172k| for (size_t i = 0; i < (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR; i++) { ------------------ | | 11| 172k|#define PARAMS_N 1344 ------------------ for (size_t i = 0; i < (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR; i++) { ------------------ | | 12| 172k|#define PARAMS_NBAR 8 ------------------ for (size_t i = 0; i < (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR; i++) { ------------------ | | 12| 172k|#define PARAMS_NBAR 8 ------------------ | Branch (210:24): [True: 172k, False: 8] ------------------ 211| 172k| Sp[i] = LE_TO_UINT16(Sp[i]); ------------------ | | 34| 172k| #define LE_TO_UINT16(n) (n) ------------------ 212| 172k| } 213| 8| frodo_sample_n(Sp, PARAMS_N*PARAMS_NBAR); ------------------ | | 38| 8|#define frodo_sample_n oqs_kem_efrodokem_1344_aes_sample_n ------------------ frodo_sample_n(Sp, PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 8|#define PARAMS_N 1344 ------------------ frodo_sample_n(Sp, PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ 214| 8| frodo_sample_n(Ep, PARAMS_N*PARAMS_NBAR); ------------------ | | 38| 8|#define frodo_sample_n oqs_kem_efrodokem_1344_aes_sample_n ------------------ frodo_sample_n(Ep, PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 8|#define PARAMS_N 1344 ------------------ frodo_sample_n(Ep, PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ 215| 8| frodo_mul_add_sa_plus_e(BBp, Sp, Ep, pk_seedA); ------------------ | | 47| 8|#define frodo_mul_add_sa_plus_e oqs_kem_efrodokem_1344_aes_mul_add_sa_plus_e ------------------ 216| | 217| | // Generate Epp, and compute W = Sp*B + Epp 218| 8| frodo_sample_n(Epp, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 38| 8|#define frodo_sample_n oqs_kem_efrodokem_1344_aes_sample_n ------------------ frodo_sample_n(Epp, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ frodo_sample_n(Epp, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ 219| 8| frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 40| 8|#define frodo_unpack oqs_kem_efrodokem_1344_aes_unpack ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 11| 8|#define PARAMS_N 1344 ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 3| 8|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_efrodokem_1344_aes_length_public_key | | ------------------ | | | | 159| 8|#define OQS_KEM_efrodokem_1344_aes_length_public_key 21520 | | ------------------ ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 18| 8|#define BYTES_SEED_A 16 ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 13| 8|#define PARAMS_LOGQ 16 ------------------ 220| 8| frodo_mul_add_sb_plus_e(W, B, Sp, Epp); ------------------ | | 50| 8|#define frodo_mul_add_sb_plus_e oqs_kem_efrodokem_1344_aes_mul_add_sb_plus_e ------------------ 221| | 222| | // Encode mu, and compute CC = W + enc(mu') (mod q) 223| 8| frodo_key_encode(CC, (uint16_t*)muprime); ------------------ | | 55| 8|#define frodo_key_encode oqs_kem_efrodokem_1344_aes_key_encode ------------------ 224| 8| frodo_add(CC, W, CC); ------------------ | | 53| 8|#define frodo_add oqs_kem_efrodokem_1344_aes_add ------------------ 225| | 226| | // Prepare input to F 227| 8| memcpy(Fin_ct, ct, CRYPTO_CIPHERTEXTBYTES); ------------------ | | 5| 8|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_efrodokem_1344_aes_length_ciphertext | | ------------------ | | | | 161| 8|#define OQS_KEM_efrodokem_1344_aes_length_ciphertext 21632 | | ------------------ ------------------ 228| | 229| | // Reducing BBp modulo q 230| 86.0k| for (int i = 0; i < PARAMS_N*PARAMS_NBAR; i++) BBp[i] = BBp[i] & ((1 << PARAMS_LOGQ)-1); ------------------ | | 11| 86.0k|#define PARAMS_N 1344 ------------------ for (int i = 0; i < PARAMS_N*PARAMS_NBAR; i++) BBp[i] = BBp[i] & ((1 << PARAMS_LOGQ)-1); ------------------ | | 12| 86.0k|#define PARAMS_NBAR 8 ------------------ for (int i = 0; i < PARAMS_N*PARAMS_NBAR; i++) BBp[i] = BBp[i] & ((1 << PARAMS_LOGQ)-1); ------------------ | | 13| 86.0k|#define PARAMS_LOGQ 16 ------------------ | Branch (230:21): [True: 86.0k, False: 8] ------------------ 231| | 232| | // Needs to avoid branching on secret data using constant-time implementation. 233| 8| int8_t selector = ct_verify(Bp, BBp, PARAMS_N*PARAMS_NBAR) | ct_verify(C, CC, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 42| 8|#define ct_verify oqs_kem_efrodokem_1344_aes_ct_verify ------------------ int8_t selector = ct_verify(Bp, BBp, PARAMS_N*PARAMS_NBAR) | ct_verify(C, CC, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 11| 8|#define PARAMS_N 1344 ------------------ int8_t selector = ct_verify(Bp, BBp, PARAMS_N*PARAMS_NBAR) | ct_verify(C, CC, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ int8_t selector = ct_verify(Bp, BBp, PARAMS_N*PARAMS_NBAR) | ct_verify(C, CC, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 42| 8|#define ct_verify oqs_kem_efrodokem_1344_aes_ct_verify ------------------ int8_t selector = ct_verify(Bp, BBp, PARAMS_N*PARAMS_NBAR) | ct_verify(C, CC, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ int8_t selector = ct_verify(Bp, BBp, PARAMS_N*PARAMS_NBAR) | ct_verify(C, CC, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ 234| | // If (selector == 0) then load k' to do ss = F(ct || k'), else if (selector == -1) load s to do ss = F(ct || s) 235| 8| ct_select((uint8_t*)Fin_k, (uint8_t*)kprime, (uint8_t*)sk_s, CRYPTO_BYTES, selector); ------------------ | | 41| 8|#define ct_select oqs_kem_efrodokem_1344_aes_ct_select ------------------ ct_select((uint8_t*)Fin_k, (uint8_t*)kprime, (uint8_t*)sk_s, CRYPTO_BYTES, selector); ------------------ | | 6| 8|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_aes_length_shared_secret | | ------------------ | | | | 162| 8|#define OQS_KEM_efrodokem_1344_aes_length_shared_secret 32 | | ------------------ ------------------ 236| 8| shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 29| 8|#define shake OQS_SHA3_shake256 ------------------ shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 6| 8|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_aes_length_shared_secret | | ------------------ | | | | 162| 8|#define OQS_KEM_efrodokem_1344_aes_length_shared_secret 32 | | ------------------ ------------------ shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 5| 8|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_efrodokem_1344_aes_length_ciphertext | | ------------------ | | | | 161| 8|#define OQS_KEM_efrodokem_1344_aes_length_ciphertext 21632 | | ------------------ ------------------ shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 6| 8|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_aes_length_shared_secret | | ------------------ | | | | 162| 8|#define OQS_KEM_efrodokem_1344_aes_length_shared_secret 32 | | ------------------ ------------------ 237| | 238| | // Cleanup: 239| 8| clear_bytes((uint8_t *)W, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 27| 8|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)W, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ clear_bytes((uint8_t *)W, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ 240| 8| clear_bytes((uint8_t *)Sp, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 27| 8|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)Sp, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 8|#define PARAMS_N 1344 ------------------ clear_bytes((uint8_t *)Sp, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ 241| 8| clear_bytes((uint8_t *)S, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 27| 8|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)S, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 8|#define PARAMS_N 1344 ------------------ clear_bytes((uint8_t *)S, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ 242| 8| clear_bytes((uint8_t *)Ep, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 27| 8|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)Ep, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 8|#define PARAMS_N 1344 ------------------ clear_bytes((uint8_t *)Ep, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ 243| 8| clear_bytes((uint8_t *)Epp, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 27| 8|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)Epp, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ clear_bytes((uint8_t *)Epp, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ 244| 8| clear_bytes(muprime, BYTES_MU); ------------------ | | 27| 8|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(muprime, BYTES_MU); ------------------ | | 19| 8|#define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 15| 8|#define PARAMS_EXTRACTED_BITS 4 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 8|#define PARAMS_NBAR 8 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 8|#define PARAMS_NBAR 8 | | ------------------ ------------------ 245| 8| clear_bytes(G2out, 2*CRYPTO_BYTES); ------------------ | | 27| 8|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(G2out, 2*CRYPTO_BYTES); ------------------ | | 6| 8|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_aes_length_shared_secret | | ------------------ | | | | 162| 8|#define OQS_KEM_efrodokem_1344_aes_length_shared_secret 32 | | ------------------ ------------------ 246| 8| clear_bytes(Fin_k, CRYPTO_BYTES); ------------------ | | 27| 8|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(Fin_k, CRYPTO_BYTES); ------------------ | | 6| 8|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_aes_length_shared_secret | | ------------------ | | | | 162| 8|#define OQS_KEM_efrodokem_1344_aes_length_shared_secret 32 | | ------------------ ------------------ 247| 8| clear_bytes(shake_input_seedSEprime, 1 + CRYPTO_BYTES); ------------------ | | 27| 8|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(shake_input_seedSEprime, 1 + CRYPTO_BYTES); ------------------ | | 6| 8|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_aes_length_shared_secret | | ------------------ | | | | 162| 8|#define OQS_KEM_efrodokem_1344_aes_length_shared_secret 32 | | ------------------ ------------------ 248| 8| return OQS_SUCCESS; 249| 8|} OQS_KEM_efrodokem_1344_shake_keypair: 19| 5|{ // FrodoKEM's key generation 20| | // Outputs: public key pk = pk_seedA||pk_b ( BYTES_SEED_A + (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8 bytes) 21| | // secret key sk = sk_s||pk_seedA||pk_b||sk_S||sk_pkh (CRYPTO_BYTES + BYTES_SEED_A + (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8 + 2*PARAMS_N*PARAMS_NBAR + BYTES_PKHASH bytes) 22| 5| uint8_t *pk_seedA = &pk[0]; 23| 5| uint8_t *pk_b = &pk[BYTES_SEED_A]; ------------------ | | 18| 5|#define BYTES_SEED_A 16 ------------------ 24| 5| uint8_t *sk_s = &sk[0]; 25| 5| uint8_t *sk_pk = &sk[CRYPTO_BYTES]; ------------------ | | 6| 5|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_shake_length_shared_secret | | ------------------ | | | | 177| 5|#define OQS_KEM_efrodokem_1344_shake_length_shared_secret 32 | | ------------------ ------------------ 26| 5| uint8_t *sk_S = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES]; ------------------ | | 6| 5|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_shake_length_shared_secret | | ------------------ | | | | 177| 5|#define OQS_KEM_efrodokem_1344_shake_length_shared_secret 32 | | ------------------ ------------------ uint8_t *sk_S = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES]; ------------------ | | 3| 5|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_efrodokem_1344_shake_length_public_key | | ------------------ | | | | 174| 5|#define OQS_KEM_efrodokem_1344_shake_length_public_key 21520 | | ------------------ ------------------ 27| 5| uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 6| 5|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_shake_length_shared_secret | | ------------------ | | | | 177| 5|#define OQS_KEM_efrodokem_1344_shake_length_shared_secret 32 | | ------------------ ------------------ uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 3| 5|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_efrodokem_1344_shake_length_public_key | | ------------------ | | | | 174| 5|#define OQS_KEM_efrodokem_1344_shake_length_public_key 21520 | | ------------------ ------------------ uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 11| 5|#define PARAMS_N 1344 ------------------ uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 12| 5|#define PARAMS_NBAR 8 ------------------ 28| 5| uint16_t B[PARAMS_N*PARAMS_NBAR] = {0}; 29| 5| uint16_t S[2*PARAMS_N*PARAMS_NBAR] = {0}; // contains secret data 30| 5| uint16_t *E = (uint16_t *)&S[PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 11| 5|#define PARAMS_N 1344 ------------------ uint16_t *E = (uint16_t *)&S[PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 12| 5|#define PARAMS_NBAR 8 ------------------ 31| 5| uint8_t randomness[2*CRYPTO_BYTES + BYTES_SEED_A]; // contains secret data via randomness_s and randomness_seedSE 32| 5| uint8_t *randomness_s = &randomness[0]; // contains secret data 33| 5| uint8_t *randomness_seedSE = &randomness[CRYPTO_BYTES]; // contains secret data ------------------ | | 6| 5|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_shake_length_shared_secret | | ------------------ | | | | 177| 5|#define OQS_KEM_efrodokem_1344_shake_length_shared_secret 32 | | ------------------ ------------------ 34| 5| uint8_t *randomness_z = &randomness[2*CRYPTO_BYTES]; ------------------ | | 6| 5|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_shake_length_shared_secret | | ------------------ | | | | 177| 5|#define OQS_KEM_efrodokem_1344_shake_length_shared_secret 32 | | ------------------ ------------------ 35| 5| uint8_t shake_input_seedSE[1 + CRYPTO_BYTES]; // contains secret data 36| | 37| | // Generate the secret value s, the seed for S and E, and the seed for the seed for A. Add seed_A to the public key 38| 5| randombytes(randomness, CRYPTO_BYTES + CRYPTO_BYTES + BYTES_SEED_A); ------------------ | | 26| 5|#define randombytes OQS_randombytes ------------------ randombytes(randomness, CRYPTO_BYTES + CRYPTO_BYTES + BYTES_SEED_A); ------------------ | | 6| 5|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_shake_length_shared_secret | | ------------------ | | | | 177| 5|#define OQS_KEM_efrodokem_1344_shake_length_shared_secret 32 | | ------------------ ------------------ randombytes(randomness, CRYPTO_BYTES + CRYPTO_BYTES + BYTES_SEED_A); ------------------ | | 6| 5|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_shake_length_shared_secret | | ------------------ | | | | 177| 5|#define OQS_KEM_efrodokem_1344_shake_length_shared_secret 32 | | ------------------ ------------------ randombytes(randomness, CRYPTO_BYTES + CRYPTO_BYTES + BYTES_SEED_A); ------------------ | | 18| 5|#define BYTES_SEED_A 16 ------------------ 39| 5| shake(pk_seedA, BYTES_SEED_A, randomness_z, BYTES_SEED_A); ------------------ | | 29| 5|#define shake OQS_SHA3_shake256 ------------------ shake(pk_seedA, BYTES_SEED_A, randomness_z, BYTES_SEED_A); ------------------ | | 18| 5|#define BYTES_SEED_A 16 ------------------ shake(pk_seedA, BYTES_SEED_A, randomness_z, BYTES_SEED_A); ------------------ | | 18| 5|#define BYTES_SEED_A 16 ------------------ 40| | 41| | // Generate S and E, and compute B = A*S + E. Generate A on-the-fly 42| 5| shake_input_seedSE[0] = 0x5F; 43| 5| memcpy(&shake_input_seedSE[1], randomness_seedSE, CRYPTO_BYTES); ------------------ | | 6| 5|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_shake_length_shared_secret | | ------------------ | | | | 177| 5|#define OQS_KEM_efrodokem_1344_shake_length_shared_secret 32 | | ------------------ ------------------ 44| 5| shake((uint8_t*)S, 2*PARAMS_N*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + CRYPTO_BYTES); ------------------ | | 29| 5|#define shake OQS_SHA3_shake256 ------------------ shake((uint8_t*)S, 2*PARAMS_N*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + CRYPTO_BYTES); ------------------ | | 11| 5|#define PARAMS_N 1344 ------------------ shake((uint8_t*)S, 2*PARAMS_N*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + CRYPTO_BYTES); ------------------ | | 12| 5|#define PARAMS_NBAR 8 ------------------ shake((uint8_t*)S, 2*PARAMS_N*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + CRYPTO_BYTES); ------------------ | | 6| 5|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_shake_length_shared_secret | | ------------------ | | | | 177| 5|#define OQS_KEM_efrodokem_1344_shake_length_shared_secret 32 | | ------------------ ------------------ 45| 107k| for (size_t i = 0; i < 2 * PARAMS_N * PARAMS_NBAR; i++) { ------------------ | | 11| 107k|#define PARAMS_N 1344 ------------------ for (size_t i = 0; i < 2 * PARAMS_N * PARAMS_NBAR; i++) { ------------------ | | 12| 107k|#define PARAMS_NBAR 8 ------------------ | Branch (45:24): [True: 107k, False: 5] ------------------ 46| 107k| S[i] = LE_TO_UINT16(S[i]); ------------------ | | 34| 107k| #define LE_TO_UINT16(n) (n) ------------------ 47| 107k| } 48| 5| frodo_sample_n(S, PARAMS_N*PARAMS_NBAR); ------------------ | | 38| 5|#define frodo_sample_n oqs_kem_efrodokem_1344_shake_sample_n ------------------ frodo_sample_n(S, PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 5|#define PARAMS_N 1344 ------------------ frodo_sample_n(S, PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 5|#define PARAMS_NBAR 8 ------------------ 49| 5| frodo_sample_n(E, PARAMS_N*PARAMS_NBAR); ------------------ | | 38| 5|#define frodo_sample_n oqs_kem_efrodokem_1344_shake_sample_n ------------------ frodo_sample_n(E, PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 5|#define PARAMS_N 1344 ------------------ frodo_sample_n(E, PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 5|#define PARAMS_NBAR 8 ------------------ 50| 5| frodo_mul_add_as_plus_e(B, S, E, pk); ------------------ | | 44| 5|#define frodo_mul_add_as_plus_e oqs_kem_efrodokem_1344_shake_mul_add_as_plus_e ------------------ 51| | 52| | // Encode the second part of the public key 53| 5| frodo_pack(pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, B, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 39| 5|#define frodo_pack oqs_kem_efrodokem_1344_shake_pack ------------------ frodo_pack(pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, B, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 3| 5|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_efrodokem_1344_shake_length_public_key | | ------------------ | | | | 174| 5|#define OQS_KEM_efrodokem_1344_shake_length_public_key 21520 | | ------------------ ------------------ frodo_pack(pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, B, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 18| 5|#define BYTES_SEED_A 16 ------------------ frodo_pack(pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, B, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 11| 5|#define PARAMS_N 1344 ------------------ frodo_pack(pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, B, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 5|#define PARAMS_NBAR 8 ------------------ frodo_pack(pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, B, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 13| 5|#define PARAMS_LOGQ 16 ------------------ 54| | 55| | // Add s, pk and S to the secret key 56| 5| memcpy(sk_s, randomness_s, CRYPTO_BYTES); ------------------ | | 6| 5|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_shake_length_shared_secret | | ------------------ | | | | 177| 5|#define OQS_KEM_efrodokem_1344_shake_length_shared_secret 32 | | ------------------ ------------------ 57| 5| memcpy(sk_pk, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 3| 5|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_efrodokem_1344_shake_length_public_key | | ------------------ | | | | 174| 5|#define OQS_KEM_efrodokem_1344_shake_length_public_key 21520 | | ------------------ ------------------ 58| 53.7k| for (size_t i = 0; i < PARAMS_N * PARAMS_NBAR; i++) { ------------------ | | 11| 53.7k|#define PARAMS_N 1344 ------------------ for (size_t i = 0; i < PARAMS_N * PARAMS_NBAR; i++) { ------------------ | | 12| 53.7k|#define PARAMS_NBAR 8 ------------------ | Branch (58:24): [True: 53.7k, False: 5] ------------------ 59| 53.7k| S[i] = UINT16_TO_LE(S[i]); ------------------ | | 35| 53.7k| #define UINT16_TO_LE(n) (n) ------------------ 60| 53.7k| } 61| 5| memcpy(sk_S, S, 2*PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 5|#define PARAMS_N 1344 ------------------ memcpy(sk_S, S, 2*PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 5|#define PARAMS_NBAR 8 ------------------ 62| | 63| | // Add H(pk) to the secret key 64| 5| shake(sk_pkh, BYTES_PKHASH, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 29| 5|#define shake OQS_SHA3_shake256 ------------------ shake(sk_pkh, BYTES_PKHASH, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 20| 5|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 5|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_shake_length_shared_secret | | | | ------------------ | | | | | | 177| 5|#define OQS_KEM_efrodokem_1344_shake_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ shake(sk_pkh, BYTES_PKHASH, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 3| 5|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_efrodokem_1344_shake_length_public_key | | ------------------ | | | | 174| 5|#define OQS_KEM_efrodokem_1344_shake_length_public_key 21520 | | ------------------ ------------------ 65| | 66| | // Cleanup: 67| 5| clear_bytes((uint8_t *)S, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 27| 5|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)S, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 5|#define PARAMS_N 1344 ------------------ clear_bytes((uint8_t *)S, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 5|#define PARAMS_NBAR 8 ------------------ 68| 5| clear_bytes((uint8_t *)E, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 27| 5|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)E, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 5|#define PARAMS_N 1344 ------------------ clear_bytes((uint8_t *)E, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 5|#define PARAMS_NBAR 8 ------------------ 69| 5| clear_bytes(randomness, 2*CRYPTO_BYTES); ------------------ | | 27| 5|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(randomness, 2*CRYPTO_BYTES); ------------------ | | 6| 5|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_shake_length_shared_secret | | ------------------ | | | | 177| 5|#define OQS_KEM_efrodokem_1344_shake_length_shared_secret 32 | | ------------------ ------------------ 70| 5| clear_bytes(shake_input_seedSE, 1 + CRYPTO_BYTES); ------------------ | | 27| 5|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(shake_input_seedSE, 1 + CRYPTO_BYTES); ------------------ | | 6| 5|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_shake_length_shared_secret | | ------------------ | | | | 177| 5|#define OQS_KEM_efrodokem_1344_shake_length_shared_secret 32 | | ------------------ ------------------ 71| 5| return OQS_SUCCESS; 72| 5|} OQS_KEM_efrodokem_1344_shake_encaps: 86| 5|{ // FrodoKEM's key encapsulation 87| | // Input: public key pk = pk_seedA||pk_b (BYTES_SEED_A + (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8 bytes) 88| | // Outputs: ciphertext ct = ct_c1||ct_c2 ( (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8 + (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8 bytes) 89| | // shared key ss (CRYPTO_BYTES bytes) 90| 5| const uint8_t *pk_seedA = &pk[0]; 91| 5| const uint8_t *pk_b = &pk[BYTES_SEED_A]; ------------------ | | 18| 5|#define BYTES_SEED_A 16 ------------------ 92| 5| uint8_t *ct_c1 = &ct[0]; 93| 5| uint8_t *ct_c2 = &ct[(PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8]; ------------------ | | 13| 5|#define PARAMS_LOGQ 16 ------------------ uint8_t *ct_c2 = &ct[(PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8]; ------------------ | | 11| 5|#define PARAMS_N 1344 ------------------ uint8_t *ct_c2 = &ct[(PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8]; ------------------ | | 12| 5|#define PARAMS_NBAR 8 ------------------ 94| 5| uint16_t B[PARAMS_N*PARAMS_NBAR] = {0}; 95| 5| uint16_t V[PARAMS_NBAR*PARAMS_NBAR]= {0}; // contains secret data 96| 5| uint16_t C[PARAMS_NBAR*PARAMS_NBAR] = {0}; 97| 5| ALIGN_HEADER(32) uint16_t Bp[PARAMS_N*PARAMS_NBAR] ALIGN_FOOTER(32) = {0}; 98| 5| ALIGN_HEADER(32) uint16_t Sp[(2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR] ALIGN_FOOTER(32) = {0}; // contains secret data 99| 5| uint16_t *Ep = (uint16_t *)&Sp[PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 11| 5|#define PARAMS_N 1344 ------------------ uint16_t *Ep = (uint16_t *)&Sp[PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 12| 5|#define PARAMS_NBAR 8 ------------------ 100| 5| uint16_t *Epp = (uint16_t *)&Sp[2*PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 11| 5|#define PARAMS_N 1344 ------------------ uint16_t *Epp = (uint16_t *)&Sp[2*PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 12| 5|#define PARAMS_NBAR 8 ------------------ 101| 5| uint8_t G2in[BYTES_PKHASH + BYTES_MU]; // contains secret data via mu 102| 5| uint8_t *pkh = &G2in[0]; 103| 5| uint8_t *mu = &G2in[BYTES_PKHASH]; // contains secret data ------------------ | | 20| 5|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 5|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_shake_length_shared_secret | | | | ------------------ | | | | | | 177| 5|#define OQS_KEM_efrodokem_1344_shake_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ 104| 5| uint8_t G2out[2*CRYPTO_BYTES]; // contains secret data 105| 5| uint8_t *seedSE = &G2out[0]; // contains secret data 106| 5| uint8_t *k = &G2out[CRYPTO_BYTES]; // contains secret data ------------------ | | 6| 5|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_shake_length_shared_secret | | ------------------ | | | | 177| 5|#define OQS_KEM_efrodokem_1344_shake_length_shared_secret 32 | | ------------------ ------------------ 107| 5| uint8_t Fin[CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES]; // contains secret data via Fin_k 108| 5| uint8_t *Fin_ct = &Fin[0]; 109| 5| uint8_t *Fin_k = &Fin[CRYPTO_CIPHERTEXTBYTES]; // contains secret data ------------------ | | 5| 5|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_efrodokem_1344_shake_length_ciphertext | | ------------------ | | | | 176| 5|#define OQS_KEM_efrodokem_1344_shake_length_ciphertext 21632 | | ------------------ ------------------ 110| 5| uint8_t shake_input_seedSE[1 + CRYPTO_BYTES]; // contains secret data 111| | 112| | // pkh <- G_1(pk), generate random mu, compute (seedSE || k) = G_2(pkh || mu) 113| 5| shake(pkh, BYTES_PKHASH, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 29| 5|#define shake OQS_SHA3_shake256 ------------------ shake(pkh, BYTES_PKHASH, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 20| 5|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 5|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_shake_length_shared_secret | | | | ------------------ | | | | | | 177| 5|#define OQS_KEM_efrodokem_1344_shake_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ shake(pkh, BYTES_PKHASH, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 3| 5|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_efrodokem_1344_shake_length_public_key | | ------------------ | | | | 174| 5|#define OQS_KEM_efrodokem_1344_shake_length_public_key 21520 | | ------------------ ------------------ 114| 5| randombytes(mu, BYTES_MU); ------------------ | | 26| 5|#define randombytes OQS_randombytes ------------------ randombytes(mu, BYTES_MU); ------------------ | | 19| 5|#define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 15| 5|#define PARAMS_EXTRACTED_BITS 4 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 5|#define PARAMS_NBAR 8 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 5|#define PARAMS_NBAR 8 | | ------------------ ------------------ 115| 5| shake(G2out, CRYPTO_BYTES + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU); ------------------ | | 29| 5|#define shake OQS_SHA3_shake256 ------------------ shake(G2out, CRYPTO_BYTES + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU); ------------------ | | 6| 5|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_shake_length_shared_secret | | ------------------ | | | | 177| 5|#define OQS_KEM_efrodokem_1344_shake_length_shared_secret 32 | | ------------------ ------------------ shake(G2out, CRYPTO_BYTES + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU); ------------------ | | 6| 5|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_shake_length_shared_secret | | ------------------ | | | | 177| 5|#define OQS_KEM_efrodokem_1344_shake_length_shared_secret 32 | | ------------------ ------------------ shake(G2out, CRYPTO_BYTES + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU); ------------------ | | 20| 5|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 5|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_shake_length_shared_secret | | | | ------------------ | | | | | | 177| 5|#define OQS_KEM_efrodokem_1344_shake_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ shake(G2out, CRYPTO_BYTES + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU); ------------------ | | 19| 5|#define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 15| 5|#define PARAMS_EXTRACTED_BITS 4 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 5|#define PARAMS_NBAR 8 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 5|#define PARAMS_NBAR 8 | | ------------------ ------------------ 116| | 117| | // Generate Sp and Ep, and compute Bp = Sp*A + Ep. Generate A on-the-fly 118| 5| shake_input_seedSE[0] = 0x96; 119| 5| memcpy(&shake_input_seedSE[1], seedSE, CRYPTO_BYTES); ------------------ | | 6| 5|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_shake_length_shared_secret | | ------------------ | | | | 177| 5|#define OQS_KEM_efrodokem_1344_shake_length_shared_secret 32 | | ------------------ ------------------ 120| 5| shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + CRYPTO_BYTES); ------------------ | | 29| 5|#define shake OQS_SHA3_shake256 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + CRYPTO_BYTES); ------------------ | | 11| 5|#define PARAMS_N 1344 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + CRYPTO_BYTES); ------------------ | | 12| 5|#define PARAMS_NBAR 8 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + CRYPTO_BYTES); ------------------ | | 12| 5|#define PARAMS_NBAR 8 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + CRYPTO_BYTES); ------------------ | | 6| 5|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_shake_length_shared_secret | | ------------------ | | | | 177| 5|#define OQS_KEM_efrodokem_1344_shake_length_shared_secret 32 | | ------------------ ------------------ 121| 107k| for (size_t i = 0; i < (2 * PARAMS_N + PARAMS_NBAR) * PARAMS_NBAR; i++) { ------------------ | | 11| 107k|#define PARAMS_N 1344 ------------------ for (size_t i = 0; i < (2 * PARAMS_N + PARAMS_NBAR) * PARAMS_NBAR; i++) { ------------------ | | 12| 107k|#define PARAMS_NBAR 8 ------------------ for (size_t i = 0; i < (2 * PARAMS_N + PARAMS_NBAR) * PARAMS_NBAR; i++) { ------------------ | | 12| 107k|#define PARAMS_NBAR 8 ------------------ | Branch (121:24): [True: 107k, False: 5] ------------------ 122| 107k| Sp[i] = LE_TO_UINT16(Sp[i]); ------------------ | | 34| 107k| #define LE_TO_UINT16(n) (n) ------------------ 123| 107k| } 124| 5| frodo_sample_n(Sp, PARAMS_N*PARAMS_NBAR); ------------------ | | 38| 5|#define frodo_sample_n oqs_kem_efrodokem_1344_shake_sample_n ------------------ frodo_sample_n(Sp, PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 5|#define PARAMS_N 1344 ------------------ frodo_sample_n(Sp, PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 5|#define PARAMS_NBAR 8 ------------------ 125| 5| frodo_sample_n(Ep, PARAMS_N*PARAMS_NBAR); ------------------ | | 38| 5|#define frodo_sample_n oqs_kem_efrodokem_1344_shake_sample_n ------------------ frodo_sample_n(Ep, PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 5|#define PARAMS_N 1344 ------------------ frodo_sample_n(Ep, PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 5|#define PARAMS_NBAR 8 ------------------ 126| 5| frodo_mul_add_sa_plus_e(Bp, Sp, Ep, pk_seedA); ------------------ | | 47| 5|#define frodo_mul_add_sa_plus_e oqs_kem_efrodokem_1344_shake_mul_add_sa_plus_e ------------------ 127| 5| frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 39| 5|#define frodo_pack oqs_kem_efrodokem_1344_shake_pack ------------------ frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 13| 5|#define PARAMS_LOGQ 16 ------------------ frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 11| 5|#define PARAMS_N 1344 ------------------ frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 5|#define PARAMS_NBAR 8 ------------------ frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 11| 5|#define PARAMS_N 1344 ------------------ frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 5|#define PARAMS_NBAR 8 ------------------ frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 13| 5|#define PARAMS_LOGQ 16 ------------------ 128| | 129| | // Generate Epp, and compute V = Sp*B + Epp 130| 5| frodo_sample_n(Epp, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 38| 5|#define frodo_sample_n oqs_kem_efrodokem_1344_shake_sample_n ------------------ frodo_sample_n(Epp, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 5|#define PARAMS_NBAR 8 ------------------ frodo_sample_n(Epp, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 5|#define PARAMS_NBAR 8 ------------------ 131| 5| frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 40| 5|#define frodo_unpack oqs_kem_efrodokem_1344_shake_unpack ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 11| 5|#define PARAMS_N 1344 ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 12| 5|#define PARAMS_NBAR 8 ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 3| 5|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_efrodokem_1344_shake_length_public_key | | ------------------ | | | | 174| 5|#define OQS_KEM_efrodokem_1344_shake_length_public_key 21520 | | ------------------ ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 18| 5|#define BYTES_SEED_A 16 ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 13| 5|#define PARAMS_LOGQ 16 ------------------ 132| 5| frodo_mul_add_sb_plus_e(V, B, Sp, Epp); ------------------ | | 50| 5|#define frodo_mul_add_sb_plus_e oqs_kem_efrodokem_1344_shake_mul_add_sb_plus_e ------------------ 133| | 134| | // Encode mu, and compute C = V + enc(mu) (mod q) 135| 5| frodo_key_encode(C, (uint16_t*)mu); ------------------ | | 55| 5|#define frodo_key_encode oqs_kem_efrodokem_1344_shake_key_encode ------------------ 136| 5| frodo_add(C, V, C); ------------------ | | 53| 5|#define frodo_add oqs_kem_efrodokem_1344_shake_add ------------------ 137| 5| frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 39| 5|#define frodo_pack oqs_kem_efrodokem_1344_shake_pack ------------------ frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 13| 5|#define PARAMS_LOGQ 16 ------------------ frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 5|#define PARAMS_NBAR 8 ------------------ frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 5|#define PARAMS_NBAR 8 ------------------ frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 5|#define PARAMS_NBAR 8 ------------------ frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 5|#define PARAMS_NBAR 8 ------------------ frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 13| 5|#define PARAMS_LOGQ 16 ------------------ 138| | 139| | // Compute ss = F(ct||KK) 140| 5| memcpy(Fin_ct, ct, CRYPTO_CIPHERTEXTBYTES); ------------------ | | 5| 5|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_efrodokem_1344_shake_length_ciphertext | | ------------------ | | | | 176| 5|#define OQS_KEM_efrodokem_1344_shake_length_ciphertext 21632 | | ------------------ ------------------ 141| 5| memcpy(Fin_k, k, CRYPTO_BYTES); ------------------ | | 6| 5|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_shake_length_shared_secret | | ------------------ | | | | 177| 5|#define OQS_KEM_efrodokem_1344_shake_length_shared_secret 32 | | ------------------ ------------------ 142| 5| shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 29| 5|#define shake OQS_SHA3_shake256 ------------------ shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 6| 5|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_shake_length_shared_secret | | ------------------ | | | | 177| 5|#define OQS_KEM_efrodokem_1344_shake_length_shared_secret 32 | | ------------------ ------------------ shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 5| 5|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_efrodokem_1344_shake_length_ciphertext | | ------------------ | | | | 176| 5|#define OQS_KEM_efrodokem_1344_shake_length_ciphertext 21632 | | ------------------ ------------------ shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 6| 5|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_shake_length_shared_secret | | ------------------ | | | | 177| 5|#define OQS_KEM_efrodokem_1344_shake_length_shared_secret 32 | | ------------------ ------------------ 143| | 144| | // Cleanup: 145| 5| clear_bytes((uint8_t *)V, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 27| 5|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)V, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 5|#define PARAMS_NBAR 8 ------------------ clear_bytes((uint8_t *)V, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 5|#define PARAMS_NBAR 8 ------------------ 146| 5| clear_bytes((uint8_t *)Sp, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 27| 5|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)Sp, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 5|#define PARAMS_N 1344 ------------------ clear_bytes((uint8_t *)Sp, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 5|#define PARAMS_NBAR 8 ------------------ 147| 5| clear_bytes((uint8_t *)Ep, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 27| 5|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)Ep, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 5|#define PARAMS_N 1344 ------------------ clear_bytes((uint8_t *)Ep, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 5|#define PARAMS_NBAR 8 ------------------ 148| 5| clear_bytes((uint8_t *)Epp, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 27| 5|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)Epp, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 5|#define PARAMS_NBAR 8 ------------------ clear_bytes((uint8_t *)Epp, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 5|#define PARAMS_NBAR 8 ------------------ 149| 5| clear_bytes(mu, BYTES_MU); ------------------ | | 27| 5|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(mu, BYTES_MU); ------------------ | | 19| 5|#define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 15| 5|#define PARAMS_EXTRACTED_BITS 4 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 5|#define PARAMS_NBAR 8 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 5|#define PARAMS_NBAR 8 | | ------------------ ------------------ 150| 5| clear_bytes(G2out, 2*CRYPTO_BYTES); ------------------ | | 27| 5|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(G2out, 2*CRYPTO_BYTES); ------------------ | | 6| 5|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_shake_length_shared_secret | | ------------------ | | | | 177| 5|#define OQS_KEM_efrodokem_1344_shake_length_shared_secret 32 | | ------------------ ------------------ 151| 5| clear_bytes(Fin_k, CRYPTO_BYTES); ------------------ | | 27| 5|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(Fin_k, CRYPTO_BYTES); ------------------ | | 6| 5|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_shake_length_shared_secret | | ------------------ | | | | 177| 5|#define OQS_KEM_efrodokem_1344_shake_length_shared_secret 32 | | ------------------ ------------------ 152| 5| clear_bytes(shake_input_seedSE, 1 + CRYPTO_BYTES); ------------------ | | 27| 5|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(shake_input_seedSE, 1 + CRYPTO_BYTES); ------------------ | | 6| 5|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_shake_length_shared_secret | | ------------------ | | | | 177| 5|#define OQS_KEM_efrodokem_1344_shake_length_shared_secret 32 | | ------------------ ------------------ 153| 5| return OQS_SUCCESS; 154| 5|} OQS_KEM_efrodokem_1344_shake_decaps: 158| 5|{ // FrodoKEM's key decapsulation 159| | // Inputs: ciphertext ct = ct_c1||ct_c2 ( (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8 + (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8 bytes) 160| | // secret key sk = sk_s||pk_seedA||pk_b||sk_S||sk_pkh (CRYPTO_BYTES + BYTES_SEED_A + (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8 + 2*PARAMS_N*PARAMS_NBAR + BYTES_PKHASH bytes) 161| | // Output: shared key ss (CRYPTO_BYTES bytes) 162| 5| uint16_t B[PARAMS_N*PARAMS_NBAR] = {0}; 163| 5| uint16_t Bp[PARAMS_N*PARAMS_NBAR] = {0}; 164| 5| uint16_t W[PARAMS_NBAR*PARAMS_NBAR] = {0}; // contains secret data 165| 5| uint16_t C[PARAMS_NBAR*PARAMS_NBAR] = {0}; 166| 5| uint16_t CC[PARAMS_NBAR*PARAMS_NBAR] = {0}; 167| 5| ALIGN_HEADER(32) uint16_t BBp[PARAMS_N*PARAMS_NBAR] ALIGN_FOOTER(32) = {0}; 168| 5| ALIGN_HEADER(32) uint16_t Sp[(2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR] ALIGN_FOOTER(32) = {0}; // contains secret data 169| 5| uint16_t *Ep = (uint16_t *)&Sp[PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 11| 5|#define PARAMS_N 1344 ------------------ uint16_t *Ep = (uint16_t *)&Sp[PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 12| 5|#define PARAMS_NBAR 8 ------------------ 170| 5| uint16_t *Epp = (uint16_t *)&Sp[2*PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 11| 5|#define PARAMS_N 1344 ------------------ uint16_t *Epp = (uint16_t *)&Sp[2*PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 12| 5|#define PARAMS_NBAR 8 ------------------ 171| 5| const uint8_t *ct_c1 = &ct[0]; 172| 5| const uint8_t *ct_c2 = &ct[(PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8]; ------------------ | | 13| 5|#define PARAMS_LOGQ 16 ------------------ const uint8_t *ct_c2 = &ct[(PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8]; ------------------ | | 11| 5|#define PARAMS_N 1344 ------------------ const uint8_t *ct_c2 = &ct[(PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8]; ------------------ | | 12| 5|#define PARAMS_NBAR 8 ------------------ 173| 5| const uint8_t *sk_s = &sk[0]; 174| 5| const uint8_t *sk_pk = &sk[CRYPTO_BYTES]; ------------------ | | 6| 5|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_shake_length_shared_secret | | ------------------ | | | | 177| 5|#define OQS_KEM_efrodokem_1344_shake_length_shared_secret 32 | | ------------------ ------------------ 175| 5| const uint16_t *sk_S = (uint16_t *) &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES]; ------------------ | | 6| 5|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_shake_length_shared_secret | | ------------------ | | | | 177| 5|#define OQS_KEM_efrodokem_1344_shake_length_shared_secret 32 | | ------------------ ------------------ const uint16_t *sk_S = (uint16_t *) &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES]; ------------------ | | 3| 5|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_efrodokem_1344_shake_length_public_key | | ------------------ | | | | 174| 5|#define OQS_KEM_efrodokem_1344_shake_length_public_key 21520 | | ------------------ ------------------ 176| 5| uint16_t S[PARAMS_N * PARAMS_NBAR]; // contains secret data 177| 5| const uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 6| 5|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_shake_length_shared_secret | | ------------------ | | | | 177| 5|#define OQS_KEM_efrodokem_1344_shake_length_shared_secret 32 | | ------------------ ------------------ const uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 3| 5|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_efrodokem_1344_shake_length_public_key | | ------------------ | | | | 174| 5|#define OQS_KEM_efrodokem_1344_shake_length_public_key 21520 | | ------------------ ------------------ const uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 11| 5|#define PARAMS_N 1344 ------------------ const uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 12| 5|#define PARAMS_NBAR 8 ------------------ 178| 5| const uint8_t *pk_seedA = &sk_pk[0]; 179| 5| const uint8_t *pk_b = &sk_pk[BYTES_SEED_A]; ------------------ | | 18| 5|#define BYTES_SEED_A 16 ------------------ 180| 5| uint8_t G2in[BYTES_PKHASH + BYTES_MU]; // contains secret data via muprime 181| 5| uint8_t *pkh = &G2in[0]; 182| 5| uint8_t *muprime = &G2in[BYTES_PKHASH]; // contains secret data ------------------ | | 20| 5|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 5|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_shake_length_shared_secret | | | | ------------------ | | | | | | 177| 5|#define OQS_KEM_efrodokem_1344_shake_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ 183| 5| uint8_t G2out[2*CRYPTO_BYTES]; // contains secret data 184| 5| uint8_t *seedSEprime = &G2out[0]; // contains secret data 185| 5| uint8_t *kprime = &G2out[CRYPTO_BYTES]; // contains secret data ------------------ | | 6| 5|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_shake_length_shared_secret | | ------------------ | | | | 177| 5|#define OQS_KEM_efrodokem_1344_shake_length_shared_secret 32 | | ------------------ ------------------ 186| 5| uint8_t Fin[CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES]; // contains secret data via Fin_k 187| 5| uint8_t *Fin_ct = &Fin[0]; 188| 5| uint8_t *Fin_k = &Fin[CRYPTO_CIPHERTEXTBYTES]; // contains secret data ------------------ | | 5| 5|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_efrodokem_1344_shake_length_ciphertext | | ------------------ | | | | 176| 5|#define OQS_KEM_efrodokem_1344_shake_length_ciphertext 21632 | | ------------------ ------------------ 189| 5| uint8_t shake_input_seedSEprime[1 + CRYPTO_BYTES]; // contains secret data 190| | 191| 53.7k| for (size_t i = 0; i < PARAMS_N * PARAMS_NBAR; i++) { ------------------ | | 11| 53.7k|#define PARAMS_N 1344 ------------------ for (size_t i = 0; i < PARAMS_N * PARAMS_NBAR; i++) { ------------------ | | 12| 53.7k|#define PARAMS_NBAR 8 ------------------ | Branch (191:24): [True: 53.7k, False: 5] ------------------ 192| 53.7k| S[i] = LE_TO_UINT16(sk_S[i]); ------------------ | | 34| 53.7k| #define LE_TO_UINT16(n) (n) ------------------ 193| 53.7k| } 194| | 195| | // Compute W = C - Bp*S (mod q), and decode the randomness mu 196| 5| frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 40| 5|#define frodo_unpack oqs_kem_efrodokem_1344_shake_unpack ------------------ frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 11| 5|#define PARAMS_N 1344 ------------------ frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 12| 5|#define PARAMS_NBAR 8 ------------------ frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 13| 5|#define PARAMS_LOGQ 16 ------------------ frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 11| 5|#define PARAMS_N 1344 ------------------ frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 12| 5|#define PARAMS_NBAR 8 ------------------ frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 13| 5|#define PARAMS_LOGQ 16 ------------------ 197| 5| frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 40| 5|#define frodo_unpack oqs_kem_efrodokem_1344_shake_unpack ------------------ frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 12| 5|#define PARAMS_NBAR 8 ------------------ frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 12| 5|#define PARAMS_NBAR 8 ------------------ frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 13| 5|#define PARAMS_LOGQ 16 ------------------ frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 12| 5|#define PARAMS_NBAR 8 ------------------ frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 12| 5|#define PARAMS_NBAR 8 ------------------ frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 13| 5|#define PARAMS_LOGQ 16 ------------------ 198| 5| frodo_mul_bs(W, Bp, S); ------------------ | | 51| 5|#define frodo_mul_bs oqs_kem_efrodokem_1344_shake_mul_bs ------------------ 199| 5| frodo_sub(W, C, W); ------------------ | | 54| 5|#define frodo_sub oqs_kem_efrodokem_1344_shake_sub ------------------ 200| 5| frodo_key_decode((uint16_t*)muprime, W); ------------------ | | 56| 5|#define frodo_key_decode oqs_kem_efrodokem_1344_shake_key_decode ------------------ 201| | 202| | // Generate (seedSE' || k') = G_2(pkh || mu') 203| 5| memcpy(pkh, sk_pkh, BYTES_PKHASH); ------------------ | | 20| 5|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 5|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_shake_length_shared_secret | | | | ------------------ | | | | | | 177| 5|#define OQS_KEM_efrodokem_1344_shake_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ 204| 5| shake(G2out, CRYPTO_BYTES + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU); ------------------ | | 29| 5|#define shake OQS_SHA3_shake256 ------------------ shake(G2out, CRYPTO_BYTES + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU); ------------------ | | 6| 5|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_shake_length_shared_secret | | ------------------ | | | | 177| 5|#define OQS_KEM_efrodokem_1344_shake_length_shared_secret 32 | | ------------------ ------------------ shake(G2out, CRYPTO_BYTES + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU); ------------------ | | 6| 5|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_shake_length_shared_secret | | ------------------ | | | | 177| 5|#define OQS_KEM_efrodokem_1344_shake_length_shared_secret 32 | | ------------------ ------------------ shake(G2out, CRYPTO_BYTES + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU); ------------------ | | 20| 5|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 5|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_shake_length_shared_secret | | | | ------------------ | | | | | | 177| 5|#define OQS_KEM_efrodokem_1344_shake_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ shake(G2out, CRYPTO_BYTES + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU); ------------------ | | 19| 5|#define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 15| 5|#define PARAMS_EXTRACTED_BITS 4 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 5|#define PARAMS_NBAR 8 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 5|#define PARAMS_NBAR 8 | | ------------------ ------------------ 205| | 206| | // Generate Sp and Ep, and compute BBp = Sp*A + Ep. Generate A on-the-fly 207| 5| shake_input_seedSEprime[0] = 0x96; 208| 5| memcpy(&shake_input_seedSEprime[1], seedSEprime, CRYPTO_BYTES); ------------------ | | 6| 5|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_shake_length_shared_secret | | ------------------ | | | | 177| 5|#define OQS_KEM_efrodokem_1344_shake_length_shared_secret 32 | | ------------------ ------------------ 209| 5| shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSEprime, 1 + CRYPTO_BYTES); ------------------ | | 29| 5|#define shake OQS_SHA3_shake256 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSEprime, 1 + CRYPTO_BYTES); ------------------ | | 11| 5|#define PARAMS_N 1344 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSEprime, 1 + CRYPTO_BYTES); ------------------ | | 12| 5|#define PARAMS_NBAR 8 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSEprime, 1 + CRYPTO_BYTES); ------------------ | | 12| 5|#define PARAMS_NBAR 8 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSEprime, 1 + CRYPTO_BYTES); ------------------ | | 6| 5|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_shake_length_shared_secret | | ------------------ | | | | 177| 5|#define OQS_KEM_efrodokem_1344_shake_length_shared_secret 32 | | ------------------ ------------------ 210| 107k| for (size_t i = 0; i < (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR; i++) { ------------------ | | 11| 107k|#define PARAMS_N 1344 ------------------ for (size_t i = 0; i < (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR; i++) { ------------------ | | 12| 107k|#define PARAMS_NBAR 8 ------------------ for (size_t i = 0; i < (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR; i++) { ------------------ | | 12| 107k|#define PARAMS_NBAR 8 ------------------ | Branch (210:24): [True: 107k, False: 5] ------------------ 211| 107k| Sp[i] = LE_TO_UINT16(Sp[i]); ------------------ | | 34| 107k| #define LE_TO_UINT16(n) (n) ------------------ 212| 107k| } 213| 5| frodo_sample_n(Sp, PARAMS_N*PARAMS_NBAR); ------------------ | | 38| 5|#define frodo_sample_n oqs_kem_efrodokem_1344_shake_sample_n ------------------ frodo_sample_n(Sp, PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 5|#define PARAMS_N 1344 ------------------ frodo_sample_n(Sp, PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 5|#define PARAMS_NBAR 8 ------------------ 214| 5| frodo_sample_n(Ep, PARAMS_N*PARAMS_NBAR); ------------------ | | 38| 5|#define frodo_sample_n oqs_kem_efrodokem_1344_shake_sample_n ------------------ frodo_sample_n(Ep, PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 5|#define PARAMS_N 1344 ------------------ frodo_sample_n(Ep, PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 5|#define PARAMS_NBAR 8 ------------------ 215| 5| frodo_mul_add_sa_plus_e(BBp, Sp, Ep, pk_seedA); ------------------ | | 47| 5|#define frodo_mul_add_sa_plus_e oqs_kem_efrodokem_1344_shake_mul_add_sa_plus_e ------------------ 216| | 217| | // Generate Epp, and compute W = Sp*B + Epp 218| 5| frodo_sample_n(Epp, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 38| 5|#define frodo_sample_n oqs_kem_efrodokem_1344_shake_sample_n ------------------ frodo_sample_n(Epp, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 5|#define PARAMS_NBAR 8 ------------------ frodo_sample_n(Epp, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 5|#define PARAMS_NBAR 8 ------------------ 219| 5| frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 40| 5|#define frodo_unpack oqs_kem_efrodokem_1344_shake_unpack ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 11| 5|#define PARAMS_N 1344 ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 12| 5|#define PARAMS_NBAR 8 ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 3| 5|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_efrodokem_1344_shake_length_public_key | | ------------------ | | | | 174| 5|#define OQS_KEM_efrodokem_1344_shake_length_public_key 21520 | | ------------------ ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 18| 5|#define BYTES_SEED_A 16 ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 13| 5|#define PARAMS_LOGQ 16 ------------------ 220| 5| frodo_mul_add_sb_plus_e(W, B, Sp, Epp); ------------------ | | 50| 5|#define frodo_mul_add_sb_plus_e oqs_kem_efrodokem_1344_shake_mul_add_sb_plus_e ------------------ 221| | 222| | // Encode mu, and compute CC = W + enc(mu') (mod q) 223| 5| frodo_key_encode(CC, (uint16_t*)muprime); ------------------ | | 55| 5|#define frodo_key_encode oqs_kem_efrodokem_1344_shake_key_encode ------------------ 224| 5| frodo_add(CC, W, CC); ------------------ | | 53| 5|#define frodo_add oqs_kem_efrodokem_1344_shake_add ------------------ 225| | 226| | // Prepare input to F 227| 5| memcpy(Fin_ct, ct, CRYPTO_CIPHERTEXTBYTES); ------------------ | | 5| 5|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_efrodokem_1344_shake_length_ciphertext | | ------------------ | | | | 176| 5|#define OQS_KEM_efrodokem_1344_shake_length_ciphertext 21632 | | ------------------ ------------------ 228| | 229| | // Reducing BBp modulo q 230| 53.7k| for (int i = 0; i < PARAMS_N*PARAMS_NBAR; i++) BBp[i] = BBp[i] & ((1 << PARAMS_LOGQ)-1); ------------------ | | 11| 53.7k|#define PARAMS_N 1344 ------------------ for (int i = 0; i < PARAMS_N*PARAMS_NBAR; i++) BBp[i] = BBp[i] & ((1 << PARAMS_LOGQ)-1); ------------------ | | 12| 53.7k|#define PARAMS_NBAR 8 ------------------ for (int i = 0; i < PARAMS_N*PARAMS_NBAR; i++) BBp[i] = BBp[i] & ((1 << PARAMS_LOGQ)-1); ------------------ | | 13| 53.7k|#define PARAMS_LOGQ 16 ------------------ | Branch (230:21): [True: 53.7k, False: 5] ------------------ 231| | 232| | // Needs to avoid branching on secret data using constant-time implementation. 233| 5| int8_t selector = ct_verify(Bp, BBp, PARAMS_N*PARAMS_NBAR) | ct_verify(C, CC, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 42| 5|#define ct_verify oqs_kem_efrodokem_1344_shake_ct_verify ------------------ int8_t selector = ct_verify(Bp, BBp, PARAMS_N*PARAMS_NBAR) | ct_verify(C, CC, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 11| 5|#define PARAMS_N 1344 ------------------ int8_t selector = ct_verify(Bp, BBp, PARAMS_N*PARAMS_NBAR) | ct_verify(C, CC, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 5|#define PARAMS_NBAR 8 ------------------ int8_t selector = ct_verify(Bp, BBp, PARAMS_N*PARAMS_NBAR) | ct_verify(C, CC, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 42| 5|#define ct_verify oqs_kem_efrodokem_1344_shake_ct_verify ------------------ int8_t selector = ct_verify(Bp, BBp, PARAMS_N*PARAMS_NBAR) | ct_verify(C, CC, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 5|#define PARAMS_NBAR 8 ------------------ int8_t selector = ct_verify(Bp, BBp, PARAMS_N*PARAMS_NBAR) | ct_verify(C, CC, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 5|#define PARAMS_NBAR 8 ------------------ 234| | // If (selector == 0) then load k' to do ss = F(ct || k'), else if (selector == -1) load s to do ss = F(ct || s) 235| 5| ct_select((uint8_t*)Fin_k, (uint8_t*)kprime, (uint8_t*)sk_s, CRYPTO_BYTES, selector); ------------------ | | 41| 5|#define ct_select oqs_kem_efrodokem_1344_shake_ct_select ------------------ ct_select((uint8_t*)Fin_k, (uint8_t*)kprime, (uint8_t*)sk_s, CRYPTO_BYTES, selector); ------------------ | | 6| 5|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_shake_length_shared_secret | | ------------------ | | | | 177| 5|#define OQS_KEM_efrodokem_1344_shake_length_shared_secret 32 | | ------------------ ------------------ 236| 5| shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 29| 5|#define shake OQS_SHA3_shake256 ------------------ shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 6| 5|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_shake_length_shared_secret | | ------------------ | | | | 177| 5|#define OQS_KEM_efrodokem_1344_shake_length_shared_secret 32 | | ------------------ ------------------ shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 5| 5|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_efrodokem_1344_shake_length_ciphertext | | ------------------ | | | | 176| 5|#define OQS_KEM_efrodokem_1344_shake_length_ciphertext 21632 | | ------------------ ------------------ shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 6| 5|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_shake_length_shared_secret | | ------------------ | | | | 177| 5|#define OQS_KEM_efrodokem_1344_shake_length_shared_secret 32 | | ------------------ ------------------ 237| | 238| | // Cleanup: 239| 5| clear_bytes((uint8_t *)W, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 27| 5|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)W, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 5|#define PARAMS_NBAR 8 ------------------ clear_bytes((uint8_t *)W, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 5|#define PARAMS_NBAR 8 ------------------ 240| 5| clear_bytes((uint8_t *)Sp, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 27| 5|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)Sp, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 5|#define PARAMS_N 1344 ------------------ clear_bytes((uint8_t *)Sp, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 5|#define PARAMS_NBAR 8 ------------------ 241| 5| clear_bytes((uint8_t *)S, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 27| 5|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)S, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 5|#define PARAMS_N 1344 ------------------ clear_bytes((uint8_t *)S, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 5|#define PARAMS_NBAR 8 ------------------ 242| 5| clear_bytes((uint8_t *)Ep, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 27| 5|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)Ep, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 5|#define PARAMS_N 1344 ------------------ clear_bytes((uint8_t *)Ep, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 5|#define PARAMS_NBAR 8 ------------------ 243| 5| clear_bytes((uint8_t *)Epp, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 27| 5|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)Epp, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 5|#define PARAMS_NBAR 8 ------------------ clear_bytes((uint8_t *)Epp, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 5|#define PARAMS_NBAR 8 ------------------ 244| 5| clear_bytes(muprime, BYTES_MU); ------------------ | | 27| 5|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(muprime, BYTES_MU); ------------------ | | 19| 5|#define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 15| 5|#define PARAMS_EXTRACTED_BITS 4 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 5|#define PARAMS_NBAR 8 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 5|#define PARAMS_NBAR 8 | | ------------------ ------------------ 245| 5| clear_bytes(G2out, 2*CRYPTO_BYTES); ------------------ | | 27| 5|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(G2out, 2*CRYPTO_BYTES); ------------------ | | 6| 5|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_shake_length_shared_secret | | ------------------ | | | | 177| 5|#define OQS_KEM_efrodokem_1344_shake_length_shared_secret 32 | | ------------------ ------------------ 246| 5| clear_bytes(Fin_k, CRYPTO_BYTES); ------------------ | | 27| 5|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(Fin_k, CRYPTO_BYTES); ------------------ | | 6| 5|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_shake_length_shared_secret | | ------------------ | | | | 177| 5|#define OQS_KEM_efrodokem_1344_shake_length_shared_secret 32 | | ------------------ ------------------ 247| 5| clear_bytes(shake_input_seedSEprime, 1 + CRYPTO_BYTES); ------------------ | | 27| 5|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(shake_input_seedSEprime, 1 + CRYPTO_BYTES); ------------------ | | 6| 5|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_shake_length_shared_secret | | ------------------ | | | | 177| 5|#define OQS_KEM_efrodokem_1344_shake_length_shared_secret 32 | | ------------------ ------------------ 248| 5| return OQS_SUCCESS; 249| 5|} OQS_KEM_frodokem_640_aes_keypair: 19| 2|{ // FrodoKEM's key generation 20| | // Outputs: public key pk = pk_seedA||pk_b ( BYTES_SEED_A + (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8 bytes) 21| | // secret key sk = sk_s||pk_seedA||pk_b||sk_S||sk_pkh (CRYPTO_BYTES + BYTES_SEED_A + (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8 + 2*PARAMS_N*PARAMS_NBAR + BYTES_PKHASH bytes) 22| 2| uint8_t *pk_seedA = &pk[0]; 23| 2| uint8_t *pk_b = &pk[BYTES_SEED_A]; ------------------ | | 18| 2|#define BYTES_SEED_A 16 ------------------ 24| 2| uint8_t *sk_s = &sk[0]; 25| 2| uint8_t *sk_pk = &sk[CRYPTO_BYTES]; ------------------ | | 6| 2|#define CRYPTO_BYTES OQS_KEM_frodokem_640_aes_length_shared_secret | | ------------------ | | | | 12| 2|#define OQS_KEM_frodokem_640_aes_length_shared_secret 16 | | ------------------ ------------------ 26| 2| uint8_t *sk_S = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES]; ------------------ | | 6| 2|#define CRYPTO_BYTES OQS_KEM_frodokem_640_aes_length_shared_secret | | ------------------ | | | | 12| 2|#define OQS_KEM_frodokem_640_aes_length_shared_secret 16 | | ------------------ ------------------ uint8_t *sk_S = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES]; ------------------ | | 3| 2|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_frodokem_640_aes_length_public_key | | ------------------ | | | | 9| 2|#define OQS_KEM_frodokem_640_aes_length_public_key 9616 | | ------------------ ------------------ 27| 2| uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 6| 2|#define CRYPTO_BYTES OQS_KEM_frodokem_640_aes_length_shared_secret | | ------------------ | | | | 12| 2|#define OQS_KEM_frodokem_640_aes_length_shared_secret 16 | | ------------------ ------------------ uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 3| 2|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_frodokem_640_aes_length_public_key | | ------------------ | | | | 9| 2|#define OQS_KEM_frodokem_640_aes_length_public_key 9616 | | ------------------ ------------------ uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 11| 2|#define PARAMS_N 640 ------------------ uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ 28| 2| uint16_t B[PARAMS_N*PARAMS_NBAR] = {0}; 29| 2| uint16_t S[2*PARAMS_N*PARAMS_NBAR] = {0}; // contains secret data 30| 2| uint16_t *E = (uint16_t *)&S[PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 11| 2|#define PARAMS_N 640 ------------------ uint16_t *E = (uint16_t *)&S[PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ 31| 2| uint8_t randomness[CRYPTO_BYTES + BYTES_SEED_SE + BYTES_SEED_A]; // contains secret data via randomness_s and randomness_seedSE 32| 2| uint8_t *randomness_s = &randomness[0]; // contains secret data 33| 2| uint8_t *randomness_seedSE = &randomness[CRYPTO_BYTES]; // contains secret data ------------------ | | 6| 2|#define CRYPTO_BYTES OQS_KEM_frodokem_640_aes_length_shared_secret | | ------------------ | | | | 12| 2|#define OQS_KEM_frodokem_640_aes_length_shared_secret 16 | | ------------------ ------------------ 34| 2| uint8_t *randomness_z = &randomness[CRYPTO_BYTES + BYTES_SEED_SE]; ------------------ | | 6| 2|#define CRYPTO_BYTES OQS_KEM_frodokem_640_aes_length_shared_secret | | ------------------ | | | | 12| 2|#define OQS_KEM_frodokem_640_aes_length_shared_secret 16 | | ------------------ ------------------ uint8_t *randomness_z = &randomness[CRYPTO_BYTES + BYTES_SEED_SE]; ------------------ | | 21| 2|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 2|#define CRYPTO_BYTES OQS_KEM_frodokem_640_aes_length_shared_secret | | | | ------------------ | | | | | | 12| 2|#define OQS_KEM_frodokem_640_aes_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ 35| 2| uint8_t shake_input_seedSE[1 + BYTES_SEED_SE]; // contains secret data 36| | 37| | // Generate the secret value s, the seed for S and E, and the seed for the seed for A. Add seed_A to the public key 38| 2| randombytes(randomness, CRYPTO_BYTES + BYTES_SEED_SE + BYTES_SEED_A); ------------------ | | 28| 2|#define randombytes OQS_randombytes ------------------ randombytes(randomness, CRYPTO_BYTES + BYTES_SEED_SE + BYTES_SEED_A); ------------------ | | 6| 2|#define CRYPTO_BYTES OQS_KEM_frodokem_640_aes_length_shared_secret | | ------------------ | | | | 12| 2|#define OQS_KEM_frodokem_640_aes_length_shared_secret 16 | | ------------------ ------------------ randombytes(randomness, CRYPTO_BYTES + BYTES_SEED_SE + BYTES_SEED_A); ------------------ | | 21| 2|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 2|#define CRYPTO_BYTES OQS_KEM_frodokem_640_aes_length_shared_secret | | | | ------------------ | | | | | | 12| 2|#define OQS_KEM_frodokem_640_aes_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ randombytes(randomness, CRYPTO_BYTES + BYTES_SEED_SE + BYTES_SEED_A); ------------------ | | 18| 2|#define BYTES_SEED_A 16 ------------------ 39| 2| shake(pk_seedA, BYTES_SEED_A, randomness_z, BYTES_SEED_A); ------------------ | | 31| 2|#define shake OQS_SHA3_shake128 ------------------ shake(pk_seedA, BYTES_SEED_A, randomness_z, BYTES_SEED_A); ------------------ | | 18| 2|#define BYTES_SEED_A 16 ------------------ shake(pk_seedA, BYTES_SEED_A, randomness_z, BYTES_SEED_A); ------------------ | | 18| 2|#define BYTES_SEED_A 16 ------------------ 40| | 41| | // Generate S and E, and compute B = A*S + E. Generate A on-the-fly 42| 2| shake_input_seedSE[0] = 0x5F; 43| 2| memcpy(&shake_input_seedSE[1], randomness_seedSE, BYTES_SEED_SE); ------------------ | | 21| 2|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 2|#define CRYPTO_BYTES OQS_KEM_frodokem_640_aes_length_shared_secret | | | | ------------------ | | | | | | 12| 2|#define OQS_KEM_frodokem_640_aes_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ 44| 2| shake((uint8_t*)S, 2*PARAMS_N*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + BYTES_SEED_SE); ------------------ | | 31| 2|#define shake OQS_SHA3_shake128 ------------------ shake((uint8_t*)S, 2*PARAMS_N*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + BYTES_SEED_SE); ------------------ | | 11| 2|#define PARAMS_N 640 ------------------ shake((uint8_t*)S, 2*PARAMS_N*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + BYTES_SEED_SE); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ shake((uint8_t*)S, 2*PARAMS_N*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + BYTES_SEED_SE); ------------------ | | 21| 2|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 2|#define CRYPTO_BYTES OQS_KEM_frodokem_640_aes_length_shared_secret | | | | ------------------ | | | | | | 12| 2|#define OQS_KEM_frodokem_640_aes_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ 45| 20.4k| for (size_t i = 0; i < 2 * PARAMS_N * PARAMS_NBAR; i++) { ------------------ | | 11| 20.4k|#define PARAMS_N 640 ------------------ for (size_t i = 0; i < 2 * PARAMS_N * PARAMS_NBAR; i++) { ------------------ | | 12| 20.4k|#define PARAMS_NBAR 8 ------------------ | Branch (45:24): [True: 20.4k, False: 2] ------------------ 46| 20.4k| S[i] = LE_TO_UINT16(S[i]); ------------------ | | 34| 20.4k| #define LE_TO_UINT16(n) (n) ------------------ 47| 20.4k| } 48| 2| frodo_sample_n(S, PARAMS_N*PARAMS_NBAR); ------------------ | | 40| 2|#define frodo_sample_n oqs_kem_frodokem_640_aes_sample_n ------------------ frodo_sample_n(S, PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 2|#define PARAMS_N 640 ------------------ frodo_sample_n(S, PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ 49| 2| frodo_sample_n(E, PARAMS_N*PARAMS_NBAR); ------------------ | | 40| 2|#define frodo_sample_n oqs_kem_frodokem_640_aes_sample_n ------------------ frodo_sample_n(E, PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 2|#define PARAMS_N 640 ------------------ frodo_sample_n(E, PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ 50| 2| frodo_mul_add_as_plus_e(B, S, E, pk); ------------------ | | 46| 2|#define frodo_mul_add_as_plus_e oqs_kem_frodokem_640_aes_mul_add_as_plus_e ------------------ 51| | 52| | // Encode the second part of the public key 53| 2| frodo_pack(pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, B, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 41| 2|#define frodo_pack oqs_kem_frodokem_640_aes_pack ------------------ frodo_pack(pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, B, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 3| 2|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_frodokem_640_aes_length_public_key | | ------------------ | | | | 9| 2|#define OQS_KEM_frodokem_640_aes_length_public_key 9616 | | ------------------ ------------------ frodo_pack(pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, B, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 18| 2|#define BYTES_SEED_A 16 ------------------ frodo_pack(pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, B, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 11| 2|#define PARAMS_N 640 ------------------ frodo_pack(pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, B, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ frodo_pack(pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, B, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 13| 2|#define PARAMS_LOGQ 15 ------------------ 54| | 55| | // Add s, pk and S to the secret key 56| 2| memcpy(sk_s, randomness_s, CRYPTO_BYTES); ------------------ | | 6| 2|#define CRYPTO_BYTES OQS_KEM_frodokem_640_aes_length_shared_secret | | ------------------ | | | | 12| 2|#define OQS_KEM_frodokem_640_aes_length_shared_secret 16 | | ------------------ ------------------ 57| 2| memcpy(sk_pk, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 3| 2|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_frodokem_640_aes_length_public_key | | ------------------ | | | | 9| 2|#define OQS_KEM_frodokem_640_aes_length_public_key 9616 | | ------------------ ------------------ 58| 10.2k| for (size_t i = 0; i < PARAMS_N * PARAMS_NBAR; i++) { ------------------ | | 11| 10.2k|#define PARAMS_N 640 ------------------ for (size_t i = 0; i < PARAMS_N * PARAMS_NBAR; i++) { ------------------ | | 12| 10.2k|#define PARAMS_NBAR 8 ------------------ | Branch (58:24): [True: 10.2k, False: 2] ------------------ 59| 10.2k| S[i] = UINT16_TO_LE(S[i]); ------------------ | | 35| 10.2k| #define UINT16_TO_LE(n) (n) ------------------ 60| 10.2k| } 61| 2| memcpy(sk_S, S, 2*PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 2|#define PARAMS_N 640 ------------------ memcpy(sk_S, S, 2*PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ 62| | 63| | // Add H(pk) to the secret key 64| 2| shake(sk_pkh, BYTES_PKHASH, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 31| 2|#define shake OQS_SHA3_shake128 ------------------ shake(sk_pkh, BYTES_PKHASH, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 22| 2|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 2|#define CRYPTO_BYTES OQS_KEM_frodokem_640_aes_length_shared_secret | | | | ------------------ | | | | | | 12| 2|#define OQS_KEM_frodokem_640_aes_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ shake(sk_pkh, BYTES_PKHASH, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 3| 2|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_frodokem_640_aes_length_public_key | | ------------------ | | | | 9| 2|#define OQS_KEM_frodokem_640_aes_length_public_key 9616 | | ------------------ ------------------ 65| | 66| | // Cleanup: 67| 2| clear_bytes((uint8_t *)S, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 29| 2|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)S, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 2|#define PARAMS_N 640 ------------------ clear_bytes((uint8_t *)S, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ 68| 2| clear_bytes((uint8_t *)E, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 29| 2|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)E, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 2|#define PARAMS_N 640 ------------------ clear_bytes((uint8_t *)E, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ 69| 2| clear_bytes(randomness, CRYPTO_BYTES + BYTES_SEED_SE); ------------------ | | 29| 2|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(randomness, CRYPTO_BYTES + BYTES_SEED_SE); ------------------ | | 6| 2|#define CRYPTO_BYTES OQS_KEM_frodokem_640_aes_length_shared_secret | | ------------------ | | | | 12| 2|#define OQS_KEM_frodokem_640_aes_length_shared_secret 16 | | ------------------ ------------------ clear_bytes(randomness, CRYPTO_BYTES + BYTES_SEED_SE); ------------------ | | 21| 2|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 2|#define CRYPTO_BYTES OQS_KEM_frodokem_640_aes_length_shared_secret | | | | ------------------ | | | | | | 12| 2|#define OQS_KEM_frodokem_640_aes_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ 70| 2| clear_bytes(shake_input_seedSE, 1 + BYTES_SEED_SE); ------------------ | | 29| 2|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(shake_input_seedSE, 1 + BYTES_SEED_SE); ------------------ | | 21| 2|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 2|#define CRYPTO_BYTES OQS_KEM_frodokem_640_aes_length_shared_secret | | | | ------------------ | | | | | | 12| 2|#define OQS_KEM_frodokem_640_aes_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ 71| 2| return OQS_SUCCESS; 72| 2|} OQS_KEM_frodokem_640_aes_encaps: 86| 2|{ // FrodoKEM's key encapsulation 87| | // Input: public key pk = pk_seedA||pk_b (BYTES_SEED_A + (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8 bytes) 88| | // Outputs: ciphertext ct = ct_c1||ct_c2||salt ( (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8 + (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8 + BYTES_SALT bytes) 89| | // shared key ss (CRYPTO_BYTES bytes) 90| 2| const uint8_t *pk_seedA = &pk[0]; 91| 2| const uint8_t *pk_b = &pk[BYTES_SEED_A]; ------------------ | | 18| 2|#define BYTES_SEED_A 16 ------------------ 92| 2| uint8_t *ct_c1 = &ct[0]; 93| 2| uint8_t *ct_c2 = &ct[(PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8]; ------------------ | | 13| 2|#define PARAMS_LOGQ 15 ------------------ uint8_t *ct_c2 = &ct[(PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8]; ------------------ | | 11| 2|#define PARAMS_N 640 ------------------ uint8_t *ct_c2 = &ct[(PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8]; ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ 94| 2| uint16_t B[PARAMS_N*PARAMS_NBAR] = {0}; 95| 2| uint16_t V[PARAMS_NBAR*PARAMS_NBAR]= {0}; // contains secret data 96| 2| uint16_t C[PARAMS_NBAR*PARAMS_NBAR] = {0}; 97| 2| ALIGN_HEADER(32) uint16_t Bp[PARAMS_N*PARAMS_NBAR] ALIGN_FOOTER(32) = {0}; 98| 2| ALIGN_HEADER(32) uint16_t Sp[(2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR] ALIGN_FOOTER(32) = {0}; // contains secret data 99| 2| uint16_t *Ep = (uint16_t *)&Sp[PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 11| 2|#define PARAMS_N 640 ------------------ uint16_t *Ep = (uint16_t *)&Sp[PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ 100| 2| uint16_t *Epp = (uint16_t *)&Sp[2*PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 11| 2|#define PARAMS_N 640 ------------------ uint16_t *Epp = (uint16_t *)&Sp[2*PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ 101| 2| uint8_t G2in[BYTES_PKHASH + BYTES_MU + BYTES_SALT]; // contains secret data via mu 102| 2| uint8_t *pkh = &G2in[0]; 103| 2| uint8_t *mu = &G2in[BYTES_PKHASH]; // contains secret data ------------------ | | 22| 2|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 2|#define CRYPTO_BYTES OQS_KEM_frodokem_640_aes_length_shared_secret | | | | ------------------ | | | | | | 12| 2|#define OQS_KEM_frodokem_640_aes_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ 104| 2| uint8_t *salt = &G2in[BYTES_PKHASH + BYTES_MU]; ------------------ | | 22| 2|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 2|#define CRYPTO_BYTES OQS_KEM_frodokem_640_aes_length_shared_secret | | | | ------------------ | | | | | | 12| 2|#define OQS_KEM_frodokem_640_aes_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ uint8_t *salt = &G2in[BYTES_PKHASH + BYTES_MU]; ------------------ | | 19| 2|#define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 15| 2|#define PARAMS_EXTRACTED_BITS 2 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 2|#define PARAMS_NBAR 8 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 2|#define PARAMS_NBAR 8 | | ------------------ ------------------ 105| 2| uint8_t G2out[BYTES_SEED_SE + CRYPTO_BYTES]; // contains secret data 106| 2| uint8_t *seedSE = &G2out[0]; // contains secret data 107| 2| uint8_t *k = &G2out[BYTES_SEED_SE]; // contains secret data ------------------ | | 21| 2|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 2|#define CRYPTO_BYTES OQS_KEM_frodokem_640_aes_length_shared_secret | | | | ------------------ | | | | | | 12| 2|#define OQS_KEM_frodokem_640_aes_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ 108| 2| uint8_t Fin[CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES]; // contains secret data via Fin_k 109| 2| uint8_t *Fin_ct = &Fin[0]; 110| 2| uint8_t *Fin_k = &Fin[CRYPTO_CIPHERTEXTBYTES]; // contains secret data ------------------ | | 5| 2|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_frodokem_640_aes_length_ciphertext | | ------------------ | | | | 11| 2|#define OQS_KEM_frodokem_640_aes_length_ciphertext 9752 | | ------------------ ------------------ 111| 2| uint8_t shake_input_seedSE[1 + BYTES_SEED_SE]; // contains secret data 112| | 113| | // pkh <- G_1(pk), generate random mu and salt, compute (seedSE || k) = G_2(pkh || mu || salt) 114| 2| shake(pkh, BYTES_PKHASH, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 31| 2|#define shake OQS_SHA3_shake128 ------------------ shake(pkh, BYTES_PKHASH, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 22| 2|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 2|#define CRYPTO_BYTES OQS_KEM_frodokem_640_aes_length_shared_secret | | | | ------------------ | | | | | | 12| 2|#define OQS_KEM_frodokem_640_aes_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ shake(pkh, BYTES_PKHASH, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 3| 2|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_frodokem_640_aes_length_public_key | | ------------------ | | | | 9| 2|#define OQS_KEM_frodokem_640_aes_length_public_key 9616 | | ------------------ ------------------ 115| 2| randombytes(mu, BYTES_MU + BYTES_SALT); ------------------ | | 28| 2|#define randombytes OQS_randombytes ------------------ randombytes(mu, BYTES_MU + BYTES_SALT); ------------------ | | 19| 2|#define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 15| 2|#define PARAMS_EXTRACTED_BITS 2 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 2|#define PARAMS_NBAR 8 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 2|#define PARAMS_NBAR 8 | | ------------------ ------------------ randombytes(mu, BYTES_MU + BYTES_SALT); ------------------ | | 20| 2|#define BYTES_SALT (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 2|#define CRYPTO_BYTES OQS_KEM_frodokem_640_aes_length_shared_secret | | | | ------------------ | | | | | | 12| 2|#define OQS_KEM_frodokem_640_aes_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ 116| 2| shake(G2out, BYTES_SEED_SE + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU + BYTES_SALT); ------------------ | | 31| 2|#define shake OQS_SHA3_shake128 ------------------ shake(G2out, BYTES_SEED_SE + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU + BYTES_SALT); ------------------ | | 21| 2|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 2|#define CRYPTO_BYTES OQS_KEM_frodokem_640_aes_length_shared_secret | | | | ------------------ | | | | | | 12| 2|#define OQS_KEM_frodokem_640_aes_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ shake(G2out, BYTES_SEED_SE + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU + BYTES_SALT); ------------------ | | 6| 2|#define CRYPTO_BYTES OQS_KEM_frodokem_640_aes_length_shared_secret | | ------------------ | | | | 12| 2|#define OQS_KEM_frodokem_640_aes_length_shared_secret 16 | | ------------------ ------------------ shake(G2out, BYTES_SEED_SE + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU + BYTES_SALT); ------------------ | | 22| 2|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 2|#define CRYPTO_BYTES OQS_KEM_frodokem_640_aes_length_shared_secret | | | | ------------------ | | | | | | 12| 2|#define OQS_KEM_frodokem_640_aes_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ shake(G2out, BYTES_SEED_SE + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU + BYTES_SALT); ------------------ | | 19| 2|#define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 15| 2|#define PARAMS_EXTRACTED_BITS 2 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 2|#define PARAMS_NBAR 8 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 2|#define PARAMS_NBAR 8 | | ------------------ ------------------ shake(G2out, BYTES_SEED_SE + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU + BYTES_SALT); ------------------ | | 20| 2|#define BYTES_SALT (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 2|#define CRYPTO_BYTES OQS_KEM_frodokem_640_aes_length_shared_secret | | | | ------------------ | | | | | | 12| 2|#define OQS_KEM_frodokem_640_aes_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ 117| | 118| | // Generate Sp and Ep, and compute Bp = Sp*A + Ep. Generate A on-the-fly 119| 2| shake_input_seedSE[0] = 0x96; 120| 2| memcpy(&shake_input_seedSE[1], seedSE, BYTES_SEED_SE); ------------------ | | 21| 2|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 2|#define CRYPTO_BYTES OQS_KEM_frodokem_640_aes_length_shared_secret | | | | ------------------ | | | | | | 12| 2|#define OQS_KEM_frodokem_640_aes_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ 121| 2| shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + BYTES_SEED_SE); ------------------ | | 31| 2|#define shake OQS_SHA3_shake128 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + BYTES_SEED_SE); ------------------ | | 11| 2|#define PARAMS_N 640 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + BYTES_SEED_SE); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + BYTES_SEED_SE); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + BYTES_SEED_SE); ------------------ | | 21| 2|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 2|#define CRYPTO_BYTES OQS_KEM_frodokem_640_aes_length_shared_secret | | | | ------------------ | | | | | | 12| 2|#define OQS_KEM_frodokem_640_aes_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ 122| 20.6k| for (size_t i = 0; i < (2 * PARAMS_N + PARAMS_NBAR) * PARAMS_NBAR; i++) { ------------------ | | 11| 20.6k|#define PARAMS_N 640 ------------------ for (size_t i = 0; i < (2 * PARAMS_N + PARAMS_NBAR) * PARAMS_NBAR; i++) { ------------------ | | 12| 20.6k|#define PARAMS_NBAR 8 ------------------ for (size_t i = 0; i < (2 * PARAMS_N + PARAMS_NBAR) * PARAMS_NBAR; i++) { ------------------ | | 12| 20.6k|#define PARAMS_NBAR 8 ------------------ | Branch (122:24): [True: 20.6k, False: 2] ------------------ 123| 20.6k| Sp[i] = LE_TO_UINT16(Sp[i]); ------------------ | | 34| 20.6k| #define LE_TO_UINT16(n) (n) ------------------ 124| 20.6k| } 125| 2| frodo_sample_n(Sp, PARAMS_N*PARAMS_NBAR); ------------------ | | 40| 2|#define frodo_sample_n oqs_kem_frodokem_640_aes_sample_n ------------------ frodo_sample_n(Sp, PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 2|#define PARAMS_N 640 ------------------ frodo_sample_n(Sp, PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ 126| 2| frodo_sample_n(Ep, PARAMS_N*PARAMS_NBAR); ------------------ | | 40| 2|#define frodo_sample_n oqs_kem_frodokem_640_aes_sample_n ------------------ frodo_sample_n(Ep, PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 2|#define PARAMS_N 640 ------------------ frodo_sample_n(Ep, PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ 127| 2| frodo_mul_add_sa_plus_e(Bp, Sp, Ep, pk_seedA); ------------------ | | 49| 2|#define frodo_mul_add_sa_plus_e oqs_kem_frodokem_640_aes_mul_add_sa_plus_e ------------------ 128| 2| frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 41| 2|#define frodo_pack oqs_kem_frodokem_640_aes_pack ------------------ frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 13| 2|#define PARAMS_LOGQ 15 ------------------ frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 11| 2|#define PARAMS_N 640 ------------------ frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 11| 2|#define PARAMS_N 640 ------------------ frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 13| 2|#define PARAMS_LOGQ 15 ------------------ 129| | 130| | // Generate Epp, and compute V = Sp*B + Epp 131| 2| frodo_sample_n(Epp, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 40| 2|#define frodo_sample_n oqs_kem_frodokem_640_aes_sample_n ------------------ frodo_sample_n(Epp, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ frodo_sample_n(Epp, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ 132| 2| frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 42| 2|#define frodo_unpack oqs_kem_frodokem_640_aes_unpack ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 11| 2|#define PARAMS_N 640 ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 3| 2|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_frodokem_640_aes_length_public_key | | ------------------ | | | | 9| 2|#define OQS_KEM_frodokem_640_aes_length_public_key 9616 | | ------------------ ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 18| 2|#define BYTES_SEED_A 16 ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 13| 2|#define PARAMS_LOGQ 15 ------------------ 133| 2| frodo_mul_add_sb_plus_e(V, B, Sp, Epp); ------------------ | | 52| 2|#define frodo_mul_add_sb_plus_e oqs_kem_frodokem_640_aes_mul_add_sb_plus_e ------------------ 134| | 135| | // Encode mu, and compute C = V + enc(mu) (mod q) 136| 2| frodo_key_encode(C, (uint16_t*)mu); ------------------ | | 57| 2|#define frodo_key_encode oqs_kem_frodokem_640_aes_key_encode ------------------ 137| 2| frodo_add(C, V, C); ------------------ | | 55| 2|#define frodo_add oqs_kem_frodokem_640_aes_add ------------------ 138| 2| frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 41| 2|#define frodo_pack oqs_kem_frodokem_640_aes_pack ------------------ frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 13| 2|#define PARAMS_LOGQ 15 ------------------ frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 13| 2|#define PARAMS_LOGQ 15 ------------------ 139| | 140| | // Append salt to ct and compute ss = F(ct_c1||ct_c2||salt||k) 141| 2| memcpy(&ct[CRYPTO_CIPHERTEXTBYTES - BYTES_SALT], salt, BYTES_SALT); ------------------ | | 5| 2|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_frodokem_640_aes_length_ciphertext | | ------------------ | | | | 11| 2|#define OQS_KEM_frodokem_640_aes_length_ciphertext 9752 | | ------------------ ------------------ memcpy(&ct[CRYPTO_CIPHERTEXTBYTES - BYTES_SALT], salt, BYTES_SALT); ------------------ | | 20| 2|#define BYTES_SALT (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 2|#define CRYPTO_BYTES OQS_KEM_frodokem_640_aes_length_shared_secret | | | | ------------------ | | | | | | 12| 2|#define OQS_KEM_frodokem_640_aes_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ memcpy(&ct[CRYPTO_CIPHERTEXTBYTES - BYTES_SALT], salt, BYTES_SALT); ------------------ | | 20| 2|#define BYTES_SALT (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 2|#define CRYPTO_BYTES OQS_KEM_frodokem_640_aes_length_shared_secret | | | | ------------------ | | | | | | 12| 2|#define OQS_KEM_frodokem_640_aes_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ 142| 2| memcpy(Fin_ct, ct, CRYPTO_CIPHERTEXTBYTES); ------------------ | | 5| 2|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_frodokem_640_aes_length_ciphertext | | ------------------ | | | | 11| 2|#define OQS_KEM_frodokem_640_aes_length_ciphertext 9752 | | ------------------ ------------------ 143| 2| memcpy(Fin_k, k, CRYPTO_BYTES); ------------------ | | 6| 2|#define CRYPTO_BYTES OQS_KEM_frodokem_640_aes_length_shared_secret | | ------------------ | | | | 12| 2|#define OQS_KEM_frodokem_640_aes_length_shared_secret 16 | | ------------------ ------------------ 144| 2| shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 31| 2|#define shake OQS_SHA3_shake128 ------------------ shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 6| 2|#define CRYPTO_BYTES OQS_KEM_frodokem_640_aes_length_shared_secret | | ------------------ | | | | 12| 2|#define OQS_KEM_frodokem_640_aes_length_shared_secret 16 | | ------------------ ------------------ shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 5| 2|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_frodokem_640_aes_length_ciphertext | | ------------------ | | | | 11| 2|#define OQS_KEM_frodokem_640_aes_length_ciphertext 9752 | | ------------------ ------------------ shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 6| 2|#define CRYPTO_BYTES OQS_KEM_frodokem_640_aes_length_shared_secret | | ------------------ | | | | 12| 2|#define OQS_KEM_frodokem_640_aes_length_shared_secret 16 | | ------------------ ------------------ 145| | 146| | // Cleanup: 147| 2| clear_bytes((uint8_t *)V, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 29| 2|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)V, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ clear_bytes((uint8_t *)V, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ 148| 2| clear_bytes((uint8_t *)Sp, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 29| 2|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)Sp, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 2|#define PARAMS_N 640 ------------------ clear_bytes((uint8_t *)Sp, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ 149| 2| clear_bytes((uint8_t *)Ep, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 29| 2|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)Ep, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 2|#define PARAMS_N 640 ------------------ clear_bytes((uint8_t *)Ep, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ 150| 2| clear_bytes((uint8_t *)Epp, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 29| 2|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)Epp, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ clear_bytes((uint8_t *)Epp, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ 151| 2| clear_bytes(mu, BYTES_MU); ------------------ | | 29| 2|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(mu, BYTES_MU); ------------------ | | 19| 2|#define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 15| 2|#define PARAMS_EXTRACTED_BITS 2 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 2|#define PARAMS_NBAR 8 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 2|#define PARAMS_NBAR 8 | | ------------------ ------------------ 152| 2| clear_bytes(G2out, BYTES_SEED_SE + CRYPTO_BYTES); ------------------ | | 29| 2|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(G2out, BYTES_SEED_SE + CRYPTO_BYTES); ------------------ | | 21| 2|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 2|#define CRYPTO_BYTES OQS_KEM_frodokem_640_aes_length_shared_secret | | | | ------------------ | | | | | | 12| 2|#define OQS_KEM_frodokem_640_aes_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ clear_bytes(G2out, BYTES_SEED_SE + CRYPTO_BYTES); ------------------ | | 6| 2|#define CRYPTO_BYTES OQS_KEM_frodokem_640_aes_length_shared_secret | | ------------------ | | | | 12| 2|#define OQS_KEM_frodokem_640_aes_length_shared_secret 16 | | ------------------ ------------------ 153| 2| clear_bytes(Fin_k, CRYPTO_BYTES); ------------------ | | 29| 2|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(Fin_k, CRYPTO_BYTES); ------------------ | | 6| 2|#define CRYPTO_BYTES OQS_KEM_frodokem_640_aes_length_shared_secret | | ------------------ | | | | 12| 2|#define OQS_KEM_frodokem_640_aes_length_shared_secret 16 | | ------------------ ------------------ 154| 2| clear_bytes(shake_input_seedSE, 1 + BYTES_SEED_SE); ------------------ | | 29| 2|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(shake_input_seedSE, 1 + BYTES_SEED_SE); ------------------ | | 21| 2|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 2|#define CRYPTO_BYTES OQS_KEM_frodokem_640_aes_length_shared_secret | | | | ------------------ | | | | | | 12| 2|#define OQS_KEM_frodokem_640_aes_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ 155| 2| return OQS_SUCCESS; 156| 2|} OQS_KEM_frodokem_640_aes_decaps: 160| 2|{ // FrodoKEM's key decapsulation 161| | // Inputs: ciphertext ct = ct_c1||ct_c2||salt ( (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8 + (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8 + BYTES_SALT bytes) 162| | // secret key sk = sk_s||pk_seedA||pk_b||sk_S||sk_pkh (CRYPTO_BYTES + BYTES_SEED_A + (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8 + 2*PARAMS_N*PARAMS_NBAR + BYTES_PKHASH bytes) 163| | // Output: shared key ss (CRYPTO_BYTES bytes) 164| 2| uint16_t B[PARAMS_N*PARAMS_NBAR] = {0}; 165| 2| uint16_t Bp[PARAMS_N*PARAMS_NBAR] = {0}; 166| 2| uint16_t W[PARAMS_NBAR*PARAMS_NBAR] = {0}; // contains secret data 167| 2| uint16_t C[PARAMS_NBAR*PARAMS_NBAR] = {0}; 168| 2| uint16_t CC[PARAMS_NBAR*PARAMS_NBAR] = {0}; 169| 2| ALIGN_HEADER(32) uint16_t BBp[PARAMS_N*PARAMS_NBAR] ALIGN_FOOTER(32) = {0}; 170| 2| ALIGN_HEADER(32) uint16_t Sp[(2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR] ALIGN_FOOTER(32) = {0}; // contains secret data 171| 2| uint16_t *Ep = (uint16_t *)&Sp[PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 11| 2|#define PARAMS_N 640 ------------------ uint16_t *Ep = (uint16_t *)&Sp[PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ 172| 2| uint16_t *Epp = (uint16_t *)&Sp[2*PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 11| 2|#define PARAMS_N 640 ------------------ uint16_t *Epp = (uint16_t *)&Sp[2*PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ 173| 2| const uint8_t *ct_c1 = &ct[0]; 174| 2| const uint8_t *ct_c2 = &ct[(PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8]; ------------------ | | 13| 2|#define PARAMS_LOGQ 15 ------------------ const uint8_t *ct_c2 = &ct[(PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8]; ------------------ | | 11| 2|#define PARAMS_N 640 ------------------ const uint8_t *ct_c2 = &ct[(PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8]; ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ 175| 2| const uint8_t *salt = &ct[CRYPTO_CIPHERTEXTBYTES - BYTES_SALT]; ------------------ | | 5| 2|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_frodokem_640_aes_length_ciphertext | | ------------------ | | | | 11| 2|#define OQS_KEM_frodokem_640_aes_length_ciphertext 9752 | | ------------------ ------------------ const uint8_t *salt = &ct[CRYPTO_CIPHERTEXTBYTES - BYTES_SALT]; ------------------ | | 20| 2|#define BYTES_SALT (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 2|#define CRYPTO_BYTES OQS_KEM_frodokem_640_aes_length_shared_secret | | | | ------------------ | | | | | | 12| 2|#define OQS_KEM_frodokem_640_aes_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ 176| 2| const uint8_t *sk_s = &sk[0]; 177| 2| const uint8_t *sk_pk = &sk[CRYPTO_BYTES]; ------------------ | | 6| 2|#define CRYPTO_BYTES OQS_KEM_frodokem_640_aes_length_shared_secret | | ------------------ | | | | 12| 2|#define OQS_KEM_frodokem_640_aes_length_shared_secret 16 | | ------------------ ------------------ 178| 2| const uint16_t *sk_S = (uint16_t *) &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES]; ------------------ | | 6| 2|#define CRYPTO_BYTES OQS_KEM_frodokem_640_aes_length_shared_secret | | ------------------ | | | | 12| 2|#define OQS_KEM_frodokem_640_aes_length_shared_secret 16 | | ------------------ ------------------ const uint16_t *sk_S = (uint16_t *) &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES]; ------------------ | | 3| 2|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_frodokem_640_aes_length_public_key | | ------------------ | | | | 9| 2|#define OQS_KEM_frodokem_640_aes_length_public_key 9616 | | ------------------ ------------------ 179| 2| uint16_t S[PARAMS_N * PARAMS_NBAR]; // contains secret data 180| 2| const uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 6| 2|#define CRYPTO_BYTES OQS_KEM_frodokem_640_aes_length_shared_secret | | ------------------ | | | | 12| 2|#define OQS_KEM_frodokem_640_aes_length_shared_secret 16 | | ------------------ ------------------ const uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 3| 2|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_frodokem_640_aes_length_public_key | | ------------------ | | | | 9| 2|#define OQS_KEM_frodokem_640_aes_length_public_key 9616 | | ------------------ ------------------ const uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 11| 2|#define PARAMS_N 640 ------------------ const uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ 181| 2| const uint8_t *pk_seedA = &sk_pk[0]; 182| 2| const uint8_t *pk_b = &sk_pk[BYTES_SEED_A]; ------------------ | | 18| 2|#define BYTES_SEED_A 16 ------------------ 183| 2| uint8_t G2in[BYTES_PKHASH + BYTES_MU + BYTES_SALT]; // contains secret data via muprime 184| 2| uint8_t *pkh = &G2in[0]; 185| 2| uint8_t *muprime = &G2in[BYTES_PKHASH]; // contains secret data ------------------ | | 22| 2|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 2|#define CRYPTO_BYTES OQS_KEM_frodokem_640_aes_length_shared_secret | | | | ------------------ | | | | | | 12| 2|#define OQS_KEM_frodokem_640_aes_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ 186| 2| uint8_t *G2in_salt = &G2in[BYTES_PKHASH + BYTES_MU]; ------------------ | | 22| 2|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 2|#define CRYPTO_BYTES OQS_KEM_frodokem_640_aes_length_shared_secret | | | | ------------------ | | | | | | 12| 2|#define OQS_KEM_frodokem_640_aes_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ uint8_t *G2in_salt = &G2in[BYTES_PKHASH + BYTES_MU]; ------------------ | | 19| 2|#define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 15| 2|#define PARAMS_EXTRACTED_BITS 2 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 2|#define PARAMS_NBAR 8 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 2|#define PARAMS_NBAR 8 | | ------------------ ------------------ 187| 2| uint8_t G2out[BYTES_SEED_SE + CRYPTO_BYTES]; // contains secret data 188| 2| uint8_t *seedSEprime = &G2out[0]; // contains secret data 189| 2| uint8_t *kprime = &G2out[BYTES_SEED_SE]; // contains secret data ------------------ | | 21| 2|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 2|#define CRYPTO_BYTES OQS_KEM_frodokem_640_aes_length_shared_secret | | | | ------------------ | | | | | | 12| 2|#define OQS_KEM_frodokem_640_aes_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ 190| 2| uint8_t Fin[CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES]; // contains secret data via Fin_k 191| 2| uint8_t *Fin_ct = &Fin[0]; 192| 2| uint8_t *Fin_k = &Fin[CRYPTO_CIPHERTEXTBYTES]; // contains secret data ------------------ | | 5| 2|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_frodokem_640_aes_length_ciphertext | | ------------------ | | | | 11| 2|#define OQS_KEM_frodokem_640_aes_length_ciphertext 9752 | | ------------------ ------------------ 193| 2| uint8_t shake_input_seedSEprime[1 + BYTES_SEED_SE]; // contains secret data 194| | 195| | 196| 10.2k| for (size_t i = 0; i < PARAMS_N * PARAMS_NBAR; i++) { ------------------ | | 11| 10.2k|#define PARAMS_N 640 ------------------ for (size_t i = 0; i < PARAMS_N * PARAMS_NBAR; i++) { ------------------ | | 12| 10.2k|#define PARAMS_NBAR 8 ------------------ | Branch (196:24): [True: 10.2k, False: 2] ------------------ 197| 10.2k| S[i] = LE_TO_UINT16(sk_S[i]); ------------------ | | 34| 10.2k| #define LE_TO_UINT16(n) (n) ------------------ 198| 10.2k| } 199| | 200| | // Compute W = C - Bp*S (mod q), and decode the randomness mu 201| 2| frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 42| 2|#define frodo_unpack oqs_kem_frodokem_640_aes_unpack ------------------ frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 11| 2|#define PARAMS_N 640 ------------------ frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 13| 2|#define PARAMS_LOGQ 15 ------------------ frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 11| 2|#define PARAMS_N 640 ------------------ frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 13| 2|#define PARAMS_LOGQ 15 ------------------ 202| 2| frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 42| 2|#define frodo_unpack oqs_kem_frodokem_640_aes_unpack ------------------ frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 13| 2|#define PARAMS_LOGQ 15 ------------------ frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 13| 2|#define PARAMS_LOGQ 15 ------------------ 203| 2| frodo_mul_bs(W, Bp, S); ------------------ | | 53| 2|#define frodo_mul_bs oqs_kem_frodokem_640_aes_mul_bs ------------------ 204| 2| frodo_sub(W, C, W); ------------------ | | 56| 2|#define frodo_sub oqs_kem_frodokem_640_aes_sub ------------------ 205| 2| frodo_key_decode((uint16_t*)muprime, W); ------------------ | | 58| 2|#define frodo_key_decode oqs_kem_frodokem_640_aes_key_decode ------------------ 206| | 207| | // Generate (seedSE' || k') = G_2(pkh || mu' || salt) 208| 2| memcpy(pkh, sk_pkh, BYTES_PKHASH); ------------------ | | 22| 2|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 2|#define CRYPTO_BYTES OQS_KEM_frodokem_640_aes_length_shared_secret | | | | ------------------ | | | | | | 12| 2|#define OQS_KEM_frodokem_640_aes_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ 209| 2| memcpy(G2in_salt, salt, BYTES_SALT); ------------------ | | 20| 2|#define BYTES_SALT (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 2|#define CRYPTO_BYTES OQS_KEM_frodokem_640_aes_length_shared_secret | | | | ------------------ | | | | | | 12| 2|#define OQS_KEM_frodokem_640_aes_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ 210| 2| shake(G2out, BYTES_SEED_SE + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU + BYTES_SALT); ------------------ | | 31| 2|#define shake OQS_SHA3_shake128 ------------------ shake(G2out, BYTES_SEED_SE + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU + BYTES_SALT); ------------------ | | 21| 2|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 2|#define CRYPTO_BYTES OQS_KEM_frodokem_640_aes_length_shared_secret | | | | ------------------ | | | | | | 12| 2|#define OQS_KEM_frodokem_640_aes_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ shake(G2out, BYTES_SEED_SE + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU + BYTES_SALT); ------------------ | | 6| 2|#define CRYPTO_BYTES OQS_KEM_frodokem_640_aes_length_shared_secret | | ------------------ | | | | 12| 2|#define OQS_KEM_frodokem_640_aes_length_shared_secret 16 | | ------------------ ------------------ shake(G2out, BYTES_SEED_SE + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU + BYTES_SALT); ------------------ | | 22| 2|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 2|#define CRYPTO_BYTES OQS_KEM_frodokem_640_aes_length_shared_secret | | | | ------------------ | | | | | | 12| 2|#define OQS_KEM_frodokem_640_aes_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ shake(G2out, BYTES_SEED_SE + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU + BYTES_SALT); ------------------ | | 19| 2|#define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 15| 2|#define PARAMS_EXTRACTED_BITS 2 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 2|#define PARAMS_NBAR 8 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 2|#define PARAMS_NBAR 8 | | ------------------ ------------------ shake(G2out, BYTES_SEED_SE + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU + BYTES_SALT); ------------------ | | 20| 2|#define BYTES_SALT (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 2|#define CRYPTO_BYTES OQS_KEM_frodokem_640_aes_length_shared_secret | | | | ------------------ | | | | | | 12| 2|#define OQS_KEM_frodokem_640_aes_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ 211| | 212| | // Generate Sp and Ep, and compute BBp = Sp*A + Ep. Generate A on-the-fly 213| 2| shake_input_seedSEprime[0] = 0x96; 214| 2| memcpy(&shake_input_seedSEprime[1], seedSEprime, BYTES_SEED_SE); ------------------ | | 21| 2|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 2|#define CRYPTO_BYTES OQS_KEM_frodokem_640_aes_length_shared_secret | | | | ------------------ | | | | | | 12| 2|#define OQS_KEM_frodokem_640_aes_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ 215| 2| shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSEprime, 1 + BYTES_SEED_SE); ------------------ | | 31| 2|#define shake OQS_SHA3_shake128 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSEprime, 1 + BYTES_SEED_SE); ------------------ | | 11| 2|#define PARAMS_N 640 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSEprime, 1 + BYTES_SEED_SE); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSEprime, 1 + BYTES_SEED_SE); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSEprime, 1 + BYTES_SEED_SE); ------------------ | | 21| 2|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 2|#define CRYPTO_BYTES OQS_KEM_frodokem_640_aes_length_shared_secret | | | | ------------------ | | | | | | 12| 2|#define OQS_KEM_frodokem_640_aes_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ 216| 20.6k| for (size_t i = 0; i < (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR; i++) { ------------------ | | 11| 20.6k|#define PARAMS_N 640 ------------------ for (size_t i = 0; i < (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR; i++) { ------------------ | | 12| 20.6k|#define PARAMS_NBAR 8 ------------------ for (size_t i = 0; i < (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR; i++) { ------------------ | | 12| 20.6k|#define PARAMS_NBAR 8 ------------------ | Branch (216:24): [True: 20.6k, False: 2] ------------------ 217| 20.6k| Sp[i] = LE_TO_UINT16(Sp[i]); ------------------ | | 34| 20.6k| #define LE_TO_UINT16(n) (n) ------------------ 218| 20.6k| } 219| 2| frodo_sample_n(Sp, PARAMS_N*PARAMS_NBAR); ------------------ | | 40| 2|#define frodo_sample_n oqs_kem_frodokem_640_aes_sample_n ------------------ frodo_sample_n(Sp, PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 2|#define PARAMS_N 640 ------------------ frodo_sample_n(Sp, PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ 220| 2| frodo_sample_n(Ep, PARAMS_N*PARAMS_NBAR); ------------------ | | 40| 2|#define frodo_sample_n oqs_kem_frodokem_640_aes_sample_n ------------------ frodo_sample_n(Ep, PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 2|#define PARAMS_N 640 ------------------ frodo_sample_n(Ep, PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ 221| 2| frodo_mul_add_sa_plus_e(BBp, Sp, Ep, pk_seedA); ------------------ | | 49| 2|#define frodo_mul_add_sa_plus_e oqs_kem_frodokem_640_aes_mul_add_sa_plus_e ------------------ 222| | 223| | // Generate Epp, and compute W = Sp*B + Epp 224| 2| frodo_sample_n(Epp, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 40| 2|#define frodo_sample_n oqs_kem_frodokem_640_aes_sample_n ------------------ frodo_sample_n(Epp, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ frodo_sample_n(Epp, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ 225| 2| frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 42| 2|#define frodo_unpack oqs_kem_frodokem_640_aes_unpack ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 11| 2|#define PARAMS_N 640 ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 3| 2|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_frodokem_640_aes_length_public_key | | ------------------ | | | | 9| 2|#define OQS_KEM_frodokem_640_aes_length_public_key 9616 | | ------------------ ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 18| 2|#define BYTES_SEED_A 16 ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 13| 2|#define PARAMS_LOGQ 15 ------------------ 226| 2| frodo_mul_add_sb_plus_e(W, B, Sp, Epp); ------------------ | | 52| 2|#define frodo_mul_add_sb_plus_e oqs_kem_frodokem_640_aes_mul_add_sb_plus_e ------------------ 227| | 228| | // Encode mu, and compute CC = W + enc(mu') (mod q) 229| 2| frodo_key_encode(CC, (uint16_t*)muprime); ------------------ | | 57| 2|#define frodo_key_encode oqs_kem_frodokem_640_aes_key_encode ------------------ 230| 2| frodo_add(CC, W, CC); ------------------ | | 55| 2|#define frodo_add oqs_kem_frodokem_640_aes_add ------------------ 231| | 232| | // Prepare input to F 233| 2| memcpy(Fin_ct, ct, CRYPTO_CIPHERTEXTBYTES); ------------------ | | 5| 2|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_frodokem_640_aes_length_ciphertext | | ------------------ | | | | 11| 2|#define OQS_KEM_frodokem_640_aes_length_ciphertext 9752 | | ------------------ ------------------ 234| | 235| | // Reducing BBp modulo q 236| 10.2k| for (int i = 0; i < PARAMS_N*PARAMS_NBAR; i++) BBp[i] = BBp[i] & ((1 << PARAMS_LOGQ)-1); ------------------ | | 11| 10.2k|#define PARAMS_N 640 ------------------ for (int i = 0; i < PARAMS_N*PARAMS_NBAR; i++) BBp[i] = BBp[i] & ((1 << PARAMS_LOGQ)-1); ------------------ | | 12| 10.2k|#define PARAMS_NBAR 8 ------------------ for (int i = 0; i < PARAMS_N*PARAMS_NBAR; i++) BBp[i] = BBp[i] & ((1 << PARAMS_LOGQ)-1); ------------------ | | 13| 10.2k|#define PARAMS_LOGQ 15 ------------------ | Branch (236:21): [True: 10.2k, False: 2] ------------------ 237| | 238| | // Needs to avoid branching on secret data using constant-time implementation. 239| 2| int8_t selector = ct_verify(Bp, BBp, PARAMS_N*PARAMS_NBAR) | ct_verify(C, CC, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 44| 2|#define ct_verify oqs_kem_frodokem_640_aes_ct_verify ------------------ int8_t selector = ct_verify(Bp, BBp, PARAMS_N*PARAMS_NBAR) | ct_verify(C, CC, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 11| 2|#define PARAMS_N 640 ------------------ int8_t selector = ct_verify(Bp, BBp, PARAMS_N*PARAMS_NBAR) | ct_verify(C, CC, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ int8_t selector = ct_verify(Bp, BBp, PARAMS_N*PARAMS_NBAR) | ct_verify(C, CC, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 44| 2|#define ct_verify oqs_kem_frodokem_640_aes_ct_verify ------------------ int8_t selector = ct_verify(Bp, BBp, PARAMS_N*PARAMS_NBAR) | ct_verify(C, CC, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ int8_t selector = ct_verify(Bp, BBp, PARAMS_N*PARAMS_NBAR) | ct_verify(C, CC, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ 240| | // If (selector == 0) then load k' to do ss = F(ct || k'), else if (selector == -1) load s to do ss = F(ct || s) 241| 2| ct_select((uint8_t*)Fin_k, (uint8_t*)kprime, (uint8_t*)sk_s, CRYPTO_BYTES, selector); ------------------ | | 43| 2|#define ct_select oqs_kem_frodokem_640_aes_ct_select ------------------ ct_select((uint8_t*)Fin_k, (uint8_t*)kprime, (uint8_t*)sk_s, CRYPTO_BYTES, selector); ------------------ | | 6| 2|#define CRYPTO_BYTES OQS_KEM_frodokem_640_aes_length_shared_secret | | ------------------ | | | | 12| 2|#define OQS_KEM_frodokem_640_aes_length_shared_secret 16 | | ------------------ ------------------ 242| 2| shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 31| 2|#define shake OQS_SHA3_shake128 ------------------ shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 6| 2|#define CRYPTO_BYTES OQS_KEM_frodokem_640_aes_length_shared_secret | | ------------------ | | | | 12| 2|#define OQS_KEM_frodokem_640_aes_length_shared_secret 16 | | ------------------ ------------------ shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 5| 2|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_frodokem_640_aes_length_ciphertext | | ------------------ | | | | 11| 2|#define OQS_KEM_frodokem_640_aes_length_ciphertext 9752 | | ------------------ ------------------ shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 6| 2|#define CRYPTO_BYTES OQS_KEM_frodokem_640_aes_length_shared_secret | | ------------------ | | | | 12| 2|#define OQS_KEM_frodokem_640_aes_length_shared_secret 16 | | ------------------ ------------------ 243| | 244| | // Cleanup: 245| 2| clear_bytes((uint8_t *)W, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 29| 2|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)W, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ clear_bytes((uint8_t *)W, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ 246| 2| clear_bytes((uint8_t *)Sp, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 29| 2|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)Sp, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 2|#define PARAMS_N 640 ------------------ clear_bytes((uint8_t *)Sp, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ 247| 2| clear_bytes((uint8_t *)S, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 29| 2|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)S, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 2|#define PARAMS_N 640 ------------------ clear_bytes((uint8_t *)S, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ 248| 2| clear_bytes((uint8_t *)Ep, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 29| 2|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)Ep, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 2|#define PARAMS_N 640 ------------------ clear_bytes((uint8_t *)Ep, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ 249| 2| clear_bytes((uint8_t *)Epp, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 29| 2|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)Epp, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ clear_bytes((uint8_t *)Epp, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ 250| 2| clear_bytes(muprime, BYTES_MU); ------------------ | | 29| 2|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(muprime, BYTES_MU); ------------------ | | 19| 2|#define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 15| 2|#define PARAMS_EXTRACTED_BITS 2 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 2|#define PARAMS_NBAR 8 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 2|#define PARAMS_NBAR 8 | | ------------------ ------------------ 251| 2| clear_bytes(G2out, BYTES_SEED_SE + CRYPTO_BYTES); ------------------ | | 29| 2|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(G2out, BYTES_SEED_SE + CRYPTO_BYTES); ------------------ | | 21| 2|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 2|#define CRYPTO_BYTES OQS_KEM_frodokem_640_aes_length_shared_secret | | | | ------------------ | | | | | | 12| 2|#define OQS_KEM_frodokem_640_aes_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ clear_bytes(G2out, BYTES_SEED_SE + CRYPTO_BYTES); ------------------ | | 6| 2|#define CRYPTO_BYTES OQS_KEM_frodokem_640_aes_length_shared_secret | | ------------------ | | | | 12| 2|#define OQS_KEM_frodokem_640_aes_length_shared_secret 16 | | ------------------ ------------------ 252| 2| clear_bytes(Fin_k, CRYPTO_BYTES); ------------------ | | 29| 2|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(Fin_k, CRYPTO_BYTES); ------------------ | | 6| 2|#define CRYPTO_BYTES OQS_KEM_frodokem_640_aes_length_shared_secret | | ------------------ | | | | 12| 2|#define OQS_KEM_frodokem_640_aes_length_shared_secret 16 | | ------------------ ------------------ 253| 2| clear_bytes(shake_input_seedSEprime, 1 + BYTES_SEED_SE); ------------------ | | 29| 2|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(shake_input_seedSEprime, 1 + BYTES_SEED_SE); ------------------ | | 21| 2|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 2|#define CRYPTO_BYTES OQS_KEM_frodokem_640_aes_length_shared_secret | | | | ------------------ | | | | | | 12| 2|#define OQS_KEM_frodokem_640_aes_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ 254| 2| return OQS_SUCCESS; 255| 2|} OQS_KEM_frodokem_640_shake_keypair: 19| 3|{ // FrodoKEM's key generation 20| | // Outputs: public key pk = pk_seedA||pk_b ( BYTES_SEED_A + (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8 bytes) 21| | // secret key sk = sk_s||pk_seedA||pk_b||sk_S||sk_pkh (CRYPTO_BYTES + BYTES_SEED_A + (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8 + 2*PARAMS_N*PARAMS_NBAR + BYTES_PKHASH bytes) 22| 3| uint8_t *pk_seedA = &pk[0]; 23| 3| uint8_t *pk_b = &pk[BYTES_SEED_A]; ------------------ | | 18| 3|#define BYTES_SEED_A 16 ------------------ 24| 3| uint8_t *sk_s = &sk[0]; 25| 3| uint8_t *sk_pk = &sk[CRYPTO_BYTES]; ------------------ | | 6| 3|#define CRYPTO_BYTES OQS_KEM_frodokem_640_shake_length_shared_secret | | ------------------ | | | | 27| 3|#define OQS_KEM_frodokem_640_shake_length_shared_secret 16 | | ------------------ ------------------ 26| 3| uint8_t *sk_S = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES]; ------------------ | | 6| 3|#define CRYPTO_BYTES OQS_KEM_frodokem_640_shake_length_shared_secret | | ------------------ | | | | 27| 3|#define OQS_KEM_frodokem_640_shake_length_shared_secret 16 | | ------------------ ------------------ uint8_t *sk_S = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES]; ------------------ | | 3| 3|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_frodokem_640_shake_length_public_key | | ------------------ | | | | 24| 3|#define OQS_KEM_frodokem_640_shake_length_public_key 9616 | | ------------------ ------------------ 27| 3| uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 6| 3|#define CRYPTO_BYTES OQS_KEM_frodokem_640_shake_length_shared_secret | | ------------------ | | | | 27| 3|#define OQS_KEM_frodokem_640_shake_length_shared_secret 16 | | ------------------ ------------------ uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 3| 3|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_frodokem_640_shake_length_public_key | | ------------------ | | | | 24| 3|#define OQS_KEM_frodokem_640_shake_length_public_key 9616 | | ------------------ ------------------ uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 11| 3|#define PARAMS_N 640 ------------------ uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ 28| 3| uint16_t B[PARAMS_N*PARAMS_NBAR] = {0}; 29| 3| uint16_t S[2*PARAMS_N*PARAMS_NBAR] = {0}; // contains secret data 30| 3| uint16_t *E = (uint16_t *)&S[PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 11| 3|#define PARAMS_N 640 ------------------ uint16_t *E = (uint16_t *)&S[PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ 31| 3| uint8_t randomness[CRYPTO_BYTES + BYTES_SEED_SE + BYTES_SEED_A]; // contains secret data via randomness_s and randomness_seedSE 32| 3| uint8_t *randomness_s = &randomness[0]; // contains secret data 33| 3| uint8_t *randomness_seedSE = &randomness[CRYPTO_BYTES]; // contains secret data ------------------ | | 6| 3|#define CRYPTO_BYTES OQS_KEM_frodokem_640_shake_length_shared_secret | | ------------------ | | | | 27| 3|#define OQS_KEM_frodokem_640_shake_length_shared_secret 16 | | ------------------ ------------------ 34| 3| uint8_t *randomness_z = &randomness[CRYPTO_BYTES + BYTES_SEED_SE]; ------------------ | | 6| 3|#define CRYPTO_BYTES OQS_KEM_frodokem_640_shake_length_shared_secret | | ------------------ | | | | 27| 3|#define OQS_KEM_frodokem_640_shake_length_shared_secret 16 | | ------------------ ------------------ uint8_t *randomness_z = &randomness[CRYPTO_BYTES + BYTES_SEED_SE]; ------------------ | | 21| 3|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 3|#define CRYPTO_BYTES OQS_KEM_frodokem_640_shake_length_shared_secret | | | | ------------------ | | | | | | 27| 3|#define OQS_KEM_frodokem_640_shake_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ 35| 3| uint8_t shake_input_seedSE[1 + BYTES_SEED_SE]; // contains secret data 36| | 37| | // Generate the secret value s, the seed for S and E, and the seed for the seed for A. Add seed_A to the public key 38| 3| randombytes(randomness, CRYPTO_BYTES + BYTES_SEED_SE + BYTES_SEED_A); ------------------ | | 28| 3|#define randombytes OQS_randombytes ------------------ randombytes(randomness, CRYPTO_BYTES + BYTES_SEED_SE + BYTES_SEED_A); ------------------ | | 6| 3|#define CRYPTO_BYTES OQS_KEM_frodokem_640_shake_length_shared_secret | | ------------------ | | | | 27| 3|#define OQS_KEM_frodokem_640_shake_length_shared_secret 16 | | ------------------ ------------------ randombytes(randomness, CRYPTO_BYTES + BYTES_SEED_SE + BYTES_SEED_A); ------------------ | | 21| 3|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 3|#define CRYPTO_BYTES OQS_KEM_frodokem_640_shake_length_shared_secret | | | | ------------------ | | | | | | 27| 3|#define OQS_KEM_frodokem_640_shake_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ randombytes(randomness, CRYPTO_BYTES + BYTES_SEED_SE + BYTES_SEED_A); ------------------ | | 18| 3|#define BYTES_SEED_A 16 ------------------ 39| 3| shake(pk_seedA, BYTES_SEED_A, randomness_z, BYTES_SEED_A); ------------------ | | 31| 3|#define shake OQS_SHA3_shake128 ------------------ shake(pk_seedA, BYTES_SEED_A, randomness_z, BYTES_SEED_A); ------------------ | | 18| 3|#define BYTES_SEED_A 16 ------------------ shake(pk_seedA, BYTES_SEED_A, randomness_z, BYTES_SEED_A); ------------------ | | 18| 3|#define BYTES_SEED_A 16 ------------------ 40| | 41| | // Generate S and E, and compute B = A*S + E. Generate A on-the-fly 42| 3| shake_input_seedSE[0] = 0x5F; 43| 3| memcpy(&shake_input_seedSE[1], randomness_seedSE, BYTES_SEED_SE); ------------------ | | 21| 3|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 3|#define CRYPTO_BYTES OQS_KEM_frodokem_640_shake_length_shared_secret | | | | ------------------ | | | | | | 27| 3|#define OQS_KEM_frodokem_640_shake_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ 44| 3| shake((uint8_t*)S, 2*PARAMS_N*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + BYTES_SEED_SE); ------------------ | | 31| 3|#define shake OQS_SHA3_shake128 ------------------ shake((uint8_t*)S, 2*PARAMS_N*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + BYTES_SEED_SE); ------------------ | | 11| 3|#define PARAMS_N 640 ------------------ shake((uint8_t*)S, 2*PARAMS_N*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + BYTES_SEED_SE); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ shake((uint8_t*)S, 2*PARAMS_N*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + BYTES_SEED_SE); ------------------ | | 21| 3|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 3|#define CRYPTO_BYTES OQS_KEM_frodokem_640_shake_length_shared_secret | | | | ------------------ | | | | | | 27| 3|#define OQS_KEM_frodokem_640_shake_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ 45| 30.7k| for (size_t i = 0; i < 2 * PARAMS_N * PARAMS_NBAR; i++) { ------------------ | | 11| 30.7k|#define PARAMS_N 640 ------------------ for (size_t i = 0; i < 2 * PARAMS_N * PARAMS_NBAR; i++) { ------------------ | | 12| 30.7k|#define PARAMS_NBAR 8 ------------------ | Branch (45:24): [True: 30.7k, False: 3] ------------------ 46| 30.7k| S[i] = LE_TO_UINT16(S[i]); ------------------ | | 34| 30.7k| #define LE_TO_UINT16(n) (n) ------------------ 47| 30.7k| } 48| 3| frodo_sample_n(S, PARAMS_N*PARAMS_NBAR); ------------------ | | 40| 3|#define frodo_sample_n oqs_kem_frodokem_640_shake_sample_n ------------------ frodo_sample_n(S, PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 3|#define PARAMS_N 640 ------------------ frodo_sample_n(S, PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ 49| 3| frodo_sample_n(E, PARAMS_N*PARAMS_NBAR); ------------------ | | 40| 3|#define frodo_sample_n oqs_kem_frodokem_640_shake_sample_n ------------------ frodo_sample_n(E, PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 3|#define PARAMS_N 640 ------------------ frodo_sample_n(E, PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ 50| 3| frodo_mul_add_as_plus_e(B, S, E, pk); ------------------ | | 46| 3|#define frodo_mul_add_as_plus_e oqs_kem_frodokem_640_shake_mul_add_as_plus_e ------------------ 51| | 52| | // Encode the second part of the public key 53| 3| frodo_pack(pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, B, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 41| 3|#define frodo_pack oqs_kem_frodokem_640_shake_pack ------------------ frodo_pack(pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, B, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 3| 3|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_frodokem_640_shake_length_public_key | | ------------------ | | | | 24| 3|#define OQS_KEM_frodokem_640_shake_length_public_key 9616 | | ------------------ ------------------ frodo_pack(pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, B, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 18| 3|#define BYTES_SEED_A 16 ------------------ frodo_pack(pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, B, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 11| 3|#define PARAMS_N 640 ------------------ frodo_pack(pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, B, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ frodo_pack(pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, B, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 13| 3|#define PARAMS_LOGQ 15 ------------------ 54| | 55| | // Add s, pk and S to the secret key 56| 3| memcpy(sk_s, randomness_s, CRYPTO_BYTES); ------------------ | | 6| 3|#define CRYPTO_BYTES OQS_KEM_frodokem_640_shake_length_shared_secret | | ------------------ | | | | 27| 3|#define OQS_KEM_frodokem_640_shake_length_shared_secret 16 | | ------------------ ------------------ 57| 3| memcpy(sk_pk, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 3| 3|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_frodokem_640_shake_length_public_key | | ------------------ | | | | 24| 3|#define OQS_KEM_frodokem_640_shake_length_public_key 9616 | | ------------------ ------------------ 58| 15.3k| for (size_t i = 0; i < PARAMS_N * PARAMS_NBAR; i++) { ------------------ | | 11| 15.3k|#define PARAMS_N 640 ------------------ for (size_t i = 0; i < PARAMS_N * PARAMS_NBAR; i++) { ------------------ | | 12| 15.3k|#define PARAMS_NBAR 8 ------------------ | Branch (58:24): [True: 15.3k, False: 3] ------------------ 59| 15.3k| S[i] = UINT16_TO_LE(S[i]); ------------------ | | 35| 15.3k| #define UINT16_TO_LE(n) (n) ------------------ 60| 15.3k| } 61| 3| memcpy(sk_S, S, 2*PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 3|#define PARAMS_N 640 ------------------ memcpy(sk_S, S, 2*PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ 62| | 63| | // Add H(pk) to the secret key 64| 3| shake(sk_pkh, BYTES_PKHASH, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 31| 3|#define shake OQS_SHA3_shake128 ------------------ shake(sk_pkh, BYTES_PKHASH, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 22| 3|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 3|#define CRYPTO_BYTES OQS_KEM_frodokem_640_shake_length_shared_secret | | | | ------------------ | | | | | | 27| 3|#define OQS_KEM_frodokem_640_shake_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ shake(sk_pkh, BYTES_PKHASH, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 3| 3|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_frodokem_640_shake_length_public_key | | ------------------ | | | | 24| 3|#define OQS_KEM_frodokem_640_shake_length_public_key 9616 | | ------------------ ------------------ 65| | 66| | // Cleanup: 67| 3| clear_bytes((uint8_t *)S, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 29| 3|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)S, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 3|#define PARAMS_N 640 ------------------ clear_bytes((uint8_t *)S, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ 68| 3| clear_bytes((uint8_t *)E, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 29| 3|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)E, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 3|#define PARAMS_N 640 ------------------ clear_bytes((uint8_t *)E, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ 69| 3| clear_bytes(randomness, CRYPTO_BYTES + BYTES_SEED_SE); ------------------ | | 29| 3|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(randomness, CRYPTO_BYTES + BYTES_SEED_SE); ------------------ | | 6| 3|#define CRYPTO_BYTES OQS_KEM_frodokem_640_shake_length_shared_secret | | ------------------ | | | | 27| 3|#define OQS_KEM_frodokem_640_shake_length_shared_secret 16 | | ------------------ ------------------ clear_bytes(randomness, CRYPTO_BYTES + BYTES_SEED_SE); ------------------ | | 21| 3|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 3|#define CRYPTO_BYTES OQS_KEM_frodokem_640_shake_length_shared_secret | | | | ------------------ | | | | | | 27| 3|#define OQS_KEM_frodokem_640_shake_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ 70| 3| clear_bytes(shake_input_seedSE, 1 + BYTES_SEED_SE); ------------------ | | 29| 3|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(shake_input_seedSE, 1 + BYTES_SEED_SE); ------------------ | | 21| 3|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 3|#define CRYPTO_BYTES OQS_KEM_frodokem_640_shake_length_shared_secret | | | | ------------------ | | | | | | 27| 3|#define OQS_KEM_frodokem_640_shake_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ 71| 3| return OQS_SUCCESS; 72| 3|} OQS_KEM_frodokem_640_shake_encaps: 86| 3|{ // FrodoKEM's key encapsulation 87| | // Input: public key pk = pk_seedA||pk_b (BYTES_SEED_A + (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8 bytes) 88| | // Outputs: ciphertext ct = ct_c1||ct_c2||salt ( (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8 + (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8 + BYTES_SALT bytes) 89| | // shared key ss (CRYPTO_BYTES bytes) 90| 3| const uint8_t *pk_seedA = &pk[0]; 91| 3| const uint8_t *pk_b = &pk[BYTES_SEED_A]; ------------------ | | 18| 3|#define BYTES_SEED_A 16 ------------------ 92| 3| uint8_t *ct_c1 = &ct[0]; 93| 3| uint8_t *ct_c2 = &ct[(PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8]; ------------------ | | 13| 3|#define PARAMS_LOGQ 15 ------------------ uint8_t *ct_c2 = &ct[(PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8]; ------------------ | | 11| 3|#define PARAMS_N 640 ------------------ uint8_t *ct_c2 = &ct[(PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8]; ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ 94| 3| uint16_t B[PARAMS_N*PARAMS_NBAR] = {0}; 95| 3| uint16_t V[PARAMS_NBAR*PARAMS_NBAR]= {0}; // contains secret data 96| 3| uint16_t C[PARAMS_NBAR*PARAMS_NBAR] = {0}; 97| 3| ALIGN_HEADER(32) uint16_t Bp[PARAMS_N*PARAMS_NBAR] ALIGN_FOOTER(32) = {0}; 98| 3| ALIGN_HEADER(32) uint16_t Sp[(2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR] ALIGN_FOOTER(32) = {0}; // contains secret data 99| 3| uint16_t *Ep = (uint16_t *)&Sp[PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 11| 3|#define PARAMS_N 640 ------------------ uint16_t *Ep = (uint16_t *)&Sp[PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ 100| 3| uint16_t *Epp = (uint16_t *)&Sp[2*PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 11| 3|#define PARAMS_N 640 ------------------ uint16_t *Epp = (uint16_t *)&Sp[2*PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ 101| 3| uint8_t G2in[BYTES_PKHASH + BYTES_MU + BYTES_SALT]; // contains secret data via mu 102| 3| uint8_t *pkh = &G2in[0]; 103| 3| uint8_t *mu = &G2in[BYTES_PKHASH]; // contains secret data ------------------ | | 22| 3|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 3|#define CRYPTO_BYTES OQS_KEM_frodokem_640_shake_length_shared_secret | | | | ------------------ | | | | | | 27| 3|#define OQS_KEM_frodokem_640_shake_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ 104| 3| uint8_t *salt = &G2in[BYTES_PKHASH + BYTES_MU]; ------------------ | | 22| 3|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 3|#define CRYPTO_BYTES OQS_KEM_frodokem_640_shake_length_shared_secret | | | | ------------------ | | | | | | 27| 3|#define OQS_KEM_frodokem_640_shake_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ uint8_t *salt = &G2in[BYTES_PKHASH + BYTES_MU]; ------------------ | | 19| 3|#define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 15| 3|#define PARAMS_EXTRACTED_BITS 2 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 3|#define PARAMS_NBAR 8 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 3|#define PARAMS_NBAR 8 | | ------------------ ------------------ 105| 3| uint8_t G2out[BYTES_SEED_SE + CRYPTO_BYTES]; // contains secret data 106| 3| uint8_t *seedSE = &G2out[0]; // contains secret data 107| 3| uint8_t *k = &G2out[BYTES_SEED_SE]; // contains secret data ------------------ | | 21| 3|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 3|#define CRYPTO_BYTES OQS_KEM_frodokem_640_shake_length_shared_secret | | | | ------------------ | | | | | | 27| 3|#define OQS_KEM_frodokem_640_shake_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ 108| 3| uint8_t Fin[CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES]; // contains secret data via Fin_k 109| 3| uint8_t *Fin_ct = &Fin[0]; 110| 3| uint8_t *Fin_k = &Fin[CRYPTO_CIPHERTEXTBYTES]; // contains secret data ------------------ | | 5| 3|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_frodokem_640_shake_length_ciphertext | | ------------------ | | | | 26| 3|#define OQS_KEM_frodokem_640_shake_length_ciphertext 9752 | | ------------------ ------------------ 111| 3| uint8_t shake_input_seedSE[1 + BYTES_SEED_SE]; // contains secret data 112| | 113| | // pkh <- G_1(pk), generate random mu and salt, compute (seedSE || k) = G_2(pkh || mu || salt) 114| 3| shake(pkh, BYTES_PKHASH, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 31| 3|#define shake OQS_SHA3_shake128 ------------------ shake(pkh, BYTES_PKHASH, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 22| 3|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 3|#define CRYPTO_BYTES OQS_KEM_frodokem_640_shake_length_shared_secret | | | | ------------------ | | | | | | 27| 3|#define OQS_KEM_frodokem_640_shake_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ shake(pkh, BYTES_PKHASH, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 3| 3|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_frodokem_640_shake_length_public_key | | ------------------ | | | | 24| 3|#define OQS_KEM_frodokem_640_shake_length_public_key 9616 | | ------------------ ------------------ 115| 3| randombytes(mu, BYTES_MU + BYTES_SALT); ------------------ | | 28| 3|#define randombytes OQS_randombytes ------------------ randombytes(mu, BYTES_MU + BYTES_SALT); ------------------ | | 19| 3|#define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 15| 3|#define PARAMS_EXTRACTED_BITS 2 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 3|#define PARAMS_NBAR 8 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 3|#define PARAMS_NBAR 8 | | ------------------ ------------------ randombytes(mu, BYTES_MU + BYTES_SALT); ------------------ | | 20| 3|#define BYTES_SALT (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 3|#define CRYPTO_BYTES OQS_KEM_frodokem_640_shake_length_shared_secret | | | | ------------------ | | | | | | 27| 3|#define OQS_KEM_frodokem_640_shake_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ 116| 3| shake(G2out, BYTES_SEED_SE + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU + BYTES_SALT); ------------------ | | 31| 3|#define shake OQS_SHA3_shake128 ------------------ shake(G2out, BYTES_SEED_SE + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU + BYTES_SALT); ------------------ | | 21| 3|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 3|#define CRYPTO_BYTES OQS_KEM_frodokem_640_shake_length_shared_secret | | | | ------------------ | | | | | | 27| 3|#define OQS_KEM_frodokem_640_shake_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ shake(G2out, BYTES_SEED_SE + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU + BYTES_SALT); ------------------ | | 6| 3|#define CRYPTO_BYTES OQS_KEM_frodokem_640_shake_length_shared_secret | | ------------------ | | | | 27| 3|#define OQS_KEM_frodokem_640_shake_length_shared_secret 16 | | ------------------ ------------------ shake(G2out, BYTES_SEED_SE + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU + BYTES_SALT); ------------------ | | 22| 3|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 3|#define CRYPTO_BYTES OQS_KEM_frodokem_640_shake_length_shared_secret | | | | ------------------ | | | | | | 27| 3|#define OQS_KEM_frodokem_640_shake_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ shake(G2out, BYTES_SEED_SE + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU + BYTES_SALT); ------------------ | | 19| 3|#define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 15| 3|#define PARAMS_EXTRACTED_BITS 2 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 3|#define PARAMS_NBAR 8 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 3|#define PARAMS_NBAR 8 | | ------------------ ------------------ shake(G2out, BYTES_SEED_SE + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU + BYTES_SALT); ------------------ | | 20| 3|#define BYTES_SALT (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 3|#define CRYPTO_BYTES OQS_KEM_frodokem_640_shake_length_shared_secret | | | | ------------------ | | | | | | 27| 3|#define OQS_KEM_frodokem_640_shake_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ 117| | 118| | // Generate Sp and Ep, and compute Bp = Sp*A + Ep. Generate A on-the-fly 119| 3| shake_input_seedSE[0] = 0x96; 120| 3| memcpy(&shake_input_seedSE[1], seedSE, BYTES_SEED_SE); ------------------ | | 21| 3|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 3|#define CRYPTO_BYTES OQS_KEM_frodokem_640_shake_length_shared_secret | | | | ------------------ | | | | | | 27| 3|#define OQS_KEM_frodokem_640_shake_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ 121| 3| shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + BYTES_SEED_SE); ------------------ | | 31| 3|#define shake OQS_SHA3_shake128 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + BYTES_SEED_SE); ------------------ | | 11| 3|#define PARAMS_N 640 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + BYTES_SEED_SE); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + BYTES_SEED_SE); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + BYTES_SEED_SE); ------------------ | | 21| 3|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 3|#define CRYPTO_BYTES OQS_KEM_frodokem_640_shake_length_shared_secret | | | | ------------------ | | | | | | 27| 3|#define OQS_KEM_frodokem_640_shake_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ 122| 30.9k| for (size_t i = 0; i < (2 * PARAMS_N + PARAMS_NBAR) * PARAMS_NBAR; i++) { ------------------ | | 11| 30.9k|#define PARAMS_N 640 ------------------ for (size_t i = 0; i < (2 * PARAMS_N + PARAMS_NBAR) * PARAMS_NBAR; i++) { ------------------ | | 12| 30.9k|#define PARAMS_NBAR 8 ------------------ for (size_t i = 0; i < (2 * PARAMS_N + PARAMS_NBAR) * PARAMS_NBAR; i++) { ------------------ | | 12| 30.9k|#define PARAMS_NBAR 8 ------------------ | Branch (122:24): [True: 30.9k, False: 3] ------------------ 123| 30.9k| Sp[i] = LE_TO_UINT16(Sp[i]); ------------------ | | 34| 30.9k| #define LE_TO_UINT16(n) (n) ------------------ 124| 30.9k| } 125| 3| frodo_sample_n(Sp, PARAMS_N*PARAMS_NBAR); ------------------ | | 40| 3|#define frodo_sample_n oqs_kem_frodokem_640_shake_sample_n ------------------ frodo_sample_n(Sp, PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 3|#define PARAMS_N 640 ------------------ frodo_sample_n(Sp, PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ 126| 3| frodo_sample_n(Ep, PARAMS_N*PARAMS_NBAR); ------------------ | | 40| 3|#define frodo_sample_n oqs_kem_frodokem_640_shake_sample_n ------------------ frodo_sample_n(Ep, PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 3|#define PARAMS_N 640 ------------------ frodo_sample_n(Ep, PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ 127| 3| frodo_mul_add_sa_plus_e(Bp, Sp, Ep, pk_seedA); ------------------ | | 49| 3|#define frodo_mul_add_sa_plus_e oqs_kem_frodokem_640_shake_mul_add_sa_plus_e ------------------ 128| 3| frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 41| 3|#define frodo_pack oqs_kem_frodokem_640_shake_pack ------------------ frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 13| 3|#define PARAMS_LOGQ 15 ------------------ frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 11| 3|#define PARAMS_N 640 ------------------ frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 11| 3|#define PARAMS_N 640 ------------------ frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 13| 3|#define PARAMS_LOGQ 15 ------------------ 129| | 130| | // Generate Epp, and compute V = Sp*B + Epp 131| 3| frodo_sample_n(Epp, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 40| 3|#define frodo_sample_n oqs_kem_frodokem_640_shake_sample_n ------------------ frodo_sample_n(Epp, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ frodo_sample_n(Epp, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ 132| 3| frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 42| 3|#define frodo_unpack oqs_kem_frodokem_640_shake_unpack ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 11| 3|#define PARAMS_N 640 ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 3| 3|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_frodokem_640_shake_length_public_key | | ------------------ | | | | 24| 3|#define OQS_KEM_frodokem_640_shake_length_public_key 9616 | | ------------------ ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 18| 3|#define BYTES_SEED_A 16 ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 13| 3|#define PARAMS_LOGQ 15 ------------------ 133| 3| frodo_mul_add_sb_plus_e(V, B, Sp, Epp); ------------------ | | 52| 3|#define frodo_mul_add_sb_plus_e oqs_kem_frodokem_640_shake_mul_add_sb_plus_e ------------------ 134| | 135| | // Encode mu, and compute C = V + enc(mu) (mod q) 136| 3| frodo_key_encode(C, (uint16_t*)mu); ------------------ | | 57| 3|#define frodo_key_encode oqs_kem_frodokem_640_shake_key_encode ------------------ 137| 3| frodo_add(C, V, C); ------------------ | | 55| 3|#define frodo_add oqs_kem_frodokem_640_shake_add ------------------ 138| 3| frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 41| 3|#define frodo_pack oqs_kem_frodokem_640_shake_pack ------------------ frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 13| 3|#define PARAMS_LOGQ 15 ------------------ frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 13| 3|#define PARAMS_LOGQ 15 ------------------ 139| | 140| | // Append salt to ct and compute ss = F(ct_c1||ct_c2||salt||k) 141| 3| memcpy(&ct[CRYPTO_CIPHERTEXTBYTES - BYTES_SALT], salt, BYTES_SALT); ------------------ | | 5| 3|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_frodokem_640_shake_length_ciphertext | | ------------------ | | | | 26| 3|#define OQS_KEM_frodokem_640_shake_length_ciphertext 9752 | | ------------------ ------------------ memcpy(&ct[CRYPTO_CIPHERTEXTBYTES - BYTES_SALT], salt, BYTES_SALT); ------------------ | | 20| 3|#define BYTES_SALT (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 3|#define CRYPTO_BYTES OQS_KEM_frodokem_640_shake_length_shared_secret | | | | ------------------ | | | | | | 27| 3|#define OQS_KEM_frodokem_640_shake_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ memcpy(&ct[CRYPTO_CIPHERTEXTBYTES - BYTES_SALT], salt, BYTES_SALT); ------------------ | | 20| 3|#define BYTES_SALT (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 3|#define CRYPTO_BYTES OQS_KEM_frodokem_640_shake_length_shared_secret | | | | ------------------ | | | | | | 27| 3|#define OQS_KEM_frodokem_640_shake_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ 142| 3| memcpy(Fin_ct, ct, CRYPTO_CIPHERTEXTBYTES); ------------------ | | 5| 3|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_frodokem_640_shake_length_ciphertext | | ------------------ | | | | 26| 3|#define OQS_KEM_frodokem_640_shake_length_ciphertext 9752 | | ------------------ ------------------ 143| 3| memcpy(Fin_k, k, CRYPTO_BYTES); ------------------ | | 6| 3|#define CRYPTO_BYTES OQS_KEM_frodokem_640_shake_length_shared_secret | | ------------------ | | | | 27| 3|#define OQS_KEM_frodokem_640_shake_length_shared_secret 16 | | ------------------ ------------------ 144| 3| shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 31| 3|#define shake OQS_SHA3_shake128 ------------------ shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 6| 3|#define CRYPTO_BYTES OQS_KEM_frodokem_640_shake_length_shared_secret | | ------------------ | | | | 27| 3|#define OQS_KEM_frodokem_640_shake_length_shared_secret 16 | | ------------------ ------------------ shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 5| 3|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_frodokem_640_shake_length_ciphertext | | ------------------ | | | | 26| 3|#define OQS_KEM_frodokem_640_shake_length_ciphertext 9752 | | ------------------ ------------------ shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 6| 3|#define CRYPTO_BYTES OQS_KEM_frodokem_640_shake_length_shared_secret | | ------------------ | | | | 27| 3|#define OQS_KEM_frodokem_640_shake_length_shared_secret 16 | | ------------------ ------------------ 145| | 146| | // Cleanup: 147| 3| clear_bytes((uint8_t *)V, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 29| 3|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)V, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ clear_bytes((uint8_t *)V, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ 148| 3| clear_bytes((uint8_t *)Sp, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 29| 3|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)Sp, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 3|#define PARAMS_N 640 ------------------ clear_bytes((uint8_t *)Sp, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ 149| 3| clear_bytes((uint8_t *)Ep, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 29| 3|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)Ep, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 3|#define PARAMS_N 640 ------------------ clear_bytes((uint8_t *)Ep, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ 150| 3| clear_bytes((uint8_t *)Epp, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 29| 3|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)Epp, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ clear_bytes((uint8_t *)Epp, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ 151| 3| clear_bytes(mu, BYTES_MU); ------------------ | | 29| 3|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(mu, BYTES_MU); ------------------ | | 19| 3|#define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 15| 3|#define PARAMS_EXTRACTED_BITS 2 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 3|#define PARAMS_NBAR 8 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 3|#define PARAMS_NBAR 8 | | ------------------ ------------------ 152| 3| clear_bytes(G2out, BYTES_SEED_SE + CRYPTO_BYTES); ------------------ | | 29| 3|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(G2out, BYTES_SEED_SE + CRYPTO_BYTES); ------------------ | | 21| 3|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 3|#define CRYPTO_BYTES OQS_KEM_frodokem_640_shake_length_shared_secret | | | | ------------------ | | | | | | 27| 3|#define OQS_KEM_frodokem_640_shake_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ clear_bytes(G2out, BYTES_SEED_SE + CRYPTO_BYTES); ------------------ | | 6| 3|#define CRYPTO_BYTES OQS_KEM_frodokem_640_shake_length_shared_secret | | ------------------ | | | | 27| 3|#define OQS_KEM_frodokem_640_shake_length_shared_secret 16 | | ------------------ ------------------ 153| 3| clear_bytes(Fin_k, CRYPTO_BYTES); ------------------ | | 29| 3|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(Fin_k, CRYPTO_BYTES); ------------------ | | 6| 3|#define CRYPTO_BYTES OQS_KEM_frodokem_640_shake_length_shared_secret | | ------------------ | | | | 27| 3|#define OQS_KEM_frodokem_640_shake_length_shared_secret 16 | | ------------------ ------------------ 154| 3| clear_bytes(shake_input_seedSE, 1 + BYTES_SEED_SE); ------------------ | | 29| 3|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(shake_input_seedSE, 1 + BYTES_SEED_SE); ------------------ | | 21| 3|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 3|#define CRYPTO_BYTES OQS_KEM_frodokem_640_shake_length_shared_secret | | | | ------------------ | | | | | | 27| 3|#define OQS_KEM_frodokem_640_shake_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ 155| 3| return OQS_SUCCESS; 156| 3|} OQS_KEM_frodokem_640_shake_decaps: 160| 3|{ // FrodoKEM's key decapsulation 161| | // Inputs: ciphertext ct = ct_c1||ct_c2||salt ( (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8 + (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8 + BYTES_SALT bytes) 162| | // secret key sk = sk_s||pk_seedA||pk_b||sk_S||sk_pkh (CRYPTO_BYTES + BYTES_SEED_A + (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8 + 2*PARAMS_N*PARAMS_NBAR + BYTES_PKHASH bytes) 163| | // Output: shared key ss (CRYPTO_BYTES bytes) 164| 3| uint16_t B[PARAMS_N*PARAMS_NBAR] = {0}; 165| 3| uint16_t Bp[PARAMS_N*PARAMS_NBAR] = {0}; 166| 3| uint16_t W[PARAMS_NBAR*PARAMS_NBAR] = {0}; // contains secret data 167| 3| uint16_t C[PARAMS_NBAR*PARAMS_NBAR] = {0}; 168| 3| uint16_t CC[PARAMS_NBAR*PARAMS_NBAR] = {0}; 169| 3| ALIGN_HEADER(32) uint16_t BBp[PARAMS_N*PARAMS_NBAR] ALIGN_FOOTER(32) = {0}; 170| 3| ALIGN_HEADER(32) uint16_t Sp[(2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR] ALIGN_FOOTER(32) = {0}; // contains secret data 171| 3| uint16_t *Ep = (uint16_t *)&Sp[PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 11| 3|#define PARAMS_N 640 ------------------ uint16_t *Ep = (uint16_t *)&Sp[PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ 172| 3| uint16_t *Epp = (uint16_t *)&Sp[2*PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 11| 3|#define PARAMS_N 640 ------------------ uint16_t *Epp = (uint16_t *)&Sp[2*PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ 173| 3| const uint8_t *ct_c1 = &ct[0]; 174| 3| const uint8_t *ct_c2 = &ct[(PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8]; ------------------ | | 13| 3|#define PARAMS_LOGQ 15 ------------------ const uint8_t *ct_c2 = &ct[(PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8]; ------------------ | | 11| 3|#define PARAMS_N 640 ------------------ const uint8_t *ct_c2 = &ct[(PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8]; ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ 175| 3| const uint8_t *salt = &ct[CRYPTO_CIPHERTEXTBYTES - BYTES_SALT]; ------------------ | | 5| 3|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_frodokem_640_shake_length_ciphertext | | ------------------ | | | | 26| 3|#define OQS_KEM_frodokem_640_shake_length_ciphertext 9752 | | ------------------ ------------------ const uint8_t *salt = &ct[CRYPTO_CIPHERTEXTBYTES - BYTES_SALT]; ------------------ | | 20| 3|#define BYTES_SALT (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 3|#define CRYPTO_BYTES OQS_KEM_frodokem_640_shake_length_shared_secret | | | | ------------------ | | | | | | 27| 3|#define OQS_KEM_frodokem_640_shake_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ 176| 3| const uint8_t *sk_s = &sk[0]; 177| 3| const uint8_t *sk_pk = &sk[CRYPTO_BYTES]; ------------------ | | 6| 3|#define CRYPTO_BYTES OQS_KEM_frodokem_640_shake_length_shared_secret | | ------------------ | | | | 27| 3|#define OQS_KEM_frodokem_640_shake_length_shared_secret 16 | | ------------------ ------------------ 178| 3| const uint16_t *sk_S = (uint16_t *) &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES]; ------------------ | | 6| 3|#define CRYPTO_BYTES OQS_KEM_frodokem_640_shake_length_shared_secret | | ------------------ | | | | 27| 3|#define OQS_KEM_frodokem_640_shake_length_shared_secret 16 | | ------------------ ------------------ const uint16_t *sk_S = (uint16_t *) &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES]; ------------------ | | 3| 3|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_frodokem_640_shake_length_public_key | | ------------------ | | | | 24| 3|#define OQS_KEM_frodokem_640_shake_length_public_key 9616 | | ------------------ ------------------ 179| 3| uint16_t S[PARAMS_N * PARAMS_NBAR]; // contains secret data 180| 3| const uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 6| 3|#define CRYPTO_BYTES OQS_KEM_frodokem_640_shake_length_shared_secret | | ------------------ | | | | 27| 3|#define OQS_KEM_frodokem_640_shake_length_shared_secret 16 | | ------------------ ------------------ const uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 3| 3|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_frodokem_640_shake_length_public_key | | ------------------ | | | | 24| 3|#define OQS_KEM_frodokem_640_shake_length_public_key 9616 | | ------------------ ------------------ const uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 11| 3|#define PARAMS_N 640 ------------------ const uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ 181| 3| const uint8_t *pk_seedA = &sk_pk[0]; 182| 3| const uint8_t *pk_b = &sk_pk[BYTES_SEED_A]; ------------------ | | 18| 3|#define BYTES_SEED_A 16 ------------------ 183| 3| uint8_t G2in[BYTES_PKHASH + BYTES_MU + BYTES_SALT]; // contains secret data via muprime 184| 3| uint8_t *pkh = &G2in[0]; 185| 3| uint8_t *muprime = &G2in[BYTES_PKHASH]; // contains secret data ------------------ | | 22| 3|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 3|#define CRYPTO_BYTES OQS_KEM_frodokem_640_shake_length_shared_secret | | | | ------------------ | | | | | | 27| 3|#define OQS_KEM_frodokem_640_shake_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ 186| 3| uint8_t *G2in_salt = &G2in[BYTES_PKHASH + BYTES_MU]; ------------------ | | 22| 3|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 3|#define CRYPTO_BYTES OQS_KEM_frodokem_640_shake_length_shared_secret | | | | ------------------ | | | | | | 27| 3|#define OQS_KEM_frodokem_640_shake_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ uint8_t *G2in_salt = &G2in[BYTES_PKHASH + BYTES_MU]; ------------------ | | 19| 3|#define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 15| 3|#define PARAMS_EXTRACTED_BITS 2 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 3|#define PARAMS_NBAR 8 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 3|#define PARAMS_NBAR 8 | | ------------------ ------------------ 187| 3| uint8_t G2out[BYTES_SEED_SE + CRYPTO_BYTES]; // contains secret data 188| 3| uint8_t *seedSEprime = &G2out[0]; // contains secret data 189| 3| uint8_t *kprime = &G2out[BYTES_SEED_SE]; // contains secret data ------------------ | | 21| 3|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 3|#define CRYPTO_BYTES OQS_KEM_frodokem_640_shake_length_shared_secret | | | | ------------------ | | | | | | 27| 3|#define OQS_KEM_frodokem_640_shake_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ 190| 3| uint8_t Fin[CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES]; // contains secret data via Fin_k 191| 3| uint8_t *Fin_ct = &Fin[0]; 192| 3| uint8_t *Fin_k = &Fin[CRYPTO_CIPHERTEXTBYTES]; // contains secret data ------------------ | | 5| 3|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_frodokem_640_shake_length_ciphertext | | ------------------ | | | | 26| 3|#define OQS_KEM_frodokem_640_shake_length_ciphertext 9752 | | ------------------ ------------------ 193| 3| uint8_t shake_input_seedSEprime[1 + BYTES_SEED_SE]; // contains secret data 194| | 195| | 196| 15.3k| for (size_t i = 0; i < PARAMS_N * PARAMS_NBAR; i++) { ------------------ | | 11| 15.3k|#define PARAMS_N 640 ------------------ for (size_t i = 0; i < PARAMS_N * PARAMS_NBAR; i++) { ------------------ | | 12| 15.3k|#define PARAMS_NBAR 8 ------------------ | Branch (196:24): [True: 15.3k, False: 3] ------------------ 197| 15.3k| S[i] = LE_TO_UINT16(sk_S[i]); ------------------ | | 34| 15.3k| #define LE_TO_UINT16(n) (n) ------------------ 198| 15.3k| } 199| | 200| | // Compute W = C - Bp*S (mod q), and decode the randomness mu 201| 3| frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 42| 3|#define frodo_unpack oqs_kem_frodokem_640_shake_unpack ------------------ frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 11| 3|#define PARAMS_N 640 ------------------ frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 13| 3|#define PARAMS_LOGQ 15 ------------------ frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 11| 3|#define PARAMS_N 640 ------------------ frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 13| 3|#define PARAMS_LOGQ 15 ------------------ 202| 3| frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 42| 3|#define frodo_unpack oqs_kem_frodokem_640_shake_unpack ------------------ frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 13| 3|#define PARAMS_LOGQ 15 ------------------ frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 13| 3|#define PARAMS_LOGQ 15 ------------------ 203| 3| frodo_mul_bs(W, Bp, S); ------------------ | | 53| 3|#define frodo_mul_bs oqs_kem_frodokem_640_shake_mul_bs ------------------ 204| 3| frodo_sub(W, C, W); ------------------ | | 56| 3|#define frodo_sub oqs_kem_frodokem_640_shake_sub ------------------ 205| 3| frodo_key_decode((uint16_t*)muprime, W); ------------------ | | 58| 3|#define frodo_key_decode oqs_kem_frodokem_640_shake_key_decode ------------------ 206| | 207| | // Generate (seedSE' || k') = G_2(pkh || mu' || salt) 208| 3| memcpy(pkh, sk_pkh, BYTES_PKHASH); ------------------ | | 22| 3|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 3|#define CRYPTO_BYTES OQS_KEM_frodokem_640_shake_length_shared_secret | | | | ------------------ | | | | | | 27| 3|#define OQS_KEM_frodokem_640_shake_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ 209| 3| memcpy(G2in_salt, salt, BYTES_SALT); ------------------ | | 20| 3|#define BYTES_SALT (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 3|#define CRYPTO_BYTES OQS_KEM_frodokem_640_shake_length_shared_secret | | | | ------------------ | | | | | | 27| 3|#define OQS_KEM_frodokem_640_shake_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ 210| 3| shake(G2out, BYTES_SEED_SE + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU + BYTES_SALT); ------------------ | | 31| 3|#define shake OQS_SHA3_shake128 ------------------ shake(G2out, BYTES_SEED_SE + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU + BYTES_SALT); ------------------ | | 21| 3|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 3|#define CRYPTO_BYTES OQS_KEM_frodokem_640_shake_length_shared_secret | | | | ------------------ | | | | | | 27| 3|#define OQS_KEM_frodokem_640_shake_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ shake(G2out, BYTES_SEED_SE + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU + BYTES_SALT); ------------------ | | 6| 3|#define CRYPTO_BYTES OQS_KEM_frodokem_640_shake_length_shared_secret | | ------------------ | | | | 27| 3|#define OQS_KEM_frodokem_640_shake_length_shared_secret 16 | | ------------------ ------------------ shake(G2out, BYTES_SEED_SE + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU + BYTES_SALT); ------------------ | | 22| 3|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 3|#define CRYPTO_BYTES OQS_KEM_frodokem_640_shake_length_shared_secret | | | | ------------------ | | | | | | 27| 3|#define OQS_KEM_frodokem_640_shake_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ shake(G2out, BYTES_SEED_SE + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU + BYTES_SALT); ------------------ | | 19| 3|#define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 15| 3|#define PARAMS_EXTRACTED_BITS 2 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 3|#define PARAMS_NBAR 8 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 3|#define PARAMS_NBAR 8 | | ------------------ ------------------ shake(G2out, BYTES_SEED_SE + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU + BYTES_SALT); ------------------ | | 20| 3|#define BYTES_SALT (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 3|#define CRYPTO_BYTES OQS_KEM_frodokem_640_shake_length_shared_secret | | | | ------------------ | | | | | | 27| 3|#define OQS_KEM_frodokem_640_shake_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ 211| | 212| | // Generate Sp and Ep, and compute BBp = Sp*A + Ep. Generate A on-the-fly 213| 3| shake_input_seedSEprime[0] = 0x96; 214| 3| memcpy(&shake_input_seedSEprime[1], seedSEprime, BYTES_SEED_SE); ------------------ | | 21| 3|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 3|#define CRYPTO_BYTES OQS_KEM_frodokem_640_shake_length_shared_secret | | | | ------------------ | | | | | | 27| 3|#define OQS_KEM_frodokem_640_shake_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ 215| 3| shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSEprime, 1 + BYTES_SEED_SE); ------------------ | | 31| 3|#define shake OQS_SHA3_shake128 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSEprime, 1 + BYTES_SEED_SE); ------------------ | | 11| 3|#define PARAMS_N 640 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSEprime, 1 + BYTES_SEED_SE); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSEprime, 1 + BYTES_SEED_SE); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSEprime, 1 + BYTES_SEED_SE); ------------------ | | 21| 3|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 3|#define CRYPTO_BYTES OQS_KEM_frodokem_640_shake_length_shared_secret | | | | ------------------ | | | | | | 27| 3|#define OQS_KEM_frodokem_640_shake_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ 216| 30.9k| for (size_t i = 0; i < (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR; i++) { ------------------ | | 11| 30.9k|#define PARAMS_N 640 ------------------ for (size_t i = 0; i < (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR; i++) { ------------------ | | 12| 30.9k|#define PARAMS_NBAR 8 ------------------ for (size_t i = 0; i < (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR; i++) { ------------------ | | 12| 30.9k|#define PARAMS_NBAR 8 ------------------ | Branch (216:24): [True: 30.9k, False: 3] ------------------ 217| 30.9k| Sp[i] = LE_TO_UINT16(Sp[i]); ------------------ | | 34| 30.9k| #define LE_TO_UINT16(n) (n) ------------------ 218| 30.9k| } 219| 3| frodo_sample_n(Sp, PARAMS_N*PARAMS_NBAR); ------------------ | | 40| 3|#define frodo_sample_n oqs_kem_frodokem_640_shake_sample_n ------------------ frodo_sample_n(Sp, PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 3|#define PARAMS_N 640 ------------------ frodo_sample_n(Sp, PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ 220| 3| frodo_sample_n(Ep, PARAMS_N*PARAMS_NBAR); ------------------ | | 40| 3|#define frodo_sample_n oqs_kem_frodokem_640_shake_sample_n ------------------ frodo_sample_n(Ep, PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 3|#define PARAMS_N 640 ------------------ frodo_sample_n(Ep, PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ 221| 3| frodo_mul_add_sa_plus_e(BBp, Sp, Ep, pk_seedA); ------------------ | | 49| 3|#define frodo_mul_add_sa_plus_e oqs_kem_frodokem_640_shake_mul_add_sa_plus_e ------------------ 222| | 223| | // Generate Epp, and compute W = Sp*B + Epp 224| 3| frodo_sample_n(Epp, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 40| 3|#define frodo_sample_n oqs_kem_frodokem_640_shake_sample_n ------------------ frodo_sample_n(Epp, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ frodo_sample_n(Epp, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ 225| 3| frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 42| 3|#define frodo_unpack oqs_kem_frodokem_640_shake_unpack ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 11| 3|#define PARAMS_N 640 ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 3| 3|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_frodokem_640_shake_length_public_key | | ------------------ | | | | 24| 3|#define OQS_KEM_frodokem_640_shake_length_public_key 9616 | | ------------------ ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 18| 3|#define BYTES_SEED_A 16 ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 13| 3|#define PARAMS_LOGQ 15 ------------------ 226| 3| frodo_mul_add_sb_plus_e(W, B, Sp, Epp); ------------------ | | 52| 3|#define frodo_mul_add_sb_plus_e oqs_kem_frodokem_640_shake_mul_add_sb_plus_e ------------------ 227| | 228| | // Encode mu, and compute CC = W + enc(mu') (mod q) 229| 3| frodo_key_encode(CC, (uint16_t*)muprime); ------------------ | | 57| 3|#define frodo_key_encode oqs_kem_frodokem_640_shake_key_encode ------------------ 230| 3| frodo_add(CC, W, CC); ------------------ | | 55| 3|#define frodo_add oqs_kem_frodokem_640_shake_add ------------------ 231| | 232| | // Prepare input to F 233| 3| memcpy(Fin_ct, ct, CRYPTO_CIPHERTEXTBYTES); ------------------ | | 5| 3|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_frodokem_640_shake_length_ciphertext | | ------------------ | | | | 26| 3|#define OQS_KEM_frodokem_640_shake_length_ciphertext 9752 | | ------------------ ------------------ 234| | 235| | // Reducing BBp modulo q 236| 15.3k| for (int i = 0; i < PARAMS_N*PARAMS_NBAR; i++) BBp[i] = BBp[i] & ((1 << PARAMS_LOGQ)-1); ------------------ | | 11| 15.3k|#define PARAMS_N 640 ------------------ for (int i = 0; i < PARAMS_N*PARAMS_NBAR; i++) BBp[i] = BBp[i] & ((1 << PARAMS_LOGQ)-1); ------------------ | | 12| 15.3k|#define PARAMS_NBAR 8 ------------------ for (int i = 0; i < PARAMS_N*PARAMS_NBAR; i++) BBp[i] = BBp[i] & ((1 << PARAMS_LOGQ)-1); ------------------ | | 13| 15.3k|#define PARAMS_LOGQ 15 ------------------ | Branch (236:21): [True: 15.3k, False: 3] ------------------ 237| | 238| | // Needs to avoid branching on secret data using constant-time implementation. 239| 3| int8_t selector = ct_verify(Bp, BBp, PARAMS_N*PARAMS_NBAR) | ct_verify(C, CC, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 44| 3|#define ct_verify oqs_kem_frodokem_640_shake_ct_verify ------------------ int8_t selector = ct_verify(Bp, BBp, PARAMS_N*PARAMS_NBAR) | ct_verify(C, CC, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 11| 3|#define PARAMS_N 640 ------------------ int8_t selector = ct_verify(Bp, BBp, PARAMS_N*PARAMS_NBAR) | ct_verify(C, CC, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ int8_t selector = ct_verify(Bp, BBp, PARAMS_N*PARAMS_NBAR) | ct_verify(C, CC, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 44| 3|#define ct_verify oqs_kem_frodokem_640_shake_ct_verify ------------------ int8_t selector = ct_verify(Bp, BBp, PARAMS_N*PARAMS_NBAR) | ct_verify(C, CC, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ int8_t selector = ct_verify(Bp, BBp, PARAMS_N*PARAMS_NBAR) | ct_verify(C, CC, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ 240| | // If (selector == 0) then load k' to do ss = F(ct || k'), else if (selector == -1) load s to do ss = F(ct || s) 241| 3| ct_select((uint8_t*)Fin_k, (uint8_t*)kprime, (uint8_t*)sk_s, CRYPTO_BYTES, selector); ------------------ | | 43| 3|#define ct_select oqs_kem_frodokem_640_shake_ct_select ------------------ ct_select((uint8_t*)Fin_k, (uint8_t*)kprime, (uint8_t*)sk_s, CRYPTO_BYTES, selector); ------------------ | | 6| 3|#define CRYPTO_BYTES OQS_KEM_frodokem_640_shake_length_shared_secret | | ------------------ | | | | 27| 3|#define OQS_KEM_frodokem_640_shake_length_shared_secret 16 | | ------------------ ------------------ 242| 3| shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 31| 3|#define shake OQS_SHA3_shake128 ------------------ shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 6| 3|#define CRYPTO_BYTES OQS_KEM_frodokem_640_shake_length_shared_secret | | ------------------ | | | | 27| 3|#define OQS_KEM_frodokem_640_shake_length_shared_secret 16 | | ------------------ ------------------ shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 5| 3|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_frodokem_640_shake_length_ciphertext | | ------------------ | | | | 26| 3|#define OQS_KEM_frodokem_640_shake_length_ciphertext 9752 | | ------------------ ------------------ shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 6| 3|#define CRYPTO_BYTES OQS_KEM_frodokem_640_shake_length_shared_secret | | ------------------ | | | | 27| 3|#define OQS_KEM_frodokem_640_shake_length_shared_secret 16 | | ------------------ ------------------ 243| | 244| | // Cleanup: 245| 3| clear_bytes((uint8_t *)W, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 29| 3|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)W, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ clear_bytes((uint8_t *)W, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ 246| 3| clear_bytes((uint8_t *)Sp, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 29| 3|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)Sp, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 3|#define PARAMS_N 640 ------------------ clear_bytes((uint8_t *)Sp, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ 247| 3| clear_bytes((uint8_t *)S, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 29| 3|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)S, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 3|#define PARAMS_N 640 ------------------ clear_bytes((uint8_t *)S, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ 248| 3| clear_bytes((uint8_t *)Ep, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 29| 3|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)Ep, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 3|#define PARAMS_N 640 ------------------ clear_bytes((uint8_t *)Ep, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ 249| 3| clear_bytes((uint8_t *)Epp, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 29| 3|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)Epp, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ clear_bytes((uint8_t *)Epp, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ 250| 3| clear_bytes(muprime, BYTES_MU); ------------------ | | 29| 3|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(muprime, BYTES_MU); ------------------ | | 19| 3|#define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 15| 3|#define PARAMS_EXTRACTED_BITS 2 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 3|#define PARAMS_NBAR 8 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 3|#define PARAMS_NBAR 8 | | ------------------ ------------------ 251| 3| clear_bytes(G2out, BYTES_SEED_SE + CRYPTO_BYTES); ------------------ | | 29| 3|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(G2out, BYTES_SEED_SE + CRYPTO_BYTES); ------------------ | | 21| 3|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 3|#define CRYPTO_BYTES OQS_KEM_frodokem_640_shake_length_shared_secret | | | | ------------------ | | | | | | 27| 3|#define OQS_KEM_frodokem_640_shake_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ clear_bytes(G2out, BYTES_SEED_SE + CRYPTO_BYTES); ------------------ | | 6| 3|#define CRYPTO_BYTES OQS_KEM_frodokem_640_shake_length_shared_secret | | ------------------ | | | | 27| 3|#define OQS_KEM_frodokem_640_shake_length_shared_secret 16 | | ------------------ ------------------ 252| 3| clear_bytes(Fin_k, CRYPTO_BYTES); ------------------ | | 29| 3|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(Fin_k, CRYPTO_BYTES); ------------------ | | 6| 3|#define CRYPTO_BYTES OQS_KEM_frodokem_640_shake_length_shared_secret | | ------------------ | | | | 27| 3|#define OQS_KEM_frodokem_640_shake_length_shared_secret 16 | | ------------------ ------------------ 253| 3| clear_bytes(shake_input_seedSEprime, 1 + BYTES_SEED_SE); ------------------ | | 29| 3|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(shake_input_seedSEprime, 1 + BYTES_SEED_SE); ------------------ | | 21| 3|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 3|#define CRYPTO_BYTES OQS_KEM_frodokem_640_shake_length_shared_secret | | | | ------------------ | | | | | | 27| 3|#define OQS_KEM_frodokem_640_shake_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ 254| 3| return OQS_SUCCESS; 255| 3|} OQS_KEM_frodokem_976_aes_keypair: 19| 15|{ // FrodoKEM's key generation 20| | // Outputs: public key pk = pk_seedA||pk_b ( BYTES_SEED_A + (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8 bytes) 21| | // secret key sk = sk_s||pk_seedA||pk_b||sk_S||sk_pkh (CRYPTO_BYTES + BYTES_SEED_A + (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8 + 2*PARAMS_N*PARAMS_NBAR + BYTES_PKHASH bytes) 22| 15| uint8_t *pk_seedA = &pk[0]; 23| 15| uint8_t *pk_b = &pk[BYTES_SEED_A]; ------------------ | | 18| 15|#define BYTES_SEED_A 16 ------------------ 24| 15| uint8_t *sk_s = &sk[0]; 25| 15| uint8_t *sk_pk = &sk[CRYPTO_BYTES]; ------------------ | | 6| 15|#define CRYPTO_BYTES OQS_KEM_frodokem_976_aes_length_shared_secret | | ------------------ | | | | 42| 15|#define OQS_KEM_frodokem_976_aes_length_shared_secret 24 | | ------------------ ------------------ 26| 15| uint8_t *sk_S = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES]; ------------------ | | 6| 15|#define CRYPTO_BYTES OQS_KEM_frodokem_976_aes_length_shared_secret | | ------------------ | | | | 42| 15|#define OQS_KEM_frodokem_976_aes_length_shared_secret 24 | | ------------------ ------------------ uint8_t *sk_S = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES]; ------------------ | | 3| 15|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_frodokem_976_aes_length_public_key | | ------------------ | | | | 39| 15|#define OQS_KEM_frodokem_976_aes_length_public_key 15632 | | ------------------ ------------------ 27| 15| uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 6| 15|#define CRYPTO_BYTES OQS_KEM_frodokem_976_aes_length_shared_secret | | ------------------ | | | | 42| 15|#define OQS_KEM_frodokem_976_aes_length_shared_secret 24 | | ------------------ ------------------ uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 3| 15|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_frodokem_976_aes_length_public_key | | ------------------ | | | | 39| 15|#define OQS_KEM_frodokem_976_aes_length_public_key 15632 | | ------------------ ------------------ uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 11| 15|#define PARAMS_N 976 ------------------ uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 12| 15|#define PARAMS_NBAR 8 ------------------ 28| 15| uint16_t B[PARAMS_N*PARAMS_NBAR] = {0}; 29| 15| uint16_t S[2*PARAMS_N*PARAMS_NBAR] = {0}; // contains secret data 30| 15| uint16_t *E = (uint16_t *)&S[PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 11| 15|#define PARAMS_N 976 ------------------ uint16_t *E = (uint16_t *)&S[PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 12| 15|#define PARAMS_NBAR 8 ------------------ 31| 15| uint8_t randomness[CRYPTO_BYTES + BYTES_SEED_SE + BYTES_SEED_A]; // contains secret data via randomness_s and randomness_seedSE 32| 15| uint8_t *randomness_s = &randomness[0]; // contains secret data 33| 15| uint8_t *randomness_seedSE = &randomness[CRYPTO_BYTES]; // contains secret data ------------------ | | 6| 15|#define CRYPTO_BYTES OQS_KEM_frodokem_976_aes_length_shared_secret | | ------------------ | | | | 42| 15|#define OQS_KEM_frodokem_976_aes_length_shared_secret 24 | | ------------------ ------------------ 34| 15| uint8_t *randomness_z = &randomness[CRYPTO_BYTES + BYTES_SEED_SE]; ------------------ | | 6| 15|#define CRYPTO_BYTES OQS_KEM_frodokem_976_aes_length_shared_secret | | ------------------ | | | | 42| 15|#define OQS_KEM_frodokem_976_aes_length_shared_secret 24 | | ------------------ ------------------ uint8_t *randomness_z = &randomness[CRYPTO_BYTES + BYTES_SEED_SE]; ------------------ | | 21| 15|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 15|#define CRYPTO_BYTES OQS_KEM_frodokem_976_aes_length_shared_secret | | | | ------------------ | | | | | | 42| 15|#define OQS_KEM_frodokem_976_aes_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ 35| 15| uint8_t shake_input_seedSE[1 + BYTES_SEED_SE]; // contains secret data 36| | 37| | // Generate the secret value s, the seed for S and E, and the seed for the seed for A. Add seed_A to the public key 38| 15| randombytes(randomness, CRYPTO_BYTES + BYTES_SEED_SE + BYTES_SEED_A); ------------------ | | 28| 15|#define randombytes OQS_randombytes ------------------ randombytes(randomness, CRYPTO_BYTES + BYTES_SEED_SE + BYTES_SEED_A); ------------------ | | 6| 15|#define CRYPTO_BYTES OQS_KEM_frodokem_976_aes_length_shared_secret | | ------------------ | | | | 42| 15|#define OQS_KEM_frodokem_976_aes_length_shared_secret 24 | | ------------------ ------------------ randombytes(randomness, CRYPTO_BYTES + BYTES_SEED_SE + BYTES_SEED_A); ------------------ | | 21| 15|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 15|#define CRYPTO_BYTES OQS_KEM_frodokem_976_aes_length_shared_secret | | | | ------------------ | | | | | | 42| 15|#define OQS_KEM_frodokem_976_aes_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ randombytes(randomness, CRYPTO_BYTES + BYTES_SEED_SE + BYTES_SEED_A); ------------------ | | 18| 15|#define BYTES_SEED_A 16 ------------------ 39| 15| shake(pk_seedA, BYTES_SEED_A, randomness_z, BYTES_SEED_A); ------------------ | | 31| 15|#define shake OQS_SHA3_shake256 ------------------ shake(pk_seedA, BYTES_SEED_A, randomness_z, BYTES_SEED_A); ------------------ | | 18| 15|#define BYTES_SEED_A 16 ------------------ shake(pk_seedA, BYTES_SEED_A, randomness_z, BYTES_SEED_A); ------------------ | | 18| 15|#define BYTES_SEED_A 16 ------------------ 40| | 41| | // Generate S and E, and compute B = A*S + E. Generate A on-the-fly 42| 15| shake_input_seedSE[0] = 0x5F; 43| 15| memcpy(&shake_input_seedSE[1], randomness_seedSE, BYTES_SEED_SE); ------------------ | | 21| 15|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 15|#define CRYPTO_BYTES OQS_KEM_frodokem_976_aes_length_shared_secret | | | | ------------------ | | | | | | 42| 15|#define OQS_KEM_frodokem_976_aes_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ 44| 15| shake((uint8_t*)S, 2*PARAMS_N*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + BYTES_SEED_SE); ------------------ | | 31| 15|#define shake OQS_SHA3_shake256 ------------------ shake((uint8_t*)S, 2*PARAMS_N*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + BYTES_SEED_SE); ------------------ | | 11| 15|#define PARAMS_N 976 ------------------ shake((uint8_t*)S, 2*PARAMS_N*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + BYTES_SEED_SE); ------------------ | | 12| 15|#define PARAMS_NBAR 8 ------------------ shake((uint8_t*)S, 2*PARAMS_N*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + BYTES_SEED_SE); ------------------ | | 21| 15|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 15|#define CRYPTO_BYTES OQS_KEM_frodokem_976_aes_length_shared_secret | | | | ------------------ | | | | | | 42| 15|#define OQS_KEM_frodokem_976_aes_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ 45| 234k| for (size_t i = 0; i < 2 * PARAMS_N * PARAMS_NBAR; i++) { ------------------ | | 11| 234k|#define PARAMS_N 976 ------------------ for (size_t i = 0; i < 2 * PARAMS_N * PARAMS_NBAR; i++) { ------------------ | | 12| 234k|#define PARAMS_NBAR 8 ------------------ | Branch (45:24): [True: 234k, False: 15] ------------------ 46| 234k| S[i] = LE_TO_UINT16(S[i]); ------------------ | | 34| 234k| #define LE_TO_UINT16(n) (n) ------------------ 47| 234k| } 48| 15| frodo_sample_n(S, PARAMS_N*PARAMS_NBAR); ------------------ | | 40| 15|#define frodo_sample_n oqs_kem_frodokem_976_aes_sample_n ------------------ frodo_sample_n(S, PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 15|#define PARAMS_N 976 ------------------ frodo_sample_n(S, PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 15|#define PARAMS_NBAR 8 ------------------ 49| 15| frodo_sample_n(E, PARAMS_N*PARAMS_NBAR); ------------------ | | 40| 15|#define frodo_sample_n oqs_kem_frodokem_976_aes_sample_n ------------------ frodo_sample_n(E, PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 15|#define PARAMS_N 976 ------------------ frodo_sample_n(E, PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 15|#define PARAMS_NBAR 8 ------------------ 50| 15| frodo_mul_add_as_plus_e(B, S, E, pk); ------------------ | | 46| 15|#define frodo_mul_add_as_plus_e oqs_kem_frodokem_976_aes_mul_add_as_plus_e ------------------ 51| | 52| | // Encode the second part of the public key 53| 15| frodo_pack(pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, B, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 41| 15|#define frodo_pack oqs_kem_frodokem_976_aes_pack ------------------ frodo_pack(pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, B, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 3| 15|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_frodokem_976_aes_length_public_key | | ------------------ | | | | 39| 15|#define OQS_KEM_frodokem_976_aes_length_public_key 15632 | | ------------------ ------------------ frodo_pack(pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, B, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 18| 15|#define BYTES_SEED_A 16 ------------------ frodo_pack(pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, B, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 11| 15|#define PARAMS_N 976 ------------------ frodo_pack(pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, B, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 15|#define PARAMS_NBAR 8 ------------------ frodo_pack(pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, B, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 13| 15|#define PARAMS_LOGQ 16 ------------------ 54| | 55| | // Add s, pk and S to the secret key 56| 15| memcpy(sk_s, randomness_s, CRYPTO_BYTES); ------------------ | | 6| 15|#define CRYPTO_BYTES OQS_KEM_frodokem_976_aes_length_shared_secret | | ------------------ | | | | 42| 15|#define OQS_KEM_frodokem_976_aes_length_shared_secret 24 | | ------------------ ------------------ 57| 15| memcpy(sk_pk, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 3| 15|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_frodokem_976_aes_length_public_key | | ------------------ | | | | 39| 15|#define OQS_KEM_frodokem_976_aes_length_public_key 15632 | | ------------------ ------------------ 58| 117k| for (size_t i = 0; i < PARAMS_N * PARAMS_NBAR; i++) { ------------------ | | 11| 117k|#define PARAMS_N 976 ------------------ for (size_t i = 0; i < PARAMS_N * PARAMS_NBAR; i++) { ------------------ | | 12| 117k|#define PARAMS_NBAR 8 ------------------ | Branch (58:24): [True: 117k, False: 15] ------------------ 59| 117k| S[i] = UINT16_TO_LE(S[i]); ------------------ | | 35| 117k| #define UINT16_TO_LE(n) (n) ------------------ 60| 117k| } 61| 15| memcpy(sk_S, S, 2*PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 15|#define PARAMS_N 976 ------------------ memcpy(sk_S, S, 2*PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 15|#define PARAMS_NBAR 8 ------------------ 62| | 63| | // Add H(pk) to the secret key 64| 15| shake(sk_pkh, BYTES_PKHASH, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 31| 15|#define shake OQS_SHA3_shake256 ------------------ shake(sk_pkh, BYTES_PKHASH, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 22| 15|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 15|#define CRYPTO_BYTES OQS_KEM_frodokem_976_aes_length_shared_secret | | | | ------------------ | | | | | | 42| 15|#define OQS_KEM_frodokem_976_aes_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ shake(sk_pkh, BYTES_PKHASH, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 3| 15|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_frodokem_976_aes_length_public_key | | ------------------ | | | | 39| 15|#define OQS_KEM_frodokem_976_aes_length_public_key 15632 | | ------------------ ------------------ 65| | 66| | // Cleanup: 67| 15| clear_bytes((uint8_t *)S, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 29| 15|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)S, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 15|#define PARAMS_N 976 ------------------ clear_bytes((uint8_t *)S, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 15|#define PARAMS_NBAR 8 ------------------ 68| 15| clear_bytes((uint8_t *)E, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 29| 15|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)E, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 15|#define PARAMS_N 976 ------------------ clear_bytes((uint8_t *)E, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 15|#define PARAMS_NBAR 8 ------------------ 69| 15| clear_bytes(randomness, CRYPTO_BYTES + BYTES_SEED_SE); ------------------ | | 29| 15|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(randomness, CRYPTO_BYTES + BYTES_SEED_SE); ------------------ | | 6| 15|#define CRYPTO_BYTES OQS_KEM_frodokem_976_aes_length_shared_secret | | ------------------ | | | | 42| 15|#define OQS_KEM_frodokem_976_aes_length_shared_secret 24 | | ------------------ ------------------ clear_bytes(randomness, CRYPTO_BYTES + BYTES_SEED_SE); ------------------ | | 21| 15|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 15|#define CRYPTO_BYTES OQS_KEM_frodokem_976_aes_length_shared_secret | | | | ------------------ | | | | | | 42| 15|#define OQS_KEM_frodokem_976_aes_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ 70| 15| clear_bytes(shake_input_seedSE, 1 + BYTES_SEED_SE); ------------------ | | 29| 15|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(shake_input_seedSE, 1 + BYTES_SEED_SE); ------------------ | | 21| 15|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 15|#define CRYPTO_BYTES OQS_KEM_frodokem_976_aes_length_shared_secret | | | | ------------------ | | | | | | 42| 15|#define OQS_KEM_frodokem_976_aes_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ 71| 15| return OQS_SUCCESS; 72| 15|} OQS_KEM_frodokem_976_aes_encaps: 86| 15|{ // FrodoKEM's key encapsulation 87| | // Input: public key pk = pk_seedA||pk_b (BYTES_SEED_A + (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8 bytes) 88| | // Outputs: ciphertext ct = ct_c1||ct_c2||salt ( (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8 + (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8 + BYTES_SALT bytes) 89| | // shared key ss (CRYPTO_BYTES bytes) 90| 15| const uint8_t *pk_seedA = &pk[0]; 91| 15| const uint8_t *pk_b = &pk[BYTES_SEED_A]; ------------------ | | 18| 15|#define BYTES_SEED_A 16 ------------------ 92| 15| uint8_t *ct_c1 = &ct[0]; 93| 15| uint8_t *ct_c2 = &ct[(PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8]; ------------------ | | 13| 15|#define PARAMS_LOGQ 16 ------------------ uint8_t *ct_c2 = &ct[(PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8]; ------------------ | | 11| 15|#define PARAMS_N 976 ------------------ uint8_t *ct_c2 = &ct[(PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8]; ------------------ | | 12| 15|#define PARAMS_NBAR 8 ------------------ 94| 15| uint16_t B[PARAMS_N*PARAMS_NBAR] = {0}; 95| 15| uint16_t V[PARAMS_NBAR*PARAMS_NBAR]= {0}; // contains secret data 96| 15| uint16_t C[PARAMS_NBAR*PARAMS_NBAR] = {0}; 97| 15| ALIGN_HEADER(32) uint16_t Bp[PARAMS_N*PARAMS_NBAR] ALIGN_FOOTER(32) = {0}; 98| 15| ALIGN_HEADER(32) uint16_t Sp[(2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR] ALIGN_FOOTER(32) = {0}; // contains secret data 99| 15| uint16_t *Ep = (uint16_t *)&Sp[PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 11| 15|#define PARAMS_N 976 ------------------ uint16_t *Ep = (uint16_t *)&Sp[PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 12| 15|#define PARAMS_NBAR 8 ------------------ 100| 15| uint16_t *Epp = (uint16_t *)&Sp[2*PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 11| 15|#define PARAMS_N 976 ------------------ uint16_t *Epp = (uint16_t *)&Sp[2*PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 12| 15|#define PARAMS_NBAR 8 ------------------ 101| 15| uint8_t G2in[BYTES_PKHASH + BYTES_MU + BYTES_SALT]; // contains secret data via mu 102| 15| uint8_t *pkh = &G2in[0]; 103| 15| uint8_t *mu = &G2in[BYTES_PKHASH]; // contains secret data ------------------ | | 22| 15|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 15|#define CRYPTO_BYTES OQS_KEM_frodokem_976_aes_length_shared_secret | | | | ------------------ | | | | | | 42| 15|#define OQS_KEM_frodokem_976_aes_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ 104| 15| uint8_t *salt = &G2in[BYTES_PKHASH + BYTES_MU]; ------------------ | | 22| 15|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 15|#define CRYPTO_BYTES OQS_KEM_frodokem_976_aes_length_shared_secret | | | | ------------------ | | | | | | 42| 15|#define OQS_KEM_frodokem_976_aes_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ uint8_t *salt = &G2in[BYTES_PKHASH + BYTES_MU]; ------------------ | | 19| 15|#define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 15| 15|#define PARAMS_EXTRACTED_BITS 3 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 15|#define PARAMS_NBAR 8 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 15|#define PARAMS_NBAR 8 | | ------------------ ------------------ 105| 15| uint8_t G2out[BYTES_SEED_SE + CRYPTO_BYTES]; // contains secret data 106| 15| uint8_t *seedSE = &G2out[0]; // contains secret data 107| 15| uint8_t *k = &G2out[BYTES_SEED_SE]; // contains secret data ------------------ | | 21| 15|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 15|#define CRYPTO_BYTES OQS_KEM_frodokem_976_aes_length_shared_secret | | | | ------------------ | | | | | | 42| 15|#define OQS_KEM_frodokem_976_aes_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ 108| 15| uint8_t Fin[CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES]; // contains secret data via Fin_k 109| 15| uint8_t *Fin_ct = &Fin[0]; 110| 15| uint8_t *Fin_k = &Fin[CRYPTO_CIPHERTEXTBYTES]; // contains secret data ------------------ | | 5| 15|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_frodokem_976_aes_length_ciphertext | | ------------------ | | | | 41| 15|#define OQS_KEM_frodokem_976_aes_length_ciphertext 15792 | | ------------------ ------------------ 111| 15| uint8_t shake_input_seedSE[1 + BYTES_SEED_SE]; // contains secret data 112| | 113| | // pkh <- G_1(pk), generate random mu and salt, compute (seedSE || k) = G_2(pkh || mu || salt) 114| 15| shake(pkh, BYTES_PKHASH, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 31| 15|#define shake OQS_SHA3_shake256 ------------------ shake(pkh, BYTES_PKHASH, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 22| 15|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 15|#define CRYPTO_BYTES OQS_KEM_frodokem_976_aes_length_shared_secret | | | | ------------------ | | | | | | 42| 15|#define OQS_KEM_frodokem_976_aes_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ shake(pkh, BYTES_PKHASH, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 3| 15|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_frodokem_976_aes_length_public_key | | ------------------ | | | | 39| 15|#define OQS_KEM_frodokem_976_aes_length_public_key 15632 | | ------------------ ------------------ 115| 15| randombytes(mu, BYTES_MU + BYTES_SALT); ------------------ | | 28| 15|#define randombytes OQS_randombytes ------------------ randombytes(mu, BYTES_MU + BYTES_SALT); ------------------ | | 19| 15|#define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 15| 15|#define PARAMS_EXTRACTED_BITS 3 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 15|#define PARAMS_NBAR 8 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 15|#define PARAMS_NBAR 8 | | ------------------ ------------------ randombytes(mu, BYTES_MU + BYTES_SALT); ------------------ | | 20| 15|#define BYTES_SALT (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 15|#define CRYPTO_BYTES OQS_KEM_frodokem_976_aes_length_shared_secret | | | | ------------------ | | | | | | 42| 15|#define OQS_KEM_frodokem_976_aes_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ 116| 15| shake(G2out, BYTES_SEED_SE + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU + BYTES_SALT); ------------------ | | 31| 15|#define shake OQS_SHA3_shake256 ------------------ shake(G2out, BYTES_SEED_SE + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU + BYTES_SALT); ------------------ | | 21| 15|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 15|#define CRYPTO_BYTES OQS_KEM_frodokem_976_aes_length_shared_secret | | | | ------------------ | | | | | | 42| 15|#define OQS_KEM_frodokem_976_aes_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ shake(G2out, BYTES_SEED_SE + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU + BYTES_SALT); ------------------ | | 6| 15|#define CRYPTO_BYTES OQS_KEM_frodokem_976_aes_length_shared_secret | | ------------------ | | | | 42| 15|#define OQS_KEM_frodokem_976_aes_length_shared_secret 24 | | ------------------ ------------------ shake(G2out, BYTES_SEED_SE + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU + BYTES_SALT); ------------------ | | 22| 15|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 15|#define CRYPTO_BYTES OQS_KEM_frodokem_976_aes_length_shared_secret | | | | ------------------ | | | | | | 42| 15|#define OQS_KEM_frodokem_976_aes_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ shake(G2out, BYTES_SEED_SE + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU + BYTES_SALT); ------------------ | | 19| 15|#define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 15| 15|#define PARAMS_EXTRACTED_BITS 3 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 15|#define PARAMS_NBAR 8 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 15|#define PARAMS_NBAR 8 | | ------------------ ------------------ shake(G2out, BYTES_SEED_SE + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU + BYTES_SALT); ------------------ | | 20| 15|#define BYTES_SALT (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 15|#define CRYPTO_BYTES OQS_KEM_frodokem_976_aes_length_shared_secret | | | | ------------------ | | | | | | 42| 15|#define OQS_KEM_frodokem_976_aes_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ 117| | 118| | // Generate Sp and Ep, and compute Bp = Sp*A + Ep. Generate A on-the-fly 119| 15| shake_input_seedSE[0] = 0x96; 120| 15| memcpy(&shake_input_seedSE[1], seedSE, BYTES_SEED_SE); ------------------ | | 21| 15|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 15|#define CRYPTO_BYTES OQS_KEM_frodokem_976_aes_length_shared_secret | | | | ------------------ | | | | | | 42| 15|#define OQS_KEM_frodokem_976_aes_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ 121| 15| shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + BYTES_SEED_SE); ------------------ | | 31| 15|#define shake OQS_SHA3_shake256 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + BYTES_SEED_SE); ------------------ | | 11| 15|#define PARAMS_N 976 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + BYTES_SEED_SE); ------------------ | | 12| 15|#define PARAMS_NBAR 8 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + BYTES_SEED_SE); ------------------ | | 12| 15|#define PARAMS_NBAR 8 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + BYTES_SEED_SE); ------------------ | | 21| 15|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 15|#define CRYPTO_BYTES OQS_KEM_frodokem_976_aes_length_shared_secret | | | | ------------------ | | | | | | 42| 15|#define OQS_KEM_frodokem_976_aes_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ 122| 235k| for (size_t i = 0; i < (2 * PARAMS_N + PARAMS_NBAR) * PARAMS_NBAR; i++) { ------------------ | | 11| 235k|#define PARAMS_N 976 ------------------ for (size_t i = 0; i < (2 * PARAMS_N + PARAMS_NBAR) * PARAMS_NBAR; i++) { ------------------ | | 12| 235k|#define PARAMS_NBAR 8 ------------------ for (size_t i = 0; i < (2 * PARAMS_N + PARAMS_NBAR) * PARAMS_NBAR; i++) { ------------------ | | 12| 235k|#define PARAMS_NBAR 8 ------------------ | Branch (122:24): [True: 235k, False: 15] ------------------ 123| 235k| Sp[i] = LE_TO_UINT16(Sp[i]); ------------------ | | 34| 235k| #define LE_TO_UINT16(n) (n) ------------------ 124| 235k| } 125| 15| frodo_sample_n(Sp, PARAMS_N*PARAMS_NBAR); ------------------ | | 40| 15|#define frodo_sample_n oqs_kem_frodokem_976_aes_sample_n ------------------ frodo_sample_n(Sp, PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 15|#define PARAMS_N 976 ------------------ frodo_sample_n(Sp, PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 15|#define PARAMS_NBAR 8 ------------------ 126| 15| frodo_sample_n(Ep, PARAMS_N*PARAMS_NBAR); ------------------ | | 40| 15|#define frodo_sample_n oqs_kem_frodokem_976_aes_sample_n ------------------ frodo_sample_n(Ep, PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 15|#define PARAMS_N 976 ------------------ frodo_sample_n(Ep, PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 15|#define PARAMS_NBAR 8 ------------------ 127| 15| frodo_mul_add_sa_plus_e(Bp, Sp, Ep, pk_seedA); ------------------ | | 49| 15|#define frodo_mul_add_sa_plus_e oqs_kem_frodokem_976_aes_mul_add_sa_plus_e ------------------ 128| 15| frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 41| 15|#define frodo_pack oqs_kem_frodokem_976_aes_pack ------------------ frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 13| 15|#define PARAMS_LOGQ 16 ------------------ frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 11| 15|#define PARAMS_N 976 ------------------ frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 15|#define PARAMS_NBAR 8 ------------------ frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 11| 15|#define PARAMS_N 976 ------------------ frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 15|#define PARAMS_NBAR 8 ------------------ frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 13| 15|#define PARAMS_LOGQ 16 ------------------ 129| | 130| | // Generate Epp, and compute V = Sp*B + Epp 131| 15| frodo_sample_n(Epp, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 40| 15|#define frodo_sample_n oqs_kem_frodokem_976_aes_sample_n ------------------ frodo_sample_n(Epp, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 15|#define PARAMS_NBAR 8 ------------------ frodo_sample_n(Epp, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 15|#define PARAMS_NBAR 8 ------------------ 132| 15| frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 42| 15|#define frodo_unpack oqs_kem_frodokem_976_aes_unpack ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 11| 15|#define PARAMS_N 976 ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 12| 15|#define PARAMS_NBAR 8 ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 3| 15|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_frodokem_976_aes_length_public_key | | ------------------ | | | | 39| 15|#define OQS_KEM_frodokem_976_aes_length_public_key 15632 | | ------------------ ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 18| 15|#define BYTES_SEED_A 16 ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 13| 15|#define PARAMS_LOGQ 16 ------------------ 133| 15| frodo_mul_add_sb_plus_e(V, B, Sp, Epp); ------------------ | | 52| 15|#define frodo_mul_add_sb_plus_e oqs_kem_frodokem_976_aes_mul_add_sb_plus_e ------------------ 134| | 135| | // Encode mu, and compute C = V + enc(mu) (mod q) 136| 15| frodo_key_encode(C, (uint16_t*)mu); ------------------ | | 57| 15|#define frodo_key_encode oqs_kem_frodokem_976_aes_key_encode ------------------ 137| 15| frodo_add(C, V, C); ------------------ | | 55| 15|#define frodo_add oqs_kem_frodokem_976_aes_add ------------------ 138| 15| frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 41| 15|#define frodo_pack oqs_kem_frodokem_976_aes_pack ------------------ frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 13| 15|#define PARAMS_LOGQ 16 ------------------ frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 15|#define PARAMS_NBAR 8 ------------------ frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 15|#define PARAMS_NBAR 8 ------------------ frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 15|#define PARAMS_NBAR 8 ------------------ frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 15|#define PARAMS_NBAR 8 ------------------ frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 13| 15|#define PARAMS_LOGQ 16 ------------------ 139| | 140| | // Append salt to ct and compute ss = F(ct_c1||ct_c2||salt||k) 141| 15| memcpy(&ct[CRYPTO_CIPHERTEXTBYTES - BYTES_SALT], salt, BYTES_SALT); ------------------ | | 5| 15|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_frodokem_976_aes_length_ciphertext | | ------------------ | | | | 41| 15|#define OQS_KEM_frodokem_976_aes_length_ciphertext 15792 | | ------------------ ------------------ memcpy(&ct[CRYPTO_CIPHERTEXTBYTES - BYTES_SALT], salt, BYTES_SALT); ------------------ | | 20| 15|#define BYTES_SALT (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 15|#define CRYPTO_BYTES OQS_KEM_frodokem_976_aes_length_shared_secret | | | | ------------------ | | | | | | 42| 15|#define OQS_KEM_frodokem_976_aes_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ memcpy(&ct[CRYPTO_CIPHERTEXTBYTES - BYTES_SALT], salt, BYTES_SALT); ------------------ | | 20| 15|#define BYTES_SALT (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 15|#define CRYPTO_BYTES OQS_KEM_frodokem_976_aes_length_shared_secret | | | | ------------------ | | | | | | 42| 15|#define OQS_KEM_frodokem_976_aes_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ 142| 15| memcpy(Fin_ct, ct, CRYPTO_CIPHERTEXTBYTES); ------------------ | | 5| 15|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_frodokem_976_aes_length_ciphertext | | ------------------ | | | | 41| 15|#define OQS_KEM_frodokem_976_aes_length_ciphertext 15792 | | ------------------ ------------------ 143| 15| memcpy(Fin_k, k, CRYPTO_BYTES); ------------------ | | 6| 15|#define CRYPTO_BYTES OQS_KEM_frodokem_976_aes_length_shared_secret | | ------------------ | | | | 42| 15|#define OQS_KEM_frodokem_976_aes_length_shared_secret 24 | | ------------------ ------------------ 144| 15| shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 31| 15|#define shake OQS_SHA3_shake256 ------------------ shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 6| 15|#define CRYPTO_BYTES OQS_KEM_frodokem_976_aes_length_shared_secret | | ------------------ | | | | 42| 15|#define OQS_KEM_frodokem_976_aes_length_shared_secret 24 | | ------------------ ------------------ shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 5| 15|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_frodokem_976_aes_length_ciphertext | | ------------------ | | | | 41| 15|#define OQS_KEM_frodokem_976_aes_length_ciphertext 15792 | | ------------------ ------------------ shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 6| 15|#define CRYPTO_BYTES OQS_KEM_frodokem_976_aes_length_shared_secret | | ------------------ | | | | 42| 15|#define OQS_KEM_frodokem_976_aes_length_shared_secret 24 | | ------------------ ------------------ 145| | 146| | // Cleanup: 147| 15| clear_bytes((uint8_t *)V, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 29| 15|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)V, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 15|#define PARAMS_NBAR 8 ------------------ clear_bytes((uint8_t *)V, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 15|#define PARAMS_NBAR 8 ------------------ 148| 15| clear_bytes((uint8_t *)Sp, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 29| 15|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)Sp, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 15|#define PARAMS_N 976 ------------------ clear_bytes((uint8_t *)Sp, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 15|#define PARAMS_NBAR 8 ------------------ 149| 15| clear_bytes((uint8_t *)Ep, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 29| 15|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)Ep, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 15|#define PARAMS_N 976 ------------------ clear_bytes((uint8_t *)Ep, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 15|#define PARAMS_NBAR 8 ------------------ 150| 15| clear_bytes((uint8_t *)Epp, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 29| 15|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)Epp, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 15|#define PARAMS_NBAR 8 ------------------ clear_bytes((uint8_t *)Epp, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 15|#define PARAMS_NBAR 8 ------------------ 151| 15| clear_bytes(mu, BYTES_MU); ------------------ | | 29| 15|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(mu, BYTES_MU); ------------------ | | 19| 15|#define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 15| 15|#define PARAMS_EXTRACTED_BITS 3 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 15|#define PARAMS_NBAR 8 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 15|#define PARAMS_NBAR 8 | | ------------------ ------------------ 152| 15| clear_bytes(G2out, BYTES_SEED_SE + CRYPTO_BYTES); ------------------ | | 29| 15|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(G2out, BYTES_SEED_SE + CRYPTO_BYTES); ------------------ | | 21| 15|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 15|#define CRYPTO_BYTES OQS_KEM_frodokem_976_aes_length_shared_secret | | | | ------------------ | | | | | | 42| 15|#define OQS_KEM_frodokem_976_aes_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ clear_bytes(G2out, BYTES_SEED_SE + CRYPTO_BYTES); ------------------ | | 6| 15|#define CRYPTO_BYTES OQS_KEM_frodokem_976_aes_length_shared_secret | | ------------------ | | | | 42| 15|#define OQS_KEM_frodokem_976_aes_length_shared_secret 24 | | ------------------ ------------------ 153| 15| clear_bytes(Fin_k, CRYPTO_BYTES); ------------------ | | 29| 15|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(Fin_k, CRYPTO_BYTES); ------------------ | | 6| 15|#define CRYPTO_BYTES OQS_KEM_frodokem_976_aes_length_shared_secret | | ------------------ | | | | 42| 15|#define OQS_KEM_frodokem_976_aes_length_shared_secret 24 | | ------------------ ------------------ 154| 15| clear_bytes(shake_input_seedSE, 1 + BYTES_SEED_SE); ------------------ | | 29| 15|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(shake_input_seedSE, 1 + BYTES_SEED_SE); ------------------ | | 21| 15|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 15|#define CRYPTO_BYTES OQS_KEM_frodokem_976_aes_length_shared_secret | | | | ------------------ | | | | | | 42| 15|#define OQS_KEM_frodokem_976_aes_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ 155| 15| return OQS_SUCCESS; 156| 15|} OQS_KEM_frodokem_976_aes_decaps: 160| 15|{ // FrodoKEM's key decapsulation 161| | // Inputs: ciphertext ct = ct_c1||ct_c2||salt ( (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8 + (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8 + BYTES_SALT bytes) 162| | // secret key sk = sk_s||pk_seedA||pk_b||sk_S||sk_pkh (CRYPTO_BYTES + BYTES_SEED_A + (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8 + 2*PARAMS_N*PARAMS_NBAR + BYTES_PKHASH bytes) 163| | // Output: shared key ss (CRYPTO_BYTES bytes) 164| 15| uint16_t B[PARAMS_N*PARAMS_NBAR] = {0}; 165| 15| uint16_t Bp[PARAMS_N*PARAMS_NBAR] = {0}; 166| 15| uint16_t W[PARAMS_NBAR*PARAMS_NBAR] = {0}; // contains secret data 167| 15| uint16_t C[PARAMS_NBAR*PARAMS_NBAR] = {0}; 168| 15| uint16_t CC[PARAMS_NBAR*PARAMS_NBAR] = {0}; 169| 15| ALIGN_HEADER(32) uint16_t BBp[PARAMS_N*PARAMS_NBAR] ALIGN_FOOTER(32) = {0}; 170| 15| ALIGN_HEADER(32) uint16_t Sp[(2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR] ALIGN_FOOTER(32) = {0}; // contains secret data 171| 15| uint16_t *Ep = (uint16_t *)&Sp[PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 11| 15|#define PARAMS_N 976 ------------------ uint16_t *Ep = (uint16_t *)&Sp[PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 12| 15|#define PARAMS_NBAR 8 ------------------ 172| 15| uint16_t *Epp = (uint16_t *)&Sp[2*PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 11| 15|#define PARAMS_N 976 ------------------ uint16_t *Epp = (uint16_t *)&Sp[2*PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 12| 15|#define PARAMS_NBAR 8 ------------------ 173| 15| const uint8_t *ct_c1 = &ct[0]; 174| 15| const uint8_t *ct_c2 = &ct[(PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8]; ------------------ | | 13| 15|#define PARAMS_LOGQ 16 ------------------ const uint8_t *ct_c2 = &ct[(PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8]; ------------------ | | 11| 15|#define PARAMS_N 976 ------------------ const uint8_t *ct_c2 = &ct[(PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8]; ------------------ | | 12| 15|#define PARAMS_NBAR 8 ------------------ 175| 15| const uint8_t *salt = &ct[CRYPTO_CIPHERTEXTBYTES - BYTES_SALT]; ------------------ | | 5| 15|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_frodokem_976_aes_length_ciphertext | | ------------------ | | | | 41| 15|#define OQS_KEM_frodokem_976_aes_length_ciphertext 15792 | | ------------------ ------------------ const uint8_t *salt = &ct[CRYPTO_CIPHERTEXTBYTES - BYTES_SALT]; ------------------ | | 20| 15|#define BYTES_SALT (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 15|#define CRYPTO_BYTES OQS_KEM_frodokem_976_aes_length_shared_secret | | | | ------------------ | | | | | | 42| 15|#define OQS_KEM_frodokem_976_aes_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ 176| 15| const uint8_t *sk_s = &sk[0]; 177| 15| const uint8_t *sk_pk = &sk[CRYPTO_BYTES]; ------------------ | | 6| 15|#define CRYPTO_BYTES OQS_KEM_frodokem_976_aes_length_shared_secret | | ------------------ | | | | 42| 15|#define OQS_KEM_frodokem_976_aes_length_shared_secret 24 | | ------------------ ------------------ 178| 15| const uint16_t *sk_S = (uint16_t *) &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES]; ------------------ | | 6| 15|#define CRYPTO_BYTES OQS_KEM_frodokem_976_aes_length_shared_secret | | ------------------ | | | | 42| 15|#define OQS_KEM_frodokem_976_aes_length_shared_secret 24 | | ------------------ ------------------ const uint16_t *sk_S = (uint16_t *) &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES]; ------------------ | | 3| 15|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_frodokem_976_aes_length_public_key | | ------------------ | | | | 39| 15|#define OQS_KEM_frodokem_976_aes_length_public_key 15632 | | ------------------ ------------------ 179| 15| uint16_t S[PARAMS_N * PARAMS_NBAR]; // contains secret data 180| 15| const uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 6| 15|#define CRYPTO_BYTES OQS_KEM_frodokem_976_aes_length_shared_secret | | ------------------ | | | | 42| 15|#define OQS_KEM_frodokem_976_aes_length_shared_secret 24 | | ------------------ ------------------ const uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 3| 15|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_frodokem_976_aes_length_public_key | | ------------------ | | | | 39| 15|#define OQS_KEM_frodokem_976_aes_length_public_key 15632 | | ------------------ ------------------ const uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 11| 15|#define PARAMS_N 976 ------------------ const uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 12| 15|#define PARAMS_NBAR 8 ------------------ 181| 15| const uint8_t *pk_seedA = &sk_pk[0]; 182| 15| const uint8_t *pk_b = &sk_pk[BYTES_SEED_A]; ------------------ | | 18| 15|#define BYTES_SEED_A 16 ------------------ 183| 15| uint8_t G2in[BYTES_PKHASH + BYTES_MU + BYTES_SALT]; // contains secret data via muprime 184| 15| uint8_t *pkh = &G2in[0]; 185| 15| uint8_t *muprime = &G2in[BYTES_PKHASH]; // contains secret data ------------------ | | 22| 15|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 15|#define CRYPTO_BYTES OQS_KEM_frodokem_976_aes_length_shared_secret | | | | ------------------ | | | | | | 42| 15|#define OQS_KEM_frodokem_976_aes_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ 186| 15| uint8_t *G2in_salt = &G2in[BYTES_PKHASH + BYTES_MU]; ------------------ | | 22| 15|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 15|#define CRYPTO_BYTES OQS_KEM_frodokem_976_aes_length_shared_secret | | | | ------------------ | | | | | | 42| 15|#define OQS_KEM_frodokem_976_aes_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ uint8_t *G2in_salt = &G2in[BYTES_PKHASH + BYTES_MU]; ------------------ | | 19| 15|#define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 15| 15|#define PARAMS_EXTRACTED_BITS 3 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 15|#define PARAMS_NBAR 8 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 15|#define PARAMS_NBAR 8 | | ------------------ ------------------ 187| 15| uint8_t G2out[BYTES_SEED_SE + CRYPTO_BYTES]; // contains secret data 188| 15| uint8_t *seedSEprime = &G2out[0]; // contains secret data 189| 15| uint8_t *kprime = &G2out[BYTES_SEED_SE]; // contains secret data ------------------ | | 21| 15|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 15|#define CRYPTO_BYTES OQS_KEM_frodokem_976_aes_length_shared_secret | | | | ------------------ | | | | | | 42| 15|#define OQS_KEM_frodokem_976_aes_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ 190| 15| uint8_t Fin[CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES]; // contains secret data via Fin_k 191| 15| uint8_t *Fin_ct = &Fin[0]; 192| 15| uint8_t *Fin_k = &Fin[CRYPTO_CIPHERTEXTBYTES]; // contains secret data ------------------ | | 5| 15|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_frodokem_976_aes_length_ciphertext | | ------------------ | | | | 41| 15|#define OQS_KEM_frodokem_976_aes_length_ciphertext 15792 | | ------------------ ------------------ 193| 15| uint8_t shake_input_seedSEprime[1 + BYTES_SEED_SE]; // contains secret data 194| | 195| | 196| 117k| for (size_t i = 0; i < PARAMS_N * PARAMS_NBAR; i++) { ------------------ | | 11| 117k|#define PARAMS_N 976 ------------------ for (size_t i = 0; i < PARAMS_N * PARAMS_NBAR; i++) { ------------------ | | 12| 117k|#define PARAMS_NBAR 8 ------------------ | Branch (196:24): [True: 117k, False: 15] ------------------ 197| 117k| S[i] = LE_TO_UINT16(sk_S[i]); ------------------ | | 34| 117k| #define LE_TO_UINT16(n) (n) ------------------ 198| 117k| } 199| | 200| | // Compute W = C - Bp*S (mod q), and decode the randomness mu 201| 15| frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 42| 15|#define frodo_unpack oqs_kem_frodokem_976_aes_unpack ------------------ frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 11| 15|#define PARAMS_N 976 ------------------ frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 12| 15|#define PARAMS_NBAR 8 ------------------ frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 13| 15|#define PARAMS_LOGQ 16 ------------------ frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 11| 15|#define PARAMS_N 976 ------------------ frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 12| 15|#define PARAMS_NBAR 8 ------------------ frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 13| 15|#define PARAMS_LOGQ 16 ------------------ 202| 15| frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 42| 15|#define frodo_unpack oqs_kem_frodokem_976_aes_unpack ------------------ frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 12| 15|#define PARAMS_NBAR 8 ------------------ frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 12| 15|#define PARAMS_NBAR 8 ------------------ frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 13| 15|#define PARAMS_LOGQ 16 ------------------ frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 12| 15|#define PARAMS_NBAR 8 ------------------ frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 12| 15|#define PARAMS_NBAR 8 ------------------ frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 13| 15|#define PARAMS_LOGQ 16 ------------------ 203| 15| frodo_mul_bs(W, Bp, S); ------------------ | | 53| 15|#define frodo_mul_bs oqs_kem_frodokem_976_aes_mul_bs ------------------ 204| 15| frodo_sub(W, C, W); ------------------ | | 56| 15|#define frodo_sub oqs_kem_frodokem_976_aes_sub ------------------ 205| 15| frodo_key_decode((uint16_t*)muprime, W); ------------------ | | 58| 15|#define frodo_key_decode oqs_kem_frodokem_976_aes_key_decode ------------------ 206| | 207| | // Generate (seedSE' || k') = G_2(pkh || mu' || salt) 208| 15| memcpy(pkh, sk_pkh, BYTES_PKHASH); ------------------ | | 22| 15|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 15|#define CRYPTO_BYTES OQS_KEM_frodokem_976_aes_length_shared_secret | | | | ------------------ | | | | | | 42| 15|#define OQS_KEM_frodokem_976_aes_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ 209| 15| memcpy(G2in_salt, salt, BYTES_SALT); ------------------ | | 20| 15|#define BYTES_SALT (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 15|#define CRYPTO_BYTES OQS_KEM_frodokem_976_aes_length_shared_secret | | | | ------------------ | | | | | | 42| 15|#define OQS_KEM_frodokem_976_aes_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ 210| 15| shake(G2out, BYTES_SEED_SE + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU + BYTES_SALT); ------------------ | | 31| 15|#define shake OQS_SHA3_shake256 ------------------ shake(G2out, BYTES_SEED_SE + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU + BYTES_SALT); ------------------ | | 21| 15|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 15|#define CRYPTO_BYTES OQS_KEM_frodokem_976_aes_length_shared_secret | | | | ------------------ | | | | | | 42| 15|#define OQS_KEM_frodokem_976_aes_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ shake(G2out, BYTES_SEED_SE + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU + BYTES_SALT); ------------------ | | 6| 15|#define CRYPTO_BYTES OQS_KEM_frodokem_976_aes_length_shared_secret | | ------------------ | | | | 42| 15|#define OQS_KEM_frodokem_976_aes_length_shared_secret 24 | | ------------------ ------------------ shake(G2out, BYTES_SEED_SE + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU + BYTES_SALT); ------------------ | | 22| 15|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 15|#define CRYPTO_BYTES OQS_KEM_frodokem_976_aes_length_shared_secret | | | | ------------------ | | | | | | 42| 15|#define OQS_KEM_frodokem_976_aes_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ shake(G2out, BYTES_SEED_SE + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU + BYTES_SALT); ------------------ | | 19| 15|#define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 15| 15|#define PARAMS_EXTRACTED_BITS 3 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 15|#define PARAMS_NBAR 8 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 15|#define PARAMS_NBAR 8 | | ------------------ ------------------ shake(G2out, BYTES_SEED_SE + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU + BYTES_SALT); ------------------ | | 20| 15|#define BYTES_SALT (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 15|#define CRYPTO_BYTES OQS_KEM_frodokem_976_aes_length_shared_secret | | | | ------------------ | | | | | | 42| 15|#define OQS_KEM_frodokem_976_aes_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ 211| | 212| | // Generate Sp and Ep, and compute BBp = Sp*A + Ep. Generate A on-the-fly 213| 15| shake_input_seedSEprime[0] = 0x96; 214| 15| memcpy(&shake_input_seedSEprime[1], seedSEprime, BYTES_SEED_SE); ------------------ | | 21| 15|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 15|#define CRYPTO_BYTES OQS_KEM_frodokem_976_aes_length_shared_secret | | | | ------------------ | | | | | | 42| 15|#define OQS_KEM_frodokem_976_aes_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ 215| 15| shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSEprime, 1 + BYTES_SEED_SE); ------------------ | | 31| 15|#define shake OQS_SHA3_shake256 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSEprime, 1 + BYTES_SEED_SE); ------------------ | | 11| 15|#define PARAMS_N 976 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSEprime, 1 + BYTES_SEED_SE); ------------------ | | 12| 15|#define PARAMS_NBAR 8 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSEprime, 1 + BYTES_SEED_SE); ------------------ | | 12| 15|#define PARAMS_NBAR 8 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSEprime, 1 + BYTES_SEED_SE); ------------------ | | 21| 15|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 15|#define CRYPTO_BYTES OQS_KEM_frodokem_976_aes_length_shared_secret | | | | ------------------ | | | | | | 42| 15|#define OQS_KEM_frodokem_976_aes_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ 216| 235k| for (size_t i = 0; i < (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR; i++) { ------------------ | | 11| 235k|#define PARAMS_N 976 ------------------ for (size_t i = 0; i < (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR; i++) { ------------------ | | 12| 235k|#define PARAMS_NBAR 8 ------------------ for (size_t i = 0; i < (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR; i++) { ------------------ | | 12| 235k|#define PARAMS_NBAR 8 ------------------ | Branch (216:24): [True: 235k, False: 15] ------------------ 217| 235k| Sp[i] = LE_TO_UINT16(Sp[i]); ------------------ | | 34| 235k| #define LE_TO_UINT16(n) (n) ------------------ 218| 235k| } 219| 15| frodo_sample_n(Sp, PARAMS_N*PARAMS_NBAR); ------------------ | | 40| 15|#define frodo_sample_n oqs_kem_frodokem_976_aes_sample_n ------------------ frodo_sample_n(Sp, PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 15|#define PARAMS_N 976 ------------------ frodo_sample_n(Sp, PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 15|#define PARAMS_NBAR 8 ------------------ 220| 15| frodo_sample_n(Ep, PARAMS_N*PARAMS_NBAR); ------------------ | | 40| 15|#define frodo_sample_n oqs_kem_frodokem_976_aes_sample_n ------------------ frodo_sample_n(Ep, PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 15|#define PARAMS_N 976 ------------------ frodo_sample_n(Ep, PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 15|#define PARAMS_NBAR 8 ------------------ 221| 15| frodo_mul_add_sa_plus_e(BBp, Sp, Ep, pk_seedA); ------------------ | | 49| 15|#define frodo_mul_add_sa_plus_e oqs_kem_frodokem_976_aes_mul_add_sa_plus_e ------------------ 222| | 223| | // Generate Epp, and compute W = Sp*B + Epp 224| 15| frodo_sample_n(Epp, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 40| 15|#define frodo_sample_n oqs_kem_frodokem_976_aes_sample_n ------------------ frodo_sample_n(Epp, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 15|#define PARAMS_NBAR 8 ------------------ frodo_sample_n(Epp, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 15|#define PARAMS_NBAR 8 ------------------ 225| 15| frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 42| 15|#define frodo_unpack oqs_kem_frodokem_976_aes_unpack ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 11| 15|#define PARAMS_N 976 ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 12| 15|#define PARAMS_NBAR 8 ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 3| 15|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_frodokem_976_aes_length_public_key | | ------------------ | | | | 39| 15|#define OQS_KEM_frodokem_976_aes_length_public_key 15632 | | ------------------ ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 18| 15|#define BYTES_SEED_A 16 ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 13| 15|#define PARAMS_LOGQ 16 ------------------ 226| 15| frodo_mul_add_sb_plus_e(W, B, Sp, Epp); ------------------ | | 52| 15|#define frodo_mul_add_sb_plus_e oqs_kem_frodokem_976_aes_mul_add_sb_plus_e ------------------ 227| | 228| | // Encode mu, and compute CC = W + enc(mu') (mod q) 229| 15| frodo_key_encode(CC, (uint16_t*)muprime); ------------------ | | 57| 15|#define frodo_key_encode oqs_kem_frodokem_976_aes_key_encode ------------------ 230| 15| frodo_add(CC, W, CC); ------------------ | | 55| 15|#define frodo_add oqs_kem_frodokem_976_aes_add ------------------ 231| | 232| | // Prepare input to F 233| 15| memcpy(Fin_ct, ct, CRYPTO_CIPHERTEXTBYTES); ------------------ | | 5| 15|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_frodokem_976_aes_length_ciphertext | | ------------------ | | | | 41| 15|#define OQS_KEM_frodokem_976_aes_length_ciphertext 15792 | | ------------------ ------------------ 234| | 235| | // Reducing BBp modulo q 236| 117k| for (int i = 0; i < PARAMS_N*PARAMS_NBAR; i++) BBp[i] = BBp[i] & ((1 << PARAMS_LOGQ)-1); ------------------ | | 11| 117k|#define PARAMS_N 976 ------------------ for (int i = 0; i < PARAMS_N*PARAMS_NBAR; i++) BBp[i] = BBp[i] & ((1 << PARAMS_LOGQ)-1); ------------------ | | 12| 117k|#define PARAMS_NBAR 8 ------------------ for (int i = 0; i < PARAMS_N*PARAMS_NBAR; i++) BBp[i] = BBp[i] & ((1 << PARAMS_LOGQ)-1); ------------------ | | 13| 117k|#define PARAMS_LOGQ 16 ------------------ | Branch (236:21): [True: 117k, False: 15] ------------------ 237| | 238| | // Needs to avoid branching on secret data using constant-time implementation. 239| 15| int8_t selector = ct_verify(Bp, BBp, PARAMS_N*PARAMS_NBAR) | ct_verify(C, CC, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 44| 15|#define ct_verify oqs_kem_frodokem_976_aes_ct_verify ------------------ int8_t selector = ct_verify(Bp, BBp, PARAMS_N*PARAMS_NBAR) | ct_verify(C, CC, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 11| 15|#define PARAMS_N 976 ------------------ int8_t selector = ct_verify(Bp, BBp, PARAMS_N*PARAMS_NBAR) | ct_verify(C, CC, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 15|#define PARAMS_NBAR 8 ------------------ int8_t selector = ct_verify(Bp, BBp, PARAMS_N*PARAMS_NBAR) | ct_verify(C, CC, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 44| 15|#define ct_verify oqs_kem_frodokem_976_aes_ct_verify ------------------ int8_t selector = ct_verify(Bp, BBp, PARAMS_N*PARAMS_NBAR) | ct_verify(C, CC, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 15|#define PARAMS_NBAR 8 ------------------ int8_t selector = ct_verify(Bp, BBp, PARAMS_N*PARAMS_NBAR) | ct_verify(C, CC, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 15|#define PARAMS_NBAR 8 ------------------ 240| | // If (selector == 0) then load k' to do ss = F(ct || k'), else if (selector == -1) load s to do ss = F(ct || s) 241| 15| ct_select((uint8_t*)Fin_k, (uint8_t*)kprime, (uint8_t*)sk_s, CRYPTO_BYTES, selector); ------------------ | | 43| 15|#define ct_select oqs_kem_frodokem_976_aes_ct_select ------------------ ct_select((uint8_t*)Fin_k, (uint8_t*)kprime, (uint8_t*)sk_s, CRYPTO_BYTES, selector); ------------------ | | 6| 15|#define CRYPTO_BYTES OQS_KEM_frodokem_976_aes_length_shared_secret | | ------------------ | | | | 42| 15|#define OQS_KEM_frodokem_976_aes_length_shared_secret 24 | | ------------------ ------------------ 242| 15| shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 31| 15|#define shake OQS_SHA3_shake256 ------------------ shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 6| 15|#define CRYPTO_BYTES OQS_KEM_frodokem_976_aes_length_shared_secret | | ------------------ | | | | 42| 15|#define OQS_KEM_frodokem_976_aes_length_shared_secret 24 | | ------------------ ------------------ shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 5| 15|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_frodokem_976_aes_length_ciphertext | | ------------------ | | | | 41| 15|#define OQS_KEM_frodokem_976_aes_length_ciphertext 15792 | | ------------------ ------------------ shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 6| 15|#define CRYPTO_BYTES OQS_KEM_frodokem_976_aes_length_shared_secret | | ------------------ | | | | 42| 15|#define OQS_KEM_frodokem_976_aes_length_shared_secret 24 | | ------------------ ------------------ 243| | 244| | // Cleanup: 245| 15| clear_bytes((uint8_t *)W, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 29| 15|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)W, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 15|#define PARAMS_NBAR 8 ------------------ clear_bytes((uint8_t *)W, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 15|#define PARAMS_NBAR 8 ------------------ 246| 15| clear_bytes((uint8_t *)Sp, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 29| 15|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)Sp, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 15|#define PARAMS_N 976 ------------------ clear_bytes((uint8_t *)Sp, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 15|#define PARAMS_NBAR 8 ------------------ 247| 15| clear_bytes((uint8_t *)S, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 29| 15|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)S, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 15|#define PARAMS_N 976 ------------------ clear_bytes((uint8_t *)S, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 15|#define PARAMS_NBAR 8 ------------------ 248| 15| clear_bytes((uint8_t *)Ep, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 29| 15|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)Ep, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 15|#define PARAMS_N 976 ------------------ clear_bytes((uint8_t *)Ep, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 15|#define PARAMS_NBAR 8 ------------------ 249| 15| clear_bytes((uint8_t *)Epp, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 29| 15|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)Epp, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 15|#define PARAMS_NBAR 8 ------------------ clear_bytes((uint8_t *)Epp, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 15|#define PARAMS_NBAR 8 ------------------ 250| 15| clear_bytes(muprime, BYTES_MU); ------------------ | | 29| 15|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(muprime, BYTES_MU); ------------------ | | 19| 15|#define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 15| 15|#define PARAMS_EXTRACTED_BITS 3 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 15|#define PARAMS_NBAR 8 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 15|#define PARAMS_NBAR 8 | | ------------------ ------------------ 251| 15| clear_bytes(G2out, BYTES_SEED_SE + CRYPTO_BYTES); ------------------ | | 29| 15|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(G2out, BYTES_SEED_SE + CRYPTO_BYTES); ------------------ | | 21| 15|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 15|#define CRYPTO_BYTES OQS_KEM_frodokem_976_aes_length_shared_secret | | | | ------------------ | | | | | | 42| 15|#define OQS_KEM_frodokem_976_aes_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ clear_bytes(G2out, BYTES_SEED_SE + CRYPTO_BYTES); ------------------ | | 6| 15|#define CRYPTO_BYTES OQS_KEM_frodokem_976_aes_length_shared_secret | | ------------------ | | | | 42| 15|#define OQS_KEM_frodokem_976_aes_length_shared_secret 24 | | ------------------ ------------------ 252| 15| clear_bytes(Fin_k, CRYPTO_BYTES); ------------------ | | 29| 15|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(Fin_k, CRYPTO_BYTES); ------------------ | | 6| 15|#define CRYPTO_BYTES OQS_KEM_frodokem_976_aes_length_shared_secret | | ------------------ | | | | 42| 15|#define OQS_KEM_frodokem_976_aes_length_shared_secret 24 | | ------------------ ------------------ 253| 15| clear_bytes(shake_input_seedSEprime, 1 + BYTES_SEED_SE); ------------------ | | 29| 15|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(shake_input_seedSEprime, 1 + BYTES_SEED_SE); ------------------ | | 21| 15|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 15|#define CRYPTO_BYTES OQS_KEM_frodokem_976_aes_length_shared_secret | | | | ------------------ | | | | | | 42| 15|#define OQS_KEM_frodokem_976_aes_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ 254| 15| return OQS_SUCCESS; 255| 15|} OQS_KEM_frodokem_976_shake_keypair: 19| 11|{ // FrodoKEM's key generation 20| | // Outputs: public key pk = pk_seedA||pk_b ( BYTES_SEED_A + (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8 bytes) 21| | // secret key sk = sk_s||pk_seedA||pk_b||sk_S||sk_pkh (CRYPTO_BYTES + BYTES_SEED_A + (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8 + 2*PARAMS_N*PARAMS_NBAR + BYTES_PKHASH bytes) 22| 11| uint8_t *pk_seedA = &pk[0]; 23| 11| uint8_t *pk_b = &pk[BYTES_SEED_A]; ------------------ | | 18| 11|#define BYTES_SEED_A 16 ------------------ 24| 11| uint8_t *sk_s = &sk[0]; 25| 11| uint8_t *sk_pk = &sk[CRYPTO_BYTES]; ------------------ | | 6| 11|#define CRYPTO_BYTES OQS_KEM_frodokem_976_shake_length_shared_secret | | ------------------ | | | | 57| 11|#define OQS_KEM_frodokem_976_shake_length_shared_secret 24 | | ------------------ ------------------ 26| 11| uint8_t *sk_S = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES]; ------------------ | | 6| 11|#define CRYPTO_BYTES OQS_KEM_frodokem_976_shake_length_shared_secret | | ------------------ | | | | 57| 11|#define OQS_KEM_frodokem_976_shake_length_shared_secret 24 | | ------------------ ------------------ uint8_t *sk_S = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES]; ------------------ | | 3| 11|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_frodokem_976_shake_length_public_key | | ------------------ | | | | 54| 11|#define OQS_KEM_frodokem_976_shake_length_public_key 15632 | | ------------------ ------------------ 27| 11| uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 6| 11|#define CRYPTO_BYTES OQS_KEM_frodokem_976_shake_length_shared_secret | | ------------------ | | | | 57| 11|#define OQS_KEM_frodokem_976_shake_length_shared_secret 24 | | ------------------ ------------------ uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 3| 11|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_frodokem_976_shake_length_public_key | | ------------------ | | | | 54| 11|#define OQS_KEM_frodokem_976_shake_length_public_key 15632 | | ------------------ ------------------ uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 11| 11|#define PARAMS_N 976 ------------------ uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 12| 11|#define PARAMS_NBAR 8 ------------------ 28| 11| uint16_t B[PARAMS_N*PARAMS_NBAR] = {0}; 29| 11| uint16_t S[2*PARAMS_N*PARAMS_NBAR] = {0}; // contains secret data 30| 11| uint16_t *E = (uint16_t *)&S[PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 11| 11|#define PARAMS_N 976 ------------------ uint16_t *E = (uint16_t *)&S[PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 12| 11|#define PARAMS_NBAR 8 ------------------ 31| 11| uint8_t randomness[CRYPTO_BYTES + BYTES_SEED_SE + BYTES_SEED_A]; // contains secret data via randomness_s and randomness_seedSE 32| 11| uint8_t *randomness_s = &randomness[0]; // contains secret data 33| 11| uint8_t *randomness_seedSE = &randomness[CRYPTO_BYTES]; // contains secret data ------------------ | | 6| 11|#define CRYPTO_BYTES OQS_KEM_frodokem_976_shake_length_shared_secret | | ------------------ | | | | 57| 11|#define OQS_KEM_frodokem_976_shake_length_shared_secret 24 | | ------------------ ------------------ 34| 11| uint8_t *randomness_z = &randomness[CRYPTO_BYTES + BYTES_SEED_SE]; ------------------ | | 6| 11|#define CRYPTO_BYTES OQS_KEM_frodokem_976_shake_length_shared_secret | | ------------------ | | | | 57| 11|#define OQS_KEM_frodokem_976_shake_length_shared_secret 24 | | ------------------ ------------------ uint8_t *randomness_z = &randomness[CRYPTO_BYTES + BYTES_SEED_SE]; ------------------ | | 21| 11|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 11|#define CRYPTO_BYTES OQS_KEM_frodokem_976_shake_length_shared_secret | | | | ------------------ | | | | | | 57| 11|#define OQS_KEM_frodokem_976_shake_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ 35| 11| uint8_t shake_input_seedSE[1 + BYTES_SEED_SE]; // contains secret data 36| | 37| | // Generate the secret value s, the seed for S and E, and the seed for the seed for A. Add seed_A to the public key 38| 11| randombytes(randomness, CRYPTO_BYTES + BYTES_SEED_SE + BYTES_SEED_A); ------------------ | | 28| 11|#define randombytes OQS_randombytes ------------------ randombytes(randomness, CRYPTO_BYTES + BYTES_SEED_SE + BYTES_SEED_A); ------------------ | | 6| 11|#define CRYPTO_BYTES OQS_KEM_frodokem_976_shake_length_shared_secret | | ------------------ | | | | 57| 11|#define OQS_KEM_frodokem_976_shake_length_shared_secret 24 | | ------------------ ------------------ randombytes(randomness, CRYPTO_BYTES + BYTES_SEED_SE + BYTES_SEED_A); ------------------ | | 21| 11|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 11|#define CRYPTO_BYTES OQS_KEM_frodokem_976_shake_length_shared_secret | | | | ------------------ | | | | | | 57| 11|#define OQS_KEM_frodokem_976_shake_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ randombytes(randomness, CRYPTO_BYTES + BYTES_SEED_SE + BYTES_SEED_A); ------------------ | | 18| 11|#define BYTES_SEED_A 16 ------------------ 39| 11| shake(pk_seedA, BYTES_SEED_A, randomness_z, BYTES_SEED_A); ------------------ | | 31| 11|#define shake OQS_SHA3_shake256 ------------------ shake(pk_seedA, BYTES_SEED_A, randomness_z, BYTES_SEED_A); ------------------ | | 18| 11|#define BYTES_SEED_A 16 ------------------ shake(pk_seedA, BYTES_SEED_A, randomness_z, BYTES_SEED_A); ------------------ | | 18| 11|#define BYTES_SEED_A 16 ------------------ 40| | 41| | // Generate S and E, and compute B = A*S + E. Generate A on-the-fly 42| 11| shake_input_seedSE[0] = 0x5F; 43| 11| memcpy(&shake_input_seedSE[1], randomness_seedSE, BYTES_SEED_SE); ------------------ | | 21| 11|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 11|#define CRYPTO_BYTES OQS_KEM_frodokem_976_shake_length_shared_secret | | | | ------------------ | | | | | | 57| 11|#define OQS_KEM_frodokem_976_shake_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ 44| 11| shake((uint8_t*)S, 2*PARAMS_N*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + BYTES_SEED_SE); ------------------ | | 31| 11|#define shake OQS_SHA3_shake256 ------------------ shake((uint8_t*)S, 2*PARAMS_N*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + BYTES_SEED_SE); ------------------ | | 11| 11|#define PARAMS_N 976 ------------------ shake((uint8_t*)S, 2*PARAMS_N*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + BYTES_SEED_SE); ------------------ | | 12| 11|#define PARAMS_NBAR 8 ------------------ shake((uint8_t*)S, 2*PARAMS_N*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + BYTES_SEED_SE); ------------------ | | 21| 11|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 11|#define CRYPTO_BYTES OQS_KEM_frodokem_976_shake_length_shared_secret | | | | ------------------ | | | | | | 57| 11|#define OQS_KEM_frodokem_976_shake_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ 45| 171k| for (size_t i = 0; i < 2 * PARAMS_N * PARAMS_NBAR; i++) { ------------------ | | 11| 171k|#define PARAMS_N 976 ------------------ for (size_t i = 0; i < 2 * PARAMS_N * PARAMS_NBAR; i++) { ------------------ | | 12| 171k|#define PARAMS_NBAR 8 ------------------ | Branch (45:24): [True: 171k, False: 11] ------------------ 46| 171k| S[i] = LE_TO_UINT16(S[i]); ------------------ | | 34| 171k| #define LE_TO_UINT16(n) (n) ------------------ 47| 171k| } 48| 11| frodo_sample_n(S, PARAMS_N*PARAMS_NBAR); ------------------ | | 40| 11|#define frodo_sample_n oqs_kem_frodokem_976_shake_sample_n ------------------ frodo_sample_n(S, PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 11|#define PARAMS_N 976 ------------------ frodo_sample_n(S, PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 11|#define PARAMS_NBAR 8 ------------------ 49| 11| frodo_sample_n(E, PARAMS_N*PARAMS_NBAR); ------------------ | | 40| 11|#define frodo_sample_n oqs_kem_frodokem_976_shake_sample_n ------------------ frodo_sample_n(E, PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 11|#define PARAMS_N 976 ------------------ frodo_sample_n(E, PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 11|#define PARAMS_NBAR 8 ------------------ 50| 11| frodo_mul_add_as_plus_e(B, S, E, pk); ------------------ | | 46| 11|#define frodo_mul_add_as_plus_e oqs_kem_frodokem_976_shake_mul_add_as_plus_e ------------------ 51| | 52| | // Encode the second part of the public key 53| 11| frodo_pack(pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, B, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 41| 11|#define frodo_pack oqs_kem_frodokem_976_shake_pack ------------------ frodo_pack(pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, B, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 3| 11|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_frodokem_976_shake_length_public_key | | ------------------ | | | | 54| 11|#define OQS_KEM_frodokem_976_shake_length_public_key 15632 | | ------------------ ------------------ frodo_pack(pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, B, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 18| 11|#define BYTES_SEED_A 16 ------------------ frodo_pack(pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, B, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 11| 11|#define PARAMS_N 976 ------------------ frodo_pack(pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, B, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 11|#define PARAMS_NBAR 8 ------------------ frodo_pack(pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, B, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 13| 11|#define PARAMS_LOGQ 16 ------------------ 54| | 55| | // Add s, pk and S to the secret key 56| 11| memcpy(sk_s, randomness_s, CRYPTO_BYTES); ------------------ | | 6| 11|#define CRYPTO_BYTES OQS_KEM_frodokem_976_shake_length_shared_secret | | ------------------ | | | | 57| 11|#define OQS_KEM_frodokem_976_shake_length_shared_secret 24 | | ------------------ ------------------ 57| 11| memcpy(sk_pk, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 3| 11|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_frodokem_976_shake_length_public_key | | ------------------ | | | | 54| 11|#define OQS_KEM_frodokem_976_shake_length_public_key 15632 | | ------------------ ------------------ 58| 85.8k| for (size_t i = 0; i < PARAMS_N * PARAMS_NBAR; i++) { ------------------ | | 11| 85.8k|#define PARAMS_N 976 ------------------ for (size_t i = 0; i < PARAMS_N * PARAMS_NBAR; i++) { ------------------ | | 12| 85.8k|#define PARAMS_NBAR 8 ------------------ | Branch (58:24): [True: 85.8k, False: 11] ------------------ 59| 85.8k| S[i] = UINT16_TO_LE(S[i]); ------------------ | | 35| 85.8k| #define UINT16_TO_LE(n) (n) ------------------ 60| 85.8k| } 61| 11| memcpy(sk_S, S, 2*PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 11|#define PARAMS_N 976 ------------------ memcpy(sk_S, S, 2*PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 11|#define PARAMS_NBAR 8 ------------------ 62| | 63| | // Add H(pk) to the secret key 64| 11| shake(sk_pkh, BYTES_PKHASH, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 31| 11|#define shake OQS_SHA3_shake256 ------------------ shake(sk_pkh, BYTES_PKHASH, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 22| 11|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 11|#define CRYPTO_BYTES OQS_KEM_frodokem_976_shake_length_shared_secret | | | | ------------------ | | | | | | 57| 11|#define OQS_KEM_frodokem_976_shake_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ shake(sk_pkh, BYTES_PKHASH, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 3| 11|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_frodokem_976_shake_length_public_key | | ------------------ | | | | 54| 11|#define OQS_KEM_frodokem_976_shake_length_public_key 15632 | | ------------------ ------------------ 65| | 66| | // Cleanup: 67| 11| clear_bytes((uint8_t *)S, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 29| 11|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)S, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 11|#define PARAMS_N 976 ------------------ clear_bytes((uint8_t *)S, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 11|#define PARAMS_NBAR 8 ------------------ 68| 11| clear_bytes((uint8_t *)E, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 29| 11|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)E, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 11|#define PARAMS_N 976 ------------------ clear_bytes((uint8_t *)E, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 11|#define PARAMS_NBAR 8 ------------------ 69| 11| clear_bytes(randomness, CRYPTO_BYTES + BYTES_SEED_SE); ------------------ | | 29| 11|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(randomness, CRYPTO_BYTES + BYTES_SEED_SE); ------------------ | | 6| 11|#define CRYPTO_BYTES OQS_KEM_frodokem_976_shake_length_shared_secret | | ------------------ | | | | 57| 11|#define OQS_KEM_frodokem_976_shake_length_shared_secret 24 | | ------------------ ------------------ clear_bytes(randomness, CRYPTO_BYTES + BYTES_SEED_SE); ------------------ | | 21| 11|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 11|#define CRYPTO_BYTES OQS_KEM_frodokem_976_shake_length_shared_secret | | | | ------------------ | | | | | | 57| 11|#define OQS_KEM_frodokem_976_shake_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ 70| 11| clear_bytes(shake_input_seedSE, 1 + BYTES_SEED_SE); ------------------ | | 29| 11|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(shake_input_seedSE, 1 + BYTES_SEED_SE); ------------------ | | 21| 11|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 11|#define CRYPTO_BYTES OQS_KEM_frodokem_976_shake_length_shared_secret | | | | ------------------ | | | | | | 57| 11|#define OQS_KEM_frodokem_976_shake_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ 71| 11| return OQS_SUCCESS; 72| 11|} OQS_KEM_frodokem_976_shake_encaps: 86| 11|{ // FrodoKEM's key encapsulation 87| | // Input: public key pk = pk_seedA||pk_b (BYTES_SEED_A + (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8 bytes) 88| | // Outputs: ciphertext ct = ct_c1||ct_c2||salt ( (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8 + (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8 + BYTES_SALT bytes) 89| | // shared key ss (CRYPTO_BYTES bytes) 90| 11| const uint8_t *pk_seedA = &pk[0]; 91| 11| const uint8_t *pk_b = &pk[BYTES_SEED_A]; ------------------ | | 18| 11|#define BYTES_SEED_A 16 ------------------ 92| 11| uint8_t *ct_c1 = &ct[0]; 93| 11| uint8_t *ct_c2 = &ct[(PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8]; ------------------ | | 13| 11|#define PARAMS_LOGQ 16 ------------------ uint8_t *ct_c2 = &ct[(PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8]; ------------------ | | 11| 11|#define PARAMS_N 976 ------------------ uint8_t *ct_c2 = &ct[(PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8]; ------------------ | | 12| 11|#define PARAMS_NBAR 8 ------------------ 94| 11| uint16_t B[PARAMS_N*PARAMS_NBAR] = {0}; 95| 11| uint16_t V[PARAMS_NBAR*PARAMS_NBAR]= {0}; // contains secret data 96| 11| uint16_t C[PARAMS_NBAR*PARAMS_NBAR] = {0}; 97| 11| ALIGN_HEADER(32) uint16_t Bp[PARAMS_N*PARAMS_NBAR] ALIGN_FOOTER(32) = {0}; 98| 11| ALIGN_HEADER(32) uint16_t Sp[(2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR] ALIGN_FOOTER(32) = {0}; // contains secret data 99| 11| uint16_t *Ep = (uint16_t *)&Sp[PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 11| 11|#define PARAMS_N 976 ------------------ uint16_t *Ep = (uint16_t *)&Sp[PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 12| 11|#define PARAMS_NBAR 8 ------------------ 100| 11| uint16_t *Epp = (uint16_t *)&Sp[2*PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 11| 11|#define PARAMS_N 976 ------------------ uint16_t *Epp = (uint16_t *)&Sp[2*PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 12| 11|#define PARAMS_NBAR 8 ------------------ 101| 11| uint8_t G2in[BYTES_PKHASH + BYTES_MU + BYTES_SALT]; // contains secret data via mu 102| 11| uint8_t *pkh = &G2in[0]; 103| 11| uint8_t *mu = &G2in[BYTES_PKHASH]; // contains secret data ------------------ | | 22| 11|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 11|#define CRYPTO_BYTES OQS_KEM_frodokem_976_shake_length_shared_secret | | | | ------------------ | | | | | | 57| 11|#define OQS_KEM_frodokem_976_shake_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ 104| 11| uint8_t *salt = &G2in[BYTES_PKHASH + BYTES_MU]; ------------------ | | 22| 11|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 11|#define CRYPTO_BYTES OQS_KEM_frodokem_976_shake_length_shared_secret | | | | ------------------ | | | | | | 57| 11|#define OQS_KEM_frodokem_976_shake_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ uint8_t *salt = &G2in[BYTES_PKHASH + BYTES_MU]; ------------------ | | 19| 11|#define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 15| 11|#define PARAMS_EXTRACTED_BITS 3 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 11|#define PARAMS_NBAR 8 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 11|#define PARAMS_NBAR 8 | | ------------------ ------------------ 105| 11| uint8_t G2out[BYTES_SEED_SE + CRYPTO_BYTES]; // contains secret data 106| 11| uint8_t *seedSE = &G2out[0]; // contains secret data 107| 11| uint8_t *k = &G2out[BYTES_SEED_SE]; // contains secret data ------------------ | | 21| 11|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 11|#define CRYPTO_BYTES OQS_KEM_frodokem_976_shake_length_shared_secret | | | | ------------------ | | | | | | 57| 11|#define OQS_KEM_frodokem_976_shake_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ 108| 11| uint8_t Fin[CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES]; // contains secret data via Fin_k 109| 11| uint8_t *Fin_ct = &Fin[0]; 110| 11| uint8_t *Fin_k = &Fin[CRYPTO_CIPHERTEXTBYTES]; // contains secret data ------------------ | | 5| 11|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_frodokem_976_shake_length_ciphertext | | ------------------ | | | | 56| 11|#define OQS_KEM_frodokem_976_shake_length_ciphertext 15792 | | ------------------ ------------------ 111| 11| uint8_t shake_input_seedSE[1 + BYTES_SEED_SE]; // contains secret data 112| | 113| | // pkh <- G_1(pk), generate random mu and salt, compute (seedSE || k) = G_2(pkh || mu || salt) 114| 11| shake(pkh, BYTES_PKHASH, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 31| 11|#define shake OQS_SHA3_shake256 ------------------ shake(pkh, BYTES_PKHASH, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 22| 11|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 11|#define CRYPTO_BYTES OQS_KEM_frodokem_976_shake_length_shared_secret | | | | ------------------ | | | | | | 57| 11|#define OQS_KEM_frodokem_976_shake_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ shake(pkh, BYTES_PKHASH, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 3| 11|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_frodokem_976_shake_length_public_key | | ------------------ | | | | 54| 11|#define OQS_KEM_frodokem_976_shake_length_public_key 15632 | | ------------------ ------------------ 115| 11| randombytes(mu, BYTES_MU + BYTES_SALT); ------------------ | | 28| 11|#define randombytes OQS_randombytes ------------------ randombytes(mu, BYTES_MU + BYTES_SALT); ------------------ | | 19| 11|#define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 15| 11|#define PARAMS_EXTRACTED_BITS 3 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 11|#define PARAMS_NBAR 8 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 11|#define PARAMS_NBAR 8 | | ------------------ ------------------ randombytes(mu, BYTES_MU + BYTES_SALT); ------------------ | | 20| 11|#define BYTES_SALT (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 11|#define CRYPTO_BYTES OQS_KEM_frodokem_976_shake_length_shared_secret | | | | ------------------ | | | | | | 57| 11|#define OQS_KEM_frodokem_976_shake_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ 116| 11| shake(G2out, BYTES_SEED_SE + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU + BYTES_SALT); ------------------ | | 31| 11|#define shake OQS_SHA3_shake256 ------------------ shake(G2out, BYTES_SEED_SE + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU + BYTES_SALT); ------------------ | | 21| 11|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 11|#define CRYPTO_BYTES OQS_KEM_frodokem_976_shake_length_shared_secret | | | | ------------------ | | | | | | 57| 11|#define OQS_KEM_frodokem_976_shake_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ shake(G2out, BYTES_SEED_SE + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU + BYTES_SALT); ------------------ | | 6| 11|#define CRYPTO_BYTES OQS_KEM_frodokem_976_shake_length_shared_secret | | ------------------ | | | | 57| 11|#define OQS_KEM_frodokem_976_shake_length_shared_secret 24 | | ------------------ ------------------ shake(G2out, BYTES_SEED_SE + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU + BYTES_SALT); ------------------ | | 22| 11|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 11|#define CRYPTO_BYTES OQS_KEM_frodokem_976_shake_length_shared_secret | | | | ------------------ | | | | | | 57| 11|#define OQS_KEM_frodokem_976_shake_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ shake(G2out, BYTES_SEED_SE + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU + BYTES_SALT); ------------------ | | 19| 11|#define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 15| 11|#define PARAMS_EXTRACTED_BITS 3 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 11|#define PARAMS_NBAR 8 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 11|#define PARAMS_NBAR 8 | | ------------------ ------------------ shake(G2out, BYTES_SEED_SE + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU + BYTES_SALT); ------------------ | | 20| 11|#define BYTES_SALT (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 11|#define CRYPTO_BYTES OQS_KEM_frodokem_976_shake_length_shared_secret | | | | ------------------ | | | | | | 57| 11|#define OQS_KEM_frodokem_976_shake_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ 117| | 118| | // Generate Sp and Ep, and compute Bp = Sp*A + Ep. Generate A on-the-fly 119| 11| shake_input_seedSE[0] = 0x96; 120| 11| memcpy(&shake_input_seedSE[1], seedSE, BYTES_SEED_SE); ------------------ | | 21| 11|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 11|#define CRYPTO_BYTES OQS_KEM_frodokem_976_shake_length_shared_secret | | | | ------------------ | | | | | | 57| 11|#define OQS_KEM_frodokem_976_shake_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ 121| 11| shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + BYTES_SEED_SE); ------------------ | | 31| 11|#define shake OQS_SHA3_shake256 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + BYTES_SEED_SE); ------------------ | | 11| 11|#define PARAMS_N 976 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + BYTES_SEED_SE); ------------------ | | 12| 11|#define PARAMS_NBAR 8 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + BYTES_SEED_SE); ------------------ | | 12| 11|#define PARAMS_NBAR 8 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + BYTES_SEED_SE); ------------------ | | 21| 11|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 11|#define CRYPTO_BYTES OQS_KEM_frodokem_976_shake_length_shared_secret | | | | ------------------ | | | | | | 57| 11|#define OQS_KEM_frodokem_976_shake_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ 122| 172k| for (size_t i = 0; i < (2 * PARAMS_N + PARAMS_NBAR) * PARAMS_NBAR; i++) { ------------------ | | 11| 172k|#define PARAMS_N 976 ------------------ for (size_t i = 0; i < (2 * PARAMS_N + PARAMS_NBAR) * PARAMS_NBAR; i++) { ------------------ | | 12| 172k|#define PARAMS_NBAR 8 ------------------ for (size_t i = 0; i < (2 * PARAMS_N + PARAMS_NBAR) * PARAMS_NBAR; i++) { ------------------ | | 12| 172k|#define PARAMS_NBAR 8 ------------------ | Branch (122:24): [True: 172k, False: 11] ------------------ 123| 172k| Sp[i] = LE_TO_UINT16(Sp[i]); ------------------ | | 34| 172k| #define LE_TO_UINT16(n) (n) ------------------ 124| 172k| } 125| 11| frodo_sample_n(Sp, PARAMS_N*PARAMS_NBAR); ------------------ | | 40| 11|#define frodo_sample_n oqs_kem_frodokem_976_shake_sample_n ------------------ frodo_sample_n(Sp, PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 11|#define PARAMS_N 976 ------------------ frodo_sample_n(Sp, PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 11|#define PARAMS_NBAR 8 ------------------ 126| 11| frodo_sample_n(Ep, PARAMS_N*PARAMS_NBAR); ------------------ | | 40| 11|#define frodo_sample_n oqs_kem_frodokem_976_shake_sample_n ------------------ frodo_sample_n(Ep, PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 11|#define PARAMS_N 976 ------------------ frodo_sample_n(Ep, PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 11|#define PARAMS_NBAR 8 ------------------ 127| 11| frodo_mul_add_sa_plus_e(Bp, Sp, Ep, pk_seedA); ------------------ | | 49| 11|#define frodo_mul_add_sa_plus_e oqs_kem_frodokem_976_shake_mul_add_sa_plus_e ------------------ 128| 11| frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 41| 11|#define frodo_pack oqs_kem_frodokem_976_shake_pack ------------------ frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 13| 11|#define PARAMS_LOGQ 16 ------------------ frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 11| 11|#define PARAMS_N 976 ------------------ frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 11|#define PARAMS_NBAR 8 ------------------ frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 11| 11|#define PARAMS_N 976 ------------------ frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 11|#define PARAMS_NBAR 8 ------------------ frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 13| 11|#define PARAMS_LOGQ 16 ------------------ 129| | 130| | // Generate Epp, and compute V = Sp*B + Epp 131| 11| frodo_sample_n(Epp, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 40| 11|#define frodo_sample_n oqs_kem_frodokem_976_shake_sample_n ------------------ frodo_sample_n(Epp, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 11|#define PARAMS_NBAR 8 ------------------ frodo_sample_n(Epp, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 11|#define PARAMS_NBAR 8 ------------------ 132| 11| frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 42| 11|#define frodo_unpack oqs_kem_frodokem_976_shake_unpack ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 11| 11|#define PARAMS_N 976 ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 12| 11|#define PARAMS_NBAR 8 ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 3| 11|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_frodokem_976_shake_length_public_key | | ------------------ | | | | 54| 11|#define OQS_KEM_frodokem_976_shake_length_public_key 15632 | | ------------------ ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 18| 11|#define BYTES_SEED_A 16 ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 13| 11|#define PARAMS_LOGQ 16 ------------------ 133| 11| frodo_mul_add_sb_plus_e(V, B, Sp, Epp); ------------------ | | 52| 11|#define frodo_mul_add_sb_plus_e oqs_kem_frodokem_976_shake_mul_add_sb_plus_e ------------------ 134| | 135| | // Encode mu, and compute C = V + enc(mu) (mod q) 136| 11| frodo_key_encode(C, (uint16_t*)mu); ------------------ | | 57| 11|#define frodo_key_encode oqs_kem_frodokem_976_shake_key_encode ------------------ 137| 11| frodo_add(C, V, C); ------------------ | | 55| 11|#define frodo_add oqs_kem_frodokem_976_shake_add ------------------ 138| 11| frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 41| 11|#define frodo_pack oqs_kem_frodokem_976_shake_pack ------------------ frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 13| 11|#define PARAMS_LOGQ 16 ------------------ frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 11|#define PARAMS_NBAR 8 ------------------ frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 11|#define PARAMS_NBAR 8 ------------------ frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 11|#define PARAMS_NBAR 8 ------------------ frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 11|#define PARAMS_NBAR 8 ------------------ frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 13| 11|#define PARAMS_LOGQ 16 ------------------ 139| | 140| | // Append salt to ct and compute ss = F(ct_c1||ct_c2||salt||k) 141| 11| memcpy(&ct[CRYPTO_CIPHERTEXTBYTES - BYTES_SALT], salt, BYTES_SALT); ------------------ | | 5| 11|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_frodokem_976_shake_length_ciphertext | | ------------------ | | | | 56| 11|#define OQS_KEM_frodokem_976_shake_length_ciphertext 15792 | | ------------------ ------------------ memcpy(&ct[CRYPTO_CIPHERTEXTBYTES - BYTES_SALT], salt, BYTES_SALT); ------------------ | | 20| 11|#define BYTES_SALT (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 11|#define CRYPTO_BYTES OQS_KEM_frodokem_976_shake_length_shared_secret | | | | ------------------ | | | | | | 57| 11|#define OQS_KEM_frodokem_976_shake_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ memcpy(&ct[CRYPTO_CIPHERTEXTBYTES - BYTES_SALT], salt, BYTES_SALT); ------------------ | | 20| 11|#define BYTES_SALT (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 11|#define CRYPTO_BYTES OQS_KEM_frodokem_976_shake_length_shared_secret | | | | ------------------ | | | | | | 57| 11|#define OQS_KEM_frodokem_976_shake_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ 142| 11| memcpy(Fin_ct, ct, CRYPTO_CIPHERTEXTBYTES); ------------------ | | 5| 11|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_frodokem_976_shake_length_ciphertext | | ------------------ | | | | 56| 11|#define OQS_KEM_frodokem_976_shake_length_ciphertext 15792 | | ------------------ ------------------ 143| 11| memcpy(Fin_k, k, CRYPTO_BYTES); ------------------ | | 6| 11|#define CRYPTO_BYTES OQS_KEM_frodokem_976_shake_length_shared_secret | | ------------------ | | | | 57| 11|#define OQS_KEM_frodokem_976_shake_length_shared_secret 24 | | ------------------ ------------------ 144| 11| shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 31| 11|#define shake OQS_SHA3_shake256 ------------------ shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 6| 11|#define CRYPTO_BYTES OQS_KEM_frodokem_976_shake_length_shared_secret | | ------------------ | | | | 57| 11|#define OQS_KEM_frodokem_976_shake_length_shared_secret 24 | | ------------------ ------------------ shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 5| 11|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_frodokem_976_shake_length_ciphertext | | ------------------ | | | | 56| 11|#define OQS_KEM_frodokem_976_shake_length_ciphertext 15792 | | ------------------ ------------------ shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 6| 11|#define CRYPTO_BYTES OQS_KEM_frodokem_976_shake_length_shared_secret | | ------------------ | | | | 57| 11|#define OQS_KEM_frodokem_976_shake_length_shared_secret 24 | | ------------------ ------------------ 145| | 146| | // Cleanup: 147| 11| clear_bytes((uint8_t *)V, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 29| 11|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)V, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 11|#define PARAMS_NBAR 8 ------------------ clear_bytes((uint8_t *)V, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 11|#define PARAMS_NBAR 8 ------------------ 148| 11| clear_bytes((uint8_t *)Sp, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 29| 11|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)Sp, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 11|#define PARAMS_N 976 ------------------ clear_bytes((uint8_t *)Sp, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 11|#define PARAMS_NBAR 8 ------------------ 149| 11| clear_bytes((uint8_t *)Ep, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 29| 11|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)Ep, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 11|#define PARAMS_N 976 ------------------ clear_bytes((uint8_t *)Ep, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 11|#define PARAMS_NBAR 8 ------------------ 150| 11| clear_bytes((uint8_t *)Epp, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 29| 11|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)Epp, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 11|#define PARAMS_NBAR 8 ------------------ clear_bytes((uint8_t *)Epp, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 11|#define PARAMS_NBAR 8 ------------------ 151| 11| clear_bytes(mu, BYTES_MU); ------------------ | | 29| 11|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(mu, BYTES_MU); ------------------ | | 19| 11|#define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 15| 11|#define PARAMS_EXTRACTED_BITS 3 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 11|#define PARAMS_NBAR 8 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 11|#define PARAMS_NBAR 8 | | ------------------ ------------------ 152| 11| clear_bytes(G2out, BYTES_SEED_SE + CRYPTO_BYTES); ------------------ | | 29| 11|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(G2out, BYTES_SEED_SE + CRYPTO_BYTES); ------------------ | | 21| 11|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 11|#define CRYPTO_BYTES OQS_KEM_frodokem_976_shake_length_shared_secret | | | | ------------------ | | | | | | 57| 11|#define OQS_KEM_frodokem_976_shake_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ clear_bytes(G2out, BYTES_SEED_SE + CRYPTO_BYTES); ------------------ | | 6| 11|#define CRYPTO_BYTES OQS_KEM_frodokem_976_shake_length_shared_secret | | ------------------ | | | | 57| 11|#define OQS_KEM_frodokem_976_shake_length_shared_secret 24 | | ------------------ ------------------ 153| 11| clear_bytes(Fin_k, CRYPTO_BYTES); ------------------ | | 29| 11|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(Fin_k, CRYPTO_BYTES); ------------------ | | 6| 11|#define CRYPTO_BYTES OQS_KEM_frodokem_976_shake_length_shared_secret | | ------------------ | | | | 57| 11|#define OQS_KEM_frodokem_976_shake_length_shared_secret 24 | | ------------------ ------------------ 154| 11| clear_bytes(shake_input_seedSE, 1 + BYTES_SEED_SE); ------------------ | | 29| 11|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(shake_input_seedSE, 1 + BYTES_SEED_SE); ------------------ | | 21| 11|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 11|#define CRYPTO_BYTES OQS_KEM_frodokem_976_shake_length_shared_secret | | | | ------------------ | | | | | | 57| 11|#define OQS_KEM_frodokem_976_shake_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ 155| 11| return OQS_SUCCESS; 156| 11|} OQS_KEM_frodokem_976_shake_decaps: 160| 11|{ // FrodoKEM's key decapsulation 161| | // Inputs: ciphertext ct = ct_c1||ct_c2||salt ( (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8 + (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8 + BYTES_SALT bytes) 162| | // secret key sk = sk_s||pk_seedA||pk_b||sk_S||sk_pkh (CRYPTO_BYTES + BYTES_SEED_A + (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8 + 2*PARAMS_N*PARAMS_NBAR + BYTES_PKHASH bytes) 163| | // Output: shared key ss (CRYPTO_BYTES bytes) 164| 11| uint16_t B[PARAMS_N*PARAMS_NBAR] = {0}; 165| 11| uint16_t Bp[PARAMS_N*PARAMS_NBAR] = {0}; 166| 11| uint16_t W[PARAMS_NBAR*PARAMS_NBAR] = {0}; // contains secret data 167| 11| uint16_t C[PARAMS_NBAR*PARAMS_NBAR] = {0}; 168| 11| uint16_t CC[PARAMS_NBAR*PARAMS_NBAR] = {0}; 169| 11| ALIGN_HEADER(32) uint16_t BBp[PARAMS_N*PARAMS_NBAR] ALIGN_FOOTER(32) = {0}; 170| 11| ALIGN_HEADER(32) uint16_t Sp[(2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR] ALIGN_FOOTER(32) = {0}; // contains secret data 171| 11| uint16_t *Ep = (uint16_t *)&Sp[PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 11| 11|#define PARAMS_N 976 ------------------ uint16_t *Ep = (uint16_t *)&Sp[PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 12| 11|#define PARAMS_NBAR 8 ------------------ 172| 11| uint16_t *Epp = (uint16_t *)&Sp[2*PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 11| 11|#define PARAMS_N 976 ------------------ uint16_t *Epp = (uint16_t *)&Sp[2*PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 12| 11|#define PARAMS_NBAR 8 ------------------ 173| 11| const uint8_t *ct_c1 = &ct[0]; 174| 11| const uint8_t *ct_c2 = &ct[(PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8]; ------------------ | | 13| 11|#define PARAMS_LOGQ 16 ------------------ const uint8_t *ct_c2 = &ct[(PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8]; ------------------ | | 11| 11|#define PARAMS_N 976 ------------------ const uint8_t *ct_c2 = &ct[(PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8]; ------------------ | | 12| 11|#define PARAMS_NBAR 8 ------------------ 175| 11| const uint8_t *salt = &ct[CRYPTO_CIPHERTEXTBYTES - BYTES_SALT]; ------------------ | | 5| 11|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_frodokem_976_shake_length_ciphertext | | ------------------ | | | | 56| 11|#define OQS_KEM_frodokem_976_shake_length_ciphertext 15792 | | ------------------ ------------------ const uint8_t *salt = &ct[CRYPTO_CIPHERTEXTBYTES - BYTES_SALT]; ------------------ | | 20| 11|#define BYTES_SALT (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 11|#define CRYPTO_BYTES OQS_KEM_frodokem_976_shake_length_shared_secret | | | | ------------------ | | | | | | 57| 11|#define OQS_KEM_frodokem_976_shake_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ 176| 11| const uint8_t *sk_s = &sk[0]; 177| 11| const uint8_t *sk_pk = &sk[CRYPTO_BYTES]; ------------------ | | 6| 11|#define CRYPTO_BYTES OQS_KEM_frodokem_976_shake_length_shared_secret | | ------------------ | | | | 57| 11|#define OQS_KEM_frodokem_976_shake_length_shared_secret 24 | | ------------------ ------------------ 178| 11| const uint16_t *sk_S = (uint16_t *) &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES]; ------------------ | | 6| 11|#define CRYPTO_BYTES OQS_KEM_frodokem_976_shake_length_shared_secret | | ------------------ | | | | 57| 11|#define OQS_KEM_frodokem_976_shake_length_shared_secret 24 | | ------------------ ------------------ const uint16_t *sk_S = (uint16_t *) &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES]; ------------------ | | 3| 11|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_frodokem_976_shake_length_public_key | | ------------------ | | | | 54| 11|#define OQS_KEM_frodokem_976_shake_length_public_key 15632 | | ------------------ ------------------ 179| 11| uint16_t S[PARAMS_N * PARAMS_NBAR]; // contains secret data 180| 11| const uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 6| 11|#define CRYPTO_BYTES OQS_KEM_frodokem_976_shake_length_shared_secret | | ------------------ | | | | 57| 11|#define OQS_KEM_frodokem_976_shake_length_shared_secret 24 | | ------------------ ------------------ const uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 3| 11|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_frodokem_976_shake_length_public_key | | ------------------ | | | | 54| 11|#define OQS_KEM_frodokem_976_shake_length_public_key 15632 | | ------------------ ------------------ const uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 11| 11|#define PARAMS_N 976 ------------------ const uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 12| 11|#define PARAMS_NBAR 8 ------------------ 181| 11| const uint8_t *pk_seedA = &sk_pk[0]; 182| 11| const uint8_t *pk_b = &sk_pk[BYTES_SEED_A]; ------------------ | | 18| 11|#define BYTES_SEED_A 16 ------------------ 183| 11| uint8_t G2in[BYTES_PKHASH + BYTES_MU + BYTES_SALT]; // contains secret data via muprime 184| 11| uint8_t *pkh = &G2in[0]; 185| 11| uint8_t *muprime = &G2in[BYTES_PKHASH]; // contains secret data ------------------ | | 22| 11|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 11|#define CRYPTO_BYTES OQS_KEM_frodokem_976_shake_length_shared_secret | | | | ------------------ | | | | | | 57| 11|#define OQS_KEM_frodokem_976_shake_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ 186| 11| uint8_t *G2in_salt = &G2in[BYTES_PKHASH + BYTES_MU]; ------------------ | | 22| 11|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 11|#define CRYPTO_BYTES OQS_KEM_frodokem_976_shake_length_shared_secret | | | | ------------------ | | | | | | 57| 11|#define OQS_KEM_frodokem_976_shake_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ uint8_t *G2in_salt = &G2in[BYTES_PKHASH + BYTES_MU]; ------------------ | | 19| 11|#define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 15| 11|#define PARAMS_EXTRACTED_BITS 3 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 11|#define PARAMS_NBAR 8 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 11|#define PARAMS_NBAR 8 | | ------------------ ------------------ 187| 11| uint8_t G2out[BYTES_SEED_SE + CRYPTO_BYTES]; // contains secret data 188| 11| uint8_t *seedSEprime = &G2out[0]; // contains secret data 189| 11| uint8_t *kprime = &G2out[BYTES_SEED_SE]; // contains secret data ------------------ | | 21| 11|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 11|#define CRYPTO_BYTES OQS_KEM_frodokem_976_shake_length_shared_secret | | | | ------------------ | | | | | | 57| 11|#define OQS_KEM_frodokem_976_shake_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ 190| 11| uint8_t Fin[CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES]; // contains secret data via Fin_k 191| 11| uint8_t *Fin_ct = &Fin[0]; 192| 11| uint8_t *Fin_k = &Fin[CRYPTO_CIPHERTEXTBYTES]; // contains secret data ------------------ | | 5| 11|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_frodokem_976_shake_length_ciphertext | | ------------------ | | | | 56| 11|#define OQS_KEM_frodokem_976_shake_length_ciphertext 15792 | | ------------------ ------------------ 193| 11| uint8_t shake_input_seedSEprime[1 + BYTES_SEED_SE]; // contains secret data 194| | 195| | 196| 85.8k| for (size_t i = 0; i < PARAMS_N * PARAMS_NBAR; i++) { ------------------ | | 11| 85.8k|#define PARAMS_N 976 ------------------ for (size_t i = 0; i < PARAMS_N * PARAMS_NBAR; i++) { ------------------ | | 12| 85.8k|#define PARAMS_NBAR 8 ------------------ | Branch (196:24): [True: 85.8k, False: 11] ------------------ 197| 85.8k| S[i] = LE_TO_UINT16(sk_S[i]); ------------------ | | 34| 85.8k| #define LE_TO_UINT16(n) (n) ------------------ 198| 85.8k| } 199| | 200| | // Compute W = C - Bp*S (mod q), and decode the randomness mu 201| 11| frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 42| 11|#define frodo_unpack oqs_kem_frodokem_976_shake_unpack ------------------ frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 11| 11|#define PARAMS_N 976 ------------------ frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 12| 11|#define PARAMS_NBAR 8 ------------------ frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 13| 11|#define PARAMS_LOGQ 16 ------------------ frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 11| 11|#define PARAMS_N 976 ------------------ frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 12| 11|#define PARAMS_NBAR 8 ------------------ frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 13| 11|#define PARAMS_LOGQ 16 ------------------ 202| 11| frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 42| 11|#define frodo_unpack oqs_kem_frodokem_976_shake_unpack ------------------ frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 12| 11|#define PARAMS_NBAR 8 ------------------ frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 12| 11|#define PARAMS_NBAR 8 ------------------ frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 13| 11|#define PARAMS_LOGQ 16 ------------------ frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 12| 11|#define PARAMS_NBAR 8 ------------------ frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 12| 11|#define PARAMS_NBAR 8 ------------------ frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 13| 11|#define PARAMS_LOGQ 16 ------------------ 203| 11| frodo_mul_bs(W, Bp, S); ------------------ | | 53| 11|#define frodo_mul_bs oqs_kem_frodokem_976_shake_mul_bs ------------------ 204| 11| frodo_sub(W, C, W); ------------------ | | 56| 11|#define frodo_sub oqs_kem_frodokem_976_shake_sub ------------------ 205| 11| frodo_key_decode((uint16_t*)muprime, W); ------------------ | | 58| 11|#define frodo_key_decode oqs_kem_frodokem_976_shake_key_decode ------------------ 206| | 207| | // Generate (seedSE' || k') = G_2(pkh || mu' || salt) 208| 11| memcpy(pkh, sk_pkh, BYTES_PKHASH); ------------------ | | 22| 11|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 11|#define CRYPTO_BYTES OQS_KEM_frodokem_976_shake_length_shared_secret | | | | ------------------ | | | | | | 57| 11|#define OQS_KEM_frodokem_976_shake_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ 209| 11| memcpy(G2in_salt, salt, BYTES_SALT); ------------------ | | 20| 11|#define BYTES_SALT (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 11|#define CRYPTO_BYTES OQS_KEM_frodokem_976_shake_length_shared_secret | | | | ------------------ | | | | | | 57| 11|#define OQS_KEM_frodokem_976_shake_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ 210| 11| shake(G2out, BYTES_SEED_SE + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU + BYTES_SALT); ------------------ | | 31| 11|#define shake OQS_SHA3_shake256 ------------------ shake(G2out, BYTES_SEED_SE + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU + BYTES_SALT); ------------------ | | 21| 11|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 11|#define CRYPTO_BYTES OQS_KEM_frodokem_976_shake_length_shared_secret | | | | ------------------ | | | | | | 57| 11|#define OQS_KEM_frodokem_976_shake_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ shake(G2out, BYTES_SEED_SE + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU + BYTES_SALT); ------------------ | | 6| 11|#define CRYPTO_BYTES OQS_KEM_frodokem_976_shake_length_shared_secret | | ------------------ | | | | 57| 11|#define OQS_KEM_frodokem_976_shake_length_shared_secret 24 | | ------------------ ------------------ shake(G2out, BYTES_SEED_SE + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU + BYTES_SALT); ------------------ | | 22| 11|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 11|#define CRYPTO_BYTES OQS_KEM_frodokem_976_shake_length_shared_secret | | | | ------------------ | | | | | | 57| 11|#define OQS_KEM_frodokem_976_shake_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ shake(G2out, BYTES_SEED_SE + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU + BYTES_SALT); ------------------ | | 19| 11|#define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 15| 11|#define PARAMS_EXTRACTED_BITS 3 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 11|#define PARAMS_NBAR 8 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 11|#define PARAMS_NBAR 8 | | ------------------ ------------------ shake(G2out, BYTES_SEED_SE + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU + BYTES_SALT); ------------------ | | 20| 11|#define BYTES_SALT (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 11|#define CRYPTO_BYTES OQS_KEM_frodokem_976_shake_length_shared_secret | | | | ------------------ | | | | | | 57| 11|#define OQS_KEM_frodokem_976_shake_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ 211| | 212| | // Generate Sp and Ep, and compute BBp = Sp*A + Ep. Generate A on-the-fly 213| 11| shake_input_seedSEprime[0] = 0x96; 214| 11| memcpy(&shake_input_seedSEprime[1], seedSEprime, BYTES_SEED_SE); ------------------ | | 21| 11|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 11|#define CRYPTO_BYTES OQS_KEM_frodokem_976_shake_length_shared_secret | | | | ------------------ | | | | | | 57| 11|#define OQS_KEM_frodokem_976_shake_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ 215| 11| shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSEprime, 1 + BYTES_SEED_SE); ------------------ | | 31| 11|#define shake OQS_SHA3_shake256 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSEprime, 1 + BYTES_SEED_SE); ------------------ | | 11| 11|#define PARAMS_N 976 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSEprime, 1 + BYTES_SEED_SE); ------------------ | | 12| 11|#define PARAMS_NBAR 8 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSEprime, 1 + BYTES_SEED_SE); ------------------ | | 12| 11|#define PARAMS_NBAR 8 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSEprime, 1 + BYTES_SEED_SE); ------------------ | | 21| 11|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 11|#define CRYPTO_BYTES OQS_KEM_frodokem_976_shake_length_shared_secret | | | | ------------------ | | | | | | 57| 11|#define OQS_KEM_frodokem_976_shake_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ 216| 172k| for (size_t i = 0; i < (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR; i++) { ------------------ | | 11| 172k|#define PARAMS_N 976 ------------------ for (size_t i = 0; i < (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR; i++) { ------------------ | | 12| 172k|#define PARAMS_NBAR 8 ------------------ for (size_t i = 0; i < (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR; i++) { ------------------ | | 12| 172k|#define PARAMS_NBAR 8 ------------------ | Branch (216:24): [True: 172k, False: 11] ------------------ 217| 172k| Sp[i] = LE_TO_UINT16(Sp[i]); ------------------ | | 34| 172k| #define LE_TO_UINT16(n) (n) ------------------ 218| 172k| } 219| 11| frodo_sample_n(Sp, PARAMS_N*PARAMS_NBAR); ------------------ | | 40| 11|#define frodo_sample_n oqs_kem_frodokem_976_shake_sample_n ------------------ frodo_sample_n(Sp, PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 11|#define PARAMS_N 976 ------------------ frodo_sample_n(Sp, PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 11|#define PARAMS_NBAR 8 ------------------ 220| 11| frodo_sample_n(Ep, PARAMS_N*PARAMS_NBAR); ------------------ | | 40| 11|#define frodo_sample_n oqs_kem_frodokem_976_shake_sample_n ------------------ frodo_sample_n(Ep, PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 11|#define PARAMS_N 976 ------------------ frodo_sample_n(Ep, PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 11|#define PARAMS_NBAR 8 ------------------ 221| 11| frodo_mul_add_sa_plus_e(BBp, Sp, Ep, pk_seedA); ------------------ | | 49| 11|#define frodo_mul_add_sa_plus_e oqs_kem_frodokem_976_shake_mul_add_sa_plus_e ------------------ 222| | 223| | // Generate Epp, and compute W = Sp*B + Epp 224| 11| frodo_sample_n(Epp, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 40| 11|#define frodo_sample_n oqs_kem_frodokem_976_shake_sample_n ------------------ frodo_sample_n(Epp, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 11|#define PARAMS_NBAR 8 ------------------ frodo_sample_n(Epp, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 11|#define PARAMS_NBAR 8 ------------------ 225| 11| frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 42| 11|#define frodo_unpack oqs_kem_frodokem_976_shake_unpack ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 11| 11|#define PARAMS_N 976 ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 12| 11|#define PARAMS_NBAR 8 ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 3| 11|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_frodokem_976_shake_length_public_key | | ------------------ | | | | 54| 11|#define OQS_KEM_frodokem_976_shake_length_public_key 15632 | | ------------------ ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 18| 11|#define BYTES_SEED_A 16 ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 13| 11|#define PARAMS_LOGQ 16 ------------------ 226| 11| frodo_mul_add_sb_plus_e(W, B, Sp, Epp); ------------------ | | 52| 11|#define frodo_mul_add_sb_plus_e oqs_kem_frodokem_976_shake_mul_add_sb_plus_e ------------------ 227| | 228| | // Encode mu, and compute CC = W + enc(mu') (mod q) 229| 11| frodo_key_encode(CC, (uint16_t*)muprime); ------------------ | | 57| 11|#define frodo_key_encode oqs_kem_frodokem_976_shake_key_encode ------------------ 230| 11| frodo_add(CC, W, CC); ------------------ | | 55| 11|#define frodo_add oqs_kem_frodokem_976_shake_add ------------------ 231| | 232| | // Prepare input to F 233| 11| memcpy(Fin_ct, ct, CRYPTO_CIPHERTEXTBYTES); ------------------ | | 5| 11|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_frodokem_976_shake_length_ciphertext | | ------------------ | | | | 56| 11|#define OQS_KEM_frodokem_976_shake_length_ciphertext 15792 | | ------------------ ------------------ 234| | 235| | // Reducing BBp modulo q 236| 85.8k| for (int i = 0; i < PARAMS_N*PARAMS_NBAR; i++) BBp[i] = BBp[i] & ((1 << PARAMS_LOGQ)-1); ------------------ | | 11| 85.8k|#define PARAMS_N 976 ------------------ for (int i = 0; i < PARAMS_N*PARAMS_NBAR; i++) BBp[i] = BBp[i] & ((1 << PARAMS_LOGQ)-1); ------------------ | | 12| 85.8k|#define PARAMS_NBAR 8 ------------------ for (int i = 0; i < PARAMS_N*PARAMS_NBAR; i++) BBp[i] = BBp[i] & ((1 << PARAMS_LOGQ)-1); ------------------ | | 13| 85.8k|#define PARAMS_LOGQ 16 ------------------ | Branch (236:21): [True: 85.8k, False: 11] ------------------ 237| | 238| | // Needs to avoid branching on secret data using constant-time implementation. 239| 11| int8_t selector = ct_verify(Bp, BBp, PARAMS_N*PARAMS_NBAR) | ct_verify(C, CC, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 44| 11|#define ct_verify oqs_kem_frodokem_976_shake_ct_verify ------------------ int8_t selector = ct_verify(Bp, BBp, PARAMS_N*PARAMS_NBAR) | ct_verify(C, CC, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 11| 11|#define PARAMS_N 976 ------------------ int8_t selector = ct_verify(Bp, BBp, PARAMS_N*PARAMS_NBAR) | ct_verify(C, CC, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 11|#define PARAMS_NBAR 8 ------------------ int8_t selector = ct_verify(Bp, BBp, PARAMS_N*PARAMS_NBAR) | ct_verify(C, CC, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 44| 11|#define ct_verify oqs_kem_frodokem_976_shake_ct_verify ------------------ int8_t selector = ct_verify(Bp, BBp, PARAMS_N*PARAMS_NBAR) | ct_verify(C, CC, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 11|#define PARAMS_NBAR 8 ------------------ int8_t selector = ct_verify(Bp, BBp, PARAMS_N*PARAMS_NBAR) | ct_verify(C, CC, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 11|#define PARAMS_NBAR 8 ------------------ 240| | // If (selector == 0) then load k' to do ss = F(ct || k'), else if (selector == -1) load s to do ss = F(ct || s) 241| 11| ct_select((uint8_t*)Fin_k, (uint8_t*)kprime, (uint8_t*)sk_s, CRYPTO_BYTES, selector); ------------------ | | 43| 11|#define ct_select oqs_kem_frodokem_976_shake_ct_select ------------------ ct_select((uint8_t*)Fin_k, (uint8_t*)kprime, (uint8_t*)sk_s, CRYPTO_BYTES, selector); ------------------ | | 6| 11|#define CRYPTO_BYTES OQS_KEM_frodokem_976_shake_length_shared_secret | | ------------------ | | | | 57| 11|#define OQS_KEM_frodokem_976_shake_length_shared_secret 24 | | ------------------ ------------------ 242| 11| shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 31| 11|#define shake OQS_SHA3_shake256 ------------------ shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 6| 11|#define CRYPTO_BYTES OQS_KEM_frodokem_976_shake_length_shared_secret | | ------------------ | | | | 57| 11|#define OQS_KEM_frodokem_976_shake_length_shared_secret 24 | | ------------------ ------------------ shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 5| 11|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_frodokem_976_shake_length_ciphertext | | ------------------ | | | | 56| 11|#define OQS_KEM_frodokem_976_shake_length_ciphertext 15792 | | ------------------ ------------------ shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 6| 11|#define CRYPTO_BYTES OQS_KEM_frodokem_976_shake_length_shared_secret | | ------------------ | | | | 57| 11|#define OQS_KEM_frodokem_976_shake_length_shared_secret 24 | | ------------------ ------------------ 243| | 244| | // Cleanup: 245| 11| clear_bytes((uint8_t *)W, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 29| 11|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)W, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 11|#define PARAMS_NBAR 8 ------------------ clear_bytes((uint8_t *)W, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 11|#define PARAMS_NBAR 8 ------------------ 246| 11| clear_bytes((uint8_t *)Sp, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 29| 11|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)Sp, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 11|#define PARAMS_N 976 ------------------ clear_bytes((uint8_t *)Sp, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 11|#define PARAMS_NBAR 8 ------------------ 247| 11| clear_bytes((uint8_t *)S, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 29| 11|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)S, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 11|#define PARAMS_N 976 ------------------ clear_bytes((uint8_t *)S, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 11|#define PARAMS_NBAR 8 ------------------ 248| 11| clear_bytes((uint8_t *)Ep, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 29| 11|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)Ep, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 11|#define PARAMS_N 976 ------------------ clear_bytes((uint8_t *)Ep, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 11|#define PARAMS_NBAR 8 ------------------ 249| 11| clear_bytes((uint8_t *)Epp, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 29| 11|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)Epp, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 11|#define PARAMS_NBAR 8 ------------------ clear_bytes((uint8_t *)Epp, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 11|#define PARAMS_NBAR 8 ------------------ 250| 11| clear_bytes(muprime, BYTES_MU); ------------------ | | 29| 11|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(muprime, BYTES_MU); ------------------ | | 19| 11|#define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 15| 11|#define PARAMS_EXTRACTED_BITS 3 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 11|#define PARAMS_NBAR 8 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 11|#define PARAMS_NBAR 8 | | ------------------ ------------------ 251| 11| clear_bytes(G2out, BYTES_SEED_SE + CRYPTO_BYTES); ------------------ | | 29| 11|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(G2out, BYTES_SEED_SE + CRYPTO_BYTES); ------------------ | | 21| 11|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 11|#define CRYPTO_BYTES OQS_KEM_frodokem_976_shake_length_shared_secret | | | | ------------------ | | | | | | 57| 11|#define OQS_KEM_frodokem_976_shake_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ clear_bytes(G2out, BYTES_SEED_SE + CRYPTO_BYTES); ------------------ | | 6| 11|#define CRYPTO_BYTES OQS_KEM_frodokem_976_shake_length_shared_secret | | ------------------ | | | | 57| 11|#define OQS_KEM_frodokem_976_shake_length_shared_secret 24 | | ------------------ ------------------ 252| 11| clear_bytes(Fin_k, CRYPTO_BYTES); ------------------ | | 29| 11|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(Fin_k, CRYPTO_BYTES); ------------------ | | 6| 11|#define CRYPTO_BYTES OQS_KEM_frodokem_976_shake_length_shared_secret | | ------------------ | | | | 57| 11|#define OQS_KEM_frodokem_976_shake_length_shared_secret 24 | | ------------------ ------------------ 253| 11| clear_bytes(shake_input_seedSEprime, 1 + BYTES_SEED_SE); ------------------ | | 29| 11|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(shake_input_seedSEprime, 1 + BYTES_SEED_SE); ------------------ | | 21| 11|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 11|#define CRYPTO_BYTES OQS_KEM_frodokem_976_shake_length_shared_secret | | | | ------------------ | | | | | | 57| 11|#define OQS_KEM_frodokem_976_shake_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ 254| 11| return OQS_SUCCESS; 255| 11|} OQS_KEM_frodokem_1344_aes_keypair: 19| 8|{ // FrodoKEM's key generation 20| | // Outputs: public key pk = pk_seedA||pk_b ( BYTES_SEED_A + (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8 bytes) 21| | // secret key sk = sk_s||pk_seedA||pk_b||sk_S||sk_pkh (CRYPTO_BYTES + BYTES_SEED_A + (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8 + 2*PARAMS_N*PARAMS_NBAR + BYTES_PKHASH bytes) 22| 8| uint8_t *pk_seedA = &pk[0]; 23| 8| uint8_t *pk_b = &pk[BYTES_SEED_A]; ------------------ | | 18| 8|#define BYTES_SEED_A 16 ------------------ 24| 8| uint8_t *sk_s = &sk[0]; 25| 8| uint8_t *sk_pk = &sk[CRYPTO_BYTES]; ------------------ | | 6| 8|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_aes_length_shared_secret | | ------------------ | | | | 72| 8|#define OQS_KEM_frodokem_1344_aes_length_shared_secret 32 | | ------------------ ------------------ 26| 8| uint8_t *sk_S = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES]; ------------------ | | 6| 8|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_aes_length_shared_secret | | ------------------ | | | | 72| 8|#define OQS_KEM_frodokem_1344_aes_length_shared_secret 32 | | ------------------ ------------------ uint8_t *sk_S = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES]; ------------------ | | 3| 8|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_frodokem_1344_aes_length_public_key | | ------------------ | | | | 69| 8|#define OQS_KEM_frodokem_1344_aes_length_public_key 21520 | | ------------------ ------------------ 27| 8| uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 6| 8|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_aes_length_shared_secret | | ------------------ | | | | 72| 8|#define OQS_KEM_frodokem_1344_aes_length_shared_secret 32 | | ------------------ ------------------ uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 3| 8|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_frodokem_1344_aes_length_public_key | | ------------------ | | | | 69| 8|#define OQS_KEM_frodokem_1344_aes_length_public_key 21520 | | ------------------ ------------------ uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 11| 8|#define PARAMS_N 1344 ------------------ uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ 28| 8| uint16_t B[PARAMS_N*PARAMS_NBAR] = {0}; 29| 8| uint16_t S[2*PARAMS_N*PARAMS_NBAR] = {0}; // contains secret data 30| 8| uint16_t *E = (uint16_t *)&S[PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 11| 8|#define PARAMS_N 1344 ------------------ uint16_t *E = (uint16_t *)&S[PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ 31| 8| uint8_t randomness[CRYPTO_BYTES + BYTES_SEED_SE + BYTES_SEED_A]; // contains secret data via randomness_s and randomness_seedSE 32| 8| uint8_t *randomness_s = &randomness[0]; // contains secret data 33| 8| uint8_t *randomness_seedSE = &randomness[CRYPTO_BYTES]; // contains secret data ------------------ | | 6| 8|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_aes_length_shared_secret | | ------------------ | | | | 72| 8|#define OQS_KEM_frodokem_1344_aes_length_shared_secret 32 | | ------------------ ------------------ 34| 8| uint8_t *randomness_z = &randomness[CRYPTO_BYTES + BYTES_SEED_SE]; ------------------ | | 6| 8|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_aes_length_shared_secret | | ------------------ | | | | 72| 8|#define OQS_KEM_frodokem_1344_aes_length_shared_secret 32 | | ------------------ ------------------ uint8_t *randomness_z = &randomness[CRYPTO_BYTES + BYTES_SEED_SE]; ------------------ | | 21| 8|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 8|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_aes_length_shared_secret | | | | ------------------ | | | | | | 72| 8|#define OQS_KEM_frodokem_1344_aes_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ 35| 8| uint8_t shake_input_seedSE[1 + BYTES_SEED_SE]; // contains secret data 36| | 37| | // Generate the secret value s, the seed for S and E, and the seed for the seed for A. Add seed_A to the public key 38| 8| randombytes(randomness, CRYPTO_BYTES + BYTES_SEED_SE + BYTES_SEED_A); ------------------ | | 28| 8|#define randombytes OQS_randombytes ------------------ randombytes(randomness, CRYPTO_BYTES + BYTES_SEED_SE + BYTES_SEED_A); ------------------ | | 6| 8|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_aes_length_shared_secret | | ------------------ | | | | 72| 8|#define OQS_KEM_frodokem_1344_aes_length_shared_secret 32 | | ------------------ ------------------ randombytes(randomness, CRYPTO_BYTES + BYTES_SEED_SE + BYTES_SEED_A); ------------------ | | 21| 8|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 8|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_aes_length_shared_secret | | | | ------------------ | | | | | | 72| 8|#define OQS_KEM_frodokem_1344_aes_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ randombytes(randomness, CRYPTO_BYTES + BYTES_SEED_SE + BYTES_SEED_A); ------------------ | | 18| 8|#define BYTES_SEED_A 16 ------------------ 39| 8| shake(pk_seedA, BYTES_SEED_A, randomness_z, BYTES_SEED_A); ------------------ | | 31| 8|#define shake OQS_SHA3_shake256 ------------------ shake(pk_seedA, BYTES_SEED_A, randomness_z, BYTES_SEED_A); ------------------ | | 18| 8|#define BYTES_SEED_A 16 ------------------ shake(pk_seedA, BYTES_SEED_A, randomness_z, BYTES_SEED_A); ------------------ | | 18| 8|#define BYTES_SEED_A 16 ------------------ 40| | 41| | // Generate S and E, and compute B = A*S + E. Generate A on-the-fly 42| 8| shake_input_seedSE[0] = 0x5F; 43| 8| memcpy(&shake_input_seedSE[1], randomness_seedSE, BYTES_SEED_SE); ------------------ | | 21| 8|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 8|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_aes_length_shared_secret | | | | ------------------ | | | | | | 72| 8|#define OQS_KEM_frodokem_1344_aes_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ 44| 8| shake((uint8_t*)S, 2*PARAMS_N*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + BYTES_SEED_SE); ------------------ | | 31| 8|#define shake OQS_SHA3_shake256 ------------------ shake((uint8_t*)S, 2*PARAMS_N*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + BYTES_SEED_SE); ------------------ | | 11| 8|#define PARAMS_N 1344 ------------------ shake((uint8_t*)S, 2*PARAMS_N*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + BYTES_SEED_SE); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ shake((uint8_t*)S, 2*PARAMS_N*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + BYTES_SEED_SE); ------------------ | | 21| 8|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 8|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_aes_length_shared_secret | | | | ------------------ | | | | | | 72| 8|#define OQS_KEM_frodokem_1344_aes_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ 45| 172k| for (size_t i = 0; i < 2 * PARAMS_N * PARAMS_NBAR; i++) { ------------------ | | 11| 172k|#define PARAMS_N 1344 ------------------ for (size_t i = 0; i < 2 * PARAMS_N * PARAMS_NBAR; i++) { ------------------ | | 12| 172k|#define PARAMS_NBAR 8 ------------------ | Branch (45:24): [True: 172k, False: 8] ------------------ 46| 172k| S[i] = LE_TO_UINT16(S[i]); ------------------ | | 34| 172k| #define LE_TO_UINT16(n) (n) ------------------ 47| 172k| } 48| 8| frodo_sample_n(S, PARAMS_N*PARAMS_NBAR); ------------------ | | 40| 8|#define frodo_sample_n oqs_kem_frodokem_1344_aes_sample_n ------------------ frodo_sample_n(S, PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 8|#define PARAMS_N 1344 ------------------ frodo_sample_n(S, PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ 49| 8| frodo_sample_n(E, PARAMS_N*PARAMS_NBAR); ------------------ | | 40| 8|#define frodo_sample_n oqs_kem_frodokem_1344_aes_sample_n ------------------ frodo_sample_n(E, PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 8|#define PARAMS_N 1344 ------------------ frodo_sample_n(E, PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ 50| 8| frodo_mul_add_as_plus_e(B, S, E, pk); ------------------ | | 46| 8|#define frodo_mul_add_as_plus_e oqs_kem_frodokem_1344_aes_mul_add_as_plus_e ------------------ 51| | 52| | // Encode the second part of the public key 53| 8| frodo_pack(pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, B, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 41| 8|#define frodo_pack oqs_kem_frodokem_1344_aes_pack ------------------ frodo_pack(pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, B, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 3| 8|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_frodokem_1344_aes_length_public_key | | ------------------ | | | | 69| 8|#define OQS_KEM_frodokem_1344_aes_length_public_key 21520 | | ------------------ ------------------ frodo_pack(pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, B, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 18| 8|#define BYTES_SEED_A 16 ------------------ frodo_pack(pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, B, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 11| 8|#define PARAMS_N 1344 ------------------ frodo_pack(pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, B, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ frodo_pack(pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, B, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 13| 8|#define PARAMS_LOGQ 16 ------------------ 54| | 55| | // Add s, pk and S to the secret key 56| 8| memcpy(sk_s, randomness_s, CRYPTO_BYTES); ------------------ | | 6| 8|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_aes_length_shared_secret | | ------------------ | | | | 72| 8|#define OQS_KEM_frodokem_1344_aes_length_shared_secret 32 | | ------------------ ------------------ 57| 8| memcpy(sk_pk, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 3| 8|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_frodokem_1344_aes_length_public_key | | ------------------ | | | | 69| 8|#define OQS_KEM_frodokem_1344_aes_length_public_key 21520 | | ------------------ ------------------ 58| 86.0k| for (size_t i = 0; i < PARAMS_N * PARAMS_NBAR; i++) { ------------------ | | 11| 86.0k|#define PARAMS_N 1344 ------------------ for (size_t i = 0; i < PARAMS_N * PARAMS_NBAR; i++) { ------------------ | | 12| 86.0k|#define PARAMS_NBAR 8 ------------------ | Branch (58:24): [True: 86.0k, False: 8] ------------------ 59| 86.0k| S[i] = UINT16_TO_LE(S[i]); ------------------ | | 35| 86.0k| #define UINT16_TO_LE(n) (n) ------------------ 60| 86.0k| } 61| 8| memcpy(sk_S, S, 2*PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 8|#define PARAMS_N 1344 ------------------ memcpy(sk_S, S, 2*PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ 62| | 63| | // Add H(pk) to the secret key 64| 8| shake(sk_pkh, BYTES_PKHASH, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 31| 8|#define shake OQS_SHA3_shake256 ------------------ shake(sk_pkh, BYTES_PKHASH, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 22| 8|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 8|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_aes_length_shared_secret | | | | ------------------ | | | | | | 72| 8|#define OQS_KEM_frodokem_1344_aes_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ shake(sk_pkh, BYTES_PKHASH, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 3| 8|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_frodokem_1344_aes_length_public_key | | ------------------ | | | | 69| 8|#define OQS_KEM_frodokem_1344_aes_length_public_key 21520 | | ------------------ ------------------ 65| | 66| | // Cleanup: 67| 8| clear_bytes((uint8_t *)S, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 29| 8|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)S, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 8|#define PARAMS_N 1344 ------------------ clear_bytes((uint8_t *)S, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ 68| 8| clear_bytes((uint8_t *)E, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 29| 8|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)E, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 8|#define PARAMS_N 1344 ------------------ clear_bytes((uint8_t *)E, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ 69| 8| clear_bytes(randomness, CRYPTO_BYTES + BYTES_SEED_SE); ------------------ | | 29| 8|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(randomness, CRYPTO_BYTES + BYTES_SEED_SE); ------------------ | | 6| 8|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_aes_length_shared_secret | | ------------------ | | | | 72| 8|#define OQS_KEM_frodokem_1344_aes_length_shared_secret 32 | | ------------------ ------------------ clear_bytes(randomness, CRYPTO_BYTES + BYTES_SEED_SE); ------------------ | | 21| 8|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 8|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_aes_length_shared_secret | | | | ------------------ | | | | | | 72| 8|#define OQS_KEM_frodokem_1344_aes_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ 70| 8| clear_bytes(shake_input_seedSE, 1 + BYTES_SEED_SE); ------------------ | | 29| 8|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(shake_input_seedSE, 1 + BYTES_SEED_SE); ------------------ | | 21| 8|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 8|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_aes_length_shared_secret | | | | ------------------ | | | | | | 72| 8|#define OQS_KEM_frodokem_1344_aes_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ 71| 8| return OQS_SUCCESS; 72| 8|} OQS_KEM_frodokem_1344_aes_encaps: 86| 8|{ // FrodoKEM's key encapsulation 87| | // Input: public key pk = pk_seedA||pk_b (BYTES_SEED_A + (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8 bytes) 88| | // Outputs: ciphertext ct = ct_c1||ct_c2||salt ( (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8 + (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8 + BYTES_SALT bytes) 89| | // shared key ss (CRYPTO_BYTES bytes) 90| 8| const uint8_t *pk_seedA = &pk[0]; 91| 8| const uint8_t *pk_b = &pk[BYTES_SEED_A]; ------------------ | | 18| 8|#define BYTES_SEED_A 16 ------------------ 92| 8| uint8_t *ct_c1 = &ct[0]; 93| 8| uint8_t *ct_c2 = &ct[(PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8]; ------------------ | | 13| 8|#define PARAMS_LOGQ 16 ------------------ uint8_t *ct_c2 = &ct[(PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8]; ------------------ | | 11| 8|#define PARAMS_N 1344 ------------------ uint8_t *ct_c2 = &ct[(PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8]; ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ 94| 8| uint16_t B[PARAMS_N*PARAMS_NBAR] = {0}; 95| 8| uint16_t V[PARAMS_NBAR*PARAMS_NBAR]= {0}; // contains secret data 96| 8| uint16_t C[PARAMS_NBAR*PARAMS_NBAR] = {0}; 97| 8| ALIGN_HEADER(32) uint16_t Bp[PARAMS_N*PARAMS_NBAR] ALIGN_FOOTER(32) = {0}; 98| 8| ALIGN_HEADER(32) uint16_t Sp[(2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR] ALIGN_FOOTER(32) = {0}; // contains secret data 99| 8| uint16_t *Ep = (uint16_t *)&Sp[PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 11| 8|#define PARAMS_N 1344 ------------------ uint16_t *Ep = (uint16_t *)&Sp[PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ 100| 8| uint16_t *Epp = (uint16_t *)&Sp[2*PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 11| 8|#define PARAMS_N 1344 ------------------ uint16_t *Epp = (uint16_t *)&Sp[2*PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ 101| 8| uint8_t G2in[BYTES_PKHASH + BYTES_MU + BYTES_SALT]; // contains secret data via mu 102| 8| uint8_t *pkh = &G2in[0]; 103| 8| uint8_t *mu = &G2in[BYTES_PKHASH]; // contains secret data ------------------ | | 22| 8|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 8|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_aes_length_shared_secret | | | | ------------------ | | | | | | 72| 8|#define OQS_KEM_frodokem_1344_aes_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ 104| 8| uint8_t *salt = &G2in[BYTES_PKHASH + BYTES_MU]; ------------------ | | 22| 8|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 8|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_aes_length_shared_secret | | | | ------------------ | | | | | | 72| 8|#define OQS_KEM_frodokem_1344_aes_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ uint8_t *salt = &G2in[BYTES_PKHASH + BYTES_MU]; ------------------ | | 19| 8|#define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 15| 8|#define PARAMS_EXTRACTED_BITS 4 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 8|#define PARAMS_NBAR 8 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 8|#define PARAMS_NBAR 8 | | ------------------ ------------------ 105| 8| uint8_t G2out[BYTES_SEED_SE + CRYPTO_BYTES]; // contains secret data 106| 8| uint8_t *seedSE = &G2out[0]; // contains secret data 107| 8| uint8_t *k = &G2out[BYTES_SEED_SE]; // contains secret data ------------------ | | 21| 8|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 8|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_aes_length_shared_secret | | | | ------------------ | | | | | | 72| 8|#define OQS_KEM_frodokem_1344_aes_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ 108| 8| uint8_t Fin[CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES]; // contains secret data via Fin_k 109| 8| uint8_t *Fin_ct = &Fin[0]; 110| 8| uint8_t *Fin_k = &Fin[CRYPTO_CIPHERTEXTBYTES]; // contains secret data ------------------ | | 5| 8|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_frodokem_1344_aes_length_ciphertext | | ------------------ | | | | 71| 8|#define OQS_KEM_frodokem_1344_aes_length_ciphertext 21696 | | ------------------ ------------------ 111| 8| uint8_t shake_input_seedSE[1 + BYTES_SEED_SE]; // contains secret data 112| | 113| | // pkh <- G_1(pk), generate random mu and salt, compute (seedSE || k) = G_2(pkh || mu || salt) 114| 8| shake(pkh, BYTES_PKHASH, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 31| 8|#define shake OQS_SHA3_shake256 ------------------ shake(pkh, BYTES_PKHASH, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 22| 8|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 8|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_aes_length_shared_secret | | | | ------------------ | | | | | | 72| 8|#define OQS_KEM_frodokem_1344_aes_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ shake(pkh, BYTES_PKHASH, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 3| 8|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_frodokem_1344_aes_length_public_key | | ------------------ | | | | 69| 8|#define OQS_KEM_frodokem_1344_aes_length_public_key 21520 | | ------------------ ------------------ 115| 8| randombytes(mu, BYTES_MU + BYTES_SALT); ------------------ | | 28| 8|#define randombytes OQS_randombytes ------------------ randombytes(mu, BYTES_MU + BYTES_SALT); ------------------ | | 19| 8|#define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 15| 8|#define PARAMS_EXTRACTED_BITS 4 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 8|#define PARAMS_NBAR 8 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 8|#define PARAMS_NBAR 8 | | ------------------ ------------------ randombytes(mu, BYTES_MU + BYTES_SALT); ------------------ | | 20| 8|#define BYTES_SALT (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 8|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_aes_length_shared_secret | | | | ------------------ | | | | | | 72| 8|#define OQS_KEM_frodokem_1344_aes_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ 116| 8| shake(G2out, BYTES_SEED_SE + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU + BYTES_SALT); ------------------ | | 31| 8|#define shake OQS_SHA3_shake256 ------------------ shake(G2out, BYTES_SEED_SE + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU + BYTES_SALT); ------------------ | | 21| 8|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 8|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_aes_length_shared_secret | | | | ------------------ | | | | | | 72| 8|#define OQS_KEM_frodokem_1344_aes_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ shake(G2out, BYTES_SEED_SE + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU + BYTES_SALT); ------------------ | | 6| 8|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_aes_length_shared_secret | | ------------------ | | | | 72| 8|#define OQS_KEM_frodokem_1344_aes_length_shared_secret 32 | | ------------------ ------------------ shake(G2out, BYTES_SEED_SE + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU + BYTES_SALT); ------------------ | | 22| 8|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 8|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_aes_length_shared_secret | | | | ------------------ | | | | | | 72| 8|#define OQS_KEM_frodokem_1344_aes_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ shake(G2out, BYTES_SEED_SE + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU + BYTES_SALT); ------------------ | | 19| 8|#define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 15| 8|#define PARAMS_EXTRACTED_BITS 4 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 8|#define PARAMS_NBAR 8 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 8|#define PARAMS_NBAR 8 | | ------------------ ------------------ shake(G2out, BYTES_SEED_SE + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU + BYTES_SALT); ------------------ | | 20| 8|#define BYTES_SALT (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 8|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_aes_length_shared_secret | | | | ------------------ | | | | | | 72| 8|#define OQS_KEM_frodokem_1344_aes_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ 117| | 118| | // Generate Sp and Ep, and compute Bp = Sp*A + Ep. Generate A on-the-fly 119| 8| shake_input_seedSE[0] = 0x96; 120| 8| memcpy(&shake_input_seedSE[1], seedSE, BYTES_SEED_SE); ------------------ | | 21| 8|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 8|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_aes_length_shared_secret | | | | ------------------ | | | | | | 72| 8|#define OQS_KEM_frodokem_1344_aes_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ 121| 8| shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + BYTES_SEED_SE); ------------------ | | 31| 8|#define shake OQS_SHA3_shake256 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + BYTES_SEED_SE); ------------------ | | 11| 8|#define PARAMS_N 1344 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + BYTES_SEED_SE); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + BYTES_SEED_SE); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + BYTES_SEED_SE); ------------------ | | 21| 8|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 8|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_aes_length_shared_secret | | | | ------------------ | | | | | | 72| 8|#define OQS_KEM_frodokem_1344_aes_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ 122| 172k| for (size_t i = 0; i < (2 * PARAMS_N + PARAMS_NBAR) * PARAMS_NBAR; i++) { ------------------ | | 11| 172k|#define PARAMS_N 1344 ------------------ for (size_t i = 0; i < (2 * PARAMS_N + PARAMS_NBAR) * PARAMS_NBAR; i++) { ------------------ | | 12| 172k|#define PARAMS_NBAR 8 ------------------ for (size_t i = 0; i < (2 * PARAMS_N + PARAMS_NBAR) * PARAMS_NBAR; i++) { ------------------ | | 12| 172k|#define PARAMS_NBAR 8 ------------------ | Branch (122:24): [True: 172k, False: 8] ------------------ 123| 172k| Sp[i] = LE_TO_UINT16(Sp[i]); ------------------ | | 34| 172k| #define LE_TO_UINT16(n) (n) ------------------ 124| 172k| } 125| 8| frodo_sample_n(Sp, PARAMS_N*PARAMS_NBAR); ------------------ | | 40| 8|#define frodo_sample_n oqs_kem_frodokem_1344_aes_sample_n ------------------ frodo_sample_n(Sp, PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 8|#define PARAMS_N 1344 ------------------ frodo_sample_n(Sp, PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ 126| 8| frodo_sample_n(Ep, PARAMS_N*PARAMS_NBAR); ------------------ | | 40| 8|#define frodo_sample_n oqs_kem_frodokem_1344_aes_sample_n ------------------ frodo_sample_n(Ep, PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 8|#define PARAMS_N 1344 ------------------ frodo_sample_n(Ep, PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ 127| 8| frodo_mul_add_sa_plus_e(Bp, Sp, Ep, pk_seedA); ------------------ | | 49| 8|#define frodo_mul_add_sa_plus_e oqs_kem_frodokem_1344_aes_mul_add_sa_plus_e ------------------ 128| 8| frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 41| 8|#define frodo_pack oqs_kem_frodokem_1344_aes_pack ------------------ frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 13| 8|#define PARAMS_LOGQ 16 ------------------ frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 11| 8|#define PARAMS_N 1344 ------------------ frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 11| 8|#define PARAMS_N 1344 ------------------ frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 13| 8|#define PARAMS_LOGQ 16 ------------------ 129| | 130| | // Generate Epp, and compute V = Sp*B + Epp 131| 8| frodo_sample_n(Epp, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 40| 8|#define frodo_sample_n oqs_kem_frodokem_1344_aes_sample_n ------------------ frodo_sample_n(Epp, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ frodo_sample_n(Epp, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ 132| 8| frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 42| 8|#define frodo_unpack oqs_kem_frodokem_1344_aes_unpack ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 11| 8|#define PARAMS_N 1344 ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 3| 8|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_frodokem_1344_aes_length_public_key | | ------------------ | | | | 69| 8|#define OQS_KEM_frodokem_1344_aes_length_public_key 21520 | | ------------------ ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 18| 8|#define BYTES_SEED_A 16 ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 13| 8|#define PARAMS_LOGQ 16 ------------------ 133| 8| frodo_mul_add_sb_plus_e(V, B, Sp, Epp); ------------------ | | 52| 8|#define frodo_mul_add_sb_plus_e oqs_kem_frodokem_1344_aes_mul_add_sb_plus_e ------------------ 134| | 135| | // Encode mu, and compute C = V + enc(mu) (mod q) 136| 8| frodo_key_encode(C, (uint16_t*)mu); ------------------ | | 57| 8|#define frodo_key_encode oqs_kem_frodokem_1344_aes_key_encode ------------------ 137| 8| frodo_add(C, V, C); ------------------ | | 55| 8|#define frodo_add oqs_kem_frodokem_1344_aes_add ------------------ 138| 8| frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 41| 8|#define frodo_pack oqs_kem_frodokem_1344_aes_pack ------------------ frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 13| 8|#define PARAMS_LOGQ 16 ------------------ frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 13| 8|#define PARAMS_LOGQ 16 ------------------ 139| | 140| | // Append salt to ct and compute ss = F(ct_c1||ct_c2||salt||k) 141| 8| memcpy(&ct[CRYPTO_CIPHERTEXTBYTES - BYTES_SALT], salt, BYTES_SALT); ------------------ | | 5| 8|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_frodokem_1344_aes_length_ciphertext | | ------------------ | | | | 71| 8|#define OQS_KEM_frodokem_1344_aes_length_ciphertext 21696 | | ------------------ ------------------ memcpy(&ct[CRYPTO_CIPHERTEXTBYTES - BYTES_SALT], salt, BYTES_SALT); ------------------ | | 20| 8|#define BYTES_SALT (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 8|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_aes_length_shared_secret | | | | ------------------ | | | | | | 72| 8|#define OQS_KEM_frodokem_1344_aes_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ memcpy(&ct[CRYPTO_CIPHERTEXTBYTES - BYTES_SALT], salt, BYTES_SALT); ------------------ | | 20| 8|#define BYTES_SALT (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 8|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_aes_length_shared_secret | | | | ------------------ | | | | | | 72| 8|#define OQS_KEM_frodokem_1344_aes_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ 142| 8| memcpy(Fin_ct, ct, CRYPTO_CIPHERTEXTBYTES); ------------------ | | 5| 8|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_frodokem_1344_aes_length_ciphertext | | ------------------ | | | | 71| 8|#define OQS_KEM_frodokem_1344_aes_length_ciphertext 21696 | | ------------------ ------------------ 143| 8| memcpy(Fin_k, k, CRYPTO_BYTES); ------------------ | | 6| 8|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_aes_length_shared_secret | | ------------------ | | | | 72| 8|#define OQS_KEM_frodokem_1344_aes_length_shared_secret 32 | | ------------------ ------------------ 144| 8| shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 31| 8|#define shake OQS_SHA3_shake256 ------------------ shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 6| 8|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_aes_length_shared_secret | | ------------------ | | | | 72| 8|#define OQS_KEM_frodokem_1344_aes_length_shared_secret 32 | | ------------------ ------------------ shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 5| 8|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_frodokem_1344_aes_length_ciphertext | | ------------------ | | | | 71| 8|#define OQS_KEM_frodokem_1344_aes_length_ciphertext 21696 | | ------------------ ------------------ shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 6| 8|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_aes_length_shared_secret | | ------------------ | | | | 72| 8|#define OQS_KEM_frodokem_1344_aes_length_shared_secret 32 | | ------------------ ------------------ 145| | 146| | // Cleanup: 147| 8| clear_bytes((uint8_t *)V, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 29| 8|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)V, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ clear_bytes((uint8_t *)V, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ 148| 8| clear_bytes((uint8_t *)Sp, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 29| 8|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)Sp, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 8|#define PARAMS_N 1344 ------------------ clear_bytes((uint8_t *)Sp, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ 149| 8| clear_bytes((uint8_t *)Ep, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 29| 8|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)Ep, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 8|#define PARAMS_N 1344 ------------------ clear_bytes((uint8_t *)Ep, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ 150| 8| clear_bytes((uint8_t *)Epp, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 29| 8|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)Epp, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ clear_bytes((uint8_t *)Epp, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ 151| 8| clear_bytes(mu, BYTES_MU); ------------------ | | 29| 8|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(mu, BYTES_MU); ------------------ | | 19| 8|#define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 15| 8|#define PARAMS_EXTRACTED_BITS 4 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 8|#define PARAMS_NBAR 8 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 8|#define PARAMS_NBAR 8 | | ------------------ ------------------ 152| 8| clear_bytes(G2out, BYTES_SEED_SE + CRYPTO_BYTES); ------------------ | | 29| 8|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(G2out, BYTES_SEED_SE + CRYPTO_BYTES); ------------------ | | 21| 8|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 8|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_aes_length_shared_secret | | | | ------------------ | | | | | | 72| 8|#define OQS_KEM_frodokem_1344_aes_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ clear_bytes(G2out, BYTES_SEED_SE + CRYPTO_BYTES); ------------------ | | 6| 8|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_aes_length_shared_secret | | ------------------ | | | | 72| 8|#define OQS_KEM_frodokem_1344_aes_length_shared_secret 32 | | ------------------ ------------------ 153| 8| clear_bytes(Fin_k, CRYPTO_BYTES); ------------------ | | 29| 8|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(Fin_k, CRYPTO_BYTES); ------------------ | | 6| 8|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_aes_length_shared_secret | | ------------------ | | | | 72| 8|#define OQS_KEM_frodokem_1344_aes_length_shared_secret 32 | | ------------------ ------------------ 154| 8| clear_bytes(shake_input_seedSE, 1 + BYTES_SEED_SE); ------------------ | | 29| 8|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(shake_input_seedSE, 1 + BYTES_SEED_SE); ------------------ | | 21| 8|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 8|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_aes_length_shared_secret | | | | ------------------ | | | | | | 72| 8|#define OQS_KEM_frodokem_1344_aes_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ 155| 8| return OQS_SUCCESS; 156| 8|} OQS_KEM_frodokem_1344_aes_decaps: 160| 8|{ // FrodoKEM's key decapsulation 161| | // Inputs: ciphertext ct = ct_c1||ct_c2||salt ( (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8 + (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8 + BYTES_SALT bytes) 162| | // secret key sk = sk_s||pk_seedA||pk_b||sk_S||sk_pkh (CRYPTO_BYTES + BYTES_SEED_A + (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8 + 2*PARAMS_N*PARAMS_NBAR + BYTES_PKHASH bytes) 163| | // Output: shared key ss (CRYPTO_BYTES bytes) 164| 8| uint16_t B[PARAMS_N*PARAMS_NBAR] = {0}; 165| 8| uint16_t Bp[PARAMS_N*PARAMS_NBAR] = {0}; 166| 8| uint16_t W[PARAMS_NBAR*PARAMS_NBAR] = {0}; // contains secret data 167| 8| uint16_t C[PARAMS_NBAR*PARAMS_NBAR] = {0}; 168| 8| uint16_t CC[PARAMS_NBAR*PARAMS_NBAR] = {0}; 169| 8| ALIGN_HEADER(32) uint16_t BBp[PARAMS_N*PARAMS_NBAR] ALIGN_FOOTER(32) = {0}; 170| 8| ALIGN_HEADER(32) uint16_t Sp[(2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR] ALIGN_FOOTER(32) = {0}; // contains secret data 171| 8| uint16_t *Ep = (uint16_t *)&Sp[PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 11| 8|#define PARAMS_N 1344 ------------------ uint16_t *Ep = (uint16_t *)&Sp[PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ 172| 8| uint16_t *Epp = (uint16_t *)&Sp[2*PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 11| 8|#define PARAMS_N 1344 ------------------ uint16_t *Epp = (uint16_t *)&Sp[2*PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ 173| 8| const uint8_t *ct_c1 = &ct[0]; 174| 8| const uint8_t *ct_c2 = &ct[(PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8]; ------------------ | | 13| 8|#define PARAMS_LOGQ 16 ------------------ const uint8_t *ct_c2 = &ct[(PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8]; ------------------ | | 11| 8|#define PARAMS_N 1344 ------------------ const uint8_t *ct_c2 = &ct[(PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8]; ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ 175| 8| const uint8_t *salt = &ct[CRYPTO_CIPHERTEXTBYTES - BYTES_SALT]; ------------------ | | 5| 8|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_frodokem_1344_aes_length_ciphertext | | ------------------ | | | | 71| 8|#define OQS_KEM_frodokem_1344_aes_length_ciphertext 21696 | | ------------------ ------------------ const uint8_t *salt = &ct[CRYPTO_CIPHERTEXTBYTES - BYTES_SALT]; ------------------ | | 20| 8|#define BYTES_SALT (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 8|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_aes_length_shared_secret | | | | ------------------ | | | | | | 72| 8|#define OQS_KEM_frodokem_1344_aes_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ 176| 8| const uint8_t *sk_s = &sk[0]; 177| 8| const uint8_t *sk_pk = &sk[CRYPTO_BYTES]; ------------------ | | 6| 8|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_aes_length_shared_secret | | ------------------ | | | | 72| 8|#define OQS_KEM_frodokem_1344_aes_length_shared_secret 32 | | ------------------ ------------------ 178| 8| const uint16_t *sk_S = (uint16_t *) &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES]; ------------------ | | 6| 8|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_aes_length_shared_secret | | ------------------ | | | | 72| 8|#define OQS_KEM_frodokem_1344_aes_length_shared_secret 32 | | ------------------ ------------------ const uint16_t *sk_S = (uint16_t *) &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES]; ------------------ | | 3| 8|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_frodokem_1344_aes_length_public_key | | ------------------ | | | | 69| 8|#define OQS_KEM_frodokem_1344_aes_length_public_key 21520 | | ------------------ ------------------ 179| 8| uint16_t S[PARAMS_N * PARAMS_NBAR]; // contains secret data 180| 8| const uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 6| 8|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_aes_length_shared_secret | | ------------------ | | | | 72| 8|#define OQS_KEM_frodokem_1344_aes_length_shared_secret 32 | | ------------------ ------------------ const uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 3| 8|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_frodokem_1344_aes_length_public_key | | ------------------ | | | | 69| 8|#define OQS_KEM_frodokem_1344_aes_length_public_key 21520 | | ------------------ ------------------ const uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 11| 8|#define PARAMS_N 1344 ------------------ const uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ 181| 8| const uint8_t *pk_seedA = &sk_pk[0]; 182| 8| const uint8_t *pk_b = &sk_pk[BYTES_SEED_A]; ------------------ | | 18| 8|#define BYTES_SEED_A 16 ------------------ 183| 8| uint8_t G2in[BYTES_PKHASH + BYTES_MU + BYTES_SALT]; // contains secret data via muprime 184| 8| uint8_t *pkh = &G2in[0]; 185| 8| uint8_t *muprime = &G2in[BYTES_PKHASH]; // contains secret data ------------------ | | 22| 8|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 8|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_aes_length_shared_secret | | | | ------------------ | | | | | | 72| 8|#define OQS_KEM_frodokem_1344_aes_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ 186| 8| uint8_t *G2in_salt = &G2in[BYTES_PKHASH + BYTES_MU]; ------------------ | | 22| 8|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 8|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_aes_length_shared_secret | | | | ------------------ | | | | | | 72| 8|#define OQS_KEM_frodokem_1344_aes_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ uint8_t *G2in_salt = &G2in[BYTES_PKHASH + BYTES_MU]; ------------------ | | 19| 8|#define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 15| 8|#define PARAMS_EXTRACTED_BITS 4 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 8|#define PARAMS_NBAR 8 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 8|#define PARAMS_NBAR 8 | | ------------------ ------------------ 187| 8| uint8_t G2out[BYTES_SEED_SE + CRYPTO_BYTES]; // contains secret data 188| 8| uint8_t *seedSEprime = &G2out[0]; // contains secret data 189| 8| uint8_t *kprime = &G2out[BYTES_SEED_SE]; // contains secret data ------------------ | | 21| 8|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 8|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_aes_length_shared_secret | | | | ------------------ | | | | | | 72| 8|#define OQS_KEM_frodokem_1344_aes_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ 190| 8| uint8_t Fin[CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES]; // contains secret data via Fin_k 191| 8| uint8_t *Fin_ct = &Fin[0]; 192| 8| uint8_t *Fin_k = &Fin[CRYPTO_CIPHERTEXTBYTES]; // contains secret data ------------------ | | 5| 8|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_frodokem_1344_aes_length_ciphertext | | ------------------ | | | | 71| 8|#define OQS_KEM_frodokem_1344_aes_length_ciphertext 21696 | | ------------------ ------------------ 193| 8| uint8_t shake_input_seedSEprime[1 + BYTES_SEED_SE]; // contains secret data 194| | 195| | 196| 86.0k| for (size_t i = 0; i < PARAMS_N * PARAMS_NBAR; i++) { ------------------ | | 11| 86.0k|#define PARAMS_N 1344 ------------------ for (size_t i = 0; i < PARAMS_N * PARAMS_NBAR; i++) { ------------------ | | 12| 86.0k|#define PARAMS_NBAR 8 ------------------ | Branch (196:24): [True: 86.0k, False: 8] ------------------ 197| 86.0k| S[i] = LE_TO_UINT16(sk_S[i]); ------------------ | | 34| 86.0k| #define LE_TO_UINT16(n) (n) ------------------ 198| 86.0k| } 199| | 200| | // Compute W = C - Bp*S (mod q), and decode the randomness mu 201| 8| frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 42| 8|#define frodo_unpack oqs_kem_frodokem_1344_aes_unpack ------------------ frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 11| 8|#define PARAMS_N 1344 ------------------ frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 13| 8|#define PARAMS_LOGQ 16 ------------------ frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 11| 8|#define PARAMS_N 1344 ------------------ frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 13| 8|#define PARAMS_LOGQ 16 ------------------ 202| 8| frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 42| 8|#define frodo_unpack oqs_kem_frodokem_1344_aes_unpack ------------------ frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 13| 8|#define PARAMS_LOGQ 16 ------------------ frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 13| 8|#define PARAMS_LOGQ 16 ------------------ 203| 8| frodo_mul_bs(W, Bp, S); ------------------ | | 53| 8|#define frodo_mul_bs oqs_kem_frodokem_1344_aes_mul_bs ------------------ 204| 8| frodo_sub(W, C, W); ------------------ | | 56| 8|#define frodo_sub oqs_kem_frodokem_1344_aes_sub ------------------ 205| 8| frodo_key_decode((uint16_t*)muprime, W); ------------------ | | 58| 8|#define frodo_key_decode oqs_kem_frodokem_1344_aes_key_decode ------------------ 206| | 207| | // Generate (seedSE' || k') = G_2(pkh || mu' || salt) 208| 8| memcpy(pkh, sk_pkh, BYTES_PKHASH); ------------------ | | 22| 8|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 8|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_aes_length_shared_secret | | | | ------------------ | | | | | | 72| 8|#define OQS_KEM_frodokem_1344_aes_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ 209| 8| memcpy(G2in_salt, salt, BYTES_SALT); ------------------ | | 20| 8|#define BYTES_SALT (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 8|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_aes_length_shared_secret | | | | ------------------ | | | | | | 72| 8|#define OQS_KEM_frodokem_1344_aes_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ 210| 8| shake(G2out, BYTES_SEED_SE + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU + BYTES_SALT); ------------------ | | 31| 8|#define shake OQS_SHA3_shake256 ------------------ shake(G2out, BYTES_SEED_SE + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU + BYTES_SALT); ------------------ | | 21| 8|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 8|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_aes_length_shared_secret | | | | ------------------ | | | | | | 72| 8|#define OQS_KEM_frodokem_1344_aes_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ shake(G2out, BYTES_SEED_SE + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU + BYTES_SALT); ------------------ | | 6| 8|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_aes_length_shared_secret | | ------------------ | | | | 72| 8|#define OQS_KEM_frodokem_1344_aes_length_shared_secret 32 | | ------------------ ------------------ shake(G2out, BYTES_SEED_SE + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU + BYTES_SALT); ------------------ | | 22| 8|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 8|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_aes_length_shared_secret | | | | ------------------ | | | | | | 72| 8|#define OQS_KEM_frodokem_1344_aes_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ shake(G2out, BYTES_SEED_SE + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU + BYTES_SALT); ------------------ | | 19| 8|#define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 15| 8|#define PARAMS_EXTRACTED_BITS 4 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 8|#define PARAMS_NBAR 8 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 8|#define PARAMS_NBAR 8 | | ------------------ ------------------ shake(G2out, BYTES_SEED_SE + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU + BYTES_SALT); ------------------ | | 20| 8|#define BYTES_SALT (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 8|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_aes_length_shared_secret | | | | ------------------ | | | | | | 72| 8|#define OQS_KEM_frodokem_1344_aes_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ 211| | 212| | // Generate Sp and Ep, and compute BBp = Sp*A + Ep. Generate A on-the-fly 213| 8| shake_input_seedSEprime[0] = 0x96; 214| 8| memcpy(&shake_input_seedSEprime[1], seedSEprime, BYTES_SEED_SE); ------------------ | | 21| 8|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 8|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_aes_length_shared_secret | | | | ------------------ | | | | | | 72| 8|#define OQS_KEM_frodokem_1344_aes_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ 215| 8| shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSEprime, 1 + BYTES_SEED_SE); ------------------ | | 31| 8|#define shake OQS_SHA3_shake256 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSEprime, 1 + BYTES_SEED_SE); ------------------ | | 11| 8|#define PARAMS_N 1344 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSEprime, 1 + BYTES_SEED_SE); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSEprime, 1 + BYTES_SEED_SE); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSEprime, 1 + BYTES_SEED_SE); ------------------ | | 21| 8|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 8|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_aes_length_shared_secret | | | | ------------------ | | | | | | 72| 8|#define OQS_KEM_frodokem_1344_aes_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ 216| 172k| for (size_t i = 0; i < (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR; i++) { ------------------ | | 11| 172k|#define PARAMS_N 1344 ------------------ for (size_t i = 0; i < (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR; i++) { ------------------ | | 12| 172k|#define PARAMS_NBAR 8 ------------------ for (size_t i = 0; i < (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR; i++) { ------------------ | | 12| 172k|#define PARAMS_NBAR 8 ------------------ | Branch (216:24): [True: 172k, False: 8] ------------------ 217| 172k| Sp[i] = LE_TO_UINT16(Sp[i]); ------------------ | | 34| 172k| #define LE_TO_UINT16(n) (n) ------------------ 218| 172k| } 219| 8| frodo_sample_n(Sp, PARAMS_N*PARAMS_NBAR); ------------------ | | 40| 8|#define frodo_sample_n oqs_kem_frodokem_1344_aes_sample_n ------------------ frodo_sample_n(Sp, PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 8|#define PARAMS_N 1344 ------------------ frodo_sample_n(Sp, PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ 220| 8| frodo_sample_n(Ep, PARAMS_N*PARAMS_NBAR); ------------------ | | 40| 8|#define frodo_sample_n oqs_kem_frodokem_1344_aes_sample_n ------------------ frodo_sample_n(Ep, PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 8|#define PARAMS_N 1344 ------------------ frodo_sample_n(Ep, PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ 221| 8| frodo_mul_add_sa_plus_e(BBp, Sp, Ep, pk_seedA); ------------------ | | 49| 8|#define frodo_mul_add_sa_plus_e oqs_kem_frodokem_1344_aes_mul_add_sa_plus_e ------------------ 222| | 223| | // Generate Epp, and compute W = Sp*B + Epp 224| 8| frodo_sample_n(Epp, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 40| 8|#define frodo_sample_n oqs_kem_frodokem_1344_aes_sample_n ------------------ frodo_sample_n(Epp, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ frodo_sample_n(Epp, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ 225| 8| frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 42| 8|#define frodo_unpack oqs_kem_frodokem_1344_aes_unpack ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 11| 8|#define PARAMS_N 1344 ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 3| 8|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_frodokem_1344_aes_length_public_key | | ------------------ | | | | 69| 8|#define OQS_KEM_frodokem_1344_aes_length_public_key 21520 | | ------------------ ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 18| 8|#define BYTES_SEED_A 16 ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 13| 8|#define PARAMS_LOGQ 16 ------------------ 226| 8| frodo_mul_add_sb_plus_e(W, B, Sp, Epp); ------------------ | | 52| 8|#define frodo_mul_add_sb_plus_e oqs_kem_frodokem_1344_aes_mul_add_sb_plus_e ------------------ 227| | 228| | // Encode mu, and compute CC = W + enc(mu') (mod q) 229| 8| frodo_key_encode(CC, (uint16_t*)muprime); ------------------ | | 57| 8|#define frodo_key_encode oqs_kem_frodokem_1344_aes_key_encode ------------------ 230| 8| frodo_add(CC, W, CC); ------------------ | | 55| 8|#define frodo_add oqs_kem_frodokem_1344_aes_add ------------------ 231| | 232| | // Prepare input to F 233| 8| memcpy(Fin_ct, ct, CRYPTO_CIPHERTEXTBYTES); ------------------ | | 5| 8|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_frodokem_1344_aes_length_ciphertext | | ------------------ | | | | 71| 8|#define OQS_KEM_frodokem_1344_aes_length_ciphertext 21696 | | ------------------ ------------------ 234| | 235| | // Reducing BBp modulo q 236| 86.0k| for (int i = 0; i < PARAMS_N*PARAMS_NBAR; i++) BBp[i] = BBp[i] & ((1 << PARAMS_LOGQ)-1); ------------------ | | 11| 86.0k|#define PARAMS_N 1344 ------------------ for (int i = 0; i < PARAMS_N*PARAMS_NBAR; i++) BBp[i] = BBp[i] & ((1 << PARAMS_LOGQ)-1); ------------------ | | 12| 86.0k|#define PARAMS_NBAR 8 ------------------ for (int i = 0; i < PARAMS_N*PARAMS_NBAR; i++) BBp[i] = BBp[i] & ((1 << PARAMS_LOGQ)-1); ------------------ | | 13| 86.0k|#define PARAMS_LOGQ 16 ------------------ | Branch (236:21): [True: 86.0k, False: 8] ------------------ 237| | 238| | // Needs to avoid branching on secret data using constant-time implementation. 239| 8| int8_t selector = ct_verify(Bp, BBp, PARAMS_N*PARAMS_NBAR) | ct_verify(C, CC, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 44| 8|#define ct_verify oqs_kem_frodokem_1344_aes_ct_verify ------------------ int8_t selector = ct_verify(Bp, BBp, PARAMS_N*PARAMS_NBAR) | ct_verify(C, CC, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 11| 8|#define PARAMS_N 1344 ------------------ int8_t selector = ct_verify(Bp, BBp, PARAMS_N*PARAMS_NBAR) | ct_verify(C, CC, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ int8_t selector = ct_verify(Bp, BBp, PARAMS_N*PARAMS_NBAR) | ct_verify(C, CC, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 44| 8|#define ct_verify oqs_kem_frodokem_1344_aes_ct_verify ------------------ int8_t selector = ct_verify(Bp, BBp, PARAMS_N*PARAMS_NBAR) | ct_verify(C, CC, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ int8_t selector = ct_verify(Bp, BBp, PARAMS_N*PARAMS_NBAR) | ct_verify(C, CC, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ 240| | // If (selector == 0) then load k' to do ss = F(ct || k'), else if (selector == -1) load s to do ss = F(ct || s) 241| 8| ct_select((uint8_t*)Fin_k, (uint8_t*)kprime, (uint8_t*)sk_s, CRYPTO_BYTES, selector); ------------------ | | 43| 8|#define ct_select oqs_kem_frodokem_1344_aes_ct_select ------------------ ct_select((uint8_t*)Fin_k, (uint8_t*)kprime, (uint8_t*)sk_s, CRYPTO_BYTES, selector); ------------------ | | 6| 8|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_aes_length_shared_secret | | ------------------ | | | | 72| 8|#define OQS_KEM_frodokem_1344_aes_length_shared_secret 32 | | ------------------ ------------------ 242| 8| shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 31| 8|#define shake OQS_SHA3_shake256 ------------------ shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 6| 8|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_aes_length_shared_secret | | ------------------ | | | | 72| 8|#define OQS_KEM_frodokem_1344_aes_length_shared_secret 32 | | ------------------ ------------------ shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 5| 8|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_frodokem_1344_aes_length_ciphertext | | ------------------ | | | | 71| 8|#define OQS_KEM_frodokem_1344_aes_length_ciphertext 21696 | | ------------------ ------------------ shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 6| 8|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_aes_length_shared_secret | | ------------------ | | | | 72| 8|#define OQS_KEM_frodokem_1344_aes_length_shared_secret 32 | | ------------------ ------------------ 243| | 244| | // Cleanup: 245| 8| clear_bytes((uint8_t *)W, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 29| 8|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)W, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ clear_bytes((uint8_t *)W, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ 246| 8| clear_bytes((uint8_t *)Sp, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 29| 8|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)Sp, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 8|#define PARAMS_N 1344 ------------------ clear_bytes((uint8_t *)Sp, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ 247| 8| clear_bytes((uint8_t *)S, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 29| 8|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)S, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 8|#define PARAMS_N 1344 ------------------ clear_bytes((uint8_t *)S, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ 248| 8| clear_bytes((uint8_t *)Ep, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 29| 8|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)Ep, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 8|#define PARAMS_N 1344 ------------------ clear_bytes((uint8_t *)Ep, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ 249| 8| clear_bytes((uint8_t *)Epp, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 29| 8|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)Epp, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ clear_bytes((uint8_t *)Epp, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ 250| 8| clear_bytes(muprime, BYTES_MU); ------------------ | | 29| 8|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(muprime, BYTES_MU); ------------------ | | 19| 8|#define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 15| 8|#define PARAMS_EXTRACTED_BITS 4 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 8|#define PARAMS_NBAR 8 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 8|#define PARAMS_NBAR 8 | | ------------------ ------------------ 251| 8| clear_bytes(G2out, BYTES_SEED_SE + CRYPTO_BYTES); ------------------ | | 29| 8|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(G2out, BYTES_SEED_SE + CRYPTO_BYTES); ------------------ | | 21| 8|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 8|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_aes_length_shared_secret | | | | ------------------ | | | | | | 72| 8|#define OQS_KEM_frodokem_1344_aes_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ clear_bytes(G2out, BYTES_SEED_SE + CRYPTO_BYTES); ------------------ | | 6| 8|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_aes_length_shared_secret | | ------------------ | | | | 72| 8|#define OQS_KEM_frodokem_1344_aes_length_shared_secret 32 | | ------------------ ------------------ 252| 8| clear_bytes(Fin_k, CRYPTO_BYTES); ------------------ | | 29| 8|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(Fin_k, CRYPTO_BYTES); ------------------ | | 6| 8|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_aes_length_shared_secret | | ------------------ | | | | 72| 8|#define OQS_KEM_frodokem_1344_aes_length_shared_secret 32 | | ------------------ ------------------ 253| 8| clear_bytes(shake_input_seedSEprime, 1 + BYTES_SEED_SE); ------------------ | | 29| 8|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(shake_input_seedSEprime, 1 + BYTES_SEED_SE); ------------------ | | 21| 8|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 8|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_aes_length_shared_secret | | | | ------------------ | | | | | | 72| 8|#define OQS_KEM_frodokem_1344_aes_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ 254| 8| return OQS_SUCCESS; 255| 8|} OQS_KEM_frodokem_1344_shake_keypair: 19| 9|{ // FrodoKEM's key generation 20| | // Outputs: public key pk = pk_seedA||pk_b ( BYTES_SEED_A + (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8 bytes) 21| | // secret key sk = sk_s||pk_seedA||pk_b||sk_S||sk_pkh (CRYPTO_BYTES + BYTES_SEED_A + (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8 + 2*PARAMS_N*PARAMS_NBAR + BYTES_PKHASH bytes) 22| 9| uint8_t *pk_seedA = &pk[0]; 23| 9| uint8_t *pk_b = &pk[BYTES_SEED_A]; ------------------ | | 18| 9|#define BYTES_SEED_A 16 ------------------ 24| 9| uint8_t *sk_s = &sk[0]; 25| 9| uint8_t *sk_pk = &sk[CRYPTO_BYTES]; ------------------ | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_shake_length_shared_secret | | ------------------ | | | | 87| 9|#define OQS_KEM_frodokem_1344_shake_length_shared_secret 32 | | ------------------ ------------------ 26| 9| uint8_t *sk_S = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES]; ------------------ | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_shake_length_shared_secret | | ------------------ | | | | 87| 9|#define OQS_KEM_frodokem_1344_shake_length_shared_secret 32 | | ------------------ ------------------ uint8_t *sk_S = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES]; ------------------ | | 3| 9|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_frodokem_1344_shake_length_public_key | | ------------------ | | | | 84| 9|#define OQS_KEM_frodokem_1344_shake_length_public_key 21520 | | ------------------ ------------------ 27| 9| uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_shake_length_shared_secret | | ------------------ | | | | 87| 9|#define OQS_KEM_frodokem_1344_shake_length_shared_secret 32 | | ------------------ ------------------ uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 3| 9|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_frodokem_1344_shake_length_public_key | | ------------------ | | | | 84| 9|#define OQS_KEM_frodokem_1344_shake_length_public_key 21520 | | ------------------ ------------------ uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 11| 9|#define PARAMS_N 1344 ------------------ uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ 28| 9| uint16_t B[PARAMS_N*PARAMS_NBAR] = {0}; 29| 9| uint16_t S[2*PARAMS_N*PARAMS_NBAR] = {0}; // contains secret data 30| 9| uint16_t *E = (uint16_t *)&S[PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 11| 9|#define PARAMS_N 1344 ------------------ uint16_t *E = (uint16_t *)&S[PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ 31| 9| uint8_t randomness[CRYPTO_BYTES + BYTES_SEED_SE + BYTES_SEED_A]; // contains secret data via randomness_s and randomness_seedSE 32| 9| uint8_t *randomness_s = &randomness[0]; // contains secret data 33| 9| uint8_t *randomness_seedSE = &randomness[CRYPTO_BYTES]; // contains secret data ------------------ | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_shake_length_shared_secret | | ------------------ | | | | 87| 9|#define OQS_KEM_frodokem_1344_shake_length_shared_secret 32 | | ------------------ ------------------ 34| 9| uint8_t *randomness_z = &randomness[CRYPTO_BYTES + BYTES_SEED_SE]; ------------------ | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_shake_length_shared_secret | | ------------------ | | | | 87| 9|#define OQS_KEM_frodokem_1344_shake_length_shared_secret 32 | | ------------------ ------------------ uint8_t *randomness_z = &randomness[CRYPTO_BYTES + BYTES_SEED_SE]; ------------------ | | 21| 9|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_shake_length_shared_secret | | | | ------------------ | | | | | | 87| 9|#define OQS_KEM_frodokem_1344_shake_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ 35| 9| uint8_t shake_input_seedSE[1 + BYTES_SEED_SE]; // contains secret data 36| | 37| | // Generate the secret value s, the seed for S and E, and the seed for the seed for A. Add seed_A to the public key 38| 9| randombytes(randomness, CRYPTO_BYTES + BYTES_SEED_SE + BYTES_SEED_A); ------------------ | | 28| 9|#define randombytes OQS_randombytes ------------------ randombytes(randomness, CRYPTO_BYTES + BYTES_SEED_SE + BYTES_SEED_A); ------------------ | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_shake_length_shared_secret | | ------------------ | | | | 87| 9|#define OQS_KEM_frodokem_1344_shake_length_shared_secret 32 | | ------------------ ------------------ randombytes(randomness, CRYPTO_BYTES + BYTES_SEED_SE + BYTES_SEED_A); ------------------ | | 21| 9|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_shake_length_shared_secret | | | | ------------------ | | | | | | 87| 9|#define OQS_KEM_frodokem_1344_shake_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ randombytes(randomness, CRYPTO_BYTES + BYTES_SEED_SE + BYTES_SEED_A); ------------------ | | 18| 9|#define BYTES_SEED_A 16 ------------------ 39| 9| shake(pk_seedA, BYTES_SEED_A, randomness_z, BYTES_SEED_A); ------------------ | | 31| 9|#define shake OQS_SHA3_shake256 ------------------ shake(pk_seedA, BYTES_SEED_A, randomness_z, BYTES_SEED_A); ------------------ | | 18| 9|#define BYTES_SEED_A 16 ------------------ shake(pk_seedA, BYTES_SEED_A, randomness_z, BYTES_SEED_A); ------------------ | | 18| 9|#define BYTES_SEED_A 16 ------------------ 40| | 41| | // Generate S and E, and compute B = A*S + E. Generate A on-the-fly 42| 9| shake_input_seedSE[0] = 0x5F; 43| 9| memcpy(&shake_input_seedSE[1], randomness_seedSE, BYTES_SEED_SE); ------------------ | | 21| 9|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_shake_length_shared_secret | | | | ------------------ | | | | | | 87| 9|#define OQS_KEM_frodokem_1344_shake_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ 44| 9| shake((uint8_t*)S, 2*PARAMS_N*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + BYTES_SEED_SE); ------------------ | | 31| 9|#define shake OQS_SHA3_shake256 ------------------ shake((uint8_t*)S, 2*PARAMS_N*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + BYTES_SEED_SE); ------------------ | | 11| 9|#define PARAMS_N 1344 ------------------ shake((uint8_t*)S, 2*PARAMS_N*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + BYTES_SEED_SE); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ shake((uint8_t*)S, 2*PARAMS_N*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + BYTES_SEED_SE); ------------------ | | 21| 9|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_shake_length_shared_secret | | | | ------------------ | | | | | | 87| 9|#define OQS_KEM_frodokem_1344_shake_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ 45| 193k| for (size_t i = 0; i < 2 * PARAMS_N * PARAMS_NBAR; i++) { ------------------ | | 11| 193k|#define PARAMS_N 1344 ------------------ for (size_t i = 0; i < 2 * PARAMS_N * PARAMS_NBAR; i++) { ------------------ | | 12| 193k|#define PARAMS_NBAR 8 ------------------ | Branch (45:24): [True: 193k, False: 9] ------------------ 46| 193k| S[i] = LE_TO_UINT16(S[i]); ------------------ | | 34| 193k| #define LE_TO_UINT16(n) (n) ------------------ 47| 193k| } 48| 9| frodo_sample_n(S, PARAMS_N*PARAMS_NBAR); ------------------ | | 40| 9|#define frodo_sample_n oqs_kem_frodokem_1344_shake_sample_n ------------------ frodo_sample_n(S, PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 9|#define PARAMS_N 1344 ------------------ frodo_sample_n(S, PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ 49| 9| frodo_sample_n(E, PARAMS_N*PARAMS_NBAR); ------------------ | | 40| 9|#define frodo_sample_n oqs_kem_frodokem_1344_shake_sample_n ------------------ frodo_sample_n(E, PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 9|#define PARAMS_N 1344 ------------------ frodo_sample_n(E, PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ 50| 9| frodo_mul_add_as_plus_e(B, S, E, pk); ------------------ | | 46| 9|#define frodo_mul_add_as_plus_e oqs_kem_frodokem_1344_shake_mul_add_as_plus_e ------------------ 51| | 52| | // Encode the second part of the public key 53| 9| frodo_pack(pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, B, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 41| 9|#define frodo_pack oqs_kem_frodokem_1344_shake_pack ------------------ frodo_pack(pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, B, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 3| 9|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_frodokem_1344_shake_length_public_key | | ------------------ | | | | 84| 9|#define OQS_KEM_frodokem_1344_shake_length_public_key 21520 | | ------------------ ------------------ frodo_pack(pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, B, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 18| 9|#define BYTES_SEED_A 16 ------------------ frodo_pack(pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, B, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 11| 9|#define PARAMS_N 1344 ------------------ frodo_pack(pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, B, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ frodo_pack(pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, B, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 13| 9|#define PARAMS_LOGQ 16 ------------------ 54| | 55| | // Add s, pk and S to the secret key 56| 9| memcpy(sk_s, randomness_s, CRYPTO_BYTES); ------------------ | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_shake_length_shared_secret | | ------------------ | | | | 87| 9|#define OQS_KEM_frodokem_1344_shake_length_shared_secret 32 | | ------------------ ------------------ 57| 9| memcpy(sk_pk, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 3| 9|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_frodokem_1344_shake_length_public_key | | ------------------ | | | | 84| 9|#define OQS_KEM_frodokem_1344_shake_length_public_key 21520 | | ------------------ ------------------ 58| 96.7k| for (size_t i = 0; i < PARAMS_N * PARAMS_NBAR; i++) { ------------------ | | 11| 96.7k|#define PARAMS_N 1344 ------------------ for (size_t i = 0; i < PARAMS_N * PARAMS_NBAR; i++) { ------------------ | | 12| 96.7k|#define PARAMS_NBAR 8 ------------------ | Branch (58:24): [True: 96.7k, False: 9] ------------------ 59| 96.7k| S[i] = UINT16_TO_LE(S[i]); ------------------ | | 35| 96.7k| #define UINT16_TO_LE(n) (n) ------------------ 60| 96.7k| } 61| 9| memcpy(sk_S, S, 2*PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 9|#define PARAMS_N 1344 ------------------ memcpy(sk_S, S, 2*PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ 62| | 63| | // Add H(pk) to the secret key 64| 9| shake(sk_pkh, BYTES_PKHASH, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 31| 9|#define shake OQS_SHA3_shake256 ------------------ shake(sk_pkh, BYTES_PKHASH, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 22| 9|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_shake_length_shared_secret | | | | ------------------ | | | | | | 87| 9|#define OQS_KEM_frodokem_1344_shake_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ shake(sk_pkh, BYTES_PKHASH, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 3| 9|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_frodokem_1344_shake_length_public_key | | ------------------ | | | | 84| 9|#define OQS_KEM_frodokem_1344_shake_length_public_key 21520 | | ------------------ ------------------ 65| | 66| | // Cleanup: 67| 9| clear_bytes((uint8_t *)S, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 29| 9|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)S, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 9|#define PARAMS_N 1344 ------------------ clear_bytes((uint8_t *)S, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ 68| 9| clear_bytes((uint8_t *)E, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 29| 9|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)E, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 9|#define PARAMS_N 1344 ------------------ clear_bytes((uint8_t *)E, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ 69| 9| clear_bytes(randomness, CRYPTO_BYTES + BYTES_SEED_SE); ------------------ | | 29| 9|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(randomness, CRYPTO_BYTES + BYTES_SEED_SE); ------------------ | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_shake_length_shared_secret | | ------------------ | | | | 87| 9|#define OQS_KEM_frodokem_1344_shake_length_shared_secret 32 | | ------------------ ------------------ clear_bytes(randomness, CRYPTO_BYTES + BYTES_SEED_SE); ------------------ | | 21| 9|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_shake_length_shared_secret | | | | ------------------ | | | | | | 87| 9|#define OQS_KEM_frodokem_1344_shake_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ 70| 9| clear_bytes(shake_input_seedSE, 1 + BYTES_SEED_SE); ------------------ | | 29| 9|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(shake_input_seedSE, 1 + BYTES_SEED_SE); ------------------ | | 21| 9|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_shake_length_shared_secret | | | | ------------------ | | | | | | 87| 9|#define OQS_KEM_frodokem_1344_shake_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ 71| 9| return OQS_SUCCESS; 72| 9|} OQS_KEM_frodokem_1344_shake_encaps: 86| 9|{ // FrodoKEM's key encapsulation 87| | // Input: public key pk = pk_seedA||pk_b (BYTES_SEED_A + (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8 bytes) 88| | // Outputs: ciphertext ct = ct_c1||ct_c2||salt ( (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8 + (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8 + BYTES_SALT bytes) 89| | // shared key ss (CRYPTO_BYTES bytes) 90| 9| const uint8_t *pk_seedA = &pk[0]; 91| 9| const uint8_t *pk_b = &pk[BYTES_SEED_A]; ------------------ | | 18| 9|#define BYTES_SEED_A 16 ------------------ 92| 9| uint8_t *ct_c1 = &ct[0]; 93| 9| uint8_t *ct_c2 = &ct[(PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8]; ------------------ | | 13| 9|#define PARAMS_LOGQ 16 ------------------ uint8_t *ct_c2 = &ct[(PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8]; ------------------ | | 11| 9|#define PARAMS_N 1344 ------------------ uint8_t *ct_c2 = &ct[(PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8]; ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ 94| 9| uint16_t B[PARAMS_N*PARAMS_NBAR] = {0}; 95| 9| uint16_t V[PARAMS_NBAR*PARAMS_NBAR]= {0}; // contains secret data 96| 9| uint16_t C[PARAMS_NBAR*PARAMS_NBAR] = {0}; 97| 9| ALIGN_HEADER(32) uint16_t Bp[PARAMS_N*PARAMS_NBAR] ALIGN_FOOTER(32) = {0}; 98| 9| ALIGN_HEADER(32) uint16_t Sp[(2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR] ALIGN_FOOTER(32) = {0}; // contains secret data 99| 9| uint16_t *Ep = (uint16_t *)&Sp[PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 11| 9|#define PARAMS_N 1344 ------------------ uint16_t *Ep = (uint16_t *)&Sp[PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ 100| 9| uint16_t *Epp = (uint16_t *)&Sp[2*PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 11| 9|#define PARAMS_N 1344 ------------------ uint16_t *Epp = (uint16_t *)&Sp[2*PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ 101| 9| uint8_t G2in[BYTES_PKHASH + BYTES_MU + BYTES_SALT]; // contains secret data via mu 102| 9| uint8_t *pkh = &G2in[0]; 103| 9| uint8_t *mu = &G2in[BYTES_PKHASH]; // contains secret data ------------------ | | 22| 9|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_shake_length_shared_secret | | | | ------------------ | | | | | | 87| 9|#define OQS_KEM_frodokem_1344_shake_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ 104| 9| uint8_t *salt = &G2in[BYTES_PKHASH + BYTES_MU]; ------------------ | | 22| 9|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_shake_length_shared_secret | | | | ------------------ | | | | | | 87| 9|#define OQS_KEM_frodokem_1344_shake_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ uint8_t *salt = &G2in[BYTES_PKHASH + BYTES_MU]; ------------------ | | 19| 9|#define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 15| 9|#define PARAMS_EXTRACTED_BITS 4 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 9|#define PARAMS_NBAR 8 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 9|#define PARAMS_NBAR 8 | | ------------------ ------------------ 105| 9| uint8_t G2out[BYTES_SEED_SE + CRYPTO_BYTES]; // contains secret data 106| 9| uint8_t *seedSE = &G2out[0]; // contains secret data 107| 9| uint8_t *k = &G2out[BYTES_SEED_SE]; // contains secret data ------------------ | | 21| 9|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_shake_length_shared_secret | | | | ------------------ | | | | | | 87| 9|#define OQS_KEM_frodokem_1344_shake_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ 108| 9| uint8_t Fin[CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES]; // contains secret data via Fin_k 109| 9| uint8_t *Fin_ct = &Fin[0]; 110| 9| uint8_t *Fin_k = &Fin[CRYPTO_CIPHERTEXTBYTES]; // contains secret data ------------------ | | 5| 9|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_frodokem_1344_shake_length_ciphertext | | ------------------ | | | | 86| 9|#define OQS_KEM_frodokem_1344_shake_length_ciphertext 21696 | | ------------------ ------------------ 111| 9| uint8_t shake_input_seedSE[1 + BYTES_SEED_SE]; // contains secret data 112| | 113| | // pkh <- G_1(pk), generate random mu and salt, compute (seedSE || k) = G_2(pkh || mu || salt) 114| 9| shake(pkh, BYTES_PKHASH, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 31| 9|#define shake OQS_SHA3_shake256 ------------------ shake(pkh, BYTES_PKHASH, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 22| 9|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_shake_length_shared_secret | | | | ------------------ | | | | | | 87| 9|#define OQS_KEM_frodokem_1344_shake_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ shake(pkh, BYTES_PKHASH, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 3| 9|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_frodokem_1344_shake_length_public_key | | ------------------ | | | | 84| 9|#define OQS_KEM_frodokem_1344_shake_length_public_key 21520 | | ------------------ ------------------ 115| 9| randombytes(mu, BYTES_MU + BYTES_SALT); ------------------ | | 28| 9|#define randombytes OQS_randombytes ------------------ randombytes(mu, BYTES_MU + BYTES_SALT); ------------------ | | 19| 9|#define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 15| 9|#define PARAMS_EXTRACTED_BITS 4 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 9|#define PARAMS_NBAR 8 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 9|#define PARAMS_NBAR 8 | | ------------------ ------------------ randombytes(mu, BYTES_MU + BYTES_SALT); ------------------ | | 20| 9|#define BYTES_SALT (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_shake_length_shared_secret | | | | ------------------ | | | | | | 87| 9|#define OQS_KEM_frodokem_1344_shake_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ 116| 9| shake(G2out, BYTES_SEED_SE + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU + BYTES_SALT); ------------------ | | 31| 9|#define shake OQS_SHA3_shake256 ------------------ shake(G2out, BYTES_SEED_SE + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU + BYTES_SALT); ------------------ | | 21| 9|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_shake_length_shared_secret | | | | ------------------ | | | | | | 87| 9|#define OQS_KEM_frodokem_1344_shake_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ shake(G2out, BYTES_SEED_SE + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU + BYTES_SALT); ------------------ | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_shake_length_shared_secret | | ------------------ | | | | 87| 9|#define OQS_KEM_frodokem_1344_shake_length_shared_secret 32 | | ------------------ ------------------ shake(G2out, BYTES_SEED_SE + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU + BYTES_SALT); ------------------ | | 22| 9|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_shake_length_shared_secret | | | | ------------------ | | | | | | 87| 9|#define OQS_KEM_frodokem_1344_shake_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ shake(G2out, BYTES_SEED_SE + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU + BYTES_SALT); ------------------ | | 19| 9|#define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 15| 9|#define PARAMS_EXTRACTED_BITS 4 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 9|#define PARAMS_NBAR 8 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 9|#define PARAMS_NBAR 8 | | ------------------ ------------------ shake(G2out, BYTES_SEED_SE + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU + BYTES_SALT); ------------------ | | 20| 9|#define BYTES_SALT (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_shake_length_shared_secret | | | | ------------------ | | | | | | 87| 9|#define OQS_KEM_frodokem_1344_shake_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ 117| | 118| | // Generate Sp and Ep, and compute Bp = Sp*A + Ep. Generate A on-the-fly 119| 9| shake_input_seedSE[0] = 0x96; 120| 9| memcpy(&shake_input_seedSE[1], seedSE, BYTES_SEED_SE); ------------------ | | 21| 9|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_shake_length_shared_secret | | | | ------------------ | | | | | | 87| 9|#define OQS_KEM_frodokem_1344_shake_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ 121| 9| shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + BYTES_SEED_SE); ------------------ | | 31| 9|#define shake OQS_SHA3_shake256 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + BYTES_SEED_SE); ------------------ | | 11| 9|#define PARAMS_N 1344 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + BYTES_SEED_SE); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + BYTES_SEED_SE); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + BYTES_SEED_SE); ------------------ | | 21| 9|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_shake_length_shared_secret | | | | ------------------ | | | | | | 87| 9|#define OQS_KEM_frodokem_1344_shake_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ 122| 194k| for (size_t i = 0; i < (2 * PARAMS_N + PARAMS_NBAR) * PARAMS_NBAR; i++) { ------------------ | | 11| 194k|#define PARAMS_N 1344 ------------------ for (size_t i = 0; i < (2 * PARAMS_N + PARAMS_NBAR) * PARAMS_NBAR; i++) { ------------------ | | 12| 194k|#define PARAMS_NBAR 8 ------------------ for (size_t i = 0; i < (2 * PARAMS_N + PARAMS_NBAR) * PARAMS_NBAR; i++) { ------------------ | | 12| 194k|#define PARAMS_NBAR 8 ------------------ | Branch (122:24): [True: 194k, False: 9] ------------------ 123| 194k| Sp[i] = LE_TO_UINT16(Sp[i]); ------------------ | | 34| 194k| #define LE_TO_UINT16(n) (n) ------------------ 124| 194k| } 125| 9| frodo_sample_n(Sp, PARAMS_N*PARAMS_NBAR); ------------------ | | 40| 9|#define frodo_sample_n oqs_kem_frodokem_1344_shake_sample_n ------------------ frodo_sample_n(Sp, PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 9|#define PARAMS_N 1344 ------------------ frodo_sample_n(Sp, PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ 126| 9| frodo_sample_n(Ep, PARAMS_N*PARAMS_NBAR); ------------------ | | 40| 9|#define frodo_sample_n oqs_kem_frodokem_1344_shake_sample_n ------------------ frodo_sample_n(Ep, PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 9|#define PARAMS_N 1344 ------------------ frodo_sample_n(Ep, PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ 127| 9| frodo_mul_add_sa_plus_e(Bp, Sp, Ep, pk_seedA); ------------------ | | 49| 9|#define frodo_mul_add_sa_plus_e oqs_kem_frodokem_1344_shake_mul_add_sa_plus_e ------------------ 128| 9| frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 41| 9|#define frodo_pack oqs_kem_frodokem_1344_shake_pack ------------------ frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 13| 9|#define PARAMS_LOGQ 16 ------------------ frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 11| 9|#define PARAMS_N 1344 ------------------ frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 11| 9|#define PARAMS_N 1344 ------------------ frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 13| 9|#define PARAMS_LOGQ 16 ------------------ 129| | 130| | // Generate Epp, and compute V = Sp*B + Epp 131| 9| frodo_sample_n(Epp, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 40| 9|#define frodo_sample_n oqs_kem_frodokem_1344_shake_sample_n ------------------ frodo_sample_n(Epp, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ frodo_sample_n(Epp, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ 132| 9| frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 42| 9|#define frodo_unpack oqs_kem_frodokem_1344_shake_unpack ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 11| 9|#define PARAMS_N 1344 ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 3| 9|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_frodokem_1344_shake_length_public_key | | ------------------ | | | | 84| 9|#define OQS_KEM_frodokem_1344_shake_length_public_key 21520 | | ------------------ ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 18| 9|#define BYTES_SEED_A 16 ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 13| 9|#define PARAMS_LOGQ 16 ------------------ 133| 9| frodo_mul_add_sb_plus_e(V, B, Sp, Epp); ------------------ | | 52| 9|#define frodo_mul_add_sb_plus_e oqs_kem_frodokem_1344_shake_mul_add_sb_plus_e ------------------ 134| | 135| | // Encode mu, and compute C = V + enc(mu) (mod q) 136| 9| frodo_key_encode(C, (uint16_t*)mu); ------------------ | | 57| 9|#define frodo_key_encode oqs_kem_frodokem_1344_shake_key_encode ------------------ 137| 9| frodo_add(C, V, C); ------------------ | | 55| 9|#define frodo_add oqs_kem_frodokem_1344_shake_add ------------------ 138| 9| frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 41| 9|#define frodo_pack oqs_kem_frodokem_1344_shake_pack ------------------ frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 13| 9|#define PARAMS_LOGQ 16 ------------------ frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 13| 9|#define PARAMS_LOGQ 16 ------------------ 139| | 140| | // Append salt to ct and compute ss = F(ct_c1||ct_c2||salt||k) 141| 9| memcpy(&ct[CRYPTO_CIPHERTEXTBYTES - BYTES_SALT], salt, BYTES_SALT); ------------------ | | 5| 9|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_frodokem_1344_shake_length_ciphertext | | ------------------ | | | | 86| 9|#define OQS_KEM_frodokem_1344_shake_length_ciphertext 21696 | | ------------------ ------------------ memcpy(&ct[CRYPTO_CIPHERTEXTBYTES - BYTES_SALT], salt, BYTES_SALT); ------------------ | | 20| 9|#define BYTES_SALT (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_shake_length_shared_secret | | | | ------------------ | | | | | | 87| 9|#define OQS_KEM_frodokem_1344_shake_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ memcpy(&ct[CRYPTO_CIPHERTEXTBYTES - BYTES_SALT], salt, BYTES_SALT); ------------------ | | 20| 9|#define BYTES_SALT (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_shake_length_shared_secret | | | | ------------------ | | | | | | 87| 9|#define OQS_KEM_frodokem_1344_shake_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ 142| 9| memcpy(Fin_ct, ct, CRYPTO_CIPHERTEXTBYTES); ------------------ | | 5| 9|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_frodokem_1344_shake_length_ciphertext | | ------------------ | | | | 86| 9|#define OQS_KEM_frodokem_1344_shake_length_ciphertext 21696 | | ------------------ ------------------ 143| 9| memcpy(Fin_k, k, CRYPTO_BYTES); ------------------ | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_shake_length_shared_secret | | ------------------ | | | | 87| 9|#define OQS_KEM_frodokem_1344_shake_length_shared_secret 32 | | ------------------ ------------------ 144| 9| shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 31| 9|#define shake OQS_SHA3_shake256 ------------------ shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_shake_length_shared_secret | | ------------------ | | | | 87| 9|#define OQS_KEM_frodokem_1344_shake_length_shared_secret 32 | | ------------------ ------------------ shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 5| 9|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_frodokem_1344_shake_length_ciphertext | | ------------------ | | | | 86| 9|#define OQS_KEM_frodokem_1344_shake_length_ciphertext 21696 | | ------------------ ------------------ shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_shake_length_shared_secret | | ------------------ | | | | 87| 9|#define OQS_KEM_frodokem_1344_shake_length_shared_secret 32 | | ------------------ ------------------ 145| | 146| | // Cleanup: 147| 9| clear_bytes((uint8_t *)V, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 29| 9|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)V, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ clear_bytes((uint8_t *)V, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ 148| 9| clear_bytes((uint8_t *)Sp, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 29| 9|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)Sp, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 9|#define PARAMS_N 1344 ------------------ clear_bytes((uint8_t *)Sp, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ 149| 9| clear_bytes((uint8_t *)Ep, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 29| 9|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)Ep, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 9|#define PARAMS_N 1344 ------------------ clear_bytes((uint8_t *)Ep, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ 150| 9| clear_bytes((uint8_t *)Epp, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 29| 9|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)Epp, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ clear_bytes((uint8_t *)Epp, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ 151| 9| clear_bytes(mu, BYTES_MU); ------------------ | | 29| 9|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(mu, BYTES_MU); ------------------ | | 19| 9|#define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 15| 9|#define PARAMS_EXTRACTED_BITS 4 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 9|#define PARAMS_NBAR 8 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 9|#define PARAMS_NBAR 8 | | ------------------ ------------------ 152| 9| clear_bytes(G2out, BYTES_SEED_SE + CRYPTO_BYTES); ------------------ | | 29| 9|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(G2out, BYTES_SEED_SE + CRYPTO_BYTES); ------------------ | | 21| 9|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_shake_length_shared_secret | | | | ------------------ | | | | | | 87| 9|#define OQS_KEM_frodokem_1344_shake_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ clear_bytes(G2out, BYTES_SEED_SE + CRYPTO_BYTES); ------------------ | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_shake_length_shared_secret | | ------------------ | | | | 87| 9|#define OQS_KEM_frodokem_1344_shake_length_shared_secret 32 | | ------------------ ------------------ 153| 9| clear_bytes(Fin_k, CRYPTO_BYTES); ------------------ | | 29| 9|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(Fin_k, CRYPTO_BYTES); ------------------ | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_shake_length_shared_secret | | ------------------ | | | | 87| 9|#define OQS_KEM_frodokem_1344_shake_length_shared_secret 32 | | ------------------ ------------------ 154| 9| clear_bytes(shake_input_seedSE, 1 + BYTES_SEED_SE); ------------------ | | 29| 9|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(shake_input_seedSE, 1 + BYTES_SEED_SE); ------------------ | | 21| 9|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_shake_length_shared_secret | | | | ------------------ | | | | | | 87| 9|#define OQS_KEM_frodokem_1344_shake_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ 155| 9| return OQS_SUCCESS; 156| 9|} OQS_KEM_frodokem_1344_shake_decaps: 160| 9|{ // FrodoKEM's key decapsulation 161| | // Inputs: ciphertext ct = ct_c1||ct_c2||salt ( (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8 + (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8 + BYTES_SALT bytes) 162| | // secret key sk = sk_s||pk_seedA||pk_b||sk_S||sk_pkh (CRYPTO_BYTES + BYTES_SEED_A + (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8 + 2*PARAMS_N*PARAMS_NBAR + BYTES_PKHASH bytes) 163| | // Output: shared key ss (CRYPTO_BYTES bytes) 164| 9| uint16_t B[PARAMS_N*PARAMS_NBAR] = {0}; 165| 9| uint16_t Bp[PARAMS_N*PARAMS_NBAR] = {0}; 166| 9| uint16_t W[PARAMS_NBAR*PARAMS_NBAR] = {0}; // contains secret data 167| 9| uint16_t C[PARAMS_NBAR*PARAMS_NBAR] = {0}; 168| 9| uint16_t CC[PARAMS_NBAR*PARAMS_NBAR] = {0}; 169| 9| ALIGN_HEADER(32) uint16_t BBp[PARAMS_N*PARAMS_NBAR] ALIGN_FOOTER(32) = {0}; 170| 9| ALIGN_HEADER(32) uint16_t Sp[(2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR] ALIGN_FOOTER(32) = {0}; // contains secret data 171| 9| uint16_t *Ep = (uint16_t *)&Sp[PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 11| 9|#define PARAMS_N 1344 ------------------ uint16_t *Ep = (uint16_t *)&Sp[PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ 172| 9| uint16_t *Epp = (uint16_t *)&Sp[2*PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 11| 9|#define PARAMS_N 1344 ------------------ uint16_t *Epp = (uint16_t *)&Sp[2*PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ 173| 9| const uint8_t *ct_c1 = &ct[0]; 174| 9| const uint8_t *ct_c2 = &ct[(PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8]; ------------------ | | 13| 9|#define PARAMS_LOGQ 16 ------------------ const uint8_t *ct_c2 = &ct[(PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8]; ------------------ | | 11| 9|#define PARAMS_N 1344 ------------------ const uint8_t *ct_c2 = &ct[(PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8]; ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ 175| 9| const uint8_t *salt = &ct[CRYPTO_CIPHERTEXTBYTES - BYTES_SALT]; ------------------ | | 5| 9|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_frodokem_1344_shake_length_ciphertext | | ------------------ | | | | 86| 9|#define OQS_KEM_frodokem_1344_shake_length_ciphertext 21696 | | ------------------ ------------------ const uint8_t *salt = &ct[CRYPTO_CIPHERTEXTBYTES - BYTES_SALT]; ------------------ | | 20| 9|#define BYTES_SALT (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_shake_length_shared_secret | | | | ------------------ | | | | | | 87| 9|#define OQS_KEM_frodokem_1344_shake_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ 176| 9| const uint8_t *sk_s = &sk[0]; 177| 9| const uint8_t *sk_pk = &sk[CRYPTO_BYTES]; ------------------ | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_shake_length_shared_secret | | ------------------ | | | | 87| 9|#define OQS_KEM_frodokem_1344_shake_length_shared_secret 32 | | ------------------ ------------------ 178| 9| const uint16_t *sk_S = (uint16_t *) &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES]; ------------------ | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_shake_length_shared_secret | | ------------------ | | | | 87| 9|#define OQS_KEM_frodokem_1344_shake_length_shared_secret 32 | | ------------------ ------------------ const uint16_t *sk_S = (uint16_t *) &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES]; ------------------ | | 3| 9|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_frodokem_1344_shake_length_public_key | | ------------------ | | | | 84| 9|#define OQS_KEM_frodokem_1344_shake_length_public_key 21520 | | ------------------ ------------------ 179| 9| uint16_t S[PARAMS_N * PARAMS_NBAR]; // contains secret data 180| 9| const uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_shake_length_shared_secret | | ------------------ | | | | 87| 9|#define OQS_KEM_frodokem_1344_shake_length_shared_secret 32 | | ------------------ ------------------ const uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 3| 9|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_frodokem_1344_shake_length_public_key | | ------------------ | | | | 84| 9|#define OQS_KEM_frodokem_1344_shake_length_public_key 21520 | | ------------------ ------------------ const uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 11| 9|#define PARAMS_N 1344 ------------------ const uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ 181| 9| const uint8_t *pk_seedA = &sk_pk[0]; 182| 9| const uint8_t *pk_b = &sk_pk[BYTES_SEED_A]; ------------------ | | 18| 9|#define BYTES_SEED_A 16 ------------------ 183| 9| uint8_t G2in[BYTES_PKHASH + BYTES_MU + BYTES_SALT]; // contains secret data via muprime 184| 9| uint8_t *pkh = &G2in[0]; 185| 9| uint8_t *muprime = &G2in[BYTES_PKHASH]; // contains secret data ------------------ | | 22| 9|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_shake_length_shared_secret | | | | ------------------ | | | | | | 87| 9|#define OQS_KEM_frodokem_1344_shake_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ 186| 9| uint8_t *G2in_salt = &G2in[BYTES_PKHASH + BYTES_MU]; ------------------ | | 22| 9|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_shake_length_shared_secret | | | | ------------------ | | | | | | 87| 9|#define OQS_KEM_frodokem_1344_shake_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ uint8_t *G2in_salt = &G2in[BYTES_PKHASH + BYTES_MU]; ------------------ | | 19| 9|#define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 15| 9|#define PARAMS_EXTRACTED_BITS 4 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 9|#define PARAMS_NBAR 8 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 9|#define PARAMS_NBAR 8 | | ------------------ ------------------ 187| 9| uint8_t G2out[BYTES_SEED_SE + CRYPTO_BYTES]; // contains secret data 188| 9| uint8_t *seedSEprime = &G2out[0]; // contains secret data 189| 9| uint8_t *kprime = &G2out[BYTES_SEED_SE]; // contains secret data ------------------ | | 21| 9|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_shake_length_shared_secret | | | | ------------------ | | | | | | 87| 9|#define OQS_KEM_frodokem_1344_shake_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ 190| 9| uint8_t Fin[CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES]; // contains secret data via Fin_k 191| 9| uint8_t *Fin_ct = &Fin[0]; 192| 9| uint8_t *Fin_k = &Fin[CRYPTO_CIPHERTEXTBYTES]; // contains secret data ------------------ | | 5| 9|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_frodokem_1344_shake_length_ciphertext | | ------------------ | | | | 86| 9|#define OQS_KEM_frodokem_1344_shake_length_ciphertext 21696 | | ------------------ ------------------ 193| 9| uint8_t shake_input_seedSEprime[1 + BYTES_SEED_SE]; // contains secret data 194| | 195| | 196| 96.7k| for (size_t i = 0; i < PARAMS_N * PARAMS_NBAR; i++) { ------------------ | | 11| 96.7k|#define PARAMS_N 1344 ------------------ for (size_t i = 0; i < PARAMS_N * PARAMS_NBAR; i++) { ------------------ | | 12| 96.7k|#define PARAMS_NBAR 8 ------------------ | Branch (196:24): [True: 96.7k, False: 9] ------------------ 197| 96.7k| S[i] = LE_TO_UINT16(sk_S[i]); ------------------ | | 34| 96.7k| #define LE_TO_UINT16(n) (n) ------------------ 198| 96.7k| } 199| | 200| | // Compute W = C - Bp*S (mod q), and decode the randomness mu 201| 9| frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 42| 9|#define frodo_unpack oqs_kem_frodokem_1344_shake_unpack ------------------ frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 11| 9|#define PARAMS_N 1344 ------------------ frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 13| 9|#define PARAMS_LOGQ 16 ------------------ frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 11| 9|#define PARAMS_N 1344 ------------------ frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 13| 9|#define PARAMS_LOGQ 16 ------------------ 202| 9| frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 42| 9|#define frodo_unpack oqs_kem_frodokem_1344_shake_unpack ------------------ frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 13| 9|#define PARAMS_LOGQ 16 ------------------ frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 13| 9|#define PARAMS_LOGQ 16 ------------------ 203| 9| frodo_mul_bs(W, Bp, S); ------------------ | | 53| 9|#define frodo_mul_bs oqs_kem_frodokem_1344_shake_mul_bs ------------------ 204| 9| frodo_sub(W, C, W); ------------------ | | 56| 9|#define frodo_sub oqs_kem_frodokem_1344_shake_sub ------------------ 205| 9| frodo_key_decode((uint16_t*)muprime, W); ------------------ | | 58| 9|#define frodo_key_decode oqs_kem_frodokem_1344_shake_key_decode ------------------ 206| | 207| | // Generate (seedSE' || k') = G_2(pkh || mu' || salt) 208| 9| memcpy(pkh, sk_pkh, BYTES_PKHASH); ------------------ | | 22| 9|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_shake_length_shared_secret | | | | ------------------ | | | | | | 87| 9|#define OQS_KEM_frodokem_1344_shake_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ 209| 9| memcpy(G2in_salt, salt, BYTES_SALT); ------------------ | | 20| 9|#define BYTES_SALT (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_shake_length_shared_secret | | | | ------------------ | | | | | | 87| 9|#define OQS_KEM_frodokem_1344_shake_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ 210| 9| shake(G2out, BYTES_SEED_SE + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU + BYTES_SALT); ------------------ | | 31| 9|#define shake OQS_SHA3_shake256 ------------------ shake(G2out, BYTES_SEED_SE + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU + BYTES_SALT); ------------------ | | 21| 9|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_shake_length_shared_secret | | | | ------------------ | | | | | | 87| 9|#define OQS_KEM_frodokem_1344_shake_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ shake(G2out, BYTES_SEED_SE + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU + BYTES_SALT); ------------------ | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_shake_length_shared_secret | | ------------------ | | | | 87| 9|#define OQS_KEM_frodokem_1344_shake_length_shared_secret 32 | | ------------------ ------------------ shake(G2out, BYTES_SEED_SE + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU + BYTES_SALT); ------------------ | | 22| 9|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_shake_length_shared_secret | | | | ------------------ | | | | | | 87| 9|#define OQS_KEM_frodokem_1344_shake_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ shake(G2out, BYTES_SEED_SE + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU + BYTES_SALT); ------------------ | | 19| 9|#define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 15| 9|#define PARAMS_EXTRACTED_BITS 4 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 9|#define PARAMS_NBAR 8 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 9|#define PARAMS_NBAR 8 | | ------------------ ------------------ shake(G2out, BYTES_SEED_SE + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU + BYTES_SALT); ------------------ | | 20| 9|#define BYTES_SALT (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_shake_length_shared_secret | | | | ------------------ | | | | | | 87| 9|#define OQS_KEM_frodokem_1344_shake_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ 211| | 212| | // Generate Sp and Ep, and compute BBp = Sp*A + Ep. Generate A on-the-fly 213| 9| shake_input_seedSEprime[0] = 0x96; 214| 9| memcpy(&shake_input_seedSEprime[1], seedSEprime, BYTES_SEED_SE); ------------------ | | 21| 9|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_shake_length_shared_secret | | | | ------------------ | | | | | | 87| 9|#define OQS_KEM_frodokem_1344_shake_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ 215| 9| shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSEprime, 1 + BYTES_SEED_SE); ------------------ | | 31| 9|#define shake OQS_SHA3_shake256 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSEprime, 1 + BYTES_SEED_SE); ------------------ | | 11| 9|#define PARAMS_N 1344 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSEprime, 1 + BYTES_SEED_SE); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSEprime, 1 + BYTES_SEED_SE); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSEprime, 1 + BYTES_SEED_SE); ------------------ | | 21| 9|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_shake_length_shared_secret | | | | ------------------ | | | | | | 87| 9|#define OQS_KEM_frodokem_1344_shake_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ 216| 194k| for (size_t i = 0; i < (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR; i++) { ------------------ | | 11| 194k|#define PARAMS_N 1344 ------------------ for (size_t i = 0; i < (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR; i++) { ------------------ | | 12| 194k|#define PARAMS_NBAR 8 ------------------ for (size_t i = 0; i < (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR; i++) { ------------------ | | 12| 194k|#define PARAMS_NBAR 8 ------------------ | Branch (216:24): [True: 194k, False: 9] ------------------ 217| 194k| Sp[i] = LE_TO_UINT16(Sp[i]); ------------------ | | 34| 194k| #define LE_TO_UINT16(n) (n) ------------------ 218| 194k| } 219| 9| frodo_sample_n(Sp, PARAMS_N*PARAMS_NBAR); ------------------ | | 40| 9|#define frodo_sample_n oqs_kem_frodokem_1344_shake_sample_n ------------------ frodo_sample_n(Sp, PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 9|#define PARAMS_N 1344 ------------------ frodo_sample_n(Sp, PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ 220| 9| frodo_sample_n(Ep, PARAMS_N*PARAMS_NBAR); ------------------ | | 40| 9|#define frodo_sample_n oqs_kem_frodokem_1344_shake_sample_n ------------------ frodo_sample_n(Ep, PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 9|#define PARAMS_N 1344 ------------------ frodo_sample_n(Ep, PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ 221| 9| frodo_mul_add_sa_plus_e(BBp, Sp, Ep, pk_seedA); ------------------ | | 49| 9|#define frodo_mul_add_sa_plus_e oqs_kem_frodokem_1344_shake_mul_add_sa_plus_e ------------------ 222| | 223| | // Generate Epp, and compute W = Sp*B + Epp 224| 9| frodo_sample_n(Epp, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 40| 9|#define frodo_sample_n oqs_kem_frodokem_1344_shake_sample_n ------------------ frodo_sample_n(Epp, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ frodo_sample_n(Epp, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ 225| 9| frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 42| 9|#define frodo_unpack oqs_kem_frodokem_1344_shake_unpack ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 11| 9|#define PARAMS_N 1344 ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 3| 9|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_frodokem_1344_shake_length_public_key | | ------------------ | | | | 84| 9|#define OQS_KEM_frodokem_1344_shake_length_public_key 21520 | | ------------------ ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 18| 9|#define BYTES_SEED_A 16 ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 13| 9|#define PARAMS_LOGQ 16 ------------------ 226| 9| frodo_mul_add_sb_plus_e(W, B, Sp, Epp); ------------------ | | 52| 9|#define frodo_mul_add_sb_plus_e oqs_kem_frodokem_1344_shake_mul_add_sb_plus_e ------------------ 227| | 228| | // Encode mu, and compute CC = W + enc(mu') (mod q) 229| 9| frodo_key_encode(CC, (uint16_t*)muprime); ------------------ | | 57| 9|#define frodo_key_encode oqs_kem_frodokem_1344_shake_key_encode ------------------ 230| 9| frodo_add(CC, W, CC); ------------------ | | 55| 9|#define frodo_add oqs_kem_frodokem_1344_shake_add ------------------ 231| | 232| | // Prepare input to F 233| 9| memcpy(Fin_ct, ct, CRYPTO_CIPHERTEXTBYTES); ------------------ | | 5| 9|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_frodokem_1344_shake_length_ciphertext | | ------------------ | | | | 86| 9|#define OQS_KEM_frodokem_1344_shake_length_ciphertext 21696 | | ------------------ ------------------ 234| | 235| | // Reducing BBp modulo q 236| 96.7k| for (int i = 0; i < PARAMS_N*PARAMS_NBAR; i++) BBp[i] = BBp[i] & ((1 << PARAMS_LOGQ)-1); ------------------ | | 11| 96.7k|#define PARAMS_N 1344 ------------------ for (int i = 0; i < PARAMS_N*PARAMS_NBAR; i++) BBp[i] = BBp[i] & ((1 << PARAMS_LOGQ)-1); ------------------ | | 12| 96.7k|#define PARAMS_NBAR 8 ------------------ for (int i = 0; i < PARAMS_N*PARAMS_NBAR; i++) BBp[i] = BBp[i] & ((1 << PARAMS_LOGQ)-1); ------------------ | | 13| 96.7k|#define PARAMS_LOGQ 16 ------------------ | Branch (236:21): [True: 96.7k, False: 9] ------------------ 237| | 238| | // Needs to avoid branching on secret data using constant-time implementation. 239| 9| int8_t selector = ct_verify(Bp, BBp, PARAMS_N*PARAMS_NBAR) | ct_verify(C, CC, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 44| 9|#define ct_verify oqs_kem_frodokem_1344_shake_ct_verify ------------------ int8_t selector = ct_verify(Bp, BBp, PARAMS_N*PARAMS_NBAR) | ct_verify(C, CC, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 11| 9|#define PARAMS_N 1344 ------------------ int8_t selector = ct_verify(Bp, BBp, PARAMS_N*PARAMS_NBAR) | ct_verify(C, CC, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ int8_t selector = ct_verify(Bp, BBp, PARAMS_N*PARAMS_NBAR) | ct_verify(C, CC, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 44| 9|#define ct_verify oqs_kem_frodokem_1344_shake_ct_verify ------------------ int8_t selector = ct_verify(Bp, BBp, PARAMS_N*PARAMS_NBAR) | ct_verify(C, CC, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ int8_t selector = ct_verify(Bp, BBp, PARAMS_N*PARAMS_NBAR) | ct_verify(C, CC, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ 240| | // If (selector == 0) then load k' to do ss = F(ct || k'), else if (selector == -1) load s to do ss = F(ct || s) 241| 9| ct_select((uint8_t*)Fin_k, (uint8_t*)kprime, (uint8_t*)sk_s, CRYPTO_BYTES, selector); ------------------ | | 43| 9|#define ct_select oqs_kem_frodokem_1344_shake_ct_select ------------------ ct_select((uint8_t*)Fin_k, (uint8_t*)kprime, (uint8_t*)sk_s, CRYPTO_BYTES, selector); ------------------ | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_shake_length_shared_secret | | ------------------ | | | | 87| 9|#define OQS_KEM_frodokem_1344_shake_length_shared_secret 32 | | ------------------ ------------------ 242| 9| shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 31| 9|#define shake OQS_SHA3_shake256 ------------------ shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_shake_length_shared_secret | | ------------------ | | | | 87| 9|#define OQS_KEM_frodokem_1344_shake_length_shared_secret 32 | | ------------------ ------------------ shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 5| 9|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_frodokem_1344_shake_length_ciphertext | | ------------------ | | | | 86| 9|#define OQS_KEM_frodokem_1344_shake_length_ciphertext 21696 | | ------------------ ------------------ shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_shake_length_shared_secret | | ------------------ | | | | 87| 9|#define OQS_KEM_frodokem_1344_shake_length_shared_secret 32 | | ------------------ ------------------ 243| | 244| | // Cleanup: 245| 9| clear_bytes((uint8_t *)W, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 29| 9|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)W, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ clear_bytes((uint8_t *)W, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ 246| 9| clear_bytes((uint8_t *)Sp, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 29| 9|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)Sp, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 9|#define PARAMS_N 1344 ------------------ clear_bytes((uint8_t *)Sp, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ 247| 9| clear_bytes((uint8_t *)S, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 29| 9|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)S, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 9|#define PARAMS_N 1344 ------------------ clear_bytes((uint8_t *)S, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ 248| 9| clear_bytes((uint8_t *)Ep, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 29| 9|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)Ep, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 9|#define PARAMS_N 1344 ------------------ clear_bytes((uint8_t *)Ep, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ 249| 9| clear_bytes((uint8_t *)Epp, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 29| 9|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)Epp, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ clear_bytes((uint8_t *)Epp, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ 250| 9| clear_bytes(muprime, BYTES_MU); ------------------ | | 29| 9|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(muprime, BYTES_MU); ------------------ | | 19| 9|#define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 15| 9|#define PARAMS_EXTRACTED_BITS 4 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 9|#define PARAMS_NBAR 8 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 9|#define PARAMS_NBAR 8 | | ------------------ ------------------ 251| 9| clear_bytes(G2out, BYTES_SEED_SE + CRYPTO_BYTES); ------------------ | | 29| 9|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(G2out, BYTES_SEED_SE + CRYPTO_BYTES); ------------------ | | 21| 9|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_shake_length_shared_secret | | | | ------------------ | | | | | | 87| 9|#define OQS_KEM_frodokem_1344_shake_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ clear_bytes(G2out, BYTES_SEED_SE + CRYPTO_BYTES); ------------------ | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_shake_length_shared_secret | | ------------------ | | | | 87| 9|#define OQS_KEM_frodokem_1344_shake_length_shared_secret 32 | | ------------------ ------------------ 252| 9| clear_bytes(Fin_k, CRYPTO_BYTES); ------------------ | | 29| 9|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(Fin_k, CRYPTO_BYTES); ------------------ | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_shake_length_shared_secret | | ------------------ | | | | 87| 9|#define OQS_KEM_frodokem_1344_shake_length_shared_secret 32 | | ------------------ ------------------ 253| 9| clear_bytes(shake_input_seedSEprime, 1 + BYTES_SEED_SE); ------------------ | | 29| 9|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(shake_input_seedSEprime, 1 + BYTES_SEED_SE); ------------------ | | 21| 9|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_shake_length_shared_secret | | | | ------------------ | | | | | | 87| 9|#define OQS_KEM_frodokem_1344_shake_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ 254| 9| return OQS_SUCCESS; 255| 9|} oqs_kem_frodokem_640_aes_mul_add_sa_plus_e_avx2: 5| 4|{ // Generate-and-multiply: generate matrix A (N x N) column-wise, multiply by s' on the left. 6| | // Inputs: s', e' (N_BAR x N) 7| | // Output: out = s'*A + e' (N_BAR x N) 8| 4| int i, j, kk; 9| | 10| 10.2k| for (i = 0; i < (PARAMS_N*PARAMS_NBAR); i += 2) { ------------------ | | 11| 10.2k|#define PARAMS_N 640 ------------------ for (i = 0; i < (PARAMS_N*PARAMS_NBAR); i += 2) { ------------------ | | 12| 10.2k|#define PARAMS_NBAR 8 ------------------ | Branch (10:17): [True: 10.2k, False: 4] ------------------ 11| 10.2k| *((uint32_t*)&out[i]) = *((uint32_t*)&e[i]); 12| 10.2k| } 13| | 14| 4| int k; 15| 4| uint16_t a_cols[PARAMS_N*PARAMS_STRIPE_STEP] = {0}; 16| 4| ALIGN_HEADER(32) uint16_t a_cols_t[PARAMS_N*PARAMS_STRIPE_STEP] ALIGN_FOOTER(32) = {0}; 17| 4| uint16_t a_cols_temp[PARAMS_N*PARAMS_STRIPE_STEP] = {0}; 18| 4| uint8_t *aes_key_schedule; 19| 4| OQS_AES128_ECB_load_schedule(seed_A, (void **) &aes_key_schedule); 20| | 21| 2.56k| for (i = 0, j = 0; i < PARAMS_N; i++, j += PARAMS_STRIPE_STEP) { ------------------ | | 11| 2.56k|#define PARAMS_N 640 ------------------ for (i = 0, j = 0; i < PARAMS_N; i++, j += PARAMS_STRIPE_STEP) { ------------------ | | 16| 2.56k|#define PARAMS_STRIPE_STEP 8 ------------------ | Branch (21:24): [True: 2.56k, False: 4] ------------------ 22| 2.56k| a_cols_temp[j] = UINT16_TO_LE(i); // Loading values in the little-endian order ------------------ | | 35| 2.56k| #define UINT16_TO_LE(n) (n) ------------------ 23| 2.56k| } 24| | 25| 324| for (kk = 0; kk < PARAMS_N; kk += PARAMS_STRIPE_STEP) { // Go through A's columns, 8 (== PARAMS_STRIPE_STEP) columns at a time. ------------------ | | 11| 324|#define PARAMS_N 640 ------------------ for (kk = 0; kk < PARAMS_N; kk += PARAMS_STRIPE_STEP) { // Go through A's columns, 8 (== PARAMS_STRIPE_STEP) columns at a time. ------------------ | | 16| 320|#define PARAMS_STRIPE_STEP 8 ------------------ | Branch (25:18): [True: 320, False: 4] ------------------ 26| 205k| for (i = 0; i < (PARAMS_N*PARAMS_STRIPE_STEP); i += PARAMS_STRIPE_STEP) { ------------------ | | 11| 205k|#define PARAMS_N 640 ------------------ for (i = 0; i < (PARAMS_N*PARAMS_STRIPE_STEP); i += PARAMS_STRIPE_STEP) { ------------------ | | 16| 205k|#define PARAMS_STRIPE_STEP 8 ------------------ for (i = 0; i < (PARAMS_N*PARAMS_STRIPE_STEP); i += PARAMS_STRIPE_STEP) { ------------------ | | 16| 204k|#define PARAMS_STRIPE_STEP 8 ------------------ | Branch (26:21): [True: 204k, False: 320] ------------------ 27| 204k| a_cols_temp[i + 1] = UINT16_TO_LE(kk); // Loading values in the little-endian order ------------------ | | 35| 204k| #define UINT16_TO_LE(n) (n) ------------------ 28| 204k| } 29| | 30| 320| OQS_AES128_ECB_enc_sch((uint8_t*)a_cols_temp, PARAMS_N*PARAMS_STRIPE_STEP*sizeof(int16_t), aes_key_schedule, (uint8_t*)a_cols); ------------------ | | 11| 320|#define PARAMS_N 640 ------------------ OQS_AES128_ECB_enc_sch((uint8_t*)a_cols_temp, PARAMS_N*PARAMS_STRIPE_STEP*sizeof(int16_t), aes_key_schedule, (uint8_t*)a_cols); ------------------ | | 16| 320|#define PARAMS_STRIPE_STEP 8 ------------------ 31| | 32| 205k| for (i = 0; i < PARAMS_N; i++) { // Transpose a_cols to have access to it in the column-major order. ------------------ | | 11| 205k|#define PARAMS_N 640 ------------------ | Branch (32:21): [True: 204k, False: 320] ------------------ 33| 1.84M| for (k = 0; k < PARAMS_STRIPE_STEP; k++) { ------------------ | | 16| 1.84M|#define PARAMS_STRIPE_STEP 8 ------------------ | Branch (33:25): [True: 1.63M, False: 204k] ------------------ 34| 1.63M| a_cols_t[k*PARAMS_N + i] = LE_TO_UINT16(a_cols[i*PARAMS_STRIPE_STEP + k]); ------------------ | | 11| 1.63M|#define PARAMS_N 640 ------------------ a_cols_t[k*PARAMS_N + i] = LE_TO_UINT16(a_cols[i*PARAMS_STRIPE_STEP + k]); ------------------ | | 34| 1.63M| #define LE_TO_UINT16(n) (n) ------------------ 35| 1.63M| } 36| 204k| } 37| | 38| 2.88k| for (i = 0; i < PARAMS_NBAR; i++) { ------------------ | | 12| 2.88k|#define PARAMS_NBAR 8 ------------------ | Branch (38:21): [True: 2.56k, False: 320] ------------------ 39| 7.68k| for (k = 0; k < PARAMS_STRIPE_STEP; k += PARAMS_PARALLEL) { ------------------ | | 16| 7.68k|#define PARAMS_STRIPE_STEP 8 ------------------ for (k = 0; k < PARAMS_STRIPE_STEP; k += PARAMS_PARALLEL) { ------------------ | | 17| 5.12k|#define PARAMS_PARALLEL 4 ------------------ | Branch (39:25): [True: 5.12k, False: 2.56k] ------------------ 40| 5.12k| ALIGN_HEADER(32) uint32_t sum[8 * PARAMS_PARALLEL] ALIGN_FOOTER(32); 41| 5.12k| __m256i a[PARAMS_PARALLEL], b, acc[PARAMS_PARALLEL]; 42| 5.12k| acc[0] = _mm256_setzero_si256(); 43| 5.12k| acc[1] = _mm256_setzero_si256(); 44| 5.12k| acc[2] = _mm256_setzero_si256(); 45| 5.12k| acc[3] = _mm256_setzero_si256(); 46| 209k| for (j = 0; j < PARAMS_N; j += 16) { // Matrix-vector multiplication ------------------ | | 11| 209k|#define PARAMS_N 640 ------------------ | Branch (46:29): [True: 204k, False: 5.12k] ------------------ 47| 204k| b = _mm256_load_si256((__m256i*)&s[i*PARAMS_N + j]); ------------------ | | 11| 204k|#define PARAMS_N 640 ------------------ 48| 204k| a[0] = _mm256_load_si256((__m256i*)&a_cols_t[(k+0)*PARAMS_N + j]); ------------------ | | 11| 204k|#define PARAMS_N 640 ------------------ 49| 204k| a[0] = _mm256_madd_epi16(a[0], b); 50| 204k| acc[0] = _mm256_add_epi16(a[0], acc[0]); 51| 204k| a[1] = _mm256_load_si256((__m256i*)&a_cols_t[(k+1)*PARAMS_N + j]); ------------------ | | 11| 204k|#define PARAMS_N 640 ------------------ 52| 204k| a[1] = _mm256_madd_epi16(a[1], b); 53| 204k| acc[1] = _mm256_add_epi16(a[1], acc[1]); 54| 204k| a[2] = _mm256_load_si256((__m256i*)&a_cols_t[(k+2)*PARAMS_N + j]); ------------------ | | 11| 204k|#define PARAMS_N 640 ------------------ 55| 204k| a[2] = _mm256_madd_epi16(a[2], b); 56| 204k| acc[2] = _mm256_add_epi16(a[2], acc[2]); 57| 204k| a[3] = _mm256_load_si256((__m256i*)&a_cols_t[(k+3)*PARAMS_N + j]); ------------------ | | 11| 204k|#define PARAMS_N 640 ------------------ 58| 204k| a[3] = _mm256_madd_epi16(a[3], b); 59| 204k| acc[3] = _mm256_add_epi16(a[3], acc[3]); 60| 204k| } 61| 5.12k| _mm256_store_si256((__m256i*)(sum + (8*0)), acc[0]); 62| 5.12k| out[i*PARAMS_N + kk + k + 0] += sum[8*0 + 0] + sum[8*0 + 1] + sum[8*0 + 2] + sum[8*0 + 3] + sum[8*0 + 4] + sum[8*0 + 5] + sum[8*0 + 6] + sum[8*0 + 7]; ------------------ | | 11| 5.12k|#define PARAMS_N 640 ------------------ 63| 5.12k| _mm256_store_si256((__m256i*)(sum + (8*1)), acc[1]); 64| 5.12k| out[i*PARAMS_N + kk + k + 1] += sum[8*1 + 0] + sum[8*1 + 1] + sum[8*1 + 2] + sum[8*1 + 3] + sum[8*1 + 4] + sum[8*1 + 5] + sum[8*1 + 6] + sum[8*1 + 7]; ------------------ | | 11| 5.12k|#define PARAMS_N 640 ------------------ 65| 5.12k| _mm256_store_si256((__m256i*)(sum + (8*2)), acc[2]); 66| 5.12k| out[i*PARAMS_N + kk + k + 2] += sum[8*2 + 0] + sum[8*2 + 1] + sum[8*2 + 2] + sum[8*2 + 3] + sum[8*2 + 4] + sum[8*2 + 5] + sum[8*2 + 6] + sum[8*2 + 7]; ------------------ | | 11| 5.12k|#define PARAMS_N 640 ------------------ 67| 5.12k| _mm256_store_si256((__m256i*)(sum + (8*3)), acc[3]); 68| 5.12k| out[i*PARAMS_N + kk + k + 3] += sum[8*3 + 0] + sum[8*3 + 1] + sum[8*3 + 2] + sum[8*3 + 3] + sum[8*3 + 4] + sum[8*3 + 5] + sum[8*3 + 6] + sum[8*3 + 7]; ------------------ | | 11| 5.12k|#define PARAMS_N 640 ------------------ 69| 5.12k| } 70| 2.56k| } 71| 320| } 72| 4| OQS_AES128_free_schedule(aes_key_schedule); 73| 4| return 1; 74| 4|} oqs_kem_frodokem_976_aes_mul_add_sa_plus_e_avx2: 5| 30|{ // Generate-and-multiply: generate matrix A (N x N) column-wise, multiply by s' on the left. 6| | // Inputs: s', e' (N_BAR x N) 7| | // Output: out = s'*A + e' (N_BAR x N) 8| 30| int i, j, kk; 9| | 10| 117k| for (i = 0; i < (PARAMS_N*PARAMS_NBAR); i += 2) { ------------------ | | 11| 117k|#define PARAMS_N 976 ------------------ for (i = 0; i < (PARAMS_N*PARAMS_NBAR); i += 2) { ------------------ | | 12| 117k|#define PARAMS_NBAR 8 ------------------ | Branch (10:17): [True: 117k, False: 30] ------------------ 11| 117k| *((uint32_t*)&out[i]) = *((uint32_t*)&e[i]); 12| 117k| } 13| | 14| 30| int k; 15| 30| uint16_t a_cols[PARAMS_N*PARAMS_STRIPE_STEP] = {0}; 16| 30| ALIGN_HEADER(32) uint16_t a_cols_t[PARAMS_N*PARAMS_STRIPE_STEP] ALIGN_FOOTER(32) = {0}; 17| 30| uint16_t a_cols_temp[PARAMS_N*PARAMS_STRIPE_STEP] = {0}; 18| 30| uint8_t *aes_key_schedule; 19| 30| OQS_AES128_ECB_load_schedule(seed_A, (void **) &aes_key_schedule); 20| | 21| 29.3k| for (i = 0, j = 0; i < PARAMS_N; i++, j += PARAMS_STRIPE_STEP) { ------------------ | | 11| 29.3k|#define PARAMS_N 976 ------------------ for (i = 0, j = 0; i < PARAMS_N; i++, j += PARAMS_STRIPE_STEP) { ------------------ | | 16| 29.2k|#define PARAMS_STRIPE_STEP 8 ------------------ | Branch (21:24): [True: 29.2k, False: 30] ------------------ 22| 29.2k| a_cols_temp[j] = UINT16_TO_LE(i); // Loading values in the little-endian order ------------------ | | 35| 29.2k| #define UINT16_TO_LE(n) (n) ------------------ 23| 29.2k| } 24| | 25| 3.69k| for (kk = 0; kk < PARAMS_N; kk += PARAMS_STRIPE_STEP) { // Go through A's columns, 8 (== PARAMS_STRIPE_STEP) columns at a time. ------------------ | | 11| 3.69k|#define PARAMS_N 976 ------------------ for (kk = 0; kk < PARAMS_N; kk += PARAMS_STRIPE_STEP) { // Go through A's columns, 8 (== PARAMS_STRIPE_STEP) columns at a time. ------------------ | | 16| 3.66k|#define PARAMS_STRIPE_STEP 8 ------------------ | Branch (25:18): [True: 3.66k, False: 30] ------------------ 26| 3.57M| for (i = 0; i < (PARAMS_N*PARAMS_STRIPE_STEP); i += PARAMS_STRIPE_STEP) { ------------------ | | 11| 3.57M|#define PARAMS_N 976 ------------------ for (i = 0; i < (PARAMS_N*PARAMS_STRIPE_STEP); i += PARAMS_STRIPE_STEP) { ------------------ | | 16| 3.57M|#define PARAMS_STRIPE_STEP 8 ------------------ for (i = 0; i < (PARAMS_N*PARAMS_STRIPE_STEP); i += PARAMS_STRIPE_STEP) { ------------------ | | 16| 3.57M|#define PARAMS_STRIPE_STEP 8 ------------------ | Branch (26:21): [True: 3.57M, False: 3.66k] ------------------ 27| 3.57M| a_cols_temp[i + 1] = UINT16_TO_LE(kk); // Loading values in the little-endian order ------------------ | | 35| 3.57M| #define UINT16_TO_LE(n) (n) ------------------ 28| 3.57M| } 29| | 30| 3.66k| OQS_AES128_ECB_enc_sch((uint8_t*)a_cols_temp, PARAMS_N*PARAMS_STRIPE_STEP*sizeof(int16_t), aes_key_schedule, (uint8_t*)a_cols); ------------------ | | 11| 3.66k|#define PARAMS_N 976 ------------------ OQS_AES128_ECB_enc_sch((uint8_t*)a_cols_temp, PARAMS_N*PARAMS_STRIPE_STEP*sizeof(int16_t), aes_key_schedule, (uint8_t*)a_cols); ------------------ | | 16| 3.66k|#define PARAMS_STRIPE_STEP 8 ------------------ 31| | 32| 3.57M| for (i = 0; i < PARAMS_N; i++) { // Transpose a_cols to have access to it in the column-major order. ------------------ | | 11| 3.57M|#define PARAMS_N 976 ------------------ | Branch (32:21): [True: 3.57M, False: 3.66k] ------------------ 33| 32.1M| for (k = 0; k < PARAMS_STRIPE_STEP; k++) { ------------------ | | 16| 32.1M|#define PARAMS_STRIPE_STEP 8 ------------------ | Branch (33:25): [True: 28.5M, False: 3.57M] ------------------ 34| 28.5M| a_cols_t[k*PARAMS_N + i] = LE_TO_UINT16(a_cols[i*PARAMS_STRIPE_STEP + k]); ------------------ | | 11| 28.5M|#define PARAMS_N 976 ------------------ a_cols_t[k*PARAMS_N + i] = LE_TO_UINT16(a_cols[i*PARAMS_STRIPE_STEP + k]); ------------------ | | 34| 28.5M| #define LE_TO_UINT16(n) (n) ------------------ 35| 28.5M| } 36| 3.57M| } 37| | 38| 32.9k| for (i = 0; i < PARAMS_NBAR; i++) { ------------------ | | 12| 32.9k|#define PARAMS_NBAR 8 ------------------ | Branch (38:21): [True: 29.2k, False: 3.66k] ------------------ 39| 87.8k| for (k = 0; k < PARAMS_STRIPE_STEP; k += PARAMS_PARALLEL) { ------------------ | | 16| 87.8k|#define PARAMS_STRIPE_STEP 8 ------------------ for (k = 0; k < PARAMS_STRIPE_STEP; k += PARAMS_PARALLEL) { ------------------ | | 17| 58.5k|#define PARAMS_PARALLEL 4 ------------------ | Branch (39:25): [True: 58.5k, False: 29.2k] ------------------ 40| 58.5k| ALIGN_HEADER(32) uint32_t sum[8 * PARAMS_PARALLEL] ALIGN_FOOTER(32); 41| 58.5k| __m256i a[PARAMS_PARALLEL], b, acc[PARAMS_PARALLEL]; 42| 58.5k| acc[0] = _mm256_setzero_si256(); 43| 58.5k| acc[1] = _mm256_setzero_si256(); 44| 58.5k| acc[2] = _mm256_setzero_si256(); 45| 58.5k| acc[3] = _mm256_setzero_si256(); 46| 3.63M| for (j = 0; j < PARAMS_N; j += 16) { // Matrix-vector multiplication ------------------ | | 11| 3.63M|#define PARAMS_N 976 ------------------ | Branch (46:29): [True: 3.57M, False: 58.5k] ------------------ 47| 3.57M| b = _mm256_load_si256((__m256i*)&s[i*PARAMS_N + j]); ------------------ | | 11| 3.57M|#define PARAMS_N 976 ------------------ 48| 3.57M| a[0] = _mm256_load_si256((__m256i*)&a_cols_t[(k+0)*PARAMS_N + j]); ------------------ | | 11| 3.57M|#define PARAMS_N 976 ------------------ 49| 3.57M| a[0] = _mm256_madd_epi16(a[0], b); 50| 3.57M| acc[0] = _mm256_add_epi16(a[0], acc[0]); 51| 3.57M| a[1] = _mm256_load_si256((__m256i*)&a_cols_t[(k+1)*PARAMS_N + j]); ------------------ | | 11| 3.57M|#define PARAMS_N 976 ------------------ 52| 3.57M| a[1] = _mm256_madd_epi16(a[1], b); 53| 3.57M| acc[1] = _mm256_add_epi16(a[1], acc[1]); 54| 3.57M| a[2] = _mm256_load_si256((__m256i*)&a_cols_t[(k+2)*PARAMS_N + j]); ------------------ | | 11| 3.57M|#define PARAMS_N 976 ------------------ 55| 3.57M| a[2] = _mm256_madd_epi16(a[2], b); 56| 3.57M| acc[2] = _mm256_add_epi16(a[2], acc[2]); 57| 3.57M| a[3] = _mm256_load_si256((__m256i*)&a_cols_t[(k+3)*PARAMS_N + j]); ------------------ | | 11| 3.57M|#define PARAMS_N 976 ------------------ 58| 3.57M| a[3] = _mm256_madd_epi16(a[3], b); 59| 3.57M| acc[3] = _mm256_add_epi16(a[3], acc[3]); 60| 3.57M| } 61| 58.5k| _mm256_store_si256((__m256i*)(sum + (8*0)), acc[0]); 62| 58.5k| out[i*PARAMS_N + kk + k + 0] += sum[8*0 + 0] + sum[8*0 + 1] + sum[8*0 + 2] + sum[8*0 + 3] + sum[8*0 + 4] + sum[8*0 + 5] + sum[8*0 + 6] + sum[8*0 + 7]; ------------------ | | 11| 58.5k|#define PARAMS_N 976 ------------------ 63| 58.5k| _mm256_store_si256((__m256i*)(sum + (8*1)), acc[1]); 64| 58.5k| out[i*PARAMS_N + kk + k + 1] += sum[8*1 + 0] + sum[8*1 + 1] + sum[8*1 + 2] + sum[8*1 + 3] + sum[8*1 + 4] + sum[8*1 + 5] + sum[8*1 + 6] + sum[8*1 + 7]; ------------------ | | 11| 58.5k|#define PARAMS_N 976 ------------------ 65| 58.5k| _mm256_store_si256((__m256i*)(sum + (8*2)), acc[2]); 66| 58.5k| out[i*PARAMS_N + kk + k + 2] += sum[8*2 + 0] + sum[8*2 + 1] + sum[8*2 + 2] + sum[8*2 + 3] + sum[8*2 + 4] + sum[8*2 + 5] + sum[8*2 + 6] + sum[8*2 + 7]; ------------------ | | 11| 58.5k|#define PARAMS_N 976 ------------------ 67| 58.5k| _mm256_store_si256((__m256i*)(sum + (8*3)), acc[3]); 68| 58.5k| out[i*PARAMS_N + kk + k + 3] += sum[8*3 + 0] + sum[8*3 + 1] + sum[8*3 + 2] + sum[8*3 + 3] + sum[8*3 + 4] + sum[8*3 + 5] + sum[8*3 + 6] + sum[8*3 + 7]; ------------------ | | 11| 58.5k|#define PARAMS_N 976 ------------------ 69| 58.5k| } 70| 29.2k| } 71| 3.66k| } 72| 30| OQS_AES128_free_schedule(aes_key_schedule); 73| 30| return 1; 74| 30|} oqs_kem_frodokem_1344_aes_mul_add_sa_plus_e_avx2: 5| 16|{ // Generate-and-multiply: generate matrix A (N x N) column-wise, multiply by s' on the left. 6| | // Inputs: s', e' (N_BAR x N) 7| | // Output: out = s'*A + e' (N_BAR x N) 8| 16| int i, j, kk; 9| | 10| 86.0k| for (i = 0; i < (PARAMS_N*PARAMS_NBAR); i += 2) { ------------------ | | 11| 86.0k|#define PARAMS_N 1344 ------------------ for (i = 0; i < (PARAMS_N*PARAMS_NBAR); i += 2) { ------------------ | | 12| 86.0k|#define PARAMS_NBAR 8 ------------------ | Branch (10:17): [True: 86.0k, False: 16] ------------------ 11| 86.0k| *((uint32_t*)&out[i]) = *((uint32_t*)&e[i]); 12| 86.0k| } 13| | 14| 16| int k; 15| 16| uint16_t a_cols[PARAMS_N*PARAMS_STRIPE_STEP] = {0}; 16| 16| ALIGN_HEADER(32) uint16_t a_cols_t[PARAMS_N*PARAMS_STRIPE_STEP] ALIGN_FOOTER(32) = {0}; 17| 16| uint16_t a_cols_temp[PARAMS_N*PARAMS_STRIPE_STEP] = {0}; 18| 16| uint8_t *aes_key_schedule; 19| 16| OQS_AES128_ECB_load_schedule(seed_A, (void **) &aes_key_schedule); 20| | 21| 21.5k| for (i = 0, j = 0; i < PARAMS_N; i++, j += PARAMS_STRIPE_STEP) { ------------------ | | 11| 21.5k|#define PARAMS_N 1344 ------------------ for (i = 0, j = 0; i < PARAMS_N; i++, j += PARAMS_STRIPE_STEP) { ------------------ | | 16| 21.5k|#define PARAMS_STRIPE_STEP 8 ------------------ | Branch (21:24): [True: 21.5k, False: 16] ------------------ 22| 21.5k| a_cols_temp[j] = UINT16_TO_LE(i); // Loading values in the little-endian order ------------------ | | 35| 21.5k| #define UINT16_TO_LE(n) (n) ------------------ 23| 21.5k| } 24| | 25| 2.70k| for (kk = 0; kk < PARAMS_N; kk += PARAMS_STRIPE_STEP) { // Go through A's columns, 8 (== PARAMS_STRIPE_STEP) columns at a time. ------------------ | | 11| 2.70k|#define PARAMS_N 1344 ------------------ for (kk = 0; kk < PARAMS_N; kk += PARAMS_STRIPE_STEP) { // Go through A's columns, 8 (== PARAMS_STRIPE_STEP) columns at a time. ------------------ | | 16| 2.68k|#define PARAMS_STRIPE_STEP 8 ------------------ | Branch (25:18): [True: 2.68k, False: 16] ------------------ 26| 3.61M| for (i = 0; i < (PARAMS_N*PARAMS_STRIPE_STEP); i += PARAMS_STRIPE_STEP) { ------------------ | | 11| 3.61M|#define PARAMS_N 1344 ------------------ for (i = 0; i < (PARAMS_N*PARAMS_STRIPE_STEP); i += PARAMS_STRIPE_STEP) { ------------------ | | 16| 3.61M|#define PARAMS_STRIPE_STEP 8 ------------------ for (i = 0; i < (PARAMS_N*PARAMS_STRIPE_STEP); i += PARAMS_STRIPE_STEP) { ------------------ | | 16| 3.61M|#define PARAMS_STRIPE_STEP 8 ------------------ | Branch (26:21): [True: 3.61M, False: 2.68k] ------------------ 27| 3.61M| a_cols_temp[i + 1] = UINT16_TO_LE(kk); // Loading values in the little-endian order ------------------ | | 35| 3.61M| #define UINT16_TO_LE(n) (n) ------------------ 28| 3.61M| } 29| | 30| 2.68k| OQS_AES128_ECB_enc_sch((uint8_t*)a_cols_temp, PARAMS_N*PARAMS_STRIPE_STEP*sizeof(int16_t), aes_key_schedule, (uint8_t*)a_cols); ------------------ | | 11| 2.68k|#define PARAMS_N 1344 ------------------ OQS_AES128_ECB_enc_sch((uint8_t*)a_cols_temp, PARAMS_N*PARAMS_STRIPE_STEP*sizeof(int16_t), aes_key_schedule, (uint8_t*)a_cols); ------------------ | | 16| 2.68k|#define PARAMS_STRIPE_STEP 8 ------------------ 31| | 32| 3.61M| for (i = 0; i < PARAMS_N; i++) { // Transpose a_cols to have access to it in the column-major order. ------------------ | | 11| 3.61M|#define PARAMS_N 1344 ------------------ | Branch (32:21): [True: 3.61M, False: 2.68k] ------------------ 33| 32.5M| for (k = 0; k < PARAMS_STRIPE_STEP; k++) { ------------------ | | 16| 32.5M|#define PARAMS_STRIPE_STEP 8 ------------------ | Branch (33:25): [True: 28.9M, False: 3.61M] ------------------ 34| 28.9M| a_cols_t[k*PARAMS_N + i] = LE_TO_UINT16(a_cols[i*PARAMS_STRIPE_STEP + k]); ------------------ | | 11| 28.9M|#define PARAMS_N 1344 ------------------ a_cols_t[k*PARAMS_N + i] = LE_TO_UINT16(a_cols[i*PARAMS_STRIPE_STEP + k]); ------------------ | | 34| 28.9M| #define LE_TO_UINT16(n) (n) ------------------ 35| 28.9M| } 36| 3.61M| } 37| | 38| 24.1k| for (i = 0; i < PARAMS_NBAR; i++) { ------------------ | | 12| 24.1k|#define PARAMS_NBAR 8 ------------------ | Branch (38:21): [True: 21.5k, False: 2.68k] ------------------ 39| 64.5k| for (k = 0; k < PARAMS_STRIPE_STEP; k += PARAMS_PARALLEL) { ------------------ | | 16| 64.5k|#define PARAMS_STRIPE_STEP 8 ------------------ for (k = 0; k < PARAMS_STRIPE_STEP; k += PARAMS_PARALLEL) { ------------------ | | 17| 43.0k|#define PARAMS_PARALLEL 4 ------------------ | Branch (39:25): [True: 43.0k, False: 21.5k] ------------------ 40| 43.0k| ALIGN_HEADER(32) uint32_t sum[8 * PARAMS_PARALLEL] ALIGN_FOOTER(32); 41| 43.0k| __m256i a[PARAMS_PARALLEL], b, acc[PARAMS_PARALLEL]; 42| 43.0k| acc[0] = _mm256_setzero_si256(); 43| 43.0k| acc[1] = _mm256_setzero_si256(); 44| 43.0k| acc[2] = _mm256_setzero_si256(); 45| 43.0k| acc[3] = _mm256_setzero_si256(); 46| 3.65M| for (j = 0; j < PARAMS_N; j += 16) { // Matrix-vector multiplication ------------------ | | 11| 3.65M|#define PARAMS_N 1344 ------------------ | Branch (46:29): [True: 3.61M, False: 43.0k] ------------------ 47| 3.61M| b = _mm256_load_si256((__m256i*)&s[i*PARAMS_N + j]); ------------------ | | 11| 3.61M|#define PARAMS_N 1344 ------------------ 48| 3.61M| a[0] = _mm256_load_si256((__m256i*)&a_cols_t[(k+0)*PARAMS_N + j]); ------------------ | | 11| 3.61M|#define PARAMS_N 1344 ------------------ 49| 3.61M| a[0] = _mm256_madd_epi16(a[0], b); 50| 3.61M| acc[0] = _mm256_add_epi16(a[0], acc[0]); 51| 3.61M| a[1] = _mm256_load_si256((__m256i*)&a_cols_t[(k+1)*PARAMS_N + j]); ------------------ | | 11| 3.61M|#define PARAMS_N 1344 ------------------ 52| 3.61M| a[1] = _mm256_madd_epi16(a[1], b); 53| 3.61M| acc[1] = _mm256_add_epi16(a[1], acc[1]); 54| 3.61M| a[2] = _mm256_load_si256((__m256i*)&a_cols_t[(k+2)*PARAMS_N + j]); ------------------ | | 11| 3.61M|#define PARAMS_N 1344 ------------------ 55| 3.61M| a[2] = _mm256_madd_epi16(a[2], b); 56| 3.61M| acc[2] = _mm256_add_epi16(a[2], acc[2]); 57| 3.61M| a[3] = _mm256_load_si256((__m256i*)&a_cols_t[(k+3)*PARAMS_N + j]); ------------------ | | 11| 3.61M|#define PARAMS_N 1344 ------------------ 58| 3.61M| a[3] = _mm256_madd_epi16(a[3], b); 59| 3.61M| acc[3] = _mm256_add_epi16(a[3], acc[3]); 60| 3.61M| } 61| 43.0k| _mm256_store_si256((__m256i*)(sum + (8*0)), acc[0]); 62| 43.0k| out[i*PARAMS_N + kk + k + 0] += sum[8*0 + 0] + sum[8*0 + 1] + sum[8*0 + 2] + sum[8*0 + 3] + sum[8*0 + 4] + sum[8*0 + 5] + sum[8*0 + 6] + sum[8*0 + 7]; ------------------ | | 11| 43.0k|#define PARAMS_N 1344 ------------------ 63| 43.0k| _mm256_store_si256((__m256i*)(sum + (8*1)), acc[1]); 64| 43.0k| out[i*PARAMS_N + kk + k + 1] += sum[8*1 + 0] + sum[8*1 + 1] + sum[8*1 + 2] + sum[8*1 + 3] + sum[8*1 + 4] + sum[8*1 + 5] + sum[8*1 + 6] + sum[8*1 + 7]; ------------------ | | 11| 43.0k|#define PARAMS_N 1344 ------------------ 65| 43.0k| _mm256_store_si256((__m256i*)(sum + (8*2)), acc[2]); 66| 43.0k| out[i*PARAMS_N + kk + k + 2] += sum[8*2 + 0] + sum[8*2 + 1] + sum[8*2 + 2] + sum[8*2 + 3] + sum[8*2 + 4] + sum[8*2 + 5] + sum[8*2 + 6] + sum[8*2 + 7]; ------------------ | | 11| 43.0k|#define PARAMS_N 1344 ------------------ 67| 43.0k| _mm256_store_si256((__m256i*)(sum + (8*3)), acc[3]); 68| 43.0k| out[i*PARAMS_N + kk + k + 3] += sum[8*3 + 0] + sum[8*3 + 1] + sum[8*3 + 2] + sum[8*3 + 3] + sum[8*3 + 4] + sum[8*3 + 5] + sum[8*3 + 6] + sum[8*3 + 7]; ------------------ | | 11| 43.0k|#define PARAMS_N 1344 ------------------ 69| 43.0k| } 70| 21.5k| } 71| 2.68k| } 72| 16| OQS_AES128_free_schedule(aes_key_schedule); 73| 16| return 1; 74| 16|} oqs_kem_efrodokem_640_aes_mul_add_sa_plus_e_avx2: 5| 8|{ // Generate-and-multiply: generate matrix A (N x N) column-wise, multiply by s' on the left. 6| | // Inputs: s', e' (N_BAR x N) 7| | // Output: out = s'*A + e' (N_BAR x N) 8| 8| int i, j, kk; 9| | 10| 20.4k| for (i = 0; i < (PARAMS_N*PARAMS_NBAR); i += 2) { ------------------ | | 11| 20.4k|#define PARAMS_N 640 ------------------ for (i = 0; i < (PARAMS_N*PARAMS_NBAR); i += 2) { ------------------ | | 12| 20.4k|#define PARAMS_NBAR 8 ------------------ | Branch (10:17): [True: 20.4k, False: 8] ------------------ 11| 20.4k| *((uint32_t*)&out[i]) = *((uint32_t*)&e[i]); 12| 20.4k| } 13| | 14| 8| int k; 15| 8| uint16_t a_cols[PARAMS_N*PARAMS_STRIPE_STEP] = {0}; 16| 8| ALIGN_HEADER(32) uint16_t a_cols_t[PARAMS_N*PARAMS_STRIPE_STEP] ALIGN_FOOTER(32) = {0}; 17| 8| uint16_t a_cols_temp[PARAMS_N*PARAMS_STRIPE_STEP] = {0}; 18| 8| uint8_t *aes_key_schedule; 19| 8| OQS_AES128_ECB_load_schedule(seed_A, (void **) &aes_key_schedule); 20| | 21| 5.12k| for (i = 0, j = 0; i < PARAMS_N; i++, j += PARAMS_STRIPE_STEP) { ------------------ | | 11| 5.12k|#define PARAMS_N 640 ------------------ for (i = 0, j = 0; i < PARAMS_N; i++, j += PARAMS_STRIPE_STEP) { ------------------ | | 16| 5.12k|#define PARAMS_STRIPE_STEP 8 ------------------ | Branch (21:24): [True: 5.12k, False: 8] ------------------ 22| 5.12k| a_cols_temp[j] = UINT16_TO_LE(i); // Loading values in the little-endian order ------------------ | | 35| 5.12k| #define UINT16_TO_LE(n) (n) ------------------ 23| 5.12k| } 24| | 25| 648| for (kk = 0; kk < PARAMS_N; kk += PARAMS_STRIPE_STEP) { // Go through A's columns, 8 (== PARAMS_STRIPE_STEP) columns at a time. ------------------ | | 11| 648|#define PARAMS_N 640 ------------------ for (kk = 0; kk < PARAMS_N; kk += PARAMS_STRIPE_STEP) { // Go through A's columns, 8 (== PARAMS_STRIPE_STEP) columns at a time. ------------------ | | 16| 640|#define PARAMS_STRIPE_STEP 8 ------------------ | Branch (25:18): [True: 640, False: 8] ------------------ 26| 410k| for (i = 0; i < (PARAMS_N*PARAMS_STRIPE_STEP); i += PARAMS_STRIPE_STEP) { ------------------ | | 11| 410k|#define PARAMS_N 640 ------------------ for (i = 0; i < (PARAMS_N*PARAMS_STRIPE_STEP); i += PARAMS_STRIPE_STEP) { ------------------ | | 16| 410k|#define PARAMS_STRIPE_STEP 8 ------------------ for (i = 0; i < (PARAMS_N*PARAMS_STRIPE_STEP); i += PARAMS_STRIPE_STEP) { ------------------ | | 16| 409k|#define PARAMS_STRIPE_STEP 8 ------------------ | Branch (26:21): [True: 409k, False: 640] ------------------ 27| 409k| a_cols_temp[i + 1] = UINT16_TO_LE(kk); // Loading values in the little-endian order ------------------ | | 35| 409k| #define UINT16_TO_LE(n) (n) ------------------ 28| 409k| } 29| | 30| 640| OQS_AES128_ECB_enc_sch((uint8_t*)a_cols_temp, PARAMS_N*PARAMS_STRIPE_STEP*sizeof(int16_t), aes_key_schedule, (uint8_t*)a_cols); ------------------ | | 11| 640|#define PARAMS_N 640 ------------------ OQS_AES128_ECB_enc_sch((uint8_t*)a_cols_temp, PARAMS_N*PARAMS_STRIPE_STEP*sizeof(int16_t), aes_key_schedule, (uint8_t*)a_cols); ------------------ | | 16| 640|#define PARAMS_STRIPE_STEP 8 ------------------ 31| | 32| 410k| for (i = 0; i < PARAMS_N; i++) { // Transpose a_cols to have access to it in the column-major order. ------------------ | | 11| 410k|#define PARAMS_N 640 ------------------ | Branch (32:21): [True: 409k, False: 640] ------------------ 33| 3.68M| for (k = 0; k < PARAMS_STRIPE_STEP; k++) { ------------------ | | 16| 3.68M|#define PARAMS_STRIPE_STEP 8 ------------------ | Branch (33:25): [True: 3.27M, False: 409k] ------------------ 34| 3.27M| a_cols_t[k*PARAMS_N + i] = LE_TO_UINT16(a_cols[i*PARAMS_STRIPE_STEP + k]); ------------------ | | 11| 3.27M|#define PARAMS_N 640 ------------------ a_cols_t[k*PARAMS_N + i] = LE_TO_UINT16(a_cols[i*PARAMS_STRIPE_STEP + k]); ------------------ | | 34| 3.27M| #define LE_TO_UINT16(n) (n) ------------------ 35| 3.27M| } 36| 409k| } 37| | 38| 5.76k| for (i = 0; i < PARAMS_NBAR; i++) { ------------------ | | 12| 5.76k|#define PARAMS_NBAR 8 ------------------ | Branch (38:21): [True: 5.12k, False: 640] ------------------ 39| 15.3k| for (k = 0; k < PARAMS_STRIPE_STEP; k += PARAMS_PARALLEL) { ------------------ | | 16| 15.3k|#define PARAMS_STRIPE_STEP 8 ------------------ for (k = 0; k < PARAMS_STRIPE_STEP; k += PARAMS_PARALLEL) { ------------------ | | 17| 10.2k|#define PARAMS_PARALLEL 4 ------------------ | Branch (39:25): [True: 10.2k, False: 5.12k] ------------------ 40| 10.2k| ALIGN_HEADER(32) uint32_t sum[8 * PARAMS_PARALLEL] ALIGN_FOOTER(32); 41| 10.2k| __m256i a[PARAMS_PARALLEL], b, acc[PARAMS_PARALLEL]; 42| 10.2k| acc[0] = _mm256_setzero_si256(); 43| 10.2k| acc[1] = _mm256_setzero_si256(); 44| 10.2k| acc[2] = _mm256_setzero_si256(); 45| 10.2k| acc[3] = _mm256_setzero_si256(); 46| 419k| for (j = 0; j < PARAMS_N; j += 16) { // Matrix-vector multiplication ------------------ | | 11| 419k|#define PARAMS_N 640 ------------------ | Branch (46:29): [True: 409k, False: 10.2k] ------------------ 47| 409k| b = _mm256_load_si256((__m256i*)&s[i*PARAMS_N + j]); ------------------ | | 11| 409k|#define PARAMS_N 640 ------------------ 48| 409k| a[0] = _mm256_load_si256((__m256i*)&a_cols_t[(k+0)*PARAMS_N + j]); ------------------ | | 11| 409k|#define PARAMS_N 640 ------------------ 49| 409k| a[0] = _mm256_madd_epi16(a[0], b); 50| 409k| acc[0] = _mm256_add_epi16(a[0], acc[0]); 51| 409k| a[1] = _mm256_load_si256((__m256i*)&a_cols_t[(k+1)*PARAMS_N + j]); ------------------ | | 11| 409k|#define PARAMS_N 640 ------------------ 52| 409k| a[1] = _mm256_madd_epi16(a[1], b); 53| 409k| acc[1] = _mm256_add_epi16(a[1], acc[1]); 54| 409k| a[2] = _mm256_load_si256((__m256i*)&a_cols_t[(k+2)*PARAMS_N + j]); ------------------ | | 11| 409k|#define PARAMS_N 640 ------------------ 55| 409k| a[2] = _mm256_madd_epi16(a[2], b); 56| 409k| acc[2] = _mm256_add_epi16(a[2], acc[2]); 57| 409k| a[3] = _mm256_load_si256((__m256i*)&a_cols_t[(k+3)*PARAMS_N + j]); ------------------ | | 11| 409k|#define PARAMS_N 640 ------------------ 58| 409k| a[3] = _mm256_madd_epi16(a[3], b); 59| 409k| acc[3] = _mm256_add_epi16(a[3], acc[3]); 60| 409k| } 61| 10.2k| _mm256_store_si256((__m256i*)(sum + (8*0)), acc[0]); 62| 10.2k| out[i*PARAMS_N + kk + k + 0] += sum[8*0 + 0] + sum[8*0 + 1] + sum[8*0 + 2] + sum[8*0 + 3] + sum[8*0 + 4] + sum[8*0 + 5] + sum[8*0 + 6] + sum[8*0 + 7]; ------------------ | | 11| 10.2k|#define PARAMS_N 640 ------------------ 63| 10.2k| _mm256_store_si256((__m256i*)(sum + (8*1)), acc[1]); 64| 10.2k| out[i*PARAMS_N + kk + k + 1] += sum[8*1 + 0] + sum[8*1 + 1] + sum[8*1 + 2] + sum[8*1 + 3] + sum[8*1 + 4] + sum[8*1 + 5] + sum[8*1 + 6] + sum[8*1 + 7]; ------------------ | | 11| 10.2k|#define PARAMS_N 640 ------------------ 65| 10.2k| _mm256_store_si256((__m256i*)(sum + (8*2)), acc[2]); 66| 10.2k| out[i*PARAMS_N + kk + k + 2] += sum[8*2 + 0] + sum[8*2 + 1] + sum[8*2 + 2] + sum[8*2 + 3] + sum[8*2 + 4] + sum[8*2 + 5] + sum[8*2 + 6] + sum[8*2 + 7]; ------------------ | | 11| 10.2k|#define PARAMS_N 640 ------------------ 67| 10.2k| _mm256_store_si256((__m256i*)(sum + (8*3)), acc[3]); 68| 10.2k| out[i*PARAMS_N + kk + k + 3] += sum[8*3 + 0] + sum[8*3 + 1] + sum[8*3 + 2] + sum[8*3 + 3] + sum[8*3 + 4] + sum[8*3 + 5] + sum[8*3 + 6] + sum[8*3 + 7]; ------------------ | | 11| 10.2k|#define PARAMS_N 640 ------------------ 69| 10.2k| } 70| 5.12k| } 71| 640| } 72| 8| OQS_AES128_free_schedule(aes_key_schedule); 73| 8| return 1; 74| 8|} oqs_kem_efrodokem_976_aes_mul_add_sa_plus_e_avx2: 5| 24|{ // Generate-and-multiply: generate matrix A (N x N) column-wise, multiply by s' on the left. 6| | // Inputs: s', e' (N_BAR x N) 7| | // Output: out = s'*A + e' (N_BAR x N) 8| 24| int i, j, kk; 9| | 10| 93.7k| for (i = 0; i < (PARAMS_N*PARAMS_NBAR); i += 2) { ------------------ | | 11| 93.7k|#define PARAMS_N 976 ------------------ for (i = 0; i < (PARAMS_N*PARAMS_NBAR); i += 2) { ------------------ | | 12| 93.7k|#define PARAMS_NBAR 8 ------------------ | Branch (10:17): [True: 93.6k, False: 24] ------------------ 11| 93.6k| *((uint32_t*)&out[i]) = *((uint32_t*)&e[i]); 12| 93.6k| } 13| | 14| 24| int k; 15| 24| uint16_t a_cols[PARAMS_N*PARAMS_STRIPE_STEP] = {0}; 16| 24| ALIGN_HEADER(32) uint16_t a_cols_t[PARAMS_N*PARAMS_STRIPE_STEP] ALIGN_FOOTER(32) = {0}; 17| 24| uint16_t a_cols_temp[PARAMS_N*PARAMS_STRIPE_STEP] = {0}; 18| 24| uint8_t *aes_key_schedule; 19| 24| OQS_AES128_ECB_load_schedule(seed_A, (void **) &aes_key_schedule); 20| | 21| 23.4k| for (i = 0, j = 0; i < PARAMS_N; i++, j += PARAMS_STRIPE_STEP) { ------------------ | | 11| 23.4k|#define PARAMS_N 976 ------------------ for (i = 0, j = 0; i < PARAMS_N; i++, j += PARAMS_STRIPE_STEP) { ------------------ | | 16| 23.4k|#define PARAMS_STRIPE_STEP 8 ------------------ | Branch (21:24): [True: 23.4k, False: 24] ------------------ 22| 23.4k| a_cols_temp[j] = UINT16_TO_LE(i); // Loading values in the little-endian order ------------------ | | 35| 23.4k| #define UINT16_TO_LE(n) (n) ------------------ 23| 23.4k| } 24| | 25| 2.95k| for (kk = 0; kk < PARAMS_N; kk += PARAMS_STRIPE_STEP) { // Go through A's columns, 8 (== PARAMS_STRIPE_STEP) columns at a time. ------------------ | | 11| 2.95k|#define PARAMS_N 976 ------------------ for (kk = 0; kk < PARAMS_N; kk += PARAMS_STRIPE_STEP) { // Go through A's columns, 8 (== PARAMS_STRIPE_STEP) columns at a time. ------------------ | | 16| 2.92k|#define PARAMS_STRIPE_STEP 8 ------------------ | Branch (25:18): [True: 2.92k, False: 24] ------------------ 26| 2.86M| for (i = 0; i < (PARAMS_N*PARAMS_STRIPE_STEP); i += PARAMS_STRIPE_STEP) { ------------------ | | 11| 2.86M|#define PARAMS_N 976 ------------------ for (i = 0; i < (PARAMS_N*PARAMS_STRIPE_STEP); i += PARAMS_STRIPE_STEP) { ------------------ | | 16| 2.86M|#define PARAMS_STRIPE_STEP 8 ------------------ for (i = 0; i < (PARAMS_N*PARAMS_STRIPE_STEP); i += PARAMS_STRIPE_STEP) { ------------------ | | 16| 2.85M|#define PARAMS_STRIPE_STEP 8 ------------------ | Branch (26:21): [True: 2.85M, False: 2.92k] ------------------ 27| 2.85M| a_cols_temp[i + 1] = UINT16_TO_LE(kk); // Loading values in the little-endian order ------------------ | | 35| 2.85M| #define UINT16_TO_LE(n) (n) ------------------ 28| 2.85M| } 29| | 30| 2.92k| OQS_AES128_ECB_enc_sch((uint8_t*)a_cols_temp, PARAMS_N*PARAMS_STRIPE_STEP*sizeof(int16_t), aes_key_schedule, (uint8_t*)a_cols); ------------------ | | 11| 2.92k|#define PARAMS_N 976 ------------------ OQS_AES128_ECB_enc_sch((uint8_t*)a_cols_temp, PARAMS_N*PARAMS_STRIPE_STEP*sizeof(int16_t), aes_key_schedule, (uint8_t*)a_cols); ------------------ | | 16| 2.92k|#define PARAMS_STRIPE_STEP 8 ------------------ 31| | 32| 2.86M| for (i = 0; i < PARAMS_N; i++) { // Transpose a_cols to have access to it in the column-major order. ------------------ | | 11| 2.86M|#define PARAMS_N 976 ------------------ | Branch (32:21): [True: 2.85M, False: 2.92k] ------------------ 33| 25.7M| for (k = 0; k < PARAMS_STRIPE_STEP; k++) { ------------------ | | 16| 25.7M|#define PARAMS_STRIPE_STEP 8 ------------------ | Branch (33:25): [True: 22.8M, False: 2.85M] ------------------ 34| 22.8M| a_cols_t[k*PARAMS_N + i] = LE_TO_UINT16(a_cols[i*PARAMS_STRIPE_STEP + k]); ------------------ | | 11| 22.8M|#define PARAMS_N 976 ------------------ a_cols_t[k*PARAMS_N + i] = LE_TO_UINT16(a_cols[i*PARAMS_STRIPE_STEP + k]); ------------------ | | 34| 22.8M| #define LE_TO_UINT16(n) (n) ------------------ 35| 22.8M| } 36| 2.85M| } 37| | 38| 26.3k| for (i = 0; i < PARAMS_NBAR; i++) { ------------------ | | 12| 26.3k|#define PARAMS_NBAR 8 ------------------ | Branch (38:21): [True: 23.4k, False: 2.92k] ------------------ 39| 70.2k| for (k = 0; k < PARAMS_STRIPE_STEP; k += PARAMS_PARALLEL) { ------------------ | | 16| 70.2k|#define PARAMS_STRIPE_STEP 8 ------------------ for (k = 0; k < PARAMS_STRIPE_STEP; k += PARAMS_PARALLEL) { ------------------ | | 17| 46.8k|#define PARAMS_PARALLEL 4 ------------------ | Branch (39:25): [True: 46.8k, False: 23.4k] ------------------ 40| 46.8k| ALIGN_HEADER(32) uint32_t sum[8 * PARAMS_PARALLEL] ALIGN_FOOTER(32); 41| 46.8k| __m256i a[PARAMS_PARALLEL], b, acc[PARAMS_PARALLEL]; 42| 46.8k| acc[0] = _mm256_setzero_si256(); 43| 46.8k| acc[1] = _mm256_setzero_si256(); 44| 46.8k| acc[2] = _mm256_setzero_si256(); 45| 46.8k| acc[3] = _mm256_setzero_si256(); 46| 2.90M| for (j = 0; j < PARAMS_N; j += 16) { // Matrix-vector multiplication ------------------ | | 11| 2.90M|#define PARAMS_N 976 ------------------ | Branch (46:29): [True: 2.85M, False: 46.8k] ------------------ 47| 2.85M| b = _mm256_load_si256((__m256i*)&s[i*PARAMS_N + j]); ------------------ | | 11| 2.85M|#define PARAMS_N 976 ------------------ 48| 2.85M| a[0] = _mm256_load_si256((__m256i*)&a_cols_t[(k+0)*PARAMS_N + j]); ------------------ | | 11| 2.85M|#define PARAMS_N 976 ------------------ 49| 2.85M| a[0] = _mm256_madd_epi16(a[0], b); 50| 2.85M| acc[0] = _mm256_add_epi16(a[0], acc[0]); 51| 2.85M| a[1] = _mm256_load_si256((__m256i*)&a_cols_t[(k+1)*PARAMS_N + j]); ------------------ | | 11| 2.85M|#define PARAMS_N 976 ------------------ 52| 2.85M| a[1] = _mm256_madd_epi16(a[1], b); 53| 2.85M| acc[1] = _mm256_add_epi16(a[1], acc[1]); 54| 2.85M| a[2] = _mm256_load_si256((__m256i*)&a_cols_t[(k+2)*PARAMS_N + j]); ------------------ | | 11| 2.85M|#define PARAMS_N 976 ------------------ 55| 2.85M| a[2] = _mm256_madd_epi16(a[2], b); 56| 2.85M| acc[2] = _mm256_add_epi16(a[2], acc[2]); 57| 2.85M| a[3] = _mm256_load_si256((__m256i*)&a_cols_t[(k+3)*PARAMS_N + j]); ------------------ | | 11| 2.85M|#define PARAMS_N 976 ------------------ 58| 2.85M| a[3] = _mm256_madd_epi16(a[3], b); 59| 2.85M| acc[3] = _mm256_add_epi16(a[3], acc[3]); 60| 2.85M| } 61| 46.8k| _mm256_store_si256((__m256i*)(sum + (8*0)), acc[0]); 62| 46.8k| out[i*PARAMS_N + kk + k + 0] += sum[8*0 + 0] + sum[8*0 + 1] + sum[8*0 + 2] + sum[8*0 + 3] + sum[8*0 + 4] + sum[8*0 + 5] + sum[8*0 + 6] + sum[8*0 + 7]; ------------------ | | 11| 46.8k|#define PARAMS_N 976 ------------------ 63| 46.8k| _mm256_store_si256((__m256i*)(sum + (8*1)), acc[1]); 64| 46.8k| out[i*PARAMS_N + kk + k + 1] += sum[8*1 + 0] + sum[8*1 + 1] + sum[8*1 + 2] + sum[8*1 + 3] + sum[8*1 + 4] + sum[8*1 + 5] + sum[8*1 + 6] + sum[8*1 + 7]; ------------------ | | 11| 46.8k|#define PARAMS_N 976 ------------------ 65| 46.8k| _mm256_store_si256((__m256i*)(sum + (8*2)), acc[2]); 66| 46.8k| out[i*PARAMS_N + kk + k + 2] += sum[8*2 + 0] + sum[8*2 + 1] + sum[8*2 + 2] + sum[8*2 + 3] + sum[8*2 + 4] + sum[8*2 + 5] + sum[8*2 + 6] + sum[8*2 + 7]; ------------------ | | 11| 46.8k|#define PARAMS_N 976 ------------------ 67| 46.8k| _mm256_store_si256((__m256i*)(sum + (8*3)), acc[3]); 68| 46.8k| out[i*PARAMS_N + kk + k + 3] += sum[8*3 + 0] + sum[8*3 + 1] + sum[8*3 + 2] + sum[8*3 + 3] + sum[8*3 + 4] + sum[8*3 + 5] + sum[8*3 + 6] + sum[8*3 + 7]; ------------------ | | 11| 46.8k|#define PARAMS_N 976 ------------------ 69| 46.8k| } 70| 23.4k| } 71| 2.92k| } 72| 24| OQS_AES128_free_schedule(aes_key_schedule); 73| 24| return 1; 74| 24|} oqs_kem_efrodokem_1344_aes_mul_add_sa_plus_e_avx2: 5| 16|{ // Generate-and-multiply: generate matrix A (N x N) column-wise, multiply by s' on the left. 6| | // Inputs: s', e' (N_BAR x N) 7| | // Output: out = s'*A + e' (N_BAR x N) 8| 16| int i, j, kk; 9| | 10| 86.0k| for (i = 0; i < (PARAMS_N*PARAMS_NBAR); i += 2) { ------------------ | | 11| 86.0k|#define PARAMS_N 1344 ------------------ for (i = 0; i < (PARAMS_N*PARAMS_NBAR); i += 2) { ------------------ | | 12| 86.0k|#define PARAMS_NBAR 8 ------------------ | Branch (10:17): [True: 86.0k, False: 16] ------------------ 11| 86.0k| *((uint32_t*)&out[i]) = *((uint32_t*)&e[i]); 12| 86.0k| } 13| | 14| 16| int k; 15| 16| uint16_t a_cols[PARAMS_N*PARAMS_STRIPE_STEP] = {0}; 16| 16| ALIGN_HEADER(32) uint16_t a_cols_t[PARAMS_N*PARAMS_STRIPE_STEP] ALIGN_FOOTER(32) = {0}; 17| 16| uint16_t a_cols_temp[PARAMS_N*PARAMS_STRIPE_STEP] = {0}; 18| 16| uint8_t *aes_key_schedule; 19| 16| OQS_AES128_ECB_load_schedule(seed_A, (void **) &aes_key_schedule); 20| | 21| 21.5k| for (i = 0, j = 0; i < PARAMS_N; i++, j += PARAMS_STRIPE_STEP) { ------------------ | | 11| 21.5k|#define PARAMS_N 1344 ------------------ for (i = 0, j = 0; i < PARAMS_N; i++, j += PARAMS_STRIPE_STEP) { ------------------ | | 16| 21.5k|#define PARAMS_STRIPE_STEP 8 ------------------ | Branch (21:24): [True: 21.5k, False: 16] ------------------ 22| 21.5k| a_cols_temp[j] = UINT16_TO_LE(i); // Loading values in the little-endian order ------------------ | | 35| 21.5k| #define UINT16_TO_LE(n) (n) ------------------ 23| 21.5k| } 24| | 25| 2.70k| for (kk = 0; kk < PARAMS_N; kk += PARAMS_STRIPE_STEP) { // Go through A's columns, 8 (== PARAMS_STRIPE_STEP) columns at a time. ------------------ | | 11| 2.70k|#define PARAMS_N 1344 ------------------ for (kk = 0; kk < PARAMS_N; kk += PARAMS_STRIPE_STEP) { // Go through A's columns, 8 (== PARAMS_STRIPE_STEP) columns at a time. ------------------ | | 16| 2.68k|#define PARAMS_STRIPE_STEP 8 ------------------ | Branch (25:18): [True: 2.68k, False: 16] ------------------ 26| 3.61M| for (i = 0; i < (PARAMS_N*PARAMS_STRIPE_STEP); i += PARAMS_STRIPE_STEP) { ------------------ | | 11| 3.61M|#define PARAMS_N 1344 ------------------ for (i = 0; i < (PARAMS_N*PARAMS_STRIPE_STEP); i += PARAMS_STRIPE_STEP) { ------------------ | | 16| 3.61M|#define PARAMS_STRIPE_STEP 8 ------------------ for (i = 0; i < (PARAMS_N*PARAMS_STRIPE_STEP); i += PARAMS_STRIPE_STEP) { ------------------ | | 16| 3.61M|#define PARAMS_STRIPE_STEP 8 ------------------ | Branch (26:21): [True: 3.61M, False: 2.68k] ------------------ 27| 3.61M| a_cols_temp[i + 1] = UINT16_TO_LE(kk); // Loading values in the little-endian order ------------------ | | 35| 3.61M| #define UINT16_TO_LE(n) (n) ------------------ 28| 3.61M| } 29| | 30| 2.68k| OQS_AES128_ECB_enc_sch((uint8_t*)a_cols_temp, PARAMS_N*PARAMS_STRIPE_STEP*sizeof(int16_t), aes_key_schedule, (uint8_t*)a_cols); ------------------ | | 11| 2.68k|#define PARAMS_N 1344 ------------------ OQS_AES128_ECB_enc_sch((uint8_t*)a_cols_temp, PARAMS_N*PARAMS_STRIPE_STEP*sizeof(int16_t), aes_key_schedule, (uint8_t*)a_cols); ------------------ | | 16| 2.68k|#define PARAMS_STRIPE_STEP 8 ------------------ 31| | 32| 3.61M| for (i = 0; i < PARAMS_N; i++) { // Transpose a_cols to have access to it in the column-major order. ------------------ | | 11| 3.61M|#define PARAMS_N 1344 ------------------ | Branch (32:21): [True: 3.61M, False: 2.68k] ------------------ 33| 32.5M| for (k = 0; k < PARAMS_STRIPE_STEP; k++) { ------------------ | | 16| 32.5M|#define PARAMS_STRIPE_STEP 8 ------------------ | Branch (33:25): [True: 28.9M, False: 3.61M] ------------------ 34| 28.9M| a_cols_t[k*PARAMS_N + i] = LE_TO_UINT16(a_cols[i*PARAMS_STRIPE_STEP + k]); ------------------ | | 11| 28.9M|#define PARAMS_N 1344 ------------------ a_cols_t[k*PARAMS_N + i] = LE_TO_UINT16(a_cols[i*PARAMS_STRIPE_STEP + k]); ------------------ | | 34| 28.9M| #define LE_TO_UINT16(n) (n) ------------------ 35| 28.9M| } 36| 3.61M| } 37| | 38| 24.1k| for (i = 0; i < PARAMS_NBAR; i++) { ------------------ | | 12| 24.1k|#define PARAMS_NBAR 8 ------------------ | Branch (38:21): [True: 21.5k, False: 2.68k] ------------------ 39| 64.5k| for (k = 0; k < PARAMS_STRIPE_STEP; k += PARAMS_PARALLEL) { ------------------ | | 16| 64.5k|#define PARAMS_STRIPE_STEP 8 ------------------ for (k = 0; k < PARAMS_STRIPE_STEP; k += PARAMS_PARALLEL) { ------------------ | | 17| 43.0k|#define PARAMS_PARALLEL 4 ------------------ | Branch (39:25): [True: 43.0k, False: 21.5k] ------------------ 40| 43.0k| ALIGN_HEADER(32) uint32_t sum[8 * PARAMS_PARALLEL] ALIGN_FOOTER(32); 41| 43.0k| __m256i a[PARAMS_PARALLEL], b, acc[PARAMS_PARALLEL]; 42| 43.0k| acc[0] = _mm256_setzero_si256(); 43| 43.0k| acc[1] = _mm256_setzero_si256(); 44| 43.0k| acc[2] = _mm256_setzero_si256(); 45| 43.0k| acc[3] = _mm256_setzero_si256(); 46| 3.65M| for (j = 0; j < PARAMS_N; j += 16) { // Matrix-vector multiplication ------------------ | | 11| 3.65M|#define PARAMS_N 1344 ------------------ | Branch (46:29): [True: 3.61M, False: 43.0k] ------------------ 47| 3.61M| b = _mm256_load_si256((__m256i*)&s[i*PARAMS_N + j]); ------------------ | | 11| 3.61M|#define PARAMS_N 1344 ------------------ 48| 3.61M| a[0] = _mm256_load_si256((__m256i*)&a_cols_t[(k+0)*PARAMS_N + j]); ------------------ | | 11| 3.61M|#define PARAMS_N 1344 ------------------ 49| 3.61M| a[0] = _mm256_madd_epi16(a[0], b); 50| 3.61M| acc[0] = _mm256_add_epi16(a[0], acc[0]); 51| 3.61M| a[1] = _mm256_load_si256((__m256i*)&a_cols_t[(k+1)*PARAMS_N + j]); ------------------ | | 11| 3.61M|#define PARAMS_N 1344 ------------------ 52| 3.61M| a[1] = _mm256_madd_epi16(a[1], b); 53| 3.61M| acc[1] = _mm256_add_epi16(a[1], acc[1]); 54| 3.61M| a[2] = _mm256_load_si256((__m256i*)&a_cols_t[(k+2)*PARAMS_N + j]); ------------------ | | 11| 3.61M|#define PARAMS_N 1344 ------------------ 55| 3.61M| a[2] = _mm256_madd_epi16(a[2], b); 56| 3.61M| acc[2] = _mm256_add_epi16(a[2], acc[2]); 57| 3.61M| a[3] = _mm256_load_si256((__m256i*)&a_cols_t[(k+3)*PARAMS_N + j]); ------------------ | | 11| 3.61M|#define PARAMS_N 1344 ------------------ 58| 3.61M| a[3] = _mm256_madd_epi16(a[3], b); 59| 3.61M| acc[3] = _mm256_add_epi16(a[3], acc[3]); 60| 3.61M| } 61| 43.0k| _mm256_store_si256((__m256i*)(sum + (8*0)), acc[0]); 62| 43.0k| out[i*PARAMS_N + kk + k + 0] += sum[8*0 + 0] + sum[8*0 + 1] + sum[8*0 + 2] + sum[8*0 + 3] + sum[8*0 + 4] + sum[8*0 + 5] + sum[8*0 + 6] + sum[8*0 + 7]; ------------------ | | 11| 43.0k|#define PARAMS_N 1344 ------------------ 63| 43.0k| _mm256_store_si256((__m256i*)(sum + (8*1)), acc[1]); 64| 43.0k| out[i*PARAMS_N + kk + k + 1] += sum[8*1 + 0] + sum[8*1 + 1] + sum[8*1 + 2] + sum[8*1 + 3] + sum[8*1 + 4] + sum[8*1 + 5] + sum[8*1 + 6] + sum[8*1 + 7]; ------------------ | | 11| 43.0k|#define PARAMS_N 1344 ------------------ 65| 43.0k| _mm256_store_si256((__m256i*)(sum + (8*2)), acc[2]); 66| 43.0k| out[i*PARAMS_N + kk + k + 2] += sum[8*2 + 0] + sum[8*2 + 1] + sum[8*2 + 2] + sum[8*2 + 3] + sum[8*2 + 4] + sum[8*2 + 5] + sum[8*2 + 6] + sum[8*2 + 7]; ------------------ | | 11| 43.0k|#define PARAMS_N 1344 ------------------ 67| 43.0k| _mm256_store_si256((__m256i*)(sum + (8*3)), acc[3]); 68| 43.0k| out[i*PARAMS_N + kk + k + 3] += sum[8*3 + 0] + sum[8*3 + 1] + sum[8*3 + 2] + sum[8*3 + 3] + sum[8*3 + 4] + sum[8*3 + 5] + sum[8*3 + 6] + sum[8*3 + 7]; ------------------ | | 11| 43.0k|#define PARAMS_N 1344 ------------------ 69| 43.0k| } 70| 21.5k| } 71| 2.68k| } 72| 16| OQS_AES128_free_schedule(aes_key_schedule); 73| 16| return 1; 74| 16|} oqs_kem_frodokem_640_aes_mul_add_as_plus_e_avx2: 4| 2|{ // Generate-and-multiply: generate matrix A (N x N) row-wise, multiply by s on the right. 5| | // Inputs: s, e (N x N_BAR) 6| | // Output: out = A*s + e (N x N_BAR) 7| 2| int i, j, k; 8| 2| ALIGN_HEADER(32) int16_t a_row[4*PARAMS_N] ALIGN_FOOTER(32) = {0}; 9| | 10| 5.12k| for (i = 0; i < (PARAMS_N*PARAMS_NBAR); i += 2) { ------------------ | | 11| 5.12k|#define PARAMS_N 640 ------------------ for (i = 0; i < (PARAMS_N*PARAMS_NBAR); i += 2) { ------------------ | | 12| 5.12k|#define PARAMS_NBAR 8 ------------------ | Branch (10:17): [True: 5.12k, False: 2] ------------------ 11| 5.12k| *((uint32_t*)&out[i]) = *((uint32_t*)&e[i]); 12| 5.12k| } 13| | 14| 2|#if defined(USE_AES128_FOR_A) 15| 2| int16_t a_row_temp[4*PARAMS_N] = {0}; // Take four lines of A at once 16| 2| uint8_t *aes_key_schedule; 17| 2| OQS_AES128_ECB_load_schedule(seed_A, (void **) &aes_key_schedule); 18| | 19| 162| for (j = 0; j < PARAMS_N; j += PARAMS_STRIPE_STEP) { ------------------ | | 11| 162|#define PARAMS_N 640 ------------------ for (j = 0; j < PARAMS_N; j += PARAMS_STRIPE_STEP) { ------------------ | | 16| 160|#define PARAMS_STRIPE_STEP 8 ------------------ | Branch (19:17): [True: 160, False: 2] ------------------ 20| 160| a_row_temp[j + 1 + 0*PARAMS_N] = UINT16_TO_LE(j); // Loading values in the little-endian order ------------------ | | 11| 160|#define PARAMS_N 640 ------------------ a_row_temp[j + 1 + 0*PARAMS_N] = UINT16_TO_LE(j); // Loading values in the little-endian order ------------------ | | 35| 160| #define UINT16_TO_LE(n) (n) ------------------ 21| 160| a_row_temp[j + 1 + 1*PARAMS_N] = UINT16_TO_LE(j); ------------------ | | 11| 160|#define PARAMS_N 640 ------------------ a_row_temp[j + 1 + 1*PARAMS_N] = UINT16_TO_LE(j); ------------------ | | 35| 160| #define UINT16_TO_LE(n) (n) ------------------ 22| 160| a_row_temp[j + 1 + 2*PARAMS_N] = UINT16_TO_LE(j); ------------------ | | 11| 160|#define PARAMS_N 640 ------------------ a_row_temp[j + 1 + 2*PARAMS_N] = UINT16_TO_LE(j); ------------------ | | 35| 160| #define UINT16_TO_LE(n) (n) ------------------ 23| 160| a_row_temp[j + 1 + 3*PARAMS_N] = UINT16_TO_LE(j); ------------------ | | 11| 160|#define PARAMS_N 640 ------------------ a_row_temp[j + 1 + 3*PARAMS_N] = UINT16_TO_LE(j); ------------------ | | 35| 160| #define UINT16_TO_LE(n) (n) ------------------ 24| 160| } 25| | 26| 322| for (i = 0; i < PARAMS_N; i += 4) { ------------------ | | 11| 322|#define PARAMS_N 640 ------------------ | Branch (26:17): [True: 320, False: 2] ------------------ 27| 25.9k| for (j = 0; j < PARAMS_N; j += PARAMS_STRIPE_STEP) { // Go through A, four rows at a time ------------------ | | 11| 25.9k|#define PARAMS_N 640 ------------------ for (j = 0; j < PARAMS_N; j += PARAMS_STRIPE_STEP) { // Go through A, four rows at a time ------------------ | | 16| 25.6k|#define PARAMS_STRIPE_STEP 8 ------------------ | Branch (27:21): [True: 25.6k, False: 320] ------------------ 28| 25.6k| a_row_temp[j + 0*PARAMS_N] = UINT16_TO_LE(i+0); // Loading values in the little-endian order ------------------ | | 11| 25.6k|#define PARAMS_N 640 ------------------ a_row_temp[j + 0*PARAMS_N] = UINT16_TO_LE(i+0); // Loading values in the little-endian order ------------------ | | 35| 25.6k| #define UINT16_TO_LE(n) (n) ------------------ 29| 25.6k| a_row_temp[j + 1*PARAMS_N] = UINT16_TO_LE(i+1); ------------------ | | 11| 25.6k|#define PARAMS_N 640 ------------------ a_row_temp[j + 1*PARAMS_N] = UINT16_TO_LE(i+1); ------------------ | | 35| 25.6k| #define UINT16_TO_LE(n) (n) ------------------ 30| 25.6k| a_row_temp[j + 2*PARAMS_N] = UINT16_TO_LE(i+2); ------------------ | | 11| 25.6k|#define PARAMS_N 640 ------------------ a_row_temp[j + 2*PARAMS_N] = UINT16_TO_LE(i+2); ------------------ | | 35| 25.6k| #define UINT16_TO_LE(n) (n) ------------------ 31| 25.6k| a_row_temp[j + 3*PARAMS_N] = UINT16_TO_LE(i+3); ------------------ | | 11| 25.6k|#define PARAMS_N 640 ------------------ a_row_temp[j + 3*PARAMS_N] = UINT16_TO_LE(i+3); ------------------ | | 35| 25.6k| #define UINT16_TO_LE(n) (n) ------------------ 32| 25.6k| } 33| | 34| 320| OQS_AES128_ECB_enc_sch((uint8_t*)a_row_temp, 4*PARAMS_N*sizeof(int16_t), aes_key_schedule, (uint8_t*)a_row); ------------------ | | 11| 320|#define PARAMS_N 640 ------------------ 35| |#elif defined (USE_SHAKE128_FOR_A) 36| | uint8_t seed_A_separated_0[2 + BYTES_SEED_A]; 37| | uint8_t seed_A_separated_1[2 + BYTES_SEED_A]; 38| | uint8_t seed_A_separated_2[2 + BYTES_SEED_A]; 39| | uint8_t seed_A_separated_3[2 + BYTES_SEED_A]; 40| | uint16_t* seed_A_origin_0 = (uint16_t*)&seed_A_separated_0; 41| | uint16_t* seed_A_origin_1 = (uint16_t*)&seed_A_separated_1; 42| | uint16_t* seed_A_origin_2 = (uint16_t*)&seed_A_separated_2; 43| | uint16_t* seed_A_origin_3 = (uint16_t*)&seed_A_separated_3; 44| | memcpy(&seed_A_separated_0[2], seed_A, BYTES_SEED_A); 45| | memcpy(&seed_A_separated_1[2], seed_A, BYTES_SEED_A); 46| | memcpy(&seed_A_separated_2[2], seed_A, BYTES_SEED_A); 47| | memcpy(&seed_A_separated_3[2], seed_A, BYTES_SEED_A); 48| | for (i = 0; i < PARAMS_N; i += 4) { 49| | seed_A_origin_0[0] = UINT16_TO_LE(i + 0); 50| | seed_A_origin_1[0] = UINT16_TO_LE(i + 1); 51| | seed_A_origin_2[0] = UINT16_TO_LE(i + 2); 52| | seed_A_origin_3[0] = UINT16_TO_LE(i + 3); 53| | OQS_SHA3_shake128_x4((unsigned char*)(a_row), (unsigned char*)(a_row + PARAMS_N), (unsigned char*)(a_row + 2*PARAMS_N), (unsigned char*)(a_row + 3*PARAMS_N), 54| | (unsigned long long)(2*PARAMS_N), seed_A_separated_0, seed_A_separated_1, seed_A_separated_2, seed_A_separated_3, 2 + BYTES_SEED_A); 55| |#endif /* USE_AES128_FOR_A */ 56| 819k| for (k = 0; k < 4 * PARAMS_N; k++) { ------------------ | | 11| 819k|#define PARAMS_N 640 ------------------ | Branch (56:21): [True: 819k, False: 320] ------------------ 57| 819k| a_row[k] = LE_TO_UINT16(a_row[k]); ------------------ | | 34| 819k| #define LE_TO_UINT16(n) (n) ------------------ 58| 819k| } 59| 2.88k| for (k = 0; k < PARAMS_NBAR; k++) { ------------------ | | 12| 2.88k|#define PARAMS_NBAR 8 ------------------ | Branch (59:21): [True: 2.56k, False: 320] ------------------ 60| 2.56k| uint16_t sum[4] = {0}; 61| 1.64M| for (j = 0; j < PARAMS_N; j++) { // Matrix-vector multiplication ------------------ | | 11| 1.64M|#define PARAMS_N 640 ------------------ | Branch (61:25): [True: 1.63M, False: 2.56k] ------------------ 62| 1.63M| uint16_t sp = s[k*PARAMS_N + j]; ------------------ | | 11| 1.63M|#define PARAMS_N 640 ------------------ 63| 1.63M| sum[0] += a_row[0*PARAMS_N + j] * sp; // Go through four lines with same s ------------------ | | 11| 1.63M|#define PARAMS_N 640 ------------------ 64| 1.63M| sum[1] += a_row[1*PARAMS_N + j] * sp; ------------------ | | 11| 1.63M|#define PARAMS_N 640 ------------------ 65| 1.63M| sum[2] += a_row[2*PARAMS_N + j] * sp; ------------------ | | 11| 1.63M|#define PARAMS_N 640 ------------------ 66| 1.63M| sum[3] += a_row[3*PARAMS_N + j] * sp; ------------------ | | 11| 1.63M|#define PARAMS_N 640 ------------------ 67| 1.63M| } 68| 2.56k| out[(i+0)*PARAMS_NBAR + k] += sum[0]; ------------------ | | 12| 2.56k|#define PARAMS_NBAR 8 ------------------ 69| 2.56k| out[(i+2)*PARAMS_NBAR + k] += sum[2]; ------------------ | | 12| 2.56k|#define PARAMS_NBAR 8 ------------------ 70| 2.56k| out[(i+1)*PARAMS_NBAR + k] += sum[1]; ------------------ | | 12| 2.56k|#define PARAMS_NBAR 8 ------------------ 71| 2.56k| out[(i+3)*PARAMS_NBAR + k] += sum[3]; ------------------ | | 12| 2.56k|#define PARAMS_NBAR 8 ------------------ 72| 2.56k| } 73| 320| } 74| | 75| 2|#if defined(USE_AES128_FOR_A) 76| 2| OQS_AES128_free_schedule(aes_key_schedule); 77| 2|#endif 78| 2| return 1; 79| 2|} oqs_kem_frodokem_976_aes_mul_add_as_plus_e_avx2: 4| 15|{ // Generate-and-multiply: generate matrix A (N x N) row-wise, multiply by s on the right. 5| | // Inputs: s, e (N x N_BAR) 6| | // Output: out = A*s + e (N x N_BAR) 7| 15| int i, j, k; 8| 15| ALIGN_HEADER(32) int16_t a_row[4*PARAMS_N] ALIGN_FOOTER(32) = {0}; 9| | 10| 58.5k| for (i = 0; i < (PARAMS_N*PARAMS_NBAR); i += 2) { ------------------ | | 11| 58.5k|#define PARAMS_N 976 ------------------ for (i = 0; i < (PARAMS_N*PARAMS_NBAR); i += 2) { ------------------ | | 12| 58.5k|#define PARAMS_NBAR 8 ------------------ | Branch (10:17): [True: 58.5k, False: 15] ------------------ 11| 58.5k| *((uint32_t*)&out[i]) = *((uint32_t*)&e[i]); 12| 58.5k| } 13| | 14| 15|#if defined(USE_AES128_FOR_A) 15| 15| int16_t a_row_temp[4*PARAMS_N] = {0}; // Take four lines of A at once 16| 15| uint8_t *aes_key_schedule; 17| 15| OQS_AES128_ECB_load_schedule(seed_A, (void **) &aes_key_schedule); 18| | 19| 1.84k| for (j = 0; j < PARAMS_N; j += PARAMS_STRIPE_STEP) { ------------------ | | 11| 1.84k|#define PARAMS_N 976 ------------------ for (j = 0; j < PARAMS_N; j += PARAMS_STRIPE_STEP) { ------------------ | | 16| 1.83k|#define PARAMS_STRIPE_STEP 8 ------------------ | Branch (19:17): [True: 1.83k, False: 15] ------------------ 20| 1.83k| a_row_temp[j + 1 + 0*PARAMS_N] = UINT16_TO_LE(j); // Loading values in the little-endian order ------------------ | | 11| 1.83k|#define PARAMS_N 976 ------------------ a_row_temp[j + 1 + 0*PARAMS_N] = UINT16_TO_LE(j); // Loading values in the little-endian order ------------------ | | 35| 1.83k| #define UINT16_TO_LE(n) (n) ------------------ 21| 1.83k| a_row_temp[j + 1 + 1*PARAMS_N] = UINT16_TO_LE(j); ------------------ | | 11| 1.83k|#define PARAMS_N 976 ------------------ a_row_temp[j + 1 + 1*PARAMS_N] = UINT16_TO_LE(j); ------------------ | | 35| 1.83k| #define UINT16_TO_LE(n) (n) ------------------ 22| 1.83k| a_row_temp[j + 1 + 2*PARAMS_N] = UINT16_TO_LE(j); ------------------ | | 11| 1.83k|#define PARAMS_N 976 ------------------ a_row_temp[j + 1 + 2*PARAMS_N] = UINT16_TO_LE(j); ------------------ | | 35| 1.83k| #define UINT16_TO_LE(n) (n) ------------------ 23| 1.83k| a_row_temp[j + 1 + 3*PARAMS_N] = UINT16_TO_LE(j); ------------------ | | 11| 1.83k|#define PARAMS_N 976 ------------------ a_row_temp[j + 1 + 3*PARAMS_N] = UINT16_TO_LE(j); ------------------ | | 35| 1.83k| #define UINT16_TO_LE(n) (n) ------------------ 24| 1.83k| } 25| | 26| 3.67k| for (i = 0; i < PARAMS_N; i += 4) { ------------------ | | 11| 3.67k|#define PARAMS_N 976 ------------------ | Branch (26:17): [True: 3.66k, False: 15] ------------------ 27| 450k| for (j = 0; j < PARAMS_N; j += PARAMS_STRIPE_STEP) { // Go through A, four rows at a time ------------------ | | 11| 450k|#define PARAMS_N 976 ------------------ for (j = 0; j < PARAMS_N; j += PARAMS_STRIPE_STEP) { // Go through A, four rows at a time ------------------ | | 16| 446k|#define PARAMS_STRIPE_STEP 8 ------------------ | Branch (27:21): [True: 446k, False: 3.66k] ------------------ 28| 446k| a_row_temp[j + 0*PARAMS_N] = UINT16_TO_LE(i+0); // Loading values in the little-endian order ------------------ | | 11| 446k|#define PARAMS_N 976 ------------------ a_row_temp[j + 0*PARAMS_N] = UINT16_TO_LE(i+0); // Loading values in the little-endian order ------------------ | | 35| 446k| #define UINT16_TO_LE(n) (n) ------------------ 29| 446k| a_row_temp[j + 1*PARAMS_N] = UINT16_TO_LE(i+1); ------------------ | | 11| 446k|#define PARAMS_N 976 ------------------ a_row_temp[j + 1*PARAMS_N] = UINT16_TO_LE(i+1); ------------------ | | 35| 446k| #define UINT16_TO_LE(n) (n) ------------------ 30| 446k| a_row_temp[j + 2*PARAMS_N] = UINT16_TO_LE(i+2); ------------------ | | 11| 446k|#define PARAMS_N 976 ------------------ a_row_temp[j + 2*PARAMS_N] = UINT16_TO_LE(i+2); ------------------ | | 35| 446k| #define UINT16_TO_LE(n) (n) ------------------ 31| 446k| a_row_temp[j + 3*PARAMS_N] = UINT16_TO_LE(i+3); ------------------ | | 11| 446k|#define PARAMS_N 976 ------------------ a_row_temp[j + 3*PARAMS_N] = UINT16_TO_LE(i+3); ------------------ | | 35| 446k| #define UINT16_TO_LE(n) (n) ------------------ 32| 446k| } 33| | 34| 3.66k| OQS_AES128_ECB_enc_sch((uint8_t*)a_row_temp, 4*PARAMS_N*sizeof(int16_t), aes_key_schedule, (uint8_t*)a_row); ------------------ | | 11| 3.66k|#define PARAMS_N 976 ------------------ 35| |#elif defined (USE_SHAKE128_FOR_A) 36| | uint8_t seed_A_separated_0[2 + BYTES_SEED_A]; 37| | uint8_t seed_A_separated_1[2 + BYTES_SEED_A]; 38| | uint8_t seed_A_separated_2[2 + BYTES_SEED_A]; 39| | uint8_t seed_A_separated_3[2 + BYTES_SEED_A]; 40| | uint16_t* seed_A_origin_0 = (uint16_t*)&seed_A_separated_0; 41| | uint16_t* seed_A_origin_1 = (uint16_t*)&seed_A_separated_1; 42| | uint16_t* seed_A_origin_2 = (uint16_t*)&seed_A_separated_2; 43| | uint16_t* seed_A_origin_3 = (uint16_t*)&seed_A_separated_3; 44| | memcpy(&seed_A_separated_0[2], seed_A, BYTES_SEED_A); 45| | memcpy(&seed_A_separated_1[2], seed_A, BYTES_SEED_A); 46| | memcpy(&seed_A_separated_2[2], seed_A, BYTES_SEED_A); 47| | memcpy(&seed_A_separated_3[2], seed_A, BYTES_SEED_A); 48| | for (i = 0; i < PARAMS_N; i += 4) { 49| | seed_A_origin_0[0] = UINT16_TO_LE(i + 0); 50| | seed_A_origin_1[0] = UINT16_TO_LE(i + 1); 51| | seed_A_origin_2[0] = UINT16_TO_LE(i + 2); 52| | seed_A_origin_3[0] = UINT16_TO_LE(i + 3); 53| | OQS_SHA3_shake128_x4((unsigned char*)(a_row), (unsigned char*)(a_row + PARAMS_N), (unsigned char*)(a_row + 2*PARAMS_N), (unsigned char*)(a_row + 3*PARAMS_N), 54| | (unsigned long long)(2*PARAMS_N), seed_A_separated_0, seed_A_separated_1, seed_A_separated_2, seed_A_separated_3, 2 + BYTES_SEED_A); 55| |#endif /* USE_AES128_FOR_A */ 56| 14.2M| for (k = 0; k < 4 * PARAMS_N; k++) { ------------------ | | 11| 14.2M|#define PARAMS_N 976 ------------------ | Branch (56:21): [True: 14.2M, False: 3.66k] ------------------ 57| 14.2M| a_row[k] = LE_TO_UINT16(a_row[k]); ------------------ | | 34| 14.2M| #define LE_TO_UINT16(n) (n) ------------------ 58| 14.2M| } 59| 32.9k| for (k = 0; k < PARAMS_NBAR; k++) { ------------------ | | 12| 32.9k|#define PARAMS_NBAR 8 ------------------ | Branch (59:21): [True: 29.2k, False: 3.66k] ------------------ 60| 29.2k| uint16_t sum[4] = {0}; 61| 28.6M| for (j = 0; j < PARAMS_N; j++) { // Matrix-vector multiplication ------------------ | | 11| 28.6M|#define PARAMS_N 976 ------------------ | Branch (61:25): [True: 28.5M, False: 29.2k] ------------------ 62| 28.5M| uint16_t sp = s[k*PARAMS_N + j]; ------------------ | | 11| 28.5M|#define PARAMS_N 976 ------------------ 63| 28.5M| sum[0] += a_row[0*PARAMS_N + j] * sp; // Go through four lines with same s ------------------ | | 11| 28.5M|#define PARAMS_N 976 ------------------ 64| 28.5M| sum[1] += a_row[1*PARAMS_N + j] * sp; ------------------ | | 11| 28.5M|#define PARAMS_N 976 ------------------ 65| 28.5M| sum[2] += a_row[2*PARAMS_N + j] * sp; ------------------ | | 11| 28.5M|#define PARAMS_N 976 ------------------ 66| 28.5M| sum[3] += a_row[3*PARAMS_N + j] * sp; ------------------ | | 11| 28.5M|#define PARAMS_N 976 ------------------ 67| 28.5M| } 68| 29.2k| out[(i+0)*PARAMS_NBAR + k] += sum[0]; ------------------ | | 12| 29.2k|#define PARAMS_NBAR 8 ------------------ 69| 29.2k| out[(i+2)*PARAMS_NBAR + k] += sum[2]; ------------------ | | 12| 29.2k|#define PARAMS_NBAR 8 ------------------ 70| 29.2k| out[(i+1)*PARAMS_NBAR + k] += sum[1]; ------------------ | | 12| 29.2k|#define PARAMS_NBAR 8 ------------------ 71| 29.2k| out[(i+3)*PARAMS_NBAR + k] += sum[3]; ------------------ | | 12| 29.2k|#define PARAMS_NBAR 8 ------------------ 72| 29.2k| } 73| 3.66k| } 74| | 75| 15|#if defined(USE_AES128_FOR_A) 76| 15| OQS_AES128_free_schedule(aes_key_schedule); 77| 15|#endif 78| 15| return 1; 79| 15|} oqs_kem_frodokem_1344_aes_mul_add_as_plus_e_avx2: 4| 8|{ // Generate-and-multiply: generate matrix A (N x N) row-wise, multiply by s on the right. 5| | // Inputs: s, e (N x N_BAR) 6| | // Output: out = A*s + e (N x N_BAR) 7| 8| int i, j, k; 8| 8| ALIGN_HEADER(32) int16_t a_row[4*PARAMS_N] ALIGN_FOOTER(32) = {0}; 9| | 10| 43.0k| for (i = 0; i < (PARAMS_N*PARAMS_NBAR); i += 2) { ------------------ | | 11| 43.0k|#define PARAMS_N 1344 ------------------ for (i = 0; i < (PARAMS_N*PARAMS_NBAR); i += 2) { ------------------ | | 12| 43.0k|#define PARAMS_NBAR 8 ------------------ | Branch (10:17): [True: 43.0k, False: 8] ------------------ 11| 43.0k| *((uint32_t*)&out[i]) = *((uint32_t*)&e[i]); 12| 43.0k| } 13| | 14| 8|#if defined(USE_AES128_FOR_A) 15| 8| int16_t a_row_temp[4*PARAMS_N] = {0}; // Take four lines of A at once 16| 8| uint8_t *aes_key_schedule; 17| 8| OQS_AES128_ECB_load_schedule(seed_A, (void **) &aes_key_schedule); 18| | 19| 1.35k| for (j = 0; j < PARAMS_N; j += PARAMS_STRIPE_STEP) { ------------------ | | 11| 1.35k|#define PARAMS_N 1344 ------------------ for (j = 0; j < PARAMS_N; j += PARAMS_STRIPE_STEP) { ------------------ | | 16| 1.34k|#define PARAMS_STRIPE_STEP 8 ------------------ | Branch (19:17): [True: 1.34k, False: 8] ------------------ 20| 1.34k| a_row_temp[j + 1 + 0*PARAMS_N] = UINT16_TO_LE(j); // Loading values in the little-endian order ------------------ | | 11| 1.34k|#define PARAMS_N 1344 ------------------ a_row_temp[j + 1 + 0*PARAMS_N] = UINT16_TO_LE(j); // Loading values in the little-endian order ------------------ | | 35| 1.34k| #define UINT16_TO_LE(n) (n) ------------------ 21| 1.34k| a_row_temp[j + 1 + 1*PARAMS_N] = UINT16_TO_LE(j); ------------------ | | 11| 1.34k|#define PARAMS_N 1344 ------------------ a_row_temp[j + 1 + 1*PARAMS_N] = UINT16_TO_LE(j); ------------------ | | 35| 1.34k| #define UINT16_TO_LE(n) (n) ------------------ 22| 1.34k| a_row_temp[j + 1 + 2*PARAMS_N] = UINT16_TO_LE(j); ------------------ | | 11| 1.34k|#define PARAMS_N 1344 ------------------ a_row_temp[j + 1 + 2*PARAMS_N] = UINT16_TO_LE(j); ------------------ | | 35| 1.34k| #define UINT16_TO_LE(n) (n) ------------------ 23| 1.34k| a_row_temp[j + 1 + 3*PARAMS_N] = UINT16_TO_LE(j); ------------------ | | 11| 1.34k|#define PARAMS_N 1344 ------------------ a_row_temp[j + 1 + 3*PARAMS_N] = UINT16_TO_LE(j); ------------------ | | 35| 1.34k| #define UINT16_TO_LE(n) (n) ------------------ 24| 1.34k| } 25| | 26| 2.69k| for (i = 0; i < PARAMS_N; i += 4) { ------------------ | | 11| 2.69k|#define PARAMS_N 1344 ------------------ | Branch (26:17): [True: 2.68k, False: 8] ------------------ 27| 454k| for (j = 0; j < PARAMS_N; j += PARAMS_STRIPE_STEP) { // Go through A, four rows at a time ------------------ | | 11| 454k|#define PARAMS_N 1344 ------------------ for (j = 0; j < PARAMS_N; j += PARAMS_STRIPE_STEP) { // Go through A, four rows at a time ------------------ | | 16| 451k|#define PARAMS_STRIPE_STEP 8 ------------------ | Branch (27:21): [True: 451k, False: 2.68k] ------------------ 28| 451k| a_row_temp[j + 0*PARAMS_N] = UINT16_TO_LE(i+0); // Loading values in the little-endian order ------------------ | | 11| 451k|#define PARAMS_N 1344 ------------------ a_row_temp[j + 0*PARAMS_N] = UINT16_TO_LE(i+0); // Loading values in the little-endian order ------------------ | | 35| 451k| #define UINT16_TO_LE(n) (n) ------------------ 29| 451k| a_row_temp[j + 1*PARAMS_N] = UINT16_TO_LE(i+1); ------------------ | | 11| 451k|#define PARAMS_N 1344 ------------------ a_row_temp[j + 1*PARAMS_N] = UINT16_TO_LE(i+1); ------------------ | | 35| 451k| #define UINT16_TO_LE(n) (n) ------------------ 30| 451k| a_row_temp[j + 2*PARAMS_N] = UINT16_TO_LE(i+2); ------------------ | | 11| 451k|#define PARAMS_N 1344 ------------------ a_row_temp[j + 2*PARAMS_N] = UINT16_TO_LE(i+2); ------------------ | | 35| 451k| #define UINT16_TO_LE(n) (n) ------------------ 31| 451k| a_row_temp[j + 3*PARAMS_N] = UINT16_TO_LE(i+3); ------------------ | | 11| 451k|#define PARAMS_N 1344 ------------------ a_row_temp[j + 3*PARAMS_N] = UINT16_TO_LE(i+3); ------------------ | | 35| 451k| #define UINT16_TO_LE(n) (n) ------------------ 32| 451k| } 33| | 34| 2.68k| OQS_AES128_ECB_enc_sch((uint8_t*)a_row_temp, 4*PARAMS_N*sizeof(int16_t), aes_key_schedule, (uint8_t*)a_row); ------------------ | | 11| 2.68k|#define PARAMS_N 1344 ------------------ 35| |#elif defined (USE_SHAKE128_FOR_A) 36| | uint8_t seed_A_separated_0[2 + BYTES_SEED_A]; 37| | uint8_t seed_A_separated_1[2 + BYTES_SEED_A]; 38| | uint8_t seed_A_separated_2[2 + BYTES_SEED_A]; 39| | uint8_t seed_A_separated_3[2 + BYTES_SEED_A]; 40| | uint16_t* seed_A_origin_0 = (uint16_t*)&seed_A_separated_0; 41| | uint16_t* seed_A_origin_1 = (uint16_t*)&seed_A_separated_1; 42| | uint16_t* seed_A_origin_2 = (uint16_t*)&seed_A_separated_2; 43| | uint16_t* seed_A_origin_3 = (uint16_t*)&seed_A_separated_3; 44| | memcpy(&seed_A_separated_0[2], seed_A, BYTES_SEED_A); 45| | memcpy(&seed_A_separated_1[2], seed_A, BYTES_SEED_A); 46| | memcpy(&seed_A_separated_2[2], seed_A, BYTES_SEED_A); 47| | memcpy(&seed_A_separated_3[2], seed_A, BYTES_SEED_A); 48| | for (i = 0; i < PARAMS_N; i += 4) { 49| | seed_A_origin_0[0] = UINT16_TO_LE(i + 0); 50| | seed_A_origin_1[0] = UINT16_TO_LE(i + 1); 51| | seed_A_origin_2[0] = UINT16_TO_LE(i + 2); 52| | seed_A_origin_3[0] = UINT16_TO_LE(i + 3); 53| | OQS_SHA3_shake128_x4((unsigned char*)(a_row), (unsigned char*)(a_row + PARAMS_N), (unsigned char*)(a_row + 2*PARAMS_N), (unsigned char*)(a_row + 3*PARAMS_N), 54| | (unsigned long long)(2*PARAMS_N), seed_A_separated_0, seed_A_separated_1, seed_A_separated_2, seed_A_separated_3, 2 + BYTES_SEED_A); 55| |#endif /* USE_AES128_FOR_A */ 56| 14.4M| for (k = 0; k < 4 * PARAMS_N; k++) { ------------------ | | 11| 14.4M|#define PARAMS_N 1344 ------------------ | Branch (56:21): [True: 14.4M, False: 2.68k] ------------------ 57| 14.4M| a_row[k] = LE_TO_UINT16(a_row[k]); ------------------ | | 34| 14.4M| #define LE_TO_UINT16(n) (n) ------------------ 58| 14.4M| } 59| 24.1k| for (k = 0; k < PARAMS_NBAR; k++) { ------------------ | | 12| 24.1k|#define PARAMS_NBAR 8 ------------------ | Branch (59:21): [True: 21.5k, False: 2.68k] ------------------ 60| 21.5k| uint16_t sum[4] = {0}; 61| 28.9M| for (j = 0; j < PARAMS_N; j++) { // Matrix-vector multiplication ------------------ | | 11| 28.9M|#define PARAMS_N 1344 ------------------ | Branch (61:25): [True: 28.9M, False: 21.5k] ------------------ 62| 28.9M| uint16_t sp = s[k*PARAMS_N + j]; ------------------ | | 11| 28.9M|#define PARAMS_N 1344 ------------------ 63| 28.9M| sum[0] += a_row[0*PARAMS_N + j] * sp; // Go through four lines with same s ------------------ | | 11| 28.9M|#define PARAMS_N 1344 ------------------ 64| 28.9M| sum[1] += a_row[1*PARAMS_N + j] * sp; ------------------ | | 11| 28.9M|#define PARAMS_N 1344 ------------------ 65| 28.9M| sum[2] += a_row[2*PARAMS_N + j] * sp; ------------------ | | 11| 28.9M|#define PARAMS_N 1344 ------------------ 66| 28.9M| sum[3] += a_row[3*PARAMS_N + j] * sp; ------------------ | | 11| 28.9M|#define PARAMS_N 1344 ------------------ 67| 28.9M| } 68| 21.5k| out[(i+0)*PARAMS_NBAR + k] += sum[0]; ------------------ | | 12| 21.5k|#define PARAMS_NBAR 8 ------------------ 69| 21.5k| out[(i+2)*PARAMS_NBAR + k] += sum[2]; ------------------ | | 12| 21.5k|#define PARAMS_NBAR 8 ------------------ 70| 21.5k| out[(i+1)*PARAMS_NBAR + k] += sum[1]; ------------------ | | 12| 21.5k|#define PARAMS_NBAR 8 ------------------ 71| 21.5k| out[(i+3)*PARAMS_NBAR + k] += sum[3]; ------------------ | | 12| 21.5k|#define PARAMS_NBAR 8 ------------------ 72| 21.5k| } 73| 2.68k| } 74| | 75| 8|#if defined(USE_AES128_FOR_A) 76| 8| OQS_AES128_free_schedule(aes_key_schedule); 77| 8|#endif 78| 8| return 1; 79| 8|} oqs_kem_frodokem_640_shake_mul_add_as_plus_e_avx2: 4| 3|{ // Generate-and-multiply: generate matrix A (N x N) row-wise, multiply by s on the right. 5| | // Inputs: s, e (N x N_BAR) 6| | // Output: out = A*s + e (N x N_BAR) 7| 3| int i, j, k; 8| 3| ALIGN_HEADER(32) int16_t a_row[4*PARAMS_N] ALIGN_FOOTER(32) = {0}; 9| | 10| 7.68k| for (i = 0; i < (PARAMS_N*PARAMS_NBAR); i += 2) { ------------------ | | 11| 7.68k|#define PARAMS_N 640 ------------------ for (i = 0; i < (PARAMS_N*PARAMS_NBAR); i += 2) { ------------------ | | 12| 7.68k|#define PARAMS_NBAR 8 ------------------ | Branch (10:17): [True: 7.68k, False: 3] ------------------ 11| 7.68k| *((uint32_t*)&out[i]) = *((uint32_t*)&e[i]); 12| 7.68k| } 13| | 14| |#if defined(USE_AES128_FOR_A) 15| | int16_t a_row_temp[4*PARAMS_N] = {0}; // Take four lines of A at once 16| | uint8_t *aes_key_schedule; 17| | OQS_AES128_ECB_load_schedule(seed_A, (void **) &aes_key_schedule); 18| | 19| | for (j = 0; j < PARAMS_N; j += PARAMS_STRIPE_STEP) { 20| | a_row_temp[j + 1 + 0*PARAMS_N] = UINT16_TO_LE(j); // Loading values in the little-endian order 21| | a_row_temp[j + 1 + 1*PARAMS_N] = UINT16_TO_LE(j); 22| | a_row_temp[j + 1 + 2*PARAMS_N] = UINT16_TO_LE(j); 23| | a_row_temp[j + 1 + 3*PARAMS_N] = UINT16_TO_LE(j); 24| | } 25| | 26| | for (i = 0; i < PARAMS_N; i += 4) { 27| | for (j = 0; j < PARAMS_N; j += PARAMS_STRIPE_STEP) { // Go through A, four rows at a time 28| | a_row_temp[j + 0*PARAMS_N] = UINT16_TO_LE(i+0); // Loading values in the little-endian order 29| | a_row_temp[j + 1*PARAMS_N] = UINT16_TO_LE(i+1); 30| | a_row_temp[j + 2*PARAMS_N] = UINT16_TO_LE(i+2); 31| | a_row_temp[j + 3*PARAMS_N] = UINT16_TO_LE(i+3); 32| | } 33| | 34| | OQS_AES128_ECB_enc_sch((uint8_t*)a_row_temp, 4*PARAMS_N*sizeof(int16_t), aes_key_schedule, (uint8_t*)a_row); 35| |#elif defined (USE_SHAKE128_FOR_A) 36| | uint8_t seed_A_separated_0[2 + BYTES_SEED_A]; 37| 3| uint8_t seed_A_separated_1[2 + BYTES_SEED_A]; 38| 3| uint8_t seed_A_separated_2[2 + BYTES_SEED_A]; 39| 3| uint8_t seed_A_separated_3[2 + BYTES_SEED_A]; 40| 3| uint16_t* seed_A_origin_0 = (uint16_t*)&seed_A_separated_0; 41| 3| uint16_t* seed_A_origin_1 = (uint16_t*)&seed_A_separated_1; 42| 3| uint16_t* seed_A_origin_2 = (uint16_t*)&seed_A_separated_2; 43| 3| uint16_t* seed_A_origin_3 = (uint16_t*)&seed_A_separated_3; 44| 3| memcpy(&seed_A_separated_0[2], seed_A, BYTES_SEED_A); ------------------ | | 18| 3|#define BYTES_SEED_A 16 ------------------ 45| 3| memcpy(&seed_A_separated_1[2], seed_A, BYTES_SEED_A); ------------------ | | 18| 3|#define BYTES_SEED_A 16 ------------------ 46| 3| memcpy(&seed_A_separated_2[2], seed_A, BYTES_SEED_A); ------------------ | | 18| 3|#define BYTES_SEED_A 16 ------------------ 47| 3| memcpy(&seed_A_separated_3[2], seed_A, BYTES_SEED_A); ------------------ | | 18| 3|#define BYTES_SEED_A 16 ------------------ 48| 483| for (i = 0; i < PARAMS_N; i += 4) { ------------------ | | 11| 483|#define PARAMS_N 640 ------------------ | Branch (48:17): [True: 480, False: 3] ------------------ 49| 480| seed_A_origin_0[0] = UINT16_TO_LE(i + 0); ------------------ | | 35| 480| #define UINT16_TO_LE(n) (n) ------------------ 50| 480| seed_A_origin_1[0] = UINT16_TO_LE(i + 1); ------------------ | | 35| 480| #define UINT16_TO_LE(n) (n) ------------------ 51| 480| seed_A_origin_2[0] = UINT16_TO_LE(i + 2); ------------------ | | 35| 480| #define UINT16_TO_LE(n) (n) ------------------ 52| 480| seed_A_origin_3[0] = UINT16_TO_LE(i + 3); ------------------ | | 35| 480| #define UINT16_TO_LE(n) (n) ------------------ 53| 480| OQS_SHA3_shake128_x4((unsigned char*)(a_row), (unsigned char*)(a_row + PARAMS_N), (unsigned char*)(a_row + 2*PARAMS_N), (unsigned char*)(a_row + 3*PARAMS_N), ------------------ | | 11| 480|#define PARAMS_N 640 ------------------ OQS_SHA3_shake128_x4((unsigned char*)(a_row), (unsigned char*)(a_row + PARAMS_N), (unsigned char*)(a_row + 2*PARAMS_N), (unsigned char*)(a_row + 3*PARAMS_N), ------------------ | | 11| 480|#define PARAMS_N 640 ------------------ OQS_SHA3_shake128_x4((unsigned char*)(a_row), (unsigned char*)(a_row + PARAMS_N), (unsigned char*)(a_row + 2*PARAMS_N), (unsigned char*)(a_row + 3*PARAMS_N), ------------------ | | 11| 480|#define PARAMS_N 640 ------------------ 54| 480| (unsigned long long)(2*PARAMS_N), seed_A_separated_0, seed_A_separated_1, seed_A_separated_2, seed_A_separated_3, 2 + BYTES_SEED_A); ------------------ | | 11| 480|#define PARAMS_N 640 ------------------ (unsigned long long)(2*PARAMS_N), seed_A_separated_0, seed_A_separated_1, seed_A_separated_2, seed_A_separated_3, 2 + BYTES_SEED_A); ------------------ | | 18| 480|#define BYTES_SEED_A 16 ------------------ 55| 480|#endif /* USE_AES128_FOR_A */ 56| 1.22M| for (k = 0; k < 4 * PARAMS_N; k++) { ------------------ | | 11| 1.22M|#define PARAMS_N 640 ------------------ | Branch (56:21): [True: 1.22M, False: 480] ------------------ 57| 1.22M| a_row[k] = LE_TO_UINT16(a_row[k]); ------------------ | | 34| 1.22M| #define LE_TO_UINT16(n) (n) ------------------ 58| 1.22M| } 59| 4.32k| for (k = 0; k < PARAMS_NBAR; k++) { ------------------ | | 12| 4.32k|#define PARAMS_NBAR 8 ------------------ | Branch (59:21): [True: 3.84k, False: 480] ------------------ 60| 3.84k| uint16_t sum[4] = {0}; 61| 2.46M| for (j = 0; j < PARAMS_N; j++) { // Matrix-vector multiplication ------------------ | | 11| 2.46M|#define PARAMS_N 640 ------------------ | Branch (61:25): [True: 2.45M, False: 3.84k] ------------------ 62| 2.45M| uint16_t sp = s[k*PARAMS_N + j]; ------------------ | | 11| 2.45M|#define PARAMS_N 640 ------------------ 63| 2.45M| sum[0] += a_row[0*PARAMS_N + j] * sp; // Go through four lines with same s ------------------ | | 11| 2.45M|#define PARAMS_N 640 ------------------ 64| 2.45M| sum[1] += a_row[1*PARAMS_N + j] * sp; ------------------ | | 11| 2.45M|#define PARAMS_N 640 ------------------ 65| 2.45M| sum[2] += a_row[2*PARAMS_N + j] * sp; ------------------ | | 11| 2.45M|#define PARAMS_N 640 ------------------ 66| 2.45M| sum[3] += a_row[3*PARAMS_N + j] * sp; ------------------ | | 11| 2.45M|#define PARAMS_N 640 ------------------ 67| 2.45M| } 68| 3.84k| out[(i+0)*PARAMS_NBAR + k] += sum[0]; ------------------ | | 12| 3.84k|#define PARAMS_NBAR 8 ------------------ 69| 3.84k| out[(i+2)*PARAMS_NBAR + k] += sum[2]; ------------------ | | 12| 3.84k|#define PARAMS_NBAR 8 ------------------ 70| 3.84k| out[(i+1)*PARAMS_NBAR + k] += sum[1]; ------------------ | | 12| 3.84k|#define PARAMS_NBAR 8 ------------------ 71| 3.84k| out[(i+3)*PARAMS_NBAR + k] += sum[3]; ------------------ | | 12| 3.84k|#define PARAMS_NBAR 8 ------------------ 72| 3.84k| } 73| 480| } 74| | 75| |#if defined(USE_AES128_FOR_A) 76| | OQS_AES128_free_schedule(aes_key_schedule); 77| |#endif 78| 3| return 1; 79| 3|} oqs_kem_frodokem_976_shake_mul_add_as_plus_e_avx2: 4| 11|{ // Generate-and-multiply: generate matrix A (N x N) row-wise, multiply by s on the right. 5| | // Inputs: s, e (N x N_BAR) 6| | // Output: out = A*s + e (N x N_BAR) 7| 11| int i, j, k; 8| 11| ALIGN_HEADER(32) int16_t a_row[4*PARAMS_N] ALIGN_FOOTER(32) = {0}; 9| | 10| 42.9k| for (i = 0; i < (PARAMS_N*PARAMS_NBAR); i += 2) { ------------------ | | 11| 42.9k|#define PARAMS_N 976 ------------------ for (i = 0; i < (PARAMS_N*PARAMS_NBAR); i += 2) { ------------------ | | 12| 42.9k|#define PARAMS_NBAR 8 ------------------ | Branch (10:17): [True: 42.9k, False: 11] ------------------ 11| 42.9k| *((uint32_t*)&out[i]) = *((uint32_t*)&e[i]); 12| 42.9k| } 13| | 14| |#if defined(USE_AES128_FOR_A) 15| | int16_t a_row_temp[4*PARAMS_N] = {0}; // Take four lines of A at once 16| | uint8_t *aes_key_schedule; 17| | OQS_AES128_ECB_load_schedule(seed_A, (void **) &aes_key_schedule); 18| | 19| | for (j = 0; j < PARAMS_N; j += PARAMS_STRIPE_STEP) { 20| | a_row_temp[j + 1 + 0*PARAMS_N] = UINT16_TO_LE(j); // Loading values in the little-endian order 21| | a_row_temp[j + 1 + 1*PARAMS_N] = UINT16_TO_LE(j); 22| | a_row_temp[j + 1 + 2*PARAMS_N] = UINT16_TO_LE(j); 23| | a_row_temp[j + 1 + 3*PARAMS_N] = UINT16_TO_LE(j); 24| | } 25| | 26| | for (i = 0; i < PARAMS_N; i += 4) { 27| | for (j = 0; j < PARAMS_N; j += PARAMS_STRIPE_STEP) { // Go through A, four rows at a time 28| | a_row_temp[j + 0*PARAMS_N] = UINT16_TO_LE(i+0); // Loading values in the little-endian order 29| | a_row_temp[j + 1*PARAMS_N] = UINT16_TO_LE(i+1); 30| | a_row_temp[j + 2*PARAMS_N] = UINT16_TO_LE(i+2); 31| | a_row_temp[j + 3*PARAMS_N] = UINT16_TO_LE(i+3); 32| | } 33| | 34| | OQS_AES128_ECB_enc_sch((uint8_t*)a_row_temp, 4*PARAMS_N*sizeof(int16_t), aes_key_schedule, (uint8_t*)a_row); 35| |#elif defined (USE_SHAKE128_FOR_A) 36| | uint8_t seed_A_separated_0[2 + BYTES_SEED_A]; 37| 11| uint8_t seed_A_separated_1[2 + BYTES_SEED_A]; 38| 11| uint8_t seed_A_separated_2[2 + BYTES_SEED_A]; 39| 11| uint8_t seed_A_separated_3[2 + BYTES_SEED_A]; 40| 11| uint16_t* seed_A_origin_0 = (uint16_t*)&seed_A_separated_0; 41| 11| uint16_t* seed_A_origin_1 = (uint16_t*)&seed_A_separated_1; 42| 11| uint16_t* seed_A_origin_2 = (uint16_t*)&seed_A_separated_2; 43| 11| uint16_t* seed_A_origin_3 = (uint16_t*)&seed_A_separated_3; 44| 11| memcpy(&seed_A_separated_0[2], seed_A, BYTES_SEED_A); ------------------ | | 18| 11|#define BYTES_SEED_A 16 ------------------ 45| 11| memcpy(&seed_A_separated_1[2], seed_A, BYTES_SEED_A); ------------------ | | 18| 11|#define BYTES_SEED_A 16 ------------------ 46| 11| memcpy(&seed_A_separated_2[2], seed_A, BYTES_SEED_A); ------------------ | | 18| 11|#define BYTES_SEED_A 16 ------------------ 47| 11| memcpy(&seed_A_separated_3[2], seed_A, BYTES_SEED_A); ------------------ | | 18| 11|#define BYTES_SEED_A 16 ------------------ 48| 2.69k| for (i = 0; i < PARAMS_N; i += 4) { ------------------ | | 11| 2.69k|#define PARAMS_N 976 ------------------ | Branch (48:17): [True: 2.68k, False: 11] ------------------ 49| 2.68k| seed_A_origin_0[0] = UINT16_TO_LE(i + 0); ------------------ | | 35| 2.68k| #define UINT16_TO_LE(n) (n) ------------------ 50| 2.68k| seed_A_origin_1[0] = UINT16_TO_LE(i + 1); ------------------ | | 35| 2.68k| #define UINT16_TO_LE(n) (n) ------------------ 51| 2.68k| seed_A_origin_2[0] = UINT16_TO_LE(i + 2); ------------------ | | 35| 2.68k| #define UINT16_TO_LE(n) (n) ------------------ 52| 2.68k| seed_A_origin_3[0] = UINT16_TO_LE(i + 3); ------------------ | | 35| 2.68k| #define UINT16_TO_LE(n) (n) ------------------ 53| 2.68k| OQS_SHA3_shake128_x4((unsigned char*)(a_row), (unsigned char*)(a_row + PARAMS_N), (unsigned char*)(a_row + 2*PARAMS_N), (unsigned char*)(a_row + 3*PARAMS_N), ------------------ | | 11| 2.68k|#define PARAMS_N 976 ------------------ OQS_SHA3_shake128_x4((unsigned char*)(a_row), (unsigned char*)(a_row + PARAMS_N), (unsigned char*)(a_row + 2*PARAMS_N), (unsigned char*)(a_row + 3*PARAMS_N), ------------------ | | 11| 2.68k|#define PARAMS_N 976 ------------------ OQS_SHA3_shake128_x4((unsigned char*)(a_row), (unsigned char*)(a_row + PARAMS_N), (unsigned char*)(a_row + 2*PARAMS_N), (unsigned char*)(a_row + 3*PARAMS_N), ------------------ | | 11| 2.68k|#define PARAMS_N 976 ------------------ 54| 2.68k| (unsigned long long)(2*PARAMS_N), seed_A_separated_0, seed_A_separated_1, seed_A_separated_2, seed_A_separated_3, 2 + BYTES_SEED_A); ------------------ | | 11| 2.68k|#define PARAMS_N 976 ------------------ (unsigned long long)(2*PARAMS_N), seed_A_separated_0, seed_A_separated_1, seed_A_separated_2, seed_A_separated_3, 2 + BYTES_SEED_A); ------------------ | | 18| 2.68k|#define BYTES_SEED_A 16 ------------------ 55| 2.68k|#endif /* USE_AES128_FOR_A */ 56| 10.4M| for (k = 0; k < 4 * PARAMS_N; k++) { ------------------ | | 11| 10.4M|#define PARAMS_N 976 ------------------ | Branch (56:21): [True: 10.4M, False: 2.68k] ------------------ 57| 10.4M| a_row[k] = LE_TO_UINT16(a_row[k]); ------------------ | | 34| 10.4M| #define LE_TO_UINT16(n) (n) ------------------ 58| 10.4M| } 59| 24.1k| for (k = 0; k < PARAMS_NBAR; k++) { ------------------ | | 12| 24.1k|#define PARAMS_NBAR 8 ------------------ | Branch (59:21): [True: 21.4k, False: 2.68k] ------------------ 60| 21.4k| uint16_t sum[4] = {0}; 61| 20.9M| for (j = 0; j < PARAMS_N; j++) { // Matrix-vector multiplication ------------------ | | 11| 20.9M|#define PARAMS_N 976 ------------------ | Branch (61:25): [True: 20.9M, False: 21.4k] ------------------ 62| 20.9M| uint16_t sp = s[k*PARAMS_N + j]; ------------------ | | 11| 20.9M|#define PARAMS_N 976 ------------------ 63| 20.9M| sum[0] += a_row[0*PARAMS_N + j] * sp; // Go through four lines with same s ------------------ | | 11| 20.9M|#define PARAMS_N 976 ------------------ 64| 20.9M| sum[1] += a_row[1*PARAMS_N + j] * sp; ------------------ | | 11| 20.9M|#define PARAMS_N 976 ------------------ 65| 20.9M| sum[2] += a_row[2*PARAMS_N + j] * sp; ------------------ | | 11| 20.9M|#define PARAMS_N 976 ------------------ 66| 20.9M| sum[3] += a_row[3*PARAMS_N + j] * sp; ------------------ | | 11| 20.9M|#define PARAMS_N 976 ------------------ 67| 20.9M| } 68| 21.4k| out[(i+0)*PARAMS_NBAR + k] += sum[0]; ------------------ | | 12| 21.4k|#define PARAMS_NBAR 8 ------------------ 69| 21.4k| out[(i+2)*PARAMS_NBAR + k] += sum[2]; ------------------ | | 12| 21.4k|#define PARAMS_NBAR 8 ------------------ 70| 21.4k| out[(i+1)*PARAMS_NBAR + k] += sum[1]; ------------------ | | 12| 21.4k|#define PARAMS_NBAR 8 ------------------ 71| 21.4k| out[(i+3)*PARAMS_NBAR + k] += sum[3]; ------------------ | | 12| 21.4k|#define PARAMS_NBAR 8 ------------------ 72| 21.4k| } 73| 2.68k| } 74| | 75| |#if defined(USE_AES128_FOR_A) 76| | OQS_AES128_free_schedule(aes_key_schedule); 77| |#endif 78| 11| return 1; 79| 11|} oqs_kem_frodokem_1344_shake_mul_add_as_plus_e_avx2: 4| 9|{ // Generate-and-multiply: generate matrix A (N x N) row-wise, multiply by s on the right. 5| | // Inputs: s, e (N x N_BAR) 6| | // Output: out = A*s + e (N x N_BAR) 7| 9| int i, j, k; 8| 9| ALIGN_HEADER(32) int16_t a_row[4*PARAMS_N] ALIGN_FOOTER(32) = {0}; 9| | 10| 48.3k| for (i = 0; i < (PARAMS_N*PARAMS_NBAR); i += 2) { ------------------ | | 11| 48.3k|#define PARAMS_N 1344 ------------------ for (i = 0; i < (PARAMS_N*PARAMS_NBAR); i += 2) { ------------------ | | 12| 48.3k|#define PARAMS_NBAR 8 ------------------ | Branch (10:17): [True: 48.3k, False: 9] ------------------ 11| 48.3k| *((uint32_t*)&out[i]) = *((uint32_t*)&e[i]); 12| 48.3k| } 13| | 14| |#if defined(USE_AES128_FOR_A) 15| | int16_t a_row_temp[4*PARAMS_N] = {0}; // Take four lines of A at once 16| | uint8_t *aes_key_schedule; 17| | OQS_AES128_ECB_load_schedule(seed_A, (void **) &aes_key_schedule); 18| | 19| | for (j = 0; j < PARAMS_N; j += PARAMS_STRIPE_STEP) { 20| | a_row_temp[j + 1 + 0*PARAMS_N] = UINT16_TO_LE(j); // Loading values in the little-endian order 21| | a_row_temp[j + 1 + 1*PARAMS_N] = UINT16_TO_LE(j); 22| | a_row_temp[j + 1 + 2*PARAMS_N] = UINT16_TO_LE(j); 23| | a_row_temp[j + 1 + 3*PARAMS_N] = UINT16_TO_LE(j); 24| | } 25| | 26| | for (i = 0; i < PARAMS_N; i += 4) { 27| | for (j = 0; j < PARAMS_N; j += PARAMS_STRIPE_STEP) { // Go through A, four rows at a time 28| | a_row_temp[j + 0*PARAMS_N] = UINT16_TO_LE(i+0); // Loading values in the little-endian order 29| | a_row_temp[j + 1*PARAMS_N] = UINT16_TO_LE(i+1); 30| | a_row_temp[j + 2*PARAMS_N] = UINT16_TO_LE(i+2); 31| | a_row_temp[j + 3*PARAMS_N] = UINT16_TO_LE(i+3); 32| | } 33| | 34| | OQS_AES128_ECB_enc_sch((uint8_t*)a_row_temp, 4*PARAMS_N*sizeof(int16_t), aes_key_schedule, (uint8_t*)a_row); 35| |#elif defined (USE_SHAKE128_FOR_A) 36| | uint8_t seed_A_separated_0[2 + BYTES_SEED_A]; 37| 9| uint8_t seed_A_separated_1[2 + BYTES_SEED_A]; 38| 9| uint8_t seed_A_separated_2[2 + BYTES_SEED_A]; 39| 9| uint8_t seed_A_separated_3[2 + BYTES_SEED_A]; 40| 9| uint16_t* seed_A_origin_0 = (uint16_t*)&seed_A_separated_0; 41| 9| uint16_t* seed_A_origin_1 = (uint16_t*)&seed_A_separated_1; 42| 9| uint16_t* seed_A_origin_2 = (uint16_t*)&seed_A_separated_2; 43| 9| uint16_t* seed_A_origin_3 = (uint16_t*)&seed_A_separated_3; 44| 9| memcpy(&seed_A_separated_0[2], seed_A, BYTES_SEED_A); ------------------ | | 18| 9|#define BYTES_SEED_A 16 ------------------ 45| 9| memcpy(&seed_A_separated_1[2], seed_A, BYTES_SEED_A); ------------------ | | 18| 9|#define BYTES_SEED_A 16 ------------------ 46| 9| memcpy(&seed_A_separated_2[2], seed_A, BYTES_SEED_A); ------------------ | | 18| 9|#define BYTES_SEED_A 16 ------------------ 47| 9| memcpy(&seed_A_separated_3[2], seed_A, BYTES_SEED_A); ------------------ | | 18| 9|#define BYTES_SEED_A 16 ------------------ 48| 3.03k| for (i = 0; i < PARAMS_N; i += 4) { ------------------ | | 11| 3.03k|#define PARAMS_N 1344 ------------------ | Branch (48:17): [True: 3.02k, False: 9] ------------------ 49| 3.02k| seed_A_origin_0[0] = UINT16_TO_LE(i + 0); ------------------ | | 35| 3.02k| #define UINT16_TO_LE(n) (n) ------------------ 50| 3.02k| seed_A_origin_1[0] = UINT16_TO_LE(i + 1); ------------------ | | 35| 3.02k| #define UINT16_TO_LE(n) (n) ------------------ 51| 3.02k| seed_A_origin_2[0] = UINT16_TO_LE(i + 2); ------------------ | | 35| 3.02k| #define UINT16_TO_LE(n) (n) ------------------ 52| 3.02k| seed_A_origin_3[0] = UINT16_TO_LE(i + 3); ------------------ | | 35| 3.02k| #define UINT16_TO_LE(n) (n) ------------------ 53| 3.02k| OQS_SHA3_shake128_x4((unsigned char*)(a_row), (unsigned char*)(a_row + PARAMS_N), (unsigned char*)(a_row + 2*PARAMS_N), (unsigned char*)(a_row + 3*PARAMS_N), ------------------ | | 11| 3.02k|#define PARAMS_N 1344 ------------------ OQS_SHA3_shake128_x4((unsigned char*)(a_row), (unsigned char*)(a_row + PARAMS_N), (unsigned char*)(a_row + 2*PARAMS_N), (unsigned char*)(a_row + 3*PARAMS_N), ------------------ | | 11| 3.02k|#define PARAMS_N 1344 ------------------ OQS_SHA3_shake128_x4((unsigned char*)(a_row), (unsigned char*)(a_row + PARAMS_N), (unsigned char*)(a_row + 2*PARAMS_N), (unsigned char*)(a_row + 3*PARAMS_N), ------------------ | | 11| 3.02k|#define PARAMS_N 1344 ------------------ 54| 3.02k| (unsigned long long)(2*PARAMS_N), seed_A_separated_0, seed_A_separated_1, seed_A_separated_2, seed_A_separated_3, 2 + BYTES_SEED_A); ------------------ | | 11| 3.02k|#define PARAMS_N 1344 ------------------ (unsigned long long)(2*PARAMS_N), seed_A_separated_0, seed_A_separated_1, seed_A_separated_2, seed_A_separated_3, 2 + BYTES_SEED_A); ------------------ | | 18| 3.02k|#define BYTES_SEED_A 16 ------------------ 55| 3.02k|#endif /* USE_AES128_FOR_A */ 56| 16.2M| for (k = 0; k < 4 * PARAMS_N; k++) { ------------------ | | 11| 16.2M|#define PARAMS_N 1344 ------------------ | Branch (56:21): [True: 16.2M, False: 3.02k] ------------------ 57| 16.2M| a_row[k] = LE_TO_UINT16(a_row[k]); ------------------ | | 34| 16.2M| #define LE_TO_UINT16(n) (n) ------------------ 58| 16.2M| } 59| 27.2k| for (k = 0; k < PARAMS_NBAR; k++) { ------------------ | | 12| 27.2k|#define PARAMS_NBAR 8 ------------------ | Branch (59:21): [True: 24.1k, False: 3.02k] ------------------ 60| 24.1k| uint16_t sum[4] = {0}; 61| 32.5M| for (j = 0; j < PARAMS_N; j++) { // Matrix-vector multiplication ------------------ | | 11| 32.5M|#define PARAMS_N 1344 ------------------ | Branch (61:25): [True: 32.5M, False: 24.1k] ------------------ 62| 32.5M| uint16_t sp = s[k*PARAMS_N + j]; ------------------ | | 11| 32.5M|#define PARAMS_N 1344 ------------------ 63| 32.5M| sum[0] += a_row[0*PARAMS_N + j] * sp; // Go through four lines with same s ------------------ | | 11| 32.5M|#define PARAMS_N 1344 ------------------ 64| 32.5M| sum[1] += a_row[1*PARAMS_N + j] * sp; ------------------ | | 11| 32.5M|#define PARAMS_N 1344 ------------------ 65| 32.5M| sum[2] += a_row[2*PARAMS_N + j] * sp; ------------------ | | 11| 32.5M|#define PARAMS_N 1344 ------------------ 66| 32.5M| sum[3] += a_row[3*PARAMS_N + j] * sp; ------------------ | | 11| 32.5M|#define PARAMS_N 1344 ------------------ 67| 32.5M| } 68| 24.1k| out[(i+0)*PARAMS_NBAR + k] += sum[0]; ------------------ | | 12| 24.1k|#define PARAMS_NBAR 8 ------------------ 69| 24.1k| out[(i+2)*PARAMS_NBAR + k] += sum[2]; ------------------ | | 12| 24.1k|#define PARAMS_NBAR 8 ------------------ 70| 24.1k| out[(i+1)*PARAMS_NBAR + k] += sum[1]; ------------------ | | 12| 24.1k|#define PARAMS_NBAR 8 ------------------ 71| 24.1k| out[(i+3)*PARAMS_NBAR + k] += sum[3]; ------------------ | | 12| 24.1k|#define PARAMS_NBAR 8 ------------------ 72| 24.1k| } 73| 3.02k| } 74| | 75| |#if defined(USE_AES128_FOR_A) 76| | OQS_AES128_free_schedule(aes_key_schedule); 77| |#endif 78| 9| return 1; 79| 9|} oqs_kem_efrodokem_640_aes_mul_add_as_plus_e_avx2: 4| 4|{ // Generate-and-multiply: generate matrix A (N x N) row-wise, multiply by s on the right. 5| | // Inputs: s, e (N x N_BAR) 6| | // Output: out = A*s + e (N x N_BAR) 7| 4| int i, j, k; 8| 4| ALIGN_HEADER(32) int16_t a_row[4*PARAMS_N] ALIGN_FOOTER(32) = {0}; 9| | 10| 10.2k| for (i = 0; i < (PARAMS_N*PARAMS_NBAR); i += 2) { ------------------ | | 11| 10.2k|#define PARAMS_N 640 ------------------ for (i = 0; i < (PARAMS_N*PARAMS_NBAR); i += 2) { ------------------ | | 12| 10.2k|#define PARAMS_NBAR 8 ------------------ | Branch (10:17): [True: 10.2k, False: 4] ------------------ 11| 10.2k| *((uint32_t*)&out[i]) = *((uint32_t*)&e[i]); 12| 10.2k| } 13| | 14| 4|#if defined(USE_AES128_FOR_A) 15| 4| int16_t a_row_temp[4*PARAMS_N] = {0}; // Take four lines of A at once 16| 4| uint8_t *aes_key_schedule; 17| 4| OQS_AES128_ECB_load_schedule(seed_A, (void **) &aes_key_schedule); 18| | 19| 324| for (j = 0; j < PARAMS_N; j += PARAMS_STRIPE_STEP) { ------------------ | | 11| 324|#define PARAMS_N 640 ------------------ for (j = 0; j < PARAMS_N; j += PARAMS_STRIPE_STEP) { ------------------ | | 16| 320|#define PARAMS_STRIPE_STEP 8 ------------------ | Branch (19:17): [True: 320, False: 4] ------------------ 20| 320| a_row_temp[j + 1 + 0*PARAMS_N] = UINT16_TO_LE(j); // Loading values in the little-endian order ------------------ | | 11| 320|#define PARAMS_N 640 ------------------ a_row_temp[j + 1 + 0*PARAMS_N] = UINT16_TO_LE(j); // Loading values in the little-endian order ------------------ | | 35| 320| #define UINT16_TO_LE(n) (n) ------------------ 21| 320| a_row_temp[j + 1 + 1*PARAMS_N] = UINT16_TO_LE(j); ------------------ | | 11| 320|#define PARAMS_N 640 ------------------ a_row_temp[j + 1 + 1*PARAMS_N] = UINT16_TO_LE(j); ------------------ | | 35| 320| #define UINT16_TO_LE(n) (n) ------------------ 22| 320| a_row_temp[j + 1 + 2*PARAMS_N] = UINT16_TO_LE(j); ------------------ | | 11| 320|#define PARAMS_N 640 ------------------ a_row_temp[j + 1 + 2*PARAMS_N] = UINT16_TO_LE(j); ------------------ | | 35| 320| #define UINT16_TO_LE(n) (n) ------------------ 23| 320| a_row_temp[j + 1 + 3*PARAMS_N] = UINT16_TO_LE(j); ------------------ | | 11| 320|#define PARAMS_N 640 ------------------ a_row_temp[j + 1 + 3*PARAMS_N] = UINT16_TO_LE(j); ------------------ | | 35| 320| #define UINT16_TO_LE(n) (n) ------------------ 24| 320| } 25| | 26| 644| for (i = 0; i < PARAMS_N; i += 4) { ------------------ | | 11| 644|#define PARAMS_N 640 ------------------ | Branch (26:17): [True: 640, False: 4] ------------------ 27| 51.8k| for (j = 0; j < PARAMS_N; j += PARAMS_STRIPE_STEP) { // Go through A, four rows at a time ------------------ | | 11| 51.8k|#define PARAMS_N 640 ------------------ for (j = 0; j < PARAMS_N; j += PARAMS_STRIPE_STEP) { // Go through A, four rows at a time ------------------ | | 16| 51.2k|#define PARAMS_STRIPE_STEP 8 ------------------ | Branch (27:21): [True: 51.2k, False: 640] ------------------ 28| 51.2k| a_row_temp[j + 0*PARAMS_N] = UINT16_TO_LE(i+0); // Loading values in the little-endian order ------------------ | | 11| 51.2k|#define PARAMS_N 640 ------------------ a_row_temp[j + 0*PARAMS_N] = UINT16_TO_LE(i+0); // Loading values in the little-endian order ------------------ | | 35| 51.2k| #define UINT16_TO_LE(n) (n) ------------------ 29| 51.2k| a_row_temp[j + 1*PARAMS_N] = UINT16_TO_LE(i+1); ------------------ | | 11| 51.2k|#define PARAMS_N 640 ------------------ a_row_temp[j + 1*PARAMS_N] = UINT16_TO_LE(i+1); ------------------ | | 35| 51.2k| #define UINT16_TO_LE(n) (n) ------------------ 30| 51.2k| a_row_temp[j + 2*PARAMS_N] = UINT16_TO_LE(i+2); ------------------ | | 11| 51.2k|#define PARAMS_N 640 ------------------ a_row_temp[j + 2*PARAMS_N] = UINT16_TO_LE(i+2); ------------------ | | 35| 51.2k| #define UINT16_TO_LE(n) (n) ------------------ 31| 51.2k| a_row_temp[j + 3*PARAMS_N] = UINT16_TO_LE(i+3); ------------------ | | 11| 51.2k|#define PARAMS_N 640 ------------------ a_row_temp[j + 3*PARAMS_N] = UINT16_TO_LE(i+3); ------------------ | | 35| 51.2k| #define UINT16_TO_LE(n) (n) ------------------ 32| 51.2k| } 33| | 34| 640| OQS_AES128_ECB_enc_sch((uint8_t*)a_row_temp, 4*PARAMS_N*sizeof(int16_t), aes_key_schedule, (uint8_t*)a_row); ------------------ | | 11| 640|#define PARAMS_N 640 ------------------ 35| |#elif defined (USE_SHAKE128_FOR_A) 36| | uint8_t seed_A_separated_0[2 + BYTES_SEED_A]; 37| | uint8_t seed_A_separated_1[2 + BYTES_SEED_A]; 38| | uint8_t seed_A_separated_2[2 + BYTES_SEED_A]; 39| | uint8_t seed_A_separated_3[2 + BYTES_SEED_A]; 40| | uint16_t* seed_A_origin_0 = (uint16_t*)&seed_A_separated_0; 41| | uint16_t* seed_A_origin_1 = (uint16_t*)&seed_A_separated_1; 42| | uint16_t* seed_A_origin_2 = (uint16_t*)&seed_A_separated_2; 43| | uint16_t* seed_A_origin_3 = (uint16_t*)&seed_A_separated_3; 44| | memcpy(&seed_A_separated_0[2], seed_A, BYTES_SEED_A); 45| | memcpy(&seed_A_separated_1[2], seed_A, BYTES_SEED_A); 46| | memcpy(&seed_A_separated_2[2], seed_A, BYTES_SEED_A); 47| | memcpy(&seed_A_separated_3[2], seed_A, BYTES_SEED_A); 48| | for (i = 0; i < PARAMS_N; i += 4) { 49| | seed_A_origin_0[0] = UINT16_TO_LE(i + 0); 50| | seed_A_origin_1[0] = UINT16_TO_LE(i + 1); 51| | seed_A_origin_2[0] = UINT16_TO_LE(i + 2); 52| | seed_A_origin_3[0] = UINT16_TO_LE(i + 3); 53| | OQS_SHA3_shake128_x4((unsigned char*)(a_row), (unsigned char*)(a_row + PARAMS_N), (unsigned char*)(a_row + 2*PARAMS_N), (unsigned char*)(a_row + 3*PARAMS_N), 54| | (unsigned long long)(2*PARAMS_N), seed_A_separated_0, seed_A_separated_1, seed_A_separated_2, seed_A_separated_3, 2 + BYTES_SEED_A); 55| |#endif /* USE_AES128_FOR_A */ 56| 1.63M| for (k = 0; k < 4 * PARAMS_N; k++) { ------------------ | | 11| 1.63M|#define PARAMS_N 640 ------------------ | Branch (56:21): [True: 1.63M, False: 640] ------------------ 57| 1.63M| a_row[k] = LE_TO_UINT16(a_row[k]); ------------------ | | 34| 1.63M| #define LE_TO_UINT16(n) (n) ------------------ 58| 1.63M| } 59| 5.76k| for (k = 0; k < PARAMS_NBAR; k++) { ------------------ | | 12| 5.76k|#define PARAMS_NBAR 8 ------------------ | Branch (59:21): [True: 5.12k, False: 640] ------------------ 60| 5.12k| uint16_t sum[4] = {0}; 61| 3.28M| for (j = 0; j < PARAMS_N; j++) { // Matrix-vector multiplication ------------------ | | 11| 3.28M|#define PARAMS_N 640 ------------------ | Branch (61:25): [True: 3.27M, False: 5.12k] ------------------ 62| 3.27M| uint16_t sp = s[k*PARAMS_N + j]; ------------------ | | 11| 3.27M|#define PARAMS_N 640 ------------------ 63| 3.27M| sum[0] += a_row[0*PARAMS_N + j] * sp; // Go through four lines with same s ------------------ | | 11| 3.27M|#define PARAMS_N 640 ------------------ 64| 3.27M| sum[1] += a_row[1*PARAMS_N + j] * sp; ------------------ | | 11| 3.27M|#define PARAMS_N 640 ------------------ 65| 3.27M| sum[2] += a_row[2*PARAMS_N + j] * sp; ------------------ | | 11| 3.27M|#define PARAMS_N 640 ------------------ 66| 3.27M| sum[3] += a_row[3*PARAMS_N + j] * sp; ------------------ | | 11| 3.27M|#define PARAMS_N 640 ------------------ 67| 3.27M| } 68| 5.12k| out[(i+0)*PARAMS_NBAR + k] += sum[0]; ------------------ | | 12| 5.12k|#define PARAMS_NBAR 8 ------------------ 69| 5.12k| out[(i+2)*PARAMS_NBAR + k] += sum[2]; ------------------ | | 12| 5.12k|#define PARAMS_NBAR 8 ------------------ 70| 5.12k| out[(i+1)*PARAMS_NBAR + k] += sum[1]; ------------------ | | 12| 5.12k|#define PARAMS_NBAR 8 ------------------ 71| 5.12k| out[(i+3)*PARAMS_NBAR + k] += sum[3]; ------------------ | | 12| 5.12k|#define PARAMS_NBAR 8 ------------------ 72| 5.12k| } 73| 640| } 74| | 75| 4|#if defined(USE_AES128_FOR_A) 76| 4| OQS_AES128_free_schedule(aes_key_schedule); 77| 4|#endif 78| 4| return 1; 79| 4|} oqs_kem_efrodokem_976_aes_mul_add_as_plus_e_avx2: 4| 12|{ // Generate-and-multiply: generate matrix A (N x N) row-wise, multiply by s on the right. 5| | // Inputs: s, e (N x N_BAR) 6| | // Output: out = A*s + e (N x N_BAR) 7| 12| int i, j, k; 8| 12| ALIGN_HEADER(32) int16_t a_row[4*PARAMS_N] ALIGN_FOOTER(32) = {0}; 9| | 10| 46.8k| for (i = 0; i < (PARAMS_N*PARAMS_NBAR); i += 2) { ------------------ | | 11| 46.8k|#define PARAMS_N 976 ------------------ for (i = 0; i < (PARAMS_N*PARAMS_NBAR); i += 2) { ------------------ | | 12| 46.8k|#define PARAMS_NBAR 8 ------------------ | Branch (10:17): [True: 46.8k, False: 12] ------------------ 11| 46.8k| *((uint32_t*)&out[i]) = *((uint32_t*)&e[i]); 12| 46.8k| } 13| | 14| 12|#if defined(USE_AES128_FOR_A) 15| 12| int16_t a_row_temp[4*PARAMS_N] = {0}; // Take four lines of A at once 16| 12| uint8_t *aes_key_schedule; 17| 12| OQS_AES128_ECB_load_schedule(seed_A, (void **) &aes_key_schedule); 18| | 19| 1.47k| for (j = 0; j < PARAMS_N; j += PARAMS_STRIPE_STEP) { ------------------ | | 11| 1.47k|#define PARAMS_N 976 ------------------ for (j = 0; j < PARAMS_N; j += PARAMS_STRIPE_STEP) { ------------------ | | 16| 1.46k|#define PARAMS_STRIPE_STEP 8 ------------------ | Branch (19:17): [True: 1.46k, False: 12] ------------------ 20| 1.46k| a_row_temp[j + 1 + 0*PARAMS_N] = UINT16_TO_LE(j); // Loading values in the little-endian order ------------------ | | 11| 1.46k|#define PARAMS_N 976 ------------------ a_row_temp[j + 1 + 0*PARAMS_N] = UINT16_TO_LE(j); // Loading values in the little-endian order ------------------ | | 35| 1.46k| #define UINT16_TO_LE(n) (n) ------------------ 21| 1.46k| a_row_temp[j + 1 + 1*PARAMS_N] = UINT16_TO_LE(j); ------------------ | | 11| 1.46k|#define PARAMS_N 976 ------------------ a_row_temp[j + 1 + 1*PARAMS_N] = UINT16_TO_LE(j); ------------------ | | 35| 1.46k| #define UINT16_TO_LE(n) (n) ------------------ 22| 1.46k| a_row_temp[j + 1 + 2*PARAMS_N] = UINT16_TO_LE(j); ------------------ | | 11| 1.46k|#define PARAMS_N 976 ------------------ a_row_temp[j + 1 + 2*PARAMS_N] = UINT16_TO_LE(j); ------------------ | | 35| 1.46k| #define UINT16_TO_LE(n) (n) ------------------ 23| 1.46k| a_row_temp[j + 1 + 3*PARAMS_N] = UINT16_TO_LE(j); ------------------ | | 11| 1.46k|#define PARAMS_N 976 ------------------ a_row_temp[j + 1 + 3*PARAMS_N] = UINT16_TO_LE(j); ------------------ | | 35| 1.46k| #define UINT16_TO_LE(n) (n) ------------------ 24| 1.46k| } 25| | 26| 2.94k| for (i = 0; i < PARAMS_N; i += 4) { ------------------ | | 11| 2.94k|#define PARAMS_N 976 ------------------ | Branch (26:17): [True: 2.92k, False: 12] ------------------ 27| 360k| for (j = 0; j < PARAMS_N; j += PARAMS_STRIPE_STEP) { // Go through A, four rows at a time ------------------ | | 11| 360k|#define PARAMS_N 976 ------------------ for (j = 0; j < PARAMS_N; j += PARAMS_STRIPE_STEP) { // Go through A, four rows at a time ------------------ | | 16| 357k|#define PARAMS_STRIPE_STEP 8 ------------------ | Branch (27:21): [True: 357k, False: 2.92k] ------------------ 28| 357k| a_row_temp[j + 0*PARAMS_N] = UINT16_TO_LE(i+0); // Loading values in the little-endian order ------------------ | | 11| 357k|#define PARAMS_N 976 ------------------ a_row_temp[j + 0*PARAMS_N] = UINT16_TO_LE(i+0); // Loading values in the little-endian order ------------------ | | 35| 357k| #define UINT16_TO_LE(n) (n) ------------------ 29| 357k| a_row_temp[j + 1*PARAMS_N] = UINT16_TO_LE(i+1); ------------------ | | 11| 357k|#define PARAMS_N 976 ------------------ a_row_temp[j + 1*PARAMS_N] = UINT16_TO_LE(i+1); ------------------ | | 35| 357k| #define UINT16_TO_LE(n) (n) ------------------ 30| 357k| a_row_temp[j + 2*PARAMS_N] = UINT16_TO_LE(i+2); ------------------ | | 11| 357k|#define PARAMS_N 976 ------------------ a_row_temp[j + 2*PARAMS_N] = UINT16_TO_LE(i+2); ------------------ | | 35| 357k| #define UINT16_TO_LE(n) (n) ------------------ 31| 357k| a_row_temp[j + 3*PARAMS_N] = UINT16_TO_LE(i+3); ------------------ | | 11| 357k|#define PARAMS_N 976 ------------------ a_row_temp[j + 3*PARAMS_N] = UINT16_TO_LE(i+3); ------------------ | | 35| 357k| #define UINT16_TO_LE(n) (n) ------------------ 32| 357k| } 33| | 34| 2.92k| OQS_AES128_ECB_enc_sch((uint8_t*)a_row_temp, 4*PARAMS_N*sizeof(int16_t), aes_key_schedule, (uint8_t*)a_row); ------------------ | | 11| 2.92k|#define PARAMS_N 976 ------------------ 35| |#elif defined (USE_SHAKE128_FOR_A) 36| | uint8_t seed_A_separated_0[2 + BYTES_SEED_A]; 37| | uint8_t seed_A_separated_1[2 + BYTES_SEED_A]; 38| | uint8_t seed_A_separated_2[2 + BYTES_SEED_A]; 39| | uint8_t seed_A_separated_3[2 + BYTES_SEED_A]; 40| | uint16_t* seed_A_origin_0 = (uint16_t*)&seed_A_separated_0; 41| | uint16_t* seed_A_origin_1 = (uint16_t*)&seed_A_separated_1; 42| | uint16_t* seed_A_origin_2 = (uint16_t*)&seed_A_separated_2; 43| | uint16_t* seed_A_origin_3 = (uint16_t*)&seed_A_separated_3; 44| | memcpy(&seed_A_separated_0[2], seed_A, BYTES_SEED_A); 45| | memcpy(&seed_A_separated_1[2], seed_A, BYTES_SEED_A); 46| | memcpy(&seed_A_separated_2[2], seed_A, BYTES_SEED_A); 47| | memcpy(&seed_A_separated_3[2], seed_A, BYTES_SEED_A); 48| | for (i = 0; i < PARAMS_N; i += 4) { 49| | seed_A_origin_0[0] = UINT16_TO_LE(i + 0); 50| | seed_A_origin_1[0] = UINT16_TO_LE(i + 1); 51| | seed_A_origin_2[0] = UINT16_TO_LE(i + 2); 52| | seed_A_origin_3[0] = UINT16_TO_LE(i + 3); 53| | OQS_SHA3_shake128_x4((unsigned char*)(a_row), (unsigned char*)(a_row + PARAMS_N), (unsigned char*)(a_row + 2*PARAMS_N), (unsigned char*)(a_row + 3*PARAMS_N), 54| | (unsigned long long)(2*PARAMS_N), seed_A_separated_0, seed_A_separated_1, seed_A_separated_2, seed_A_separated_3, 2 + BYTES_SEED_A); 55| |#endif /* USE_AES128_FOR_A */ 56| 11.4M| for (k = 0; k < 4 * PARAMS_N; k++) { ------------------ | | 11| 11.4M|#define PARAMS_N 976 ------------------ | Branch (56:21): [True: 11.4M, False: 2.92k] ------------------ 57| 11.4M| a_row[k] = LE_TO_UINT16(a_row[k]); ------------------ | | 34| 11.4M| #define LE_TO_UINT16(n) (n) ------------------ 58| 11.4M| } 59| 26.3k| for (k = 0; k < PARAMS_NBAR; k++) { ------------------ | | 12| 26.3k|#define PARAMS_NBAR 8 ------------------ | Branch (59:21): [True: 23.4k, False: 2.92k] ------------------ 60| 23.4k| uint16_t sum[4] = {0}; 61| 22.8M| for (j = 0; j < PARAMS_N; j++) { // Matrix-vector multiplication ------------------ | | 11| 22.8M|#define PARAMS_N 976 ------------------ | Branch (61:25): [True: 22.8M, False: 23.4k] ------------------ 62| 22.8M| uint16_t sp = s[k*PARAMS_N + j]; ------------------ | | 11| 22.8M|#define PARAMS_N 976 ------------------ 63| 22.8M| sum[0] += a_row[0*PARAMS_N + j] * sp; // Go through four lines with same s ------------------ | | 11| 22.8M|#define PARAMS_N 976 ------------------ 64| 22.8M| sum[1] += a_row[1*PARAMS_N + j] * sp; ------------------ | | 11| 22.8M|#define PARAMS_N 976 ------------------ 65| 22.8M| sum[2] += a_row[2*PARAMS_N + j] * sp; ------------------ | | 11| 22.8M|#define PARAMS_N 976 ------------------ 66| 22.8M| sum[3] += a_row[3*PARAMS_N + j] * sp; ------------------ | | 11| 22.8M|#define PARAMS_N 976 ------------------ 67| 22.8M| } 68| 23.4k| out[(i+0)*PARAMS_NBAR + k] += sum[0]; ------------------ | | 12| 23.4k|#define PARAMS_NBAR 8 ------------------ 69| 23.4k| out[(i+2)*PARAMS_NBAR + k] += sum[2]; ------------------ | | 12| 23.4k|#define PARAMS_NBAR 8 ------------------ 70| 23.4k| out[(i+1)*PARAMS_NBAR + k] += sum[1]; ------------------ | | 12| 23.4k|#define PARAMS_NBAR 8 ------------------ 71| 23.4k| out[(i+3)*PARAMS_NBAR + k] += sum[3]; ------------------ | | 12| 23.4k|#define PARAMS_NBAR 8 ------------------ 72| 23.4k| } 73| 2.92k| } 74| | 75| 12|#if defined(USE_AES128_FOR_A) 76| 12| OQS_AES128_free_schedule(aes_key_schedule); 77| 12|#endif 78| 12| return 1; 79| 12|} oqs_kem_efrodokem_1344_aes_mul_add_as_plus_e_avx2: 4| 8|{ // Generate-and-multiply: generate matrix A (N x N) row-wise, multiply by s on the right. 5| | // Inputs: s, e (N x N_BAR) 6| | // Output: out = A*s + e (N x N_BAR) 7| 8| int i, j, k; 8| 8| ALIGN_HEADER(32) int16_t a_row[4*PARAMS_N] ALIGN_FOOTER(32) = {0}; 9| | 10| 43.0k| for (i = 0; i < (PARAMS_N*PARAMS_NBAR); i += 2) { ------------------ | | 11| 43.0k|#define PARAMS_N 1344 ------------------ for (i = 0; i < (PARAMS_N*PARAMS_NBAR); i += 2) { ------------------ | | 12| 43.0k|#define PARAMS_NBAR 8 ------------------ | Branch (10:17): [True: 43.0k, False: 8] ------------------ 11| 43.0k| *((uint32_t*)&out[i]) = *((uint32_t*)&e[i]); 12| 43.0k| } 13| | 14| 8|#if defined(USE_AES128_FOR_A) 15| 8| int16_t a_row_temp[4*PARAMS_N] = {0}; // Take four lines of A at once 16| 8| uint8_t *aes_key_schedule; 17| 8| OQS_AES128_ECB_load_schedule(seed_A, (void **) &aes_key_schedule); 18| | 19| 1.35k| for (j = 0; j < PARAMS_N; j += PARAMS_STRIPE_STEP) { ------------------ | | 11| 1.35k|#define PARAMS_N 1344 ------------------ for (j = 0; j < PARAMS_N; j += PARAMS_STRIPE_STEP) { ------------------ | | 16| 1.34k|#define PARAMS_STRIPE_STEP 8 ------------------ | Branch (19:17): [True: 1.34k, False: 8] ------------------ 20| 1.34k| a_row_temp[j + 1 + 0*PARAMS_N] = UINT16_TO_LE(j); // Loading values in the little-endian order ------------------ | | 11| 1.34k|#define PARAMS_N 1344 ------------------ a_row_temp[j + 1 + 0*PARAMS_N] = UINT16_TO_LE(j); // Loading values in the little-endian order ------------------ | | 35| 1.34k| #define UINT16_TO_LE(n) (n) ------------------ 21| 1.34k| a_row_temp[j + 1 + 1*PARAMS_N] = UINT16_TO_LE(j); ------------------ | | 11| 1.34k|#define PARAMS_N 1344 ------------------ a_row_temp[j + 1 + 1*PARAMS_N] = UINT16_TO_LE(j); ------------------ | | 35| 1.34k| #define UINT16_TO_LE(n) (n) ------------------ 22| 1.34k| a_row_temp[j + 1 + 2*PARAMS_N] = UINT16_TO_LE(j); ------------------ | | 11| 1.34k|#define PARAMS_N 1344 ------------------ a_row_temp[j + 1 + 2*PARAMS_N] = UINT16_TO_LE(j); ------------------ | | 35| 1.34k| #define UINT16_TO_LE(n) (n) ------------------ 23| 1.34k| a_row_temp[j + 1 + 3*PARAMS_N] = UINT16_TO_LE(j); ------------------ | | 11| 1.34k|#define PARAMS_N 1344 ------------------ a_row_temp[j + 1 + 3*PARAMS_N] = UINT16_TO_LE(j); ------------------ | | 35| 1.34k| #define UINT16_TO_LE(n) (n) ------------------ 24| 1.34k| } 25| | 26| 2.69k| for (i = 0; i < PARAMS_N; i += 4) { ------------------ | | 11| 2.69k|#define PARAMS_N 1344 ------------------ | Branch (26:17): [True: 2.68k, False: 8] ------------------ 27| 454k| for (j = 0; j < PARAMS_N; j += PARAMS_STRIPE_STEP) { // Go through A, four rows at a time ------------------ | | 11| 454k|#define PARAMS_N 1344 ------------------ for (j = 0; j < PARAMS_N; j += PARAMS_STRIPE_STEP) { // Go through A, four rows at a time ------------------ | | 16| 451k|#define PARAMS_STRIPE_STEP 8 ------------------ | Branch (27:21): [True: 451k, False: 2.68k] ------------------ 28| 451k| a_row_temp[j + 0*PARAMS_N] = UINT16_TO_LE(i+0); // Loading values in the little-endian order ------------------ | | 11| 451k|#define PARAMS_N 1344 ------------------ a_row_temp[j + 0*PARAMS_N] = UINT16_TO_LE(i+0); // Loading values in the little-endian order ------------------ | | 35| 451k| #define UINT16_TO_LE(n) (n) ------------------ 29| 451k| a_row_temp[j + 1*PARAMS_N] = UINT16_TO_LE(i+1); ------------------ | | 11| 451k|#define PARAMS_N 1344 ------------------ a_row_temp[j + 1*PARAMS_N] = UINT16_TO_LE(i+1); ------------------ | | 35| 451k| #define UINT16_TO_LE(n) (n) ------------------ 30| 451k| a_row_temp[j + 2*PARAMS_N] = UINT16_TO_LE(i+2); ------------------ | | 11| 451k|#define PARAMS_N 1344 ------------------ a_row_temp[j + 2*PARAMS_N] = UINT16_TO_LE(i+2); ------------------ | | 35| 451k| #define UINT16_TO_LE(n) (n) ------------------ 31| 451k| a_row_temp[j + 3*PARAMS_N] = UINT16_TO_LE(i+3); ------------------ | | 11| 451k|#define PARAMS_N 1344 ------------------ a_row_temp[j + 3*PARAMS_N] = UINT16_TO_LE(i+3); ------------------ | | 35| 451k| #define UINT16_TO_LE(n) (n) ------------------ 32| 451k| } 33| | 34| 2.68k| OQS_AES128_ECB_enc_sch((uint8_t*)a_row_temp, 4*PARAMS_N*sizeof(int16_t), aes_key_schedule, (uint8_t*)a_row); ------------------ | | 11| 2.68k|#define PARAMS_N 1344 ------------------ 35| |#elif defined (USE_SHAKE128_FOR_A) 36| | uint8_t seed_A_separated_0[2 + BYTES_SEED_A]; 37| | uint8_t seed_A_separated_1[2 + BYTES_SEED_A]; 38| | uint8_t seed_A_separated_2[2 + BYTES_SEED_A]; 39| | uint8_t seed_A_separated_3[2 + BYTES_SEED_A]; 40| | uint16_t* seed_A_origin_0 = (uint16_t*)&seed_A_separated_0; 41| | uint16_t* seed_A_origin_1 = (uint16_t*)&seed_A_separated_1; 42| | uint16_t* seed_A_origin_2 = (uint16_t*)&seed_A_separated_2; 43| | uint16_t* seed_A_origin_3 = (uint16_t*)&seed_A_separated_3; 44| | memcpy(&seed_A_separated_0[2], seed_A, BYTES_SEED_A); 45| | memcpy(&seed_A_separated_1[2], seed_A, BYTES_SEED_A); 46| | memcpy(&seed_A_separated_2[2], seed_A, BYTES_SEED_A); 47| | memcpy(&seed_A_separated_3[2], seed_A, BYTES_SEED_A); 48| | for (i = 0; i < PARAMS_N; i += 4) { 49| | seed_A_origin_0[0] = UINT16_TO_LE(i + 0); 50| | seed_A_origin_1[0] = UINT16_TO_LE(i + 1); 51| | seed_A_origin_2[0] = UINT16_TO_LE(i + 2); 52| | seed_A_origin_3[0] = UINT16_TO_LE(i + 3); 53| | OQS_SHA3_shake128_x4((unsigned char*)(a_row), (unsigned char*)(a_row + PARAMS_N), (unsigned char*)(a_row + 2*PARAMS_N), (unsigned char*)(a_row + 3*PARAMS_N), 54| | (unsigned long long)(2*PARAMS_N), seed_A_separated_0, seed_A_separated_1, seed_A_separated_2, seed_A_separated_3, 2 + BYTES_SEED_A); 55| |#endif /* USE_AES128_FOR_A */ 56| 14.4M| for (k = 0; k < 4 * PARAMS_N; k++) { ------------------ | | 11| 14.4M|#define PARAMS_N 1344 ------------------ | Branch (56:21): [True: 14.4M, False: 2.68k] ------------------ 57| 14.4M| a_row[k] = LE_TO_UINT16(a_row[k]); ------------------ | | 34| 14.4M| #define LE_TO_UINT16(n) (n) ------------------ 58| 14.4M| } 59| 24.1k| for (k = 0; k < PARAMS_NBAR; k++) { ------------------ | | 12| 24.1k|#define PARAMS_NBAR 8 ------------------ | Branch (59:21): [True: 21.5k, False: 2.68k] ------------------ 60| 21.5k| uint16_t sum[4] = {0}; 61| 28.9M| for (j = 0; j < PARAMS_N; j++) { // Matrix-vector multiplication ------------------ | | 11| 28.9M|#define PARAMS_N 1344 ------------------ | Branch (61:25): [True: 28.9M, False: 21.5k] ------------------ 62| 28.9M| uint16_t sp = s[k*PARAMS_N + j]; ------------------ | | 11| 28.9M|#define PARAMS_N 1344 ------------------ 63| 28.9M| sum[0] += a_row[0*PARAMS_N + j] * sp; // Go through four lines with same s ------------------ | | 11| 28.9M|#define PARAMS_N 1344 ------------------ 64| 28.9M| sum[1] += a_row[1*PARAMS_N + j] * sp; ------------------ | | 11| 28.9M|#define PARAMS_N 1344 ------------------ 65| 28.9M| sum[2] += a_row[2*PARAMS_N + j] * sp; ------------------ | | 11| 28.9M|#define PARAMS_N 1344 ------------------ 66| 28.9M| sum[3] += a_row[3*PARAMS_N + j] * sp; ------------------ | | 11| 28.9M|#define PARAMS_N 1344 ------------------ 67| 28.9M| } 68| 21.5k| out[(i+0)*PARAMS_NBAR + k] += sum[0]; ------------------ | | 12| 21.5k|#define PARAMS_NBAR 8 ------------------ 69| 21.5k| out[(i+2)*PARAMS_NBAR + k] += sum[2]; ------------------ | | 12| 21.5k|#define PARAMS_NBAR 8 ------------------ 70| 21.5k| out[(i+1)*PARAMS_NBAR + k] += sum[1]; ------------------ | | 12| 21.5k|#define PARAMS_NBAR 8 ------------------ 71| 21.5k| out[(i+3)*PARAMS_NBAR + k] += sum[3]; ------------------ | | 12| 21.5k|#define PARAMS_NBAR 8 ------------------ 72| 21.5k| } 73| 2.68k| } 74| | 75| 8|#if defined(USE_AES128_FOR_A) 76| 8| OQS_AES128_free_schedule(aes_key_schedule); 77| 8|#endif 78| 8| return 1; 79| 8|} oqs_kem_efrodokem_640_shake_mul_add_as_plus_e_avx2: 4| 2|{ // Generate-and-multiply: generate matrix A (N x N) row-wise, multiply by s on the right. 5| | // Inputs: s, e (N x N_BAR) 6| | // Output: out = A*s + e (N x N_BAR) 7| 2| int i, j, k; 8| 2| ALIGN_HEADER(32) int16_t a_row[4*PARAMS_N] ALIGN_FOOTER(32) = {0}; 9| | 10| 5.12k| for (i = 0; i < (PARAMS_N*PARAMS_NBAR); i += 2) { ------------------ | | 11| 5.12k|#define PARAMS_N 640 ------------------ for (i = 0; i < (PARAMS_N*PARAMS_NBAR); i += 2) { ------------------ | | 12| 5.12k|#define PARAMS_NBAR 8 ------------------ | Branch (10:17): [True: 5.12k, False: 2] ------------------ 11| 5.12k| *((uint32_t*)&out[i]) = *((uint32_t*)&e[i]); 12| 5.12k| } 13| | 14| |#if defined(USE_AES128_FOR_A) 15| | int16_t a_row_temp[4*PARAMS_N] = {0}; // Take four lines of A at once 16| | uint8_t *aes_key_schedule; 17| | OQS_AES128_ECB_load_schedule(seed_A, (void **) &aes_key_schedule); 18| | 19| | for (j = 0; j < PARAMS_N; j += PARAMS_STRIPE_STEP) { 20| | a_row_temp[j + 1 + 0*PARAMS_N] = UINT16_TO_LE(j); // Loading values in the little-endian order 21| | a_row_temp[j + 1 + 1*PARAMS_N] = UINT16_TO_LE(j); 22| | a_row_temp[j + 1 + 2*PARAMS_N] = UINT16_TO_LE(j); 23| | a_row_temp[j + 1 + 3*PARAMS_N] = UINT16_TO_LE(j); 24| | } 25| | 26| | for (i = 0; i < PARAMS_N; i += 4) { 27| | for (j = 0; j < PARAMS_N; j += PARAMS_STRIPE_STEP) { // Go through A, four rows at a time 28| | a_row_temp[j + 0*PARAMS_N] = UINT16_TO_LE(i+0); // Loading values in the little-endian order 29| | a_row_temp[j + 1*PARAMS_N] = UINT16_TO_LE(i+1); 30| | a_row_temp[j + 2*PARAMS_N] = UINT16_TO_LE(i+2); 31| | a_row_temp[j + 3*PARAMS_N] = UINT16_TO_LE(i+3); 32| | } 33| | 34| | OQS_AES128_ECB_enc_sch((uint8_t*)a_row_temp, 4*PARAMS_N*sizeof(int16_t), aes_key_schedule, (uint8_t*)a_row); 35| |#elif defined (USE_SHAKE128_FOR_A) 36| | uint8_t seed_A_separated_0[2 + BYTES_SEED_A]; 37| 2| uint8_t seed_A_separated_1[2 + BYTES_SEED_A]; 38| 2| uint8_t seed_A_separated_2[2 + BYTES_SEED_A]; 39| 2| uint8_t seed_A_separated_3[2 + BYTES_SEED_A]; 40| 2| uint16_t* seed_A_origin_0 = (uint16_t*)&seed_A_separated_0; 41| 2| uint16_t* seed_A_origin_1 = (uint16_t*)&seed_A_separated_1; 42| 2| uint16_t* seed_A_origin_2 = (uint16_t*)&seed_A_separated_2; 43| 2| uint16_t* seed_A_origin_3 = (uint16_t*)&seed_A_separated_3; 44| 2| memcpy(&seed_A_separated_0[2], seed_A, BYTES_SEED_A); ------------------ | | 18| 2|#define BYTES_SEED_A 16 ------------------ 45| 2| memcpy(&seed_A_separated_1[2], seed_A, BYTES_SEED_A); ------------------ | | 18| 2|#define BYTES_SEED_A 16 ------------------ 46| 2| memcpy(&seed_A_separated_2[2], seed_A, BYTES_SEED_A); ------------------ | | 18| 2|#define BYTES_SEED_A 16 ------------------ 47| 2| memcpy(&seed_A_separated_3[2], seed_A, BYTES_SEED_A); ------------------ | | 18| 2|#define BYTES_SEED_A 16 ------------------ 48| 322| for (i = 0; i < PARAMS_N; i += 4) { ------------------ | | 11| 322|#define PARAMS_N 640 ------------------ | Branch (48:17): [True: 320, False: 2] ------------------ 49| 320| seed_A_origin_0[0] = UINT16_TO_LE(i + 0); ------------------ | | 35| 320| #define UINT16_TO_LE(n) (n) ------------------ 50| 320| seed_A_origin_1[0] = UINT16_TO_LE(i + 1); ------------------ | | 35| 320| #define UINT16_TO_LE(n) (n) ------------------ 51| 320| seed_A_origin_2[0] = UINT16_TO_LE(i + 2); ------------------ | | 35| 320| #define UINT16_TO_LE(n) (n) ------------------ 52| 320| seed_A_origin_3[0] = UINT16_TO_LE(i + 3); ------------------ | | 35| 320| #define UINT16_TO_LE(n) (n) ------------------ 53| 320| OQS_SHA3_shake128_x4((unsigned char*)(a_row), (unsigned char*)(a_row + PARAMS_N), (unsigned char*)(a_row + 2*PARAMS_N), (unsigned char*)(a_row + 3*PARAMS_N), ------------------ | | 11| 320|#define PARAMS_N 640 ------------------ OQS_SHA3_shake128_x4((unsigned char*)(a_row), (unsigned char*)(a_row + PARAMS_N), (unsigned char*)(a_row + 2*PARAMS_N), (unsigned char*)(a_row + 3*PARAMS_N), ------------------ | | 11| 320|#define PARAMS_N 640 ------------------ OQS_SHA3_shake128_x4((unsigned char*)(a_row), (unsigned char*)(a_row + PARAMS_N), (unsigned char*)(a_row + 2*PARAMS_N), (unsigned char*)(a_row + 3*PARAMS_N), ------------------ | | 11| 320|#define PARAMS_N 640 ------------------ 54| 320| (unsigned long long)(2*PARAMS_N), seed_A_separated_0, seed_A_separated_1, seed_A_separated_2, seed_A_separated_3, 2 + BYTES_SEED_A); ------------------ | | 11| 320|#define PARAMS_N 640 ------------------ (unsigned long long)(2*PARAMS_N), seed_A_separated_0, seed_A_separated_1, seed_A_separated_2, seed_A_separated_3, 2 + BYTES_SEED_A); ------------------ | | 18| 320|#define BYTES_SEED_A 16 ------------------ 55| 320|#endif /* USE_AES128_FOR_A */ 56| 819k| for (k = 0; k < 4 * PARAMS_N; k++) { ------------------ | | 11| 819k|#define PARAMS_N 640 ------------------ | Branch (56:21): [True: 819k, False: 320] ------------------ 57| 819k| a_row[k] = LE_TO_UINT16(a_row[k]); ------------------ | | 34| 819k| #define LE_TO_UINT16(n) (n) ------------------ 58| 819k| } 59| 2.88k| for (k = 0; k < PARAMS_NBAR; k++) { ------------------ | | 12| 2.88k|#define PARAMS_NBAR 8 ------------------ | Branch (59:21): [True: 2.56k, False: 320] ------------------ 60| 2.56k| uint16_t sum[4] = {0}; 61| 1.64M| for (j = 0; j < PARAMS_N; j++) { // Matrix-vector multiplication ------------------ | | 11| 1.64M|#define PARAMS_N 640 ------------------ | Branch (61:25): [True: 1.63M, False: 2.56k] ------------------ 62| 1.63M| uint16_t sp = s[k*PARAMS_N + j]; ------------------ | | 11| 1.63M|#define PARAMS_N 640 ------------------ 63| 1.63M| sum[0] += a_row[0*PARAMS_N + j] * sp; // Go through four lines with same s ------------------ | | 11| 1.63M|#define PARAMS_N 640 ------------------ 64| 1.63M| sum[1] += a_row[1*PARAMS_N + j] * sp; ------------------ | | 11| 1.63M|#define PARAMS_N 640 ------------------ 65| 1.63M| sum[2] += a_row[2*PARAMS_N + j] * sp; ------------------ | | 11| 1.63M|#define PARAMS_N 640 ------------------ 66| 1.63M| sum[3] += a_row[3*PARAMS_N + j] * sp; ------------------ | | 11| 1.63M|#define PARAMS_N 640 ------------------ 67| 1.63M| } 68| 2.56k| out[(i+0)*PARAMS_NBAR + k] += sum[0]; ------------------ | | 12| 2.56k|#define PARAMS_NBAR 8 ------------------ 69| 2.56k| out[(i+2)*PARAMS_NBAR + k] += sum[2]; ------------------ | | 12| 2.56k|#define PARAMS_NBAR 8 ------------------ 70| 2.56k| out[(i+1)*PARAMS_NBAR + k] += sum[1]; ------------------ | | 12| 2.56k|#define PARAMS_NBAR 8 ------------------ 71| 2.56k| out[(i+3)*PARAMS_NBAR + k] += sum[3]; ------------------ | | 12| 2.56k|#define PARAMS_NBAR 8 ------------------ 72| 2.56k| } 73| 320| } 74| | 75| |#if defined(USE_AES128_FOR_A) 76| | OQS_AES128_free_schedule(aes_key_schedule); 77| |#endif 78| 2| return 1; 79| 2|} oqs_kem_efrodokem_976_shake_mul_add_as_plus_e_avx2: 4| 12|{ // Generate-and-multiply: generate matrix A (N x N) row-wise, multiply by s on the right. 5| | // Inputs: s, e (N x N_BAR) 6| | // Output: out = A*s + e (N x N_BAR) 7| 12| int i, j, k; 8| 12| ALIGN_HEADER(32) int16_t a_row[4*PARAMS_N] ALIGN_FOOTER(32) = {0}; 9| | 10| 46.8k| for (i = 0; i < (PARAMS_N*PARAMS_NBAR); i += 2) { ------------------ | | 11| 46.8k|#define PARAMS_N 976 ------------------ for (i = 0; i < (PARAMS_N*PARAMS_NBAR); i += 2) { ------------------ | | 12| 46.8k|#define PARAMS_NBAR 8 ------------------ | Branch (10:17): [True: 46.8k, False: 12] ------------------ 11| 46.8k| *((uint32_t*)&out[i]) = *((uint32_t*)&e[i]); 12| 46.8k| } 13| | 14| |#if defined(USE_AES128_FOR_A) 15| | int16_t a_row_temp[4*PARAMS_N] = {0}; // Take four lines of A at once 16| | uint8_t *aes_key_schedule; 17| | OQS_AES128_ECB_load_schedule(seed_A, (void **) &aes_key_schedule); 18| | 19| | for (j = 0; j < PARAMS_N; j += PARAMS_STRIPE_STEP) { 20| | a_row_temp[j + 1 + 0*PARAMS_N] = UINT16_TO_LE(j); // Loading values in the little-endian order 21| | a_row_temp[j + 1 + 1*PARAMS_N] = UINT16_TO_LE(j); 22| | a_row_temp[j + 1 + 2*PARAMS_N] = UINT16_TO_LE(j); 23| | a_row_temp[j + 1 + 3*PARAMS_N] = UINT16_TO_LE(j); 24| | } 25| | 26| | for (i = 0; i < PARAMS_N; i += 4) { 27| | for (j = 0; j < PARAMS_N; j += PARAMS_STRIPE_STEP) { // Go through A, four rows at a time 28| | a_row_temp[j + 0*PARAMS_N] = UINT16_TO_LE(i+0); // Loading values in the little-endian order 29| | a_row_temp[j + 1*PARAMS_N] = UINT16_TO_LE(i+1); 30| | a_row_temp[j + 2*PARAMS_N] = UINT16_TO_LE(i+2); 31| | a_row_temp[j + 3*PARAMS_N] = UINT16_TO_LE(i+3); 32| | } 33| | 34| | OQS_AES128_ECB_enc_sch((uint8_t*)a_row_temp, 4*PARAMS_N*sizeof(int16_t), aes_key_schedule, (uint8_t*)a_row); 35| |#elif defined (USE_SHAKE128_FOR_A) 36| | uint8_t seed_A_separated_0[2 + BYTES_SEED_A]; 37| 12| uint8_t seed_A_separated_1[2 + BYTES_SEED_A]; 38| 12| uint8_t seed_A_separated_2[2 + BYTES_SEED_A]; 39| 12| uint8_t seed_A_separated_3[2 + BYTES_SEED_A]; 40| 12| uint16_t* seed_A_origin_0 = (uint16_t*)&seed_A_separated_0; 41| 12| uint16_t* seed_A_origin_1 = (uint16_t*)&seed_A_separated_1; 42| 12| uint16_t* seed_A_origin_2 = (uint16_t*)&seed_A_separated_2; 43| 12| uint16_t* seed_A_origin_3 = (uint16_t*)&seed_A_separated_3; 44| 12| memcpy(&seed_A_separated_0[2], seed_A, BYTES_SEED_A); ------------------ | | 18| 12|#define BYTES_SEED_A 16 ------------------ 45| 12| memcpy(&seed_A_separated_1[2], seed_A, BYTES_SEED_A); ------------------ | | 18| 12|#define BYTES_SEED_A 16 ------------------ 46| 12| memcpy(&seed_A_separated_2[2], seed_A, BYTES_SEED_A); ------------------ | | 18| 12|#define BYTES_SEED_A 16 ------------------ 47| 12| memcpy(&seed_A_separated_3[2], seed_A, BYTES_SEED_A); ------------------ | | 18| 12|#define BYTES_SEED_A 16 ------------------ 48| 2.94k| for (i = 0; i < PARAMS_N; i += 4) { ------------------ | | 11| 2.94k|#define PARAMS_N 976 ------------------ | Branch (48:17): [True: 2.92k, False: 12] ------------------ 49| 2.92k| seed_A_origin_0[0] = UINT16_TO_LE(i + 0); ------------------ | | 35| 2.92k| #define UINT16_TO_LE(n) (n) ------------------ 50| 2.92k| seed_A_origin_1[0] = UINT16_TO_LE(i + 1); ------------------ | | 35| 2.92k| #define UINT16_TO_LE(n) (n) ------------------ 51| 2.92k| seed_A_origin_2[0] = UINT16_TO_LE(i + 2); ------------------ | | 35| 2.92k| #define UINT16_TO_LE(n) (n) ------------------ 52| 2.92k| seed_A_origin_3[0] = UINT16_TO_LE(i + 3); ------------------ | | 35| 2.92k| #define UINT16_TO_LE(n) (n) ------------------ 53| 2.92k| OQS_SHA3_shake128_x4((unsigned char*)(a_row), (unsigned char*)(a_row + PARAMS_N), (unsigned char*)(a_row + 2*PARAMS_N), (unsigned char*)(a_row + 3*PARAMS_N), ------------------ | | 11| 2.92k|#define PARAMS_N 976 ------------------ OQS_SHA3_shake128_x4((unsigned char*)(a_row), (unsigned char*)(a_row + PARAMS_N), (unsigned char*)(a_row + 2*PARAMS_N), (unsigned char*)(a_row + 3*PARAMS_N), ------------------ | | 11| 2.92k|#define PARAMS_N 976 ------------------ OQS_SHA3_shake128_x4((unsigned char*)(a_row), (unsigned char*)(a_row + PARAMS_N), (unsigned char*)(a_row + 2*PARAMS_N), (unsigned char*)(a_row + 3*PARAMS_N), ------------------ | | 11| 2.92k|#define PARAMS_N 976 ------------------ 54| 2.92k| (unsigned long long)(2*PARAMS_N), seed_A_separated_0, seed_A_separated_1, seed_A_separated_2, seed_A_separated_3, 2 + BYTES_SEED_A); ------------------ | | 11| 2.92k|#define PARAMS_N 976 ------------------ (unsigned long long)(2*PARAMS_N), seed_A_separated_0, seed_A_separated_1, seed_A_separated_2, seed_A_separated_3, 2 + BYTES_SEED_A); ------------------ | | 18| 2.92k|#define BYTES_SEED_A 16 ------------------ 55| 2.92k|#endif /* USE_AES128_FOR_A */ 56| 11.4M| for (k = 0; k < 4 * PARAMS_N; k++) { ------------------ | | 11| 11.4M|#define PARAMS_N 976 ------------------ | Branch (56:21): [True: 11.4M, False: 2.92k] ------------------ 57| 11.4M| a_row[k] = LE_TO_UINT16(a_row[k]); ------------------ | | 34| 11.4M| #define LE_TO_UINT16(n) (n) ------------------ 58| 11.4M| } 59| 26.3k| for (k = 0; k < PARAMS_NBAR; k++) { ------------------ | | 12| 26.3k|#define PARAMS_NBAR 8 ------------------ | Branch (59:21): [True: 23.4k, False: 2.92k] ------------------ 60| 23.4k| uint16_t sum[4] = {0}; 61| 22.8M| for (j = 0; j < PARAMS_N; j++) { // Matrix-vector multiplication ------------------ | | 11| 22.8M|#define PARAMS_N 976 ------------------ | Branch (61:25): [True: 22.8M, False: 23.4k] ------------------ 62| 22.8M| uint16_t sp = s[k*PARAMS_N + j]; ------------------ | | 11| 22.8M|#define PARAMS_N 976 ------------------ 63| 22.8M| sum[0] += a_row[0*PARAMS_N + j] * sp; // Go through four lines with same s ------------------ | | 11| 22.8M|#define PARAMS_N 976 ------------------ 64| 22.8M| sum[1] += a_row[1*PARAMS_N + j] * sp; ------------------ | | 11| 22.8M|#define PARAMS_N 976 ------------------ 65| 22.8M| sum[2] += a_row[2*PARAMS_N + j] * sp; ------------------ | | 11| 22.8M|#define PARAMS_N 976 ------------------ 66| 22.8M| sum[3] += a_row[3*PARAMS_N + j] * sp; ------------------ | | 11| 22.8M|#define PARAMS_N 976 ------------------ 67| 22.8M| } 68| 23.4k| out[(i+0)*PARAMS_NBAR + k] += sum[0]; ------------------ | | 12| 23.4k|#define PARAMS_NBAR 8 ------------------ 69| 23.4k| out[(i+2)*PARAMS_NBAR + k] += sum[2]; ------------------ | | 12| 23.4k|#define PARAMS_NBAR 8 ------------------ 70| 23.4k| out[(i+1)*PARAMS_NBAR + k] += sum[1]; ------------------ | | 12| 23.4k|#define PARAMS_NBAR 8 ------------------ 71| 23.4k| out[(i+3)*PARAMS_NBAR + k] += sum[3]; ------------------ | | 12| 23.4k|#define PARAMS_NBAR 8 ------------------ 72| 23.4k| } 73| 2.92k| } 74| | 75| |#if defined(USE_AES128_FOR_A) 76| | OQS_AES128_free_schedule(aes_key_schedule); 77| |#endif 78| 12| return 1; 79| 12|} oqs_kem_efrodokem_1344_shake_mul_add_as_plus_e_avx2: 4| 5|{ // Generate-and-multiply: generate matrix A (N x N) row-wise, multiply by s on the right. 5| | // Inputs: s, e (N x N_BAR) 6| | // Output: out = A*s + e (N x N_BAR) 7| 5| int i, j, k; 8| 5| ALIGN_HEADER(32) int16_t a_row[4*PARAMS_N] ALIGN_FOOTER(32) = {0}; 9| | 10| 26.8k| for (i = 0; i < (PARAMS_N*PARAMS_NBAR); i += 2) { ------------------ | | 11| 26.8k|#define PARAMS_N 1344 ------------------ for (i = 0; i < (PARAMS_N*PARAMS_NBAR); i += 2) { ------------------ | | 12| 26.8k|#define PARAMS_NBAR 8 ------------------ | Branch (10:17): [True: 26.8k, False: 5] ------------------ 11| 26.8k| *((uint32_t*)&out[i]) = *((uint32_t*)&e[i]); 12| 26.8k| } 13| | 14| |#if defined(USE_AES128_FOR_A) 15| | int16_t a_row_temp[4*PARAMS_N] = {0}; // Take four lines of A at once 16| | uint8_t *aes_key_schedule; 17| | OQS_AES128_ECB_load_schedule(seed_A, (void **) &aes_key_schedule); 18| | 19| | for (j = 0; j < PARAMS_N; j += PARAMS_STRIPE_STEP) { 20| | a_row_temp[j + 1 + 0*PARAMS_N] = UINT16_TO_LE(j); // Loading values in the little-endian order 21| | a_row_temp[j + 1 + 1*PARAMS_N] = UINT16_TO_LE(j); 22| | a_row_temp[j + 1 + 2*PARAMS_N] = UINT16_TO_LE(j); 23| | a_row_temp[j + 1 + 3*PARAMS_N] = UINT16_TO_LE(j); 24| | } 25| | 26| | for (i = 0; i < PARAMS_N; i += 4) { 27| | for (j = 0; j < PARAMS_N; j += PARAMS_STRIPE_STEP) { // Go through A, four rows at a time 28| | a_row_temp[j + 0*PARAMS_N] = UINT16_TO_LE(i+0); // Loading values in the little-endian order 29| | a_row_temp[j + 1*PARAMS_N] = UINT16_TO_LE(i+1); 30| | a_row_temp[j + 2*PARAMS_N] = UINT16_TO_LE(i+2); 31| | a_row_temp[j + 3*PARAMS_N] = UINT16_TO_LE(i+3); 32| | } 33| | 34| | OQS_AES128_ECB_enc_sch((uint8_t*)a_row_temp, 4*PARAMS_N*sizeof(int16_t), aes_key_schedule, (uint8_t*)a_row); 35| |#elif defined (USE_SHAKE128_FOR_A) 36| | uint8_t seed_A_separated_0[2 + BYTES_SEED_A]; 37| 5| uint8_t seed_A_separated_1[2 + BYTES_SEED_A]; 38| 5| uint8_t seed_A_separated_2[2 + BYTES_SEED_A]; 39| 5| uint8_t seed_A_separated_3[2 + BYTES_SEED_A]; 40| 5| uint16_t* seed_A_origin_0 = (uint16_t*)&seed_A_separated_0; 41| 5| uint16_t* seed_A_origin_1 = (uint16_t*)&seed_A_separated_1; 42| 5| uint16_t* seed_A_origin_2 = (uint16_t*)&seed_A_separated_2; 43| 5| uint16_t* seed_A_origin_3 = (uint16_t*)&seed_A_separated_3; 44| 5| memcpy(&seed_A_separated_0[2], seed_A, BYTES_SEED_A); ------------------ | | 18| 5|#define BYTES_SEED_A 16 ------------------ 45| 5| memcpy(&seed_A_separated_1[2], seed_A, BYTES_SEED_A); ------------------ | | 18| 5|#define BYTES_SEED_A 16 ------------------ 46| 5| memcpy(&seed_A_separated_2[2], seed_A, BYTES_SEED_A); ------------------ | | 18| 5|#define BYTES_SEED_A 16 ------------------ 47| 5| memcpy(&seed_A_separated_3[2], seed_A, BYTES_SEED_A); ------------------ | | 18| 5|#define BYTES_SEED_A 16 ------------------ 48| 1.68k| for (i = 0; i < PARAMS_N; i += 4) { ------------------ | | 11| 1.68k|#define PARAMS_N 1344 ------------------ | Branch (48:17): [True: 1.68k, False: 5] ------------------ 49| 1.68k| seed_A_origin_0[0] = UINT16_TO_LE(i + 0); ------------------ | | 35| 1.68k| #define UINT16_TO_LE(n) (n) ------------------ 50| 1.68k| seed_A_origin_1[0] = UINT16_TO_LE(i + 1); ------------------ | | 35| 1.68k| #define UINT16_TO_LE(n) (n) ------------------ 51| 1.68k| seed_A_origin_2[0] = UINT16_TO_LE(i + 2); ------------------ | | 35| 1.68k| #define UINT16_TO_LE(n) (n) ------------------ 52| 1.68k| seed_A_origin_3[0] = UINT16_TO_LE(i + 3); ------------------ | | 35| 1.68k| #define UINT16_TO_LE(n) (n) ------------------ 53| 1.68k| OQS_SHA3_shake128_x4((unsigned char*)(a_row), (unsigned char*)(a_row + PARAMS_N), (unsigned char*)(a_row + 2*PARAMS_N), (unsigned char*)(a_row + 3*PARAMS_N), ------------------ | | 11| 1.68k|#define PARAMS_N 1344 ------------------ OQS_SHA3_shake128_x4((unsigned char*)(a_row), (unsigned char*)(a_row + PARAMS_N), (unsigned char*)(a_row + 2*PARAMS_N), (unsigned char*)(a_row + 3*PARAMS_N), ------------------ | | 11| 1.68k|#define PARAMS_N 1344 ------------------ OQS_SHA3_shake128_x4((unsigned char*)(a_row), (unsigned char*)(a_row + PARAMS_N), (unsigned char*)(a_row + 2*PARAMS_N), (unsigned char*)(a_row + 3*PARAMS_N), ------------------ | | 11| 1.68k|#define PARAMS_N 1344 ------------------ 54| 1.68k| (unsigned long long)(2*PARAMS_N), seed_A_separated_0, seed_A_separated_1, seed_A_separated_2, seed_A_separated_3, 2 + BYTES_SEED_A); ------------------ | | 11| 1.68k|#define PARAMS_N 1344 ------------------ (unsigned long long)(2*PARAMS_N), seed_A_separated_0, seed_A_separated_1, seed_A_separated_2, seed_A_separated_3, 2 + BYTES_SEED_A); ------------------ | | 18| 1.68k|#define BYTES_SEED_A 16 ------------------ 55| 1.68k|#endif /* USE_AES128_FOR_A */ 56| 9.03M| for (k = 0; k < 4 * PARAMS_N; k++) { ------------------ | | 11| 9.03M|#define PARAMS_N 1344 ------------------ | Branch (56:21): [True: 9.03M, False: 1.68k] ------------------ 57| 9.03M| a_row[k] = LE_TO_UINT16(a_row[k]); ------------------ | | 34| 9.03M| #define LE_TO_UINT16(n) (n) ------------------ 58| 9.03M| } 59| 15.1k| for (k = 0; k < PARAMS_NBAR; k++) { ------------------ | | 12| 15.1k|#define PARAMS_NBAR 8 ------------------ | Branch (59:21): [True: 13.4k, False: 1.68k] ------------------ 60| 13.4k| uint16_t sum[4] = {0}; 61| 18.0M| for (j = 0; j < PARAMS_N; j++) { // Matrix-vector multiplication ------------------ | | 11| 18.0M|#define PARAMS_N 1344 ------------------ | Branch (61:25): [True: 18.0M, False: 13.4k] ------------------ 62| 18.0M| uint16_t sp = s[k*PARAMS_N + j]; ------------------ | | 11| 18.0M|#define PARAMS_N 1344 ------------------ 63| 18.0M| sum[0] += a_row[0*PARAMS_N + j] * sp; // Go through four lines with same s ------------------ | | 11| 18.0M|#define PARAMS_N 1344 ------------------ 64| 18.0M| sum[1] += a_row[1*PARAMS_N + j] * sp; ------------------ | | 11| 18.0M|#define PARAMS_N 1344 ------------------ 65| 18.0M| sum[2] += a_row[2*PARAMS_N + j] * sp; ------------------ | | 11| 18.0M|#define PARAMS_N 1344 ------------------ 66| 18.0M| sum[3] += a_row[3*PARAMS_N + j] * sp; ------------------ | | 11| 18.0M|#define PARAMS_N 1344 ------------------ 67| 18.0M| } 68| 13.4k| out[(i+0)*PARAMS_NBAR + k] += sum[0]; ------------------ | | 12| 13.4k|#define PARAMS_NBAR 8 ------------------ 69| 13.4k| out[(i+2)*PARAMS_NBAR + k] += sum[2]; ------------------ | | 12| 13.4k|#define PARAMS_NBAR 8 ------------------ 70| 13.4k| out[(i+1)*PARAMS_NBAR + k] += sum[1]; ------------------ | | 12| 13.4k|#define PARAMS_NBAR 8 ------------------ 71| 13.4k| out[(i+3)*PARAMS_NBAR + k] += sum[3]; ------------------ | | 12| 13.4k|#define PARAMS_NBAR 8 ------------------ 72| 13.4k| } 73| 1.68k| } 74| | 75| |#if defined(USE_AES128_FOR_A) 76| | OQS_AES128_free_schedule(aes_key_schedule); 77| |#endif 78| 5| return 1; 79| 5|} oqs_kem_frodokem_640_aes_mul_add_as_plus_e: 27| 2|{ // Generate-and-multiply: generate matrix A (N x N) row-wise, multiply by s on the right. 28| | // Inputs: s, e (N x N_BAR) 29| | // Output: out = A*s + e (N x N_BAR) 30| 2|#if defined(OQS_DIST_X86_64_BUILD) 31| 2| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2)) { ------------------ | Branch (31:9): [True: 2, False: 0] ------------------ 32| 2| return frodo_mul_add_as_plus_e_avx2(out, s, e, seed_A); ------------------ | | 48| 2|#define frodo_mul_add_as_plus_e_avx2 oqs_kem_frodokem_640_aes_mul_add_as_plus_e_avx2 ------------------ 33| 2| } else { 34| 0| return frodo_mul_add_as_plus_e_portable(out, s, e, seed_A); ------------------ | | 47| 0|#define frodo_mul_add_as_plus_e_portable oqs_kem_frodokem_640_aes_mul_add_as_plus_e_portable ------------------ 35| 0| } 36| |#elif defined(OQS_USE_AVX2_INSTRUCTIONS) 37| | return frodo_mul_add_as_plus_e_avx2(out, s, e, seed_A); 38| |#else 39| | return frodo_mul_add_as_plus_e_portable(out, s, e, seed_A); 40| |#endif 41| 2|} oqs_kem_frodokem_640_aes_mul_add_sa_plus_e: 44| 4|{ // Generate-and-multiply: generate matrix A (N x N) column-wise, multiply by s' on the left. 45| | // Inputs: s', e' (N_BAR x N) 46| | // Output: out = s'*A + e' (N_BAR x N) 47| 4|#if defined(USE_AES128_FOR_A) 48| 4| #if defined(OQS_DIST_X86_64_BUILD) 49| 4| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2)) { ------------------ | Branch (49:9): [True: 4, False: 0] ------------------ 50| 4| return frodo_mul_add_sa_plus_e_aes_avx2(out, s, e, seed_A); ------------------ | | 51| 4|#define frodo_mul_add_sa_plus_e_aes_avx2 oqs_kem_frodokem_640_aes_mul_add_sa_plus_e_avx2 ------------------ 51| 4| } else { 52| 0| return frodo_mul_add_sa_plus_e_aes_portable(out, s, e, seed_A); ------------------ | | 50| 0|#define frodo_mul_add_sa_plus_e_aes_portable oqs_kem_frodokem_640_aes_mul_add_sa_plus_e_portable ------------------ 53| 0| } 54| | #elif defined(OQS_USE_AVX2_INSTRUCTIONS) 55| | return frodo_mul_add_sa_plus_e_aes_avx2(out, s, e, seed_A); 56| | #else 57| | return frodo_mul_add_sa_plus_e_aes_portable(out, s, e, seed_A); 58| | #endif 59| |#elif defined(USE_SHAKE128_FOR_A) 60| | #if defined(OQS_DIST_X86_64_BUILD) 61| | if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2)) { 62| | return frodo_mul_add_sa_plus_e_shake_avx2(out, s, e, seed_A); 63| | } else { 64| | return frodo_mul_add_sa_plus_e_shake_portable(out, s, e, seed_A); 65| | } 66| | #elif defined(OQS_USE_AVX2_INSTRUCTIONS) 67| | return frodo_mul_add_sa_plus_e_shake_avx2(out, s, e, seed_A); 68| | #else 69| | return frodo_mul_add_sa_plus_e_shake_portable(out, s, e, seed_A); 70| | #endif 71| |#endif 72| 4|} oqs_kem_frodokem_640_aes_mul_bs: 75| 2|{ // Multiply by s on the right 76| | // Inputs: b (N_BAR x N), s (N x N_BAR) 77| | // Output: out = b*s (N_BAR x N_BAR) 78| 2| int i, j, k; 79| | 80| 18| for (i = 0; i < PARAMS_NBAR; i++) { ------------------ | | 12| 18|#define PARAMS_NBAR 8 ------------------ | Branch (80:17): [True: 16, False: 2] ------------------ 81| 144| for (j = 0; j < PARAMS_NBAR; j++) { ------------------ | | 12| 144|#define PARAMS_NBAR 8 ------------------ | Branch (81:21): [True: 128, False: 16] ------------------ 82| 128| out[i*PARAMS_NBAR + j] = 0; ------------------ | | 12| 128|#define PARAMS_NBAR 8 ------------------ 83| 82.0k| for (k = 0; k < PARAMS_N; k++) { ------------------ | | 11| 82.0k|#define PARAMS_N 640 ------------------ | Branch (83:25): [True: 81.9k, False: 128] ------------------ 84| 81.9k| out[i*PARAMS_NBAR + j] += (uint16_t) ((uint32_t) b[i*PARAMS_N + k] * (uint32_t) s[j*PARAMS_N + k]); ------------------ | | 12| 81.9k|#define PARAMS_NBAR 8 ------------------ out[i*PARAMS_NBAR + j] += (uint16_t) ((uint32_t) b[i*PARAMS_N + k] * (uint32_t) s[j*PARAMS_N + k]); ------------------ | | 11| 81.9k|#define PARAMS_N 640 ------------------ out[i*PARAMS_NBAR + j] += (uint16_t) ((uint32_t) b[i*PARAMS_N + k] * (uint32_t) s[j*PARAMS_N + k]); ------------------ | | 11| 81.9k|#define PARAMS_N 640 ------------------ 85| 81.9k| } 86| 128| out[i*PARAMS_NBAR + j] = (uint32_t)(out[i*PARAMS_NBAR + j]) & ((1<>= PARAMS_EXTRACTED_BITS; ------------------ | | 15| 256|#define PARAMS_EXTRACTED_BITS 2 ------------------ 147| 256| pos++; 148| 256| } 149| 32| } 150| 4|} oqs_kem_frodokem_640_aes_key_decode: 154| 2|{ // Decoding 155| 2| unsigned int i, j, index = 0, npieces_word = 8; 156| 2| unsigned int nwords = (PARAMS_NBAR * PARAMS_NBAR) / 8; ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ unsigned int nwords = (PARAMS_NBAR * PARAMS_NBAR) / 8; ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ 157| 2| uint16_t temp, maskex=((uint16_t)1 << PARAMS_EXTRACTED_BITS) -1, maskq =((uint16_t)1 << PARAMS_LOGQ) -1; ------------------ | | 15| 2|#define PARAMS_EXTRACTED_BITS 2 ------------------ uint16_t temp, maskex=((uint16_t)1 << PARAMS_EXTRACTED_BITS) -1, maskq =((uint16_t)1 << PARAMS_LOGQ) -1; ------------------ | | 13| 2|#define PARAMS_LOGQ 15 ------------------ 158| 2| uint8_t *pos = (uint8_t*)out; 159| 2| uint64_t templong; 160| | 161| 18| for (i = 0; i < nwords; i++) { ------------------ | Branch (161:17): [True: 16, False: 2] ------------------ 162| 16| templong = 0; 163| 144| for (j = 0; j < npieces_word; j++) { // temp = floor(in*2^{-11}+0.5) ------------------ | Branch (163:21): [True: 128, False: 16] ------------------ 164| 128| temp = ((in[index] & maskq) + (1 << (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS - 1))) >> (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS); ------------------ | | 13| 128|#define PARAMS_LOGQ 15 ------------------ temp = ((in[index] & maskq) + (1 << (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS - 1))) >> (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS); ------------------ | | 15| 128|#define PARAMS_EXTRACTED_BITS 2 ------------------ temp = ((in[index] & maskq) + (1 << (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS - 1))) >> (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS); ------------------ | | 13| 128|#define PARAMS_LOGQ 15 ------------------ temp = ((in[index] & maskq) + (1 << (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS - 1))) >> (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS); ------------------ | | 15| 128|#define PARAMS_EXTRACTED_BITS 2 ------------------ 165| 128| templong |= ((uint64_t)(temp & maskex)) << (PARAMS_EXTRACTED_BITS * j); ------------------ | | 15| 128|#define PARAMS_EXTRACTED_BITS 2 ------------------ 166| 128| index++; 167| 128| } 168| 48| for (j = 0; j < PARAMS_EXTRACTED_BITS; j++) { ------------------ | | 15| 48|#define PARAMS_EXTRACTED_BITS 2 ------------------ | Branch (168:21): [True: 32, False: 16] ------------------ 169| 32| pos[i*PARAMS_EXTRACTED_BITS + j] = (templong >> (8*j)) & 0xFF; ------------------ | | 15| 32|#define PARAMS_EXTRACTED_BITS 2 ------------------ 170| 32| } 171| 16| } 172| 2|} oqs_kem_frodokem_640_shake_mul_add_as_plus_e: 27| 3|{ // Generate-and-multiply: generate matrix A (N x N) row-wise, multiply by s on the right. 28| | // Inputs: s, e (N x N_BAR) 29| | // Output: out = A*s + e (N x N_BAR) 30| 3|#if defined(OQS_DIST_X86_64_BUILD) 31| 3| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2)) { ------------------ | Branch (31:9): [True: 3, False: 0] ------------------ 32| 3| return frodo_mul_add_as_plus_e_avx2(out, s, e, seed_A); ------------------ | | 48| 3|#define frodo_mul_add_as_plus_e_avx2 oqs_kem_frodokem_640_shake_mul_add_as_plus_e_avx2 ------------------ 33| 3| } else { 34| 0| return frodo_mul_add_as_plus_e_portable(out, s, e, seed_A); ------------------ | | 47| 0|#define frodo_mul_add_as_plus_e_portable oqs_kem_frodokem_640_shake_mul_add_as_plus_e_portable ------------------ 35| 0| } 36| |#elif defined(OQS_USE_AVX2_INSTRUCTIONS) 37| | return frodo_mul_add_as_plus_e_avx2(out, s, e, seed_A); 38| |#else 39| | return frodo_mul_add_as_plus_e_portable(out, s, e, seed_A); 40| |#endif 41| 3|} oqs_kem_frodokem_640_shake_mul_add_sa_plus_e: 44| 6|{ // Generate-and-multiply: generate matrix A (N x N) column-wise, multiply by s' on the left. 45| | // Inputs: s', e' (N_BAR x N) 46| | // Output: out = s'*A + e' (N_BAR x N) 47| |#if defined(USE_AES128_FOR_A) 48| | #if defined(OQS_DIST_X86_64_BUILD) 49| | if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2)) { 50| | return frodo_mul_add_sa_plus_e_aes_avx2(out, s, e, seed_A); 51| | } else { 52| | return frodo_mul_add_sa_plus_e_aes_portable(out, s, e, seed_A); 53| | } 54| | #elif defined(OQS_USE_AVX2_INSTRUCTIONS) 55| | return frodo_mul_add_sa_plus_e_aes_avx2(out, s, e, seed_A); 56| | #else 57| | return frodo_mul_add_sa_plus_e_aes_portable(out, s, e, seed_A); 58| | #endif 59| |#elif defined(USE_SHAKE128_FOR_A) 60| | #if defined(OQS_DIST_X86_64_BUILD) 61| 6| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2)) { ------------------ | Branch (61:9): [True: 6, False: 0] ------------------ 62| 6| return frodo_mul_add_sa_plus_e_shake_avx2(out, s, e, seed_A); ------------------ | | 51| 6|#define frodo_mul_add_sa_plus_e_shake_avx2 oqs_kem_frodokem_640_shake_mul_add_sa_plus_e_avx2 ------------------ 63| 6| } else { 64| 0| return frodo_mul_add_sa_plus_e_shake_portable(out, s, e, seed_A); ------------------ | | 50| 0|#define frodo_mul_add_sa_plus_e_shake_portable oqs_kem_frodokem_640_shake_mul_add_sa_plus_e_portable ------------------ 65| 0| } 66| | #elif defined(OQS_USE_AVX2_INSTRUCTIONS) 67| | return frodo_mul_add_sa_plus_e_shake_avx2(out, s, e, seed_A); 68| | #else 69| | return frodo_mul_add_sa_plus_e_shake_portable(out, s, e, seed_A); 70| | #endif 71| 6|#endif 72| 6|} oqs_kem_frodokem_640_shake_mul_bs: 75| 3|{ // Multiply by s on the right 76| | // Inputs: b (N_BAR x N), s (N x N_BAR) 77| | // Output: out = b*s (N_BAR x N_BAR) 78| 3| int i, j, k; 79| | 80| 27| for (i = 0; i < PARAMS_NBAR; i++) { ------------------ | | 12| 27|#define PARAMS_NBAR 8 ------------------ | Branch (80:17): [True: 24, False: 3] ------------------ 81| 216| for (j = 0; j < PARAMS_NBAR; j++) { ------------------ | | 12| 216|#define PARAMS_NBAR 8 ------------------ | Branch (81:21): [True: 192, False: 24] ------------------ 82| 192| out[i*PARAMS_NBAR + j] = 0; ------------------ | | 12| 192|#define PARAMS_NBAR 8 ------------------ 83| 123k| for (k = 0; k < PARAMS_N; k++) { ------------------ | | 11| 123k|#define PARAMS_N 640 ------------------ | Branch (83:25): [True: 122k, False: 192] ------------------ 84| 122k| out[i*PARAMS_NBAR + j] += (uint16_t) ((uint32_t) b[i*PARAMS_N + k] * (uint32_t) s[j*PARAMS_N + k]); ------------------ | | 12| 122k|#define PARAMS_NBAR 8 ------------------ out[i*PARAMS_NBAR + j] += (uint16_t) ((uint32_t) b[i*PARAMS_N + k] * (uint32_t) s[j*PARAMS_N + k]); ------------------ | | 11| 122k|#define PARAMS_N 640 ------------------ out[i*PARAMS_NBAR + j] += (uint16_t) ((uint32_t) b[i*PARAMS_N + k] * (uint32_t) s[j*PARAMS_N + k]); ------------------ | | 11| 122k|#define PARAMS_N 640 ------------------ 85| 122k| } 86| 192| out[i*PARAMS_NBAR + j] = (uint32_t)(out[i*PARAMS_NBAR + j]) & ((1<>= PARAMS_EXTRACTED_BITS; ------------------ | | 15| 384|#define PARAMS_EXTRACTED_BITS 2 ------------------ 147| 384| pos++; 148| 384| } 149| 48| } 150| 6|} oqs_kem_frodokem_640_shake_key_decode: 154| 3|{ // Decoding 155| 3| unsigned int i, j, index = 0, npieces_word = 8; 156| 3| unsigned int nwords = (PARAMS_NBAR * PARAMS_NBAR) / 8; ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ unsigned int nwords = (PARAMS_NBAR * PARAMS_NBAR) / 8; ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ 157| 3| uint16_t temp, maskex=((uint16_t)1 << PARAMS_EXTRACTED_BITS) -1, maskq =((uint16_t)1 << PARAMS_LOGQ) -1; ------------------ | | 15| 3|#define PARAMS_EXTRACTED_BITS 2 ------------------ uint16_t temp, maskex=((uint16_t)1 << PARAMS_EXTRACTED_BITS) -1, maskq =((uint16_t)1 << PARAMS_LOGQ) -1; ------------------ | | 13| 3|#define PARAMS_LOGQ 15 ------------------ 158| 3| uint8_t *pos = (uint8_t*)out; 159| 3| uint64_t templong; 160| | 161| 27| for (i = 0; i < nwords; i++) { ------------------ | Branch (161:17): [True: 24, False: 3] ------------------ 162| 24| templong = 0; 163| 216| for (j = 0; j < npieces_word; j++) { // temp = floor(in*2^{-11}+0.5) ------------------ | Branch (163:21): [True: 192, False: 24] ------------------ 164| 192| temp = ((in[index] & maskq) + (1 << (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS - 1))) >> (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS); ------------------ | | 13| 192|#define PARAMS_LOGQ 15 ------------------ temp = ((in[index] & maskq) + (1 << (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS - 1))) >> (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS); ------------------ | | 15| 192|#define PARAMS_EXTRACTED_BITS 2 ------------------ temp = ((in[index] & maskq) + (1 << (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS - 1))) >> (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS); ------------------ | | 13| 192|#define PARAMS_LOGQ 15 ------------------ temp = ((in[index] & maskq) + (1 << (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS - 1))) >> (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS); ------------------ | | 15| 192|#define PARAMS_EXTRACTED_BITS 2 ------------------ 165| 192| templong |= ((uint64_t)(temp & maskex)) << (PARAMS_EXTRACTED_BITS * j); ------------------ | | 15| 192|#define PARAMS_EXTRACTED_BITS 2 ------------------ 166| 192| index++; 167| 192| } 168| 72| for (j = 0; j < PARAMS_EXTRACTED_BITS; j++) { ------------------ | | 15| 72|#define PARAMS_EXTRACTED_BITS 2 ------------------ | Branch (168:21): [True: 48, False: 24] ------------------ 169| 48| pos[i*PARAMS_EXTRACTED_BITS + j] = (templong >> (8*j)) & 0xFF; ------------------ | | 15| 48|#define PARAMS_EXTRACTED_BITS 2 ------------------ 170| 48| } 171| 24| } 172| 3|} oqs_kem_frodokem_976_aes_mul_add_as_plus_e: 27| 15|{ // Generate-and-multiply: generate matrix A (N x N) row-wise, multiply by s on the right. 28| | // Inputs: s, e (N x N_BAR) 29| | // Output: out = A*s + e (N x N_BAR) 30| 15|#if defined(OQS_DIST_X86_64_BUILD) 31| 15| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2)) { ------------------ | Branch (31:9): [True: 15, False: 0] ------------------ 32| 15| return frodo_mul_add_as_plus_e_avx2(out, s, e, seed_A); ------------------ | | 48| 15|#define frodo_mul_add_as_plus_e_avx2 oqs_kem_frodokem_976_aes_mul_add_as_plus_e_avx2 ------------------ 33| 15| } else { 34| 0| return frodo_mul_add_as_plus_e_portable(out, s, e, seed_A); ------------------ | | 47| 0|#define frodo_mul_add_as_plus_e_portable oqs_kem_frodokem_976_aes_mul_add_as_plus_e_portable ------------------ 35| 0| } 36| |#elif defined(OQS_USE_AVX2_INSTRUCTIONS) 37| | return frodo_mul_add_as_plus_e_avx2(out, s, e, seed_A); 38| |#else 39| | return frodo_mul_add_as_plus_e_portable(out, s, e, seed_A); 40| |#endif 41| 15|} oqs_kem_frodokem_976_aes_mul_add_sa_plus_e: 44| 30|{ // Generate-and-multiply: generate matrix A (N x N) column-wise, multiply by s' on the left. 45| | // Inputs: s', e' (N_BAR x N) 46| | // Output: out = s'*A + e' (N_BAR x N) 47| 30|#if defined(USE_AES128_FOR_A) 48| 30| #if defined(OQS_DIST_X86_64_BUILD) 49| 30| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2)) { ------------------ | Branch (49:9): [True: 30, False: 0] ------------------ 50| 30| return frodo_mul_add_sa_plus_e_aes_avx2(out, s, e, seed_A); ------------------ | | 51| 30|#define frodo_mul_add_sa_plus_e_aes_avx2 oqs_kem_frodokem_976_aes_mul_add_sa_plus_e_avx2 ------------------ 51| 30| } else { 52| 0| return frodo_mul_add_sa_plus_e_aes_portable(out, s, e, seed_A); ------------------ | | 50| 0|#define frodo_mul_add_sa_plus_e_aes_portable oqs_kem_frodokem_976_aes_mul_add_sa_plus_e_portable ------------------ 53| 0| } 54| | #elif defined(OQS_USE_AVX2_INSTRUCTIONS) 55| | return frodo_mul_add_sa_plus_e_aes_avx2(out, s, e, seed_A); 56| | #else 57| | return frodo_mul_add_sa_plus_e_aes_portable(out, s, e, seed_A); 58| | #endif 59| |#elif defined(USE_SHAKE128_FOR_A) 60| | #if defined(OQS_DIST_X86_64_BUILD) 61| | if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2)) { 62| | return frodo_mul_add_sa_plus_e_shake_avx2(out, s, e, seed_A); 63| | } else { 64| | return frodo_mul_add_sa_plus_e_shake_portable(out, s, e, seed_A); 65| | } 66| | #elif defined(OQS_USE_AVX2_INSTRUCTIONS) 67| | return frodo_mul_add_sa_plus_e_shake_avx2(out, s, e, seed_A); 68| | #else 69| | return frodo_mul_add_sa_plus_e_shake_portable(out, s, e, seed_A); 70| | #endif 71| |#endif 72| 30|} oqs_kem_frodokem_976_aes_mul_bs: 75| 15|{ // Multiply by s on the right 76| | // Inputs: b (N_BAR x N), s (N x N_BAR) 77| | // Output: out = b*s (N_BAR x N_BAR) 78| 15| int i, j, k; 79| | 80| 135| for (i = 0; i < PARAMS_NBAR; i++) { ------------------ | | 12| 135|#define PARAMS_NBAR 8 ------------------ | Branch (80:17): [True: 120, False: 15] ------------------ 81| 1.08k| for (j = 0; j < PARAMS_NBAR; j++) { ------------------ | | 12| 1.08k|#define PARAMS_NBAR 8 ------------------ | Branch (81:21): [True: 960, False: 120] ------------------ 82| 960| out[i*PARAMS_NBAR + j] = 0; ------------------ | | 12| 960|#define PARAMS_NBAR 8 ------------------ 83| 937k| for (k = 0; k < PARAMS_N; k++) { ------------------ | | 11| 937k|#define PARAMS_N 976 ------------------ | Branch (83:25): [True: 936k, False: 960] ------------------ 84| 936k| out[i*PARAMS_NBAR + j] += (uint16_t) ((uint32_t) b[i*PARAMS_N + k] * (uint32_t) s[j*PARAMS_N + k]); ------------------ | | 12| 936k|#define PARAMS_NBAR 8 ------------------ out[i*PARAMS_NBAR + j] += (uint16_t) ((uint32_t) b[i*PARAMS_N + k] * (uint32_t) s[j*PARAMS_N + k]); ------------------ | | 11| 936k|#define PARAMS_N 976 ------------------ out[i*PARAMS_NBAR + j] += (uint16_t) ((uint32_t) b[i*PARAMS_N + k] * (uint32_t) s[j*PARAMS_N + k]); ------------------ | | 11| 936k|#define PARAMS_N 976 ------------------ 85| 936k| } 86| 960| out[i*PARAMS_NBAR + j] = (uint32_t)(out[i*PARAMS_NBAR + j]) & ((1<>= PARAMS_EXTRACTED_BITS; ------------------ | | 15| 1.92k|#define PARAMS_EXTRACTED_BITS 3 ------------------ 147| 1.92k| pos++; 148| 1.92k| } 149| 240| } 150| 30|} oqs_kem_frodokem_976_aes_key_decode: 154| 15|{ // Decoding 155| 15| unsigned int i, j, index = 0, npieces_word = 8; 156| 15| unsigned int nwords = (PARAMS_NBAR * PARAMS_NBAR) / 8; ------------------ | | 12| 15|#define PARAMS_NBAR 8 ------------------ unsigned int nwords = (PARAMS_NBAR * PARAMS_NBAR) / 8; ------------------ | | 12| 15|#define PARAMS_NBAR 8 ------------------ 157| 15| uint16_t temp, maskex=((uint16_t)1 << PARAMS_EXTRACTED_BITS) -1, maskq =((uint16_t)1 << PARAMS_LOGQ) -1; ------------------ | | 15| 15|#define PARAMS_EXTRACTED_BITS 3 ------------------ uint16_t temp, maskex=((uint16_t)1 << PARAMS_EXTRACTED_BITS) -1, maskq =((uint16_t)1 << PARAMS_LOGQ) -1; ------------------ | | 13| 15|#define PARAMS_LOGQ 16 ------------------ 158| 15| uint8_t *pos = (uint8_t*)out; 159| 15| uint64_t templong; 160| | 161| 135| for (i = 0; i < nwords; i++) { ------------------ | Branch (161:17): [True: 120, False: 15] ------------------ 162| 120| templong = 0; 163| 1.08k| for (j = 0; j < npieces_word; j++) { // temp = floor(in*2^{-11}+0.5) ------------------ | Branch (163:21): [True: 960, False: 120] ------------------ 164| 960| temp = ((in[index] & maskq) + (1 << (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS - 1))) >> (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS); ------------------ | | 13| 960|#define PARAMS_LOGQ 16 ------------------ temp = ((in[index] & maskq) + (1 << (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS - 1))) >> (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS); ------------------ | | 15| 960|#define PARAMS_EXTRACTED_BITS 3 ------------------ temp = ((in[index] & maskq) + (1 << (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS - 1))) >> (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS); ------------------ | | 13| 960|#define PARAMS_LOGQ 16 ------------------ temp = ((in[index] & maskq) + (1 << (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS - 1))) >> (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS); ------------------ | | 15| 960|#define PARAMS_EXTRACTED_BITS 3 ------------------ 165| 960| templong |= ((uint64_t)(temp & maskex)) << (PARAMS_EXTRACTED_BITS * j); ------------------ | | 15| 960|#define PARAMS_EXTRACTED_BITS 3 ------------------ 166| 960| index++; 167| 960| } 168| 480| for (j = 0; j < PARAMS_EXTRACTED_BITS; j++) { ------------------ | | 15| 480|#define PARAMS_EXTRACTED_BITS 3 ------------------ | Branch (168:21): [True: 360, False: 120] ------------------ 169| 360| pos[i*PARAMS_EXTRACTED_BITS + j] = (templong >> (8*j)) & 0xFF; ------------------ | | 15| 360|#define PARAMS_EXTRACTED_BITS 3 ------------------ 170| 360| } 171| 120| } 172| 15|} oqs_kem_frodokem_976_shake_mul_add_as_plus_e: 27| 11|{ // Generate-and-multiply: generate matrix A (N x N) row-wise, multiply by s on the right. 28| | // Inputs: s, e (N x N_BAR) 29| | // Output: out = A*s + e (N x N_BAR) 30| 11|#if defined(OQS_DIST_X86_64_BUILD) 31| 11| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2)) { ------------------ | Branch (31:9): [True: 11, False: 0] ------------------ 32| 11| return frodo_mul_add_as_plus_e_avx2(out, s, e, seed_A); ------------------ | | 48| 11|#define frodo_mul_add_as_plus_e_avx2 oqs_kem_frodokem_976_shake_mul_add_as_plus_e_avx2 ------------------ 33| 11| } else { 34| 0| return frodo_mul_add_as_plus_e_portable(out, s, e, seed_A); ------------------ | | 47| 0|#define frodo_mul_add_as_plus_e_portable oqs_kem_frodokem_976_shake_mul_add_as_plus_e_portable ------------------ 35| 0| } 36| |#elif defined(OQS_USE_AVX2_INSTRUCTIONS) 37| | return frodo_mul_add_as_plus_e_avx2(out, s, e, seed_A); 38| |#else 39| | return frodo_mul_add_as_plus_e_portable(out, s, e, seed_A); 40| |#endif 41| 11|} oqs_kem_frodokem_976_shake_mul_add_sa_plus_e: 44| 22|{ // Generate-and-multiply: generate matrix A (N x N) column-wise, multiply by s' on the left. 45| | // Inputs: s', e' (N_BAR x N) 46| | // Output: out = s'*A + e' (N_BAR x N) 47| |#if defined(USE_AES128_FOR_A) 48| | #if defined(OQS_DIST_X86_64_BUILD) 49| | if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2)) { 50| | return frodo_mul_add_sa_plus_e_aes_avx2(out, s, e, seed_A); 51| | } else { 52| | return frodo_mul_add_sa_plus_e_aes_portable(out, s, e, seed_A); 53| | } 54| | #elif defined(OQS_USE_AVX2_INSTRUCTIONS) 55| | return frodo_mul_add_sa_plus_e_aes_avx2(out, s, e, seed_A); 56| | #else 57| | return frodo_mul_add_sa_plus_e_aes_portable(out, s, e, seed_A); 58| | #endif 59| |#elif defined(USE_SHAKE128_FOR_A) 60| | #if defined(OQS_DIST_X86_64_BUILD) 61| 22| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2)) { ------------------ | Branch (61:9): [True: 22, False: 0] ------------------ 62| 22| return frodo_mul_add_sa_plus_e_shake_avx2(out, s, e, seed_A); ------------------ | | 51| 22|#define frodo_mul_add_sa_plus_e_shake_avx2 oqs_kem_frodokem_976_shake_mul_add_sa_plus_e_avx2 ------------------ 63| 22| } else { 64| 0| return frodo_mul_add_sa_plus_e_shake_portable(out, s, e, seed_A); ------------------ | | 50| 0|#define frodo_mul_add_sa_plus_e_shake_portable oqs_kem_frodokem_976_shake_mul_add_sa_plus_e_portable ------------------ 65| 0| } 66| | #elif defined(OQS_USE_AVX2_INSTRUCTIONS) 67| | return frodo_mul_add_sa_plus_e_shake_avx2(out, s, e, seed_A); 68| | #else 69| | return frodo_mul_add_sa_plus_e_shake_portable(out, s, e, seed_A); 70| | #endif 71| 22|#endif 72| 22|} oqs_kem_frodokem_976_shake_mul_bs: 75| 11|{ // Multiply by s on the right 76| | // Inputs: b (N_BAR x N), s (N x N_BAR) 77| | // Output: out = b*s (N_BAR x N_BAR) 78| 11| int i, j, k; 79| | 80| 99| for (i = 0; i < PARAMS_NBAR; i++) { ------------------ | | 12| 99|#define PARAMS_NBAR 8 ------------------ | Branch (80:17): [True: 88, False: 11] ------------------ 81| 792| for (j = 0; j < PARAMS_NBAR; j++) { ------------------ | | 12| 792|#define PARAMS_NBAR 8 ------------------ | Branch (81:21): [True: 704, False: 88] ------------------ 82| 704| out[i*PARAMS_NBAR + j] = 0; ------------------ | | 12| 704|#define PARAMS_NBAR 8 ------------------ 83| 687k| for (k = 0; k < PARAMS_N; k++) { ------------------ | | 11| 687k|#define PARAMS_N 976 ------------------ | Branch (83:25): [True: 687k, False: 704] ------------------ 84| 687k| out[i*PARAMS_NBAR + j] += (uint16_t) ((uint32_t) b[i*PARAMS_N + k] * (uint32_t) s[j*PARAMS_N + k]); ------------------ | | 12| 687k|#define PARAMS_NBAR 8 ------------------ out[i*PARAMS_NBAR + j] += (uint16_t) ((uint32_t) b[i*PARAMS_N + k] * (uint32_t) s[j*PARAMS_N + k]); ------------------ | | 11| 687k|#define PARAMS_N 976 ------------------ out[i*PARAMS_NBAR + j] += (uint16_t) ((uint32_t) b[i*PARAMS_N + k] * (uint32_t) s[j*PARAMS_N + k]); ------------------ | | 11| 687k|#define PARAMS_N 976 ------------------ 85| 687k| } 86| 704| out[i*PARAMS_NBAR + j] = (uint32_t)(out[i*PARAMS_NBAR + j]) & ((1<>= PARAMS_EXTRACTED_BITS; ------------------ | | 15| 1.40k|#define PARAMS_EXTRACTED_BITS 3 ------------------ 147| 1.40k| pos++; 148| 1.40k| } 149| 176| } 150| 22|} oqs_kem_frodokem_976_shake_key_decode: 154| 11|{ // Decoding 155| 11| unsigned int i, j, index = 0, npieces_word = 8; 156| 11| unsigned int nwords = (PARAMS_NBAR * PARAMS_NBAR) / 8; ------------------ | | 12| 11|#define PARAMS_NBAR 8 ------------------ unsigned int nwords = (PARAMS_NBAR * PARAMS_NBAR) / 8; ------------------ | | 12| 11|#define PARAMS_NBAR 8 ------------------ 157| 11| uint16_t temp, maskex=((uint16_t)1 << PARAMS_EXTRACTED_BITS) -1, maskq =((uint16_t)1 << PARAMS_LOGQ) -1; ------------------ | | 15| 11|#define PARAMS_EXTRACTED_BITS 3 ------------------ uint16_t temp, maskex=((uint16_t)1 << PARAMS_EXTRACTED_BITS) -1, maskq =((uint16_t)1 << PARAMS_LOGQ) -1; ------------------ | | 13| 11|#define PARAMS_LOGQ 16 ------------------ 158| 11| uint8_t *pos = (uint8_t*)out; 159| 11| uint64_t templong; 160| | 161| 99| for (i = 0; i < nwords; i++) { ------------------ | Branch (161:17): [True: 88, False: 11] ------------------ 162| 88| templong = 0; 163| 792| for (j = 0; j < npieces_word; j++) { // temp = floor(in*2^{-11}+0.5) ------------------ | Branch (163:21): [True: 704, False: 88] ------------------ 164| 704| temp = ((in[index] & maskq) + (1 << (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS - 1))) >> (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS); ------------------ | | 13| 704|#define PARAMS_LOGQ 16 ------------------ temp = ((in[index] & maskq) + (1 << (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS - 1))) >> (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS); ------------------ | | 15| 704|#define PARAMS_EXTRACTED_BITS 3 ------------------ temp = ((in[index] & maskq) + (1 << (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS - 1))) >> (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS); ------------------ | | 13| 704|#define PARAMS_LOGQ 16 ------------------ temp = ((in[index] & maskq) + (1 << (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS - 1))) >> (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS); ------------------ | | 15| 704|#define PARAMS_EXTRACTED_BITS 3 ------------------ 165| 704| templong |= ((uint64_t)(temp & maskex)) << (PARAMS_EXTRACTED_BITS * j); ------------------ | | 15| 704|#define PARAMS_EXTRACTED_BITS 3 ------------------ 166| 704| index++; 167| 704| } 168| 352| for (j = 0; j < PARAMS_EXTRACTED_BITS; j++) { ------------------ | | 15| 352|#define PARAMS_EXTRACTED_BITS 3 ------------------ | Branch (168:21): [True: 264, False: 88] ------------------ 169| 264| pos[i*PARAMS_EXTRACTED_BITS + j] = (templong >> (8*j)) & 0xFF; ------------------ | | 15| 264|#define PARAMS_EXTRACTED_BITS 3 ------------------ 170| 264| } 171| 88| } 172| 11|} oqs_kem_frodokem_1344_aes_mul_add_as_plus_e: 27| 8|{ // Generate-and-multiply: generate matrix A (N x N) row-wise, multiply by s on the right. 28| | // Inputs: s, e (N x N_BAR) 29| | // Output: out = A*s + e (N x N_BAR) 30| 8|#if defined(OQS_DIST_X86_64_BUILD) 31| 8| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2)) { ------------------ | Branch (31:9): [True: 8, False: 0] ------------------ 32| 8| return frodo_mul_add_as_plus_e_avx2(out, s, e, seed_A); ------------------ | | 48| 8|#define frodo_mul_add_as_plus_e_avx2 oqs_kem_frodokem_1344_aes_mul_add_as_plus_e_avx2 ------------------ 33| 8| } else { 34| 0| return frodo_mul_add_as_plus_e_portable(out, s, e, seed_A); ------------------ | | 47| 0|#define frodo_mul_add_as_plus_e_portable oqs_kem_frodokem_1344_aes_mul_add_as_plus_e_portable ------------------ 35| 0| } 36| |#elif defined(OQS_USE_AVX2_INSTRUCTIONS) 37| | return frodo_mul_add_as_plus_e_avx2(out, s, e, seed_A); 38| |#else 39| | return frodo_mul_add_as_plus_e_portable(out, s, e, seed_A); 40| |#endif 41| 8|} oqs_kem_frodokem_1344_aes_mul_add_sa_plus_e: 44| 16|{ // Generate-and-multiply: generate matrix A (N x N) column-wise, multiply by s' on the left. 45| | // Inputs: s', e' (N_BAR x N) 46| | // Output: out = s'*A + e' (N_BAR x N) 47| 16|#if defined(USE_AES128_FOR_A) 48| 16| #if defined(OQS_DIST_X86_64_BUILD) 49| 16| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2)) { ------------------ | Branch (49:9): [True: 16, False: 0] ------------------ 50| 16| return frodo_mul_add_sa_plus_e_aes_avx2(out, s, e, seed_A); ------------------ | | 51| 16|#define frodo_mul_add_sa_plus_e_aes_avx2 oqs_kem_frodokem_1344_aes_mul_add_sa_plus_e_avx2 ------------------ 51| 16| } else { 52| 0| return frodo_mul_add_sa_plus_e_aes_portable(out, s, e, seed_A); ------------------ | | 50| 0|#define frodo_mul_add_sa_plus_e_aes_portable oqs_kem_frodokem_1344_aes_mul_add_sa_plus_e_portable ------------------ 53| 0| } 54| | #elif defined(OQS_USE_AVX2_INSTRUCTIONS) 55| | return frodo_mul_add_sa_plus_e_aes_avx2(out, s, e, seed_A); 56| | #else 57| | return frodo_mul_add_sa_plus_e_aes_portable(out, s, e, seed_A); 58| | #endif 59| |#elif defined(USE_SHAKE128_FOR_A) 60| | #if defined(OQS_DIST_X86_64_BUILD) 61| | if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2)) { 62| | return frodo_mul_add_sa_plus_e_shake_avx2(out, s, e, seed_A); 63| | } else { 64| | return frodo_mul_add_sa_plus_e_shake_portable(out, s, e, seed_A); 65| | } 66| | #elif defined(OQS_USE_AVX2_INSTRUCTIONS) 67| | return frodo_mul_add_sa_plus_e_shake_avx2(out, s, e, seed_A); 68| | #else 69| | return frodo_mul_add_sa_plus_e_shake_portable(out, s, e, seed_A); 70| | #endif 71| |#endif 72| 16|} oqs_kem_frodokem_1344_aes_mul_bs: 75| 8|{ // Multiply by s on the right 76| | // Inputs: b (N_BAR x N), s (N x N_BAR) 77| | // Output: out = b*s (N_BAR x N_BAR) 78| 8| int i, j, k; 79| | 80| 72| for (i = 0; i < PARAMS_NBAR; i++) { ------------------ | | 12| 72|#define PARAMS_NBAR 8 ------------------ | Branch (80:17): [True: 64, False: 8] ------------------ 81| 576| for (j = 0; j < PARAMS_NBAR; j++) { ------------------ | | 12| 576|#define PARAMS_NBAR 8 ------------------ | Branch (81:21): [True: 512, False: 64] ------------------ 82| 512| out[i*PARAMS_NBAR + j] = 0; ------------------ | | 12| 512|#define PARAMS_NBAR 8 ------------------ 83| 688k| for (k = 0; k < PARAMS_N; k++) { ------------------ | | 11| 688k|#define PARAMS_N 1344 ------------------ | Branch (83:25): [True: 688k, False: 512] ------------------ 84| 688k| out[i*PARAMS_NBAR + j] += (uint16_t) ((uint32_t) b[i*PARAMS_N + k] * (uint32_t) s[j*PARAMS_N + k]); ------------------ | | 12| 688k|#define PARAMS_NBAR 8 ------------------ out[i*PARAMS_NBAR + j] += (uint16_t) ((uint32_t) b[i*PARAMS_N + k] * (uint32_t) s[j*PARAMS_N + k]); ------------------ | | 11| 688k|#define PARAMS_N 1344 ------------------ out[i*PARAMS_NBAR + j] += (uint16_t) ((uint32_t) b[i*PARAMS_N + k] * (uint32_t) s[j*PARAMS_N + k]); ------------------ | | 11| 688k|#define PARAMS_N 1344 ------------------ 85| 688k| } 86| 512| out[i*PARAMS_NBAR + j] = (uint32_t)(out[i*PARAMS_NBAR + j]) & ((1<>= PARAMS_EXTRACTED_BITS; ------------------ | | 15| 1.02k|#define PARAMS_EXTRACTED_BITS 4 ------------------ 147| 1.02k| pos++; 148| 1.02k| } 149| 128| } 150| 16|} oqs_kem_frodokem_1344_aes_key_decode: 154| 8|{ // Decoding 155| 8| unsigned int i, j, index = 0, npieces_word = 8; 156| 8| unsigned int nwords = (PARAMS_NBAR * PARAMS_NBAR) / 8; ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ unsigned int nwords = (PARAMS_NBAR * PARAMS_NBAR) / 8; ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ 157| 8| uint16_t temp, maskex=((uint16_t)1 << PARAMS_EXTRACTED_BITS) -1, maskq =((uint16_t)1 << PARAMS_LOGQ) -1; ------------------ | | 15| 8|#define PARAMS_EXTRACTED_BITS 4 ------------------ uint16_t temp, maskex=((uint16_t)1 << PARAMS_EXTRACTED_BITS) -1, maskq =((uint16_t)1 << PARAMS_LOGQ) -1; ------------------ | | 13| 8|#define PARAMS_LOGQ 16 ------------------ 158| 8| uint8_t *pos = (uint8_t*)out; 159| 8| uint64_t templong; 160| | 161| 72| for (i = 0; i < nwords; i++) { ------------------ | Branch (161:17): [True: 64, False: 8] ------------------ 162| 64| templong = 0; 163| 576| for (j = 0; j < npieces_word; j++) { // temp = floor(in*2^{-11}+0.5) ------------------ | Branch (163:21): [True: 512, False: 64] ------------------ 164| 512| temp = ((in[index] & maskq) + (1 << (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS - 1))) >> (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS); ------------------ | | 13| 512|#define PARAMS_LOGQ 16 ------------------ temp = ((in[index] & maskq) + (1 << (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS - 1))) >> (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS); ------------------ | | 15| 512|#define PARAMS_EXTRACTED_BITS 4 ------------------ temp = ((in[index] & maskq) + (1 << (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS - 1))) >> (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS); ------------------ | | 13| 512|#define PARAMS_LOGQ 16 ------------------ temp = ((in[index] & maskq) + (1 << (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS - 1))) >> (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS); ------------------ | | 15| 512|#define PARAMS_EXTRACTED_BITS 4 ------------------ 165| 512| templong |= ((uint64_t)(temp & maskex)) << (PARAMS_EXTRACTED_BITS * j); ------------------ | | 15| 512|#define PARAMS_EXTRACTED_BITS 4 ------------------ 166| 512| index++; 167| 512| } 168| 320| for (j = 0; j < PARAMS_EXTRACTED_BITS; j++) { ------------------ | | 15| 320|#define PARAMS_EXTRACTED_BITS 4 ------------------ | Branch (168:21): [True: 256, False: 64] ------------------ 169| 256| pos[i*PARAMS_EXTRACTED_BITS + j] = (templong >> (8*j)) & 0xFF; ------------------ | | 15| 256|#define PARAMS_EXTRACTED_BITS 4 ------------------ 170| 256| } 171| 64| } 172| 8|} oqs_kem_frodokem_1344_shake_mul_add_as_plus_e: 27| 9|{ // Generate-and-multiply: generate matrix A (N x N) row-wise, multiply by s on the right. 28| | // Inputs: s, e (N x N_BAR) 29| | // Output: out = A*s + e (N x N_BAR) 30| 9|#if defined(OQS_DIST_X86_64_BUILD) 31| 9| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2)) { ------------------ | Branch (31:9): [True: 9, False: 0] ------------------ 32| 9| return frodo_mul_add_as_plus_e_avx2(out, s, e, seed_A); ------------------ | | 48| 9|#define frodo_mul_add_as_plus_e_avx2 oqs_kem_frodokem_1344_shake_mul_add_as_plus_e_avx2 ------------------ 33| 9| } else { 34| 0| return frodo_mul_add_as_plus_e_portable(out, s, e, seed_A); ------------------ | | 47| 0|#define frodo_mul_add_as_plus_e_portable oqs_kem_frodokem_1344_shake_mul_add_as_plus_e_portable ------------------ 35| 0| } 36| |#elif defined(OQS_USE_AVX2_INSTRUCTIONS) 37| | return frodo_mul_add_as_plus_e_avx2(out, s, e, seed_A); 38| |#else 39| | return frodo_mul_add_as_plus_e_portable(out, s, e, seed_A); 40| |#endif 41| 9|} oqs_kem_frodokem_1344_shake_mul_add_sa_plus_e: 44| 18|{ // Generate-and-multiply: generate matrix A (N x N) column-wise, multiply by s' on the left. 45| | // Inputs: s', e' (N_BAR x N) 46| | // Output: out = s'*A + e' (N_BAR x N) 47| |#if defined(USE_AES128_FOR_A) 48| | #if defined(OQS_DIST_X86_64_BUILD) 49| | if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2)) { 50| | return frodo_mul_add_sa_plus_e_aes_avx2(out, s, e, seed_A); 51| | } else { 52| | return frodo_mul_add_sa_plus_e_aes_portable(out, s, e, seed_A); 53| | } 54| | #elif defined(OQS_USE_AVX2_INSTRUCTIONS) 55| | return frodo_mul_add_sa_plus_e_aes_avx2(out, s, e, seed_A); 56| | #else 57| | return frodo_mul_add_sa_plus_e_aes_portable(out, s, e, seed_A); 58| | #endif 59| |#elif defined(USE_SHAKE128_FOR_A) 60| | #if defined(OQS_DIST_X86_64_BUILD) 61| 18| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2)) { ------------------ | Branch (61:9): [True: 18, False: 0] ------------------ 62| 18| return frodo_mul_add_sa_plus_e_shake_avx2(out, s, e, seed_A); ------------------ | | 51| 18|#define frodo_mul_add_sa_plus_e_shake_avx2 oqs_kem_frodokem_1344_shake_mul_add_sa_plus_e_avx2 ------------------ 63| 18| } else { 64| 0| return frodo_mul_add_sa_plus_e_shake_portable(out, s, e, seed_A); ------------------ | | 50| 0|#define frodo_mul_add_sa_plus_e_shake_portable oqs_kem_frodokem_1344_shake_mul_add_sa_plus_e_portable ------------------ 65| 0| } 66| | #elif defined(OQS_USE_AVX2_INSTRUCTIONS) 67| | return frodo_mul_add_sa_plus_e_shake_avx2(out, s, e, seed_A); 68| | #else 69| | return frodo_mul_add_sa_plus_e_shake_portable(out, s, e, seed_A); 70| | #endif 71| 18|#endif 72| 18|} oqs_kem_frodokem_1344_shake_mul_bs: 75| 9|{ // Multiply by s on the right 76| | // Inputs: b (N_BAR x N), s (N x N_BAR) 77| | // Output: out = b*s (N_BAR x N_BAR) 78| 9| int i, j, k; 79| | 80| 81| for (i = 0; i < PARAMS_NBAR; i++) { ------------------ | | 12| 81|#define PARAMS_NBAR 8 ------------------ | Branch (80:17): [True: 72, False: 9] ------------------ 81| 648| for (j = 0; j < PARAMS_NBAR; j++) { ------------------ | | 12| 648|#define PARAMS_NBAR 8 ------------------ | Branch (81:21): [True: 576, False: 72] ------------------ 82| 576| out[i*PARAMS_NBAR + j] = 0; ------------------ | | 12| 576|#define PARAMS_NBAR 8 ------------------ 83| 774k| for (k = 0; k < PARAMS_N; k++) { ------------------ | | 11| 774k|#define PARAMS_N 1344 ------------------ | Branch (83:25): [True: 774k, False: 576] ------------------ 84| 774k| out[i*PARAMS_NBAR + j] += (uint16_t) ((uint32_t) b[i*PARAMS_N + k] * (uint32_t) s[j*PARAMS_N + k]); ------------------ | | 12| 774k|#define PARAMS_NBAR 8 ------------------ out[i*PARAMS_NBAR + j] += (uint16_t) ((uint32_t) b[i*PARAMS_N + k] * (uint32_t) s[j*PARAMS_N + k]); ------------------ | | 11| 774k|#define PARAMS_N 1344 ------------------ out[i*PARAMS_NBAR + j] += (uint16_t) ((uint32_t) b[i*PARAMS_N + k] * (uint32_t) s[j*PARAMS_N + k]); ------------------ | | 11| 774k|#define PARAMS_N 1344 ------------------ 85| 774k| } 86| 576| out[i*PARAMS_NBAR + j] = (uint32_t)(out[i*PARAMS_NBAR + j]) & ((1<>= PARAMS_EXTRACTED_BITS; ------------------ | | 15| 1.15k|#define PARAMS_EXTRACTED_BITS 4 ------------------ 147| 1.15k| pos++; 148| 1.15k| } 149| 144| } 150| 18|} oqs_kem_frodokem_1344_shake_key_decode: 154| 9|{ // Decoding 155| 9| unsigned int i, j, index = 0, npieces_word = 8; 156| 9| unsigned int nwords = (PARAMS_NBAR * PARAMS_NBAR) / 8; ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ unsigned int nwords = (PARAMS_NBAR * PARAMS_NBAR) / 8; ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ 157| 9| uint16_t temp, maskex=((uint16_t)1 << PARAMS_EXTRACTED_BITS) -1, maskq =((uint16_t)1 << PARAMS_LOGQ) -1; ------------------ | | 15| 9|#define PARAMS_EXTRACTED_BITS 4 ------------------ uint16_t temp, maskex=((uint16_t)1 << PARAMS_EXTRACTED_BITS) -1, maskq =((uint16_t)1 << PARAMS_LOGQ) -1; ------------------ | | 13| 9|#define PARAMS_LOGQ 16 ------------------ 158| 9| uint8_t *pos = (uint8_t*)out; 159| 9| uint64_t templong; 160| | 161| 81| for (i = 0; i < nwords; i++) { ------------------ | Branch (161:17): [True: 72, False: 9] ------------------ 162| 72| templong = 0; 163| 648| for (j = 0; j < npieces_word; j++) { // temp = floor(in*2^{-11}+0.5) ------------------ | Branch (163:21): [True: 576, False: 72] ------------------ 164| 576| temp = ((in[index] & maskq) + (1 << (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS - 1))) >> (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS); ------------------ | | 13| 576|#define PARAMS_LOGQ 16 ------------------ temp = ((in[index] & maskq) + (1 << (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS - 1))) >> (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS); ------------------ | | 15| 576|#define PARAMS_EXTRACTED_BITS 4 ------------------ temp = ((in[index] & maskq) + (1 << (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS - 1))) >> (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS); ------------------ | | 13| 576|#define PARAMS_LOGQ 16 ------------------ temp = ((in[index] & maskq) + (1 << (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS - 1))) >> (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS); ------------------ | | 15| 576|#define PARAMS_EXTRACTED_BITS 4 ------------------ 165| 576| templong |= ((uint64_t)(temp & maskex)) << (PARAMS_EXTRACTED_BITS * j); ------------------ | | 15| 576|#define PARAMS_EXTRACTED_BITS 4 ------------------ 166| 576| index++; 167| 576| } 168| 360| for (j = 0; j < PARAMS_EXTRACTED_BITS; j++) { ------------------ | | 15| 360|#define PARAMS_EXTRACTED_BITS 4 ------------------ | Branch (168:21): [True: 288, False: 72] ------------------ 169| 288| pos[i*PARAMS_EXTRACTED_BITS + j] = (templong >> (8*j)) & 0xFF; ------------------ | | 15| 288|#define PARAMS_EXTRACTED_BITS 4 ------------------ 170| 288| } 171| 72| } 172| 9|} oqs_kem_efrodokem_640_aes_mul_add_as_plus_e: 27| 4|{ // Generate-and-multiply: generate matrix A (N x N) row-wise, multiply by s on the right. 28| | // Inputs: s, e (N x N_BAR) 29| | // Output: out = A*s + e (N x N_BAR) 30| 4|#if defined(OQS_DIST_X86_64_BUILD) 31| 4| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2)) { ------------------ | Branch (31:9): [True: 4, False: 0] ------------------ 32| 4| return frodo_mul_add_as_plus_e_avx2(out, s, e, seed_A); ------------------ | | 46| 4|#define frodo_mul_add_as_plus_e_avx2 oqs_kem_efrodokem_640_aes_mul_add_as_plus_e_avx2 ------------------ 33| 4| } else { 34| 0| return frodo_mul_add_as_plus_e_portable(out, s, e, seed_A); ------------------ | | 45| 0|#define frodo_mul_add_as_plus_e_portable oqs_ekem_frodokem_640_aes_mul_add_as_plus_e_portable ------------------ 35| 0| } 36| |#elif defined(OQS_USE_AVX2_INSTRUCTIONS) 37| | return frodo_mul_add_as_plus_e_avx2(out, s, e, seed_A); 38| |#else 39| | return frodo_mul_add_as_plus_e_portable(out, s, e, seed_A); 40| |#endif 41| 4|} oqs_kem_efrodokem_640_aes_mul_add_sa_plus_e: 44| 8|{ // Generate-and-multiply: generate matrix A (N x N) column-wise, multiply by s' on the left. 45| | // Inputs: s', e' (N_BAR x N) 46| | // Output: out = s'*A + e' (N_BAR x N) 47| 8|#if defined(USE_AES128_FOR_A) 48| 8| #if defined(OQS_DIST_X86_64_BUILD) 49| 8| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2)) { ------------------ | Branch (49:9): [True: 8, False: 0] ------------------ 50| 8| return frodo_mul_add_sa_plus_e_aes_avx2(out, s, e, seed_A); ------------------ | | 49| 8|#define frodo_mul_add_sa_plus_e_aes_avx2 oqs_kem_efrodokem_640_aes_mul_add_sa_plus_e_avx2 ------------------ 51| 8| } else { 52| 0| return frodo_mul_add_sa_plus_e_aes_portable(out, s, e, seed_A); ------------------ | | 48| 0|#define frodo_mul_add_sa_plus_e_aes_portable oqs_kem_efrodokem_640_aes_mul_add_sa_plus_e_portable ------------------ 53| 0| } 54| | #elif defined(OQS_USE_AVX2_INSTRUCTIONS) 55| | return frodo_mul_add_sa_plus_e_aes_avx2(out, s, e, seed_A); 56| | #else 57| | return frodo_mul_add_sa_plus_e_aes_portable(out, s, e, seed_A); 58| | #endif 59| |#elif defined(USE_SHAKE128_FOR_A) 60| | #if defined(OQS_DIST_X86_64_BUILD) 61| | if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2)) { 62| | return frodo_mul_add_sa_plus_e_shake_avx2(out, s, e, seed_A); 63| | } else { 64| | return frodo_mul_add_sa_plus_e_shake_portable(out, s, e, seed_A); 65| | } 66| | #elif defined(OQS_USE_AVX2_INSTRUCTIONS) 67| | return frodo_mul_add_sa_plus_e_shake_avx2(out, s, e, seed_A); 68| | #else 69| | return frodo_mul_add_sa_plus_e_shake_portable(out, s, e, seed_A); 70| | #endif 71| |#endif 72| 8|} oqs_kem_efrodokem_640_aes_mul_bs: 75| 4|{ // Multiply by s on the right 76| | // Inputs: b (N_BAR x N), s (N x N_BAR) 77| | // Output: out = b*s (N_BAR x N_BAR) 78| 4| int i, j, k; 79| | 80| 36| for (i = 0; i < PARAMS_NBAR; i++) { ------------------ | | 12| 36|#define PARAMS_NBAR 8 ------------------ | Branch (80:17): [True: 32, False: 4] ------------------ 81| 288| for (j = 0; j < PARAMS_NBAR; j++) { ------------------ | | 12| 288|#define PARAMS_NBAR 8 ------------------ | Branch (81:21): [True: 256, False: 32] ------------------ 82| 256| out[i*PARAMS_NBAR + j] = 0; ------------------ | | 12| 256|#define PARAMS_NBAR 8 ------------------ 83| 164k| for (k = 0; k < PARAMS_N; k++) { ------------------ | | 11| 164k|#define PARAMS_N 640 ------------------ | Branch (83:25): [True: 163k, False: 256] ------------------ 84| 163k| out[i*PARAMS_NBAR + j] += (uint16_t) ((uint32_t) b[i*PARAMS_N + k] * (uint32_t) s[j*PARAMS_N + k]); ------------------ | | 12| 163k|#define PARAMS_NBAR 8 ------------------ out[i*PARAMS_NBAR + j] += (uint16_t) ((uint32_t) b[i*PARAMS_N + k] * (uint32_t) s[j*PARAMS_N + k]); ------------------ | | 11| 163k|#define PARAMS_N 640 ------------------ out[i*PARAMS_NBAR + j] += (uint16_t) ((uint32_t) b[i*PARAMS_N + k] * (uint32_t) s[j*PARAMS_N + k]); ------------------ | | 11| 163k|#define PARAMS_N 640 ------------------ 85| 163k| } 86| 256| out[i*PARAMS_NBAR + j] = (uint32_t)(out[i*PARAMS_NBAR + j]) & ((1<>= PARAMS_EXTRACTED_BITS; ------------------ | | 15| 512|#define PARAMS_EXTRACTED_BITS 2 ------------------ 147| 512| pos++; 148| 512| } 149| 64| } 150| 8|} oqs_kem_efrodokem_640_aes_key_decode: 154| 4|{ // Decoding 155| 4| unsigned int i, j, index = 0, npieces_word = 8; 156| 4| unsigned int nwords = (PARAMS_NBAR * PARAMS_NBAR) / 8; ------------------ | | 12| 4|#define PARAMS_NBAR 8 ------------------ unsigned int nwords = (PARAMS_NBAR * PARAMS_NBAR) / 8; ------------------ | | 12| 4|#define PARAMS_NBAR 8 ------------------ 157| 4| uint16_t temp, maskex=((uint16_t)1 << PARAMS_EXTRACTED_BITS) -1, maskq =((uint16_t)1 << PARAMS_LOGQ) -1; ------------------ | | 15| 4|#define PARAMS_EXTRACTED_BITS 2 ------------------ uint16_t temp, maskex=((uint16_t)1 << PARAMS_EXTRACTED_BITS) -1, maskq =((uint16_t)1 << PARAMS_LOGQ) -1; ------------------ | | 13| 4|#define PARAMS_LOGQ 15 ------------------ 158| 4| uint8_t *pos = (uint8_t*)out; 159| 4| uint64_t templong; 160| | 161| 36| for (i = 0; i < nwords; i++) { ------------------ | Branch (161:17): [True: 32, False: 4] ------------------ 162| 32| templong = 0; 163| 288| for (j = 0; j < npieces_word; j++) { // temp = floor(in*2^{-11}+0.5) ------------------ | Branch (163:21): [True: 256, False: 32] ------------------ 164| 256| temp = ((in[index] & maskq) + (1 << (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS - 1))) >> (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS); ------------------ | | 13| 256|#define PARAMS_LOGQ 15 ------------------ temp = ((in[index] & maskq) + (1 << (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS - 1))) >> (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS); ------------------ | | 15| 256|#define PARAMS_EXTRACTED_BITS 2 ------------------ temp = ((in[index] & maskq) + (1 << (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS - 1))) >> (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS); ------------------ | | 13| 256|#define PARAMS_LOGQ 15 ------------------ temp = ((in[index] & maskq) + (1 << (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS - 1))) >> (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS); ------------------ | | 15| 256|#define PARAMS_EXTRACTED_BITS 2 ------------------ 165| 256| templong |= ((uint64_t)(temp & maskex)) << (PARAMS_EXTRACTED_BITS * j); ------------------ | | 15| 256|#define PARAMS_EXTRACTED_BITS 2 ------------------ 166| 256| index++; 167| 256| } 168| 96| for (j = 0; j < PARAMS_EXTRACTED_BITS; j++) { ------------------ | | 15| 96|#define PARAMS_EXTRACTED_BITS 2 ------------------ | Branch (168:21): [True: 64, False: 32] ------------------ 169| 64| pos[i*PARAMS_EXTRACTED_BITS + j] = (templong >> (8*j)) & 0xFF; ------------------ | | 15| 64|#define PARAMS_EXTRACTED_BITS 2 ------------------ 170| 64| } 171| 32| } 172| 4|} oqs_kem_efrodokem_640_shake_mul_add_as_plus_e: 27| 2|{ // Generate-and-multiply: generate matrix A (N x N) row-wise, multiply by s on the right. 28| | // Inputs: s, e (N x N_BAR) 29| | // Output: out = A*s + e (N x N_BAR) 30| 2|#if defined(OQS_DIST_X86_64_BUILD) 31| 2| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2)) { ------------------ | Branch (31:9): [True: 2, False: 0] ------------------ 32| 2| return frodo_mul_add_as_plus_e_avx2(out, s, e, seed_A); ------------------ | | 46| 2|#define frodo_mul_add_as_plus_e_avx2 oqs_kem_efrodokem_640_shake_mul_add_as_plus_e_avx2 ------------------ 33| 2| } else { 34| 0| return frodo_mul_add_as_plus_e_portable(out, s, e, seed_A); ------------------ | | 45| 0|#define frodo_mul_add_as_plus_e_portable oqs_kem_efrodokem_640_shake_mul_add_as_plus_e_portable ------------------ 35| 0| } 36| |#elif defined(OQS_USE_AVX2_INSTRUCTIONS) 37| | return frodo_mul_add_as_plus_e_avx2(out, s, e, seed_A); 38| |#else 39| | return frodo_mul_add_as_plus_e_portable(out, s, e, seed_A); 40| |#endif 41| 2|} oqs_kem_efrodokem_640_shake_mul_add_sa_plus_e: 44| 4|{ // Generate-and-multiply: generate matrix A (N x N) column-wise, multiply by s' on the left. 45| | // Inputs: s', e' (N_BAR x N) 46| | // Output: out = s'*A + e' (N_BAR x N) 47| |#if defined(USE_AES128_FOR_A) 48| | #if defined(OQS_DIST_X86_64_BUILD) 49| | if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2)) { 50| | return frodo_mul_add_sa_plus_e_aes_avx2(out, s, e, seed_A); 51| | } else { 52| | return frodo_mul_add_sa_plus_e_aes_portable(out, s, e, seed_A); 53| | } 54| | #elif defined(OQS_USE_AVX2_INSTRUCTIONS) 55| | return frodo_mul_add_sa_plus_e_aes_avx2(out, s, e, seed_A); 56| | #else 57| | return frodo_mul_add_sa_plus_e_aes_portable(out, s, e, seed_A); 58| | #endif 59| |#elif defined(USE_SHAKE128_FOR_A) 60| | #if defined(OQS_DIST_X86_64_BUILD) 61| 4| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2)) { ------------------ | Branch (61:9): [True: 4, False: 0] ------------------ 62| 4| return frodo_mul_add_sa_plus_e_shake_avx2(out, s, e, seed_A); ------------------ | | 49| 4|#define frodo_mul_add_sa_plus_e_shake_avx2 oqs_kem_efrodokem_640_shake_mul_add_sa_plus_e_avx2 ------------------ 63| 4| } else { 64| 0| return frodo_mul_add_sa_plus_e_shake_portable(out, s, e, seed_A); ------------------ | | 48| 0|#define frodo_mul_add_sa_plus_e_shake_portable oqs_kem_efrodokem_640_shake_mul_add_sa_plus_e_portable ------------------ 65| 0| } 66| | #elif defined(OQS_USE_AVX2_INSTRUCTIONS) 67| | return frodo_mul_add_sa_plus_e_shake_avx2(out, s, e, seed_A); 68| | #else 69| | return frodo_mul_add_sa_plus_e_shake_portable(out, s, e, seed_A); 70| | #endif 71| 4|#endif 72| 4|} oqs_kem_efrodokem_640_shake_mul_bs: 75| 2|{ // Multiply by s on the right 76| | // Inputs: b (N_BAR x N), s (N x N_BAR) 77| | // Output: out = b*s (N_BAR x N_BAR) 78| 2| int i, j, k; 79| | 80| 18| for (i = 0; i < PARAMS_NBAR; i++) { ------------------ | | 12| 18|#define PARAMS_NBAR 8 ------------------ | Branch (80:17): [True: 16, False: 2] ------------------ 81| 144| for (j = 0; j < PARAMS_NBAR; j++) { ------------------ | | 12| 144|#define PARAMS_NBAR 8 ------------------ | Branch (81:21): [True: 128, False: 16] ------------------ 82| 128| out[i*PARAMS_NBAR + j] = 0; ------------------ | | 12| 128|#define PARAMS_NBAR 8 ------------------ 83| 82.0k| for (k = 0; k < PARAMS_N; k++) { ------------------ | | 11| 82.0k|#define PARAMS_N 640 ------------------ | Branch (83:25): [True: 81.9k, False: 128] ------------------ 84| 81.9k| out[i*PARAMS_NBAR + j] += (uint16_t) ((uint32_t) b[i*PARAMS_N + k] * (uint32_t) s[j*PARAMS_N + k]); ------------------ | | 12| 81.9k|#define PARAMS_NBAR 8 ------------------ out[i*PARAMS_NBAR + j] += (uint16_t) ((uint32_t) b[i*PARAMS_N + k] * (uint32_t) s[j*PARAMS_N + k]); ------------------ | | 11| 81.9k|#define PARAMS_N 640 ------------------ out[i*PARAMS_NBAR + j] += (uint16_t) ((uint32_t) b[i*PARAMS_N + k] * (uint32_t) s[j*PARAMS_N + k]); ------------------ | | 11| 81.9k|#define PARAMS_N 640 ------------------ 85| 81.9k| } 86| 128| out[i*PARAMS_NBAR + j] = (uint32_t)(out[i*PARAMS_NBAR + j]) & ((1<>= PARAMS_EXTRACTED_BITS; ------------------ | | 15| 256|#define PARAMS_EXTRACTED_BITS 2 ------------------ 147| 256| pos++; 148| 256| } 149| 32| } 150| 4|} oqs_kem_efrodokem_640_shake_key_decode: 154| 2|{ // Decoding 155| 2| unsigned int i, j, index = 0, npieces_word = 8; 156| 2| unsigned int nwords = (PARAMS_NBAR * PARAMS_NBAR) / 8; ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ unsigned int nwords = (PARAMS_NBAR * PARAMS_NBAR) / 8; ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ 157| 2| uint16_t temp, maskex=((uint16_t)1 << PARAMS_EXTRACTED_BITS) -1, maskq =((uint16_t)1 << PARAMS_LOGQ) -1; ------------------ | | 15| 2|#define PARAMS_EXTRACTED_BITS 2 ------------------ uint16_t temp, maskex=((uint16_t)1 << PARAMS_EXTRACTED_BITS) -1, maskq =((uint16_t)1 << PARAMS_LOGQ) -1; ------------------ | | 13| 2|#define PARAMS_LOGQ 15 ------------------ 158| 2| uint8_t *pos = (uint8_t*)out; 159| 2| uint64_t templong; 160| | 161| 18| for (i = 0; i < nwords; i++) { ------------------ | Branch (161:17): [True: 16, False: 2] ------------------ 162| 16| templong = 0; 163| 144| for (j = 0; j < npieces_word; j++) { // temp = floor(in*2^{-11}+0.5) ------------------ | Branch (163:21): [True: 128, False: 16] ------------------ 164| 128| temp = ((in[index] & maskq) + (1 << (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS - 1))) >> (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS); ------------------ | | 13| 128|#define PARAMS_LOGQ 15 ------------------ temp = ((in[index] & maskq) + (1 << (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS - 1))) >> (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS); ------------------ | | 15| 128|#define PARAMS_EXTRACTED_BITS 2 ------------------ temp = ((in[index] & maskq) + (1 << (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS - 1))) >> (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS); ------------------ | | 13| 128|#define PARAMS_LOGQ 15 ------------------ temp = ((in[index] & maskq) + (1 << (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS - 1))) >> (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS); ------------------ | | 15| 128|#define PARAMS_EXTRACTED_BITS 2 ------------------ 165| 128| templong |= ((uint64_t)(temp & maskex)) << (PARAMS_EXTRACTED_BITS * j); ------------------ | | 15| 128|#define PARAMS_EXTRACTED_BITS 2 ------------------ 166| 128| index++; 167| 128| } 168| 48| for (j = 0; j < PARAMS_EXTRACTED_BITS; j++) { ------------------ | | 15| 48|#define PARAMS_EXTRACTED_BITS 2 ------------------ | Branch (168:21): [True: 32, False: 16] ------------------ 169| 32| pos[i*PARAMS_EXTRACTED_BITS + j] = (templong >> (8*j)) & 0xFF; ------------------ | | 15| 32|#define PARAMS_EXTRACTED_BITS 2 ------------------ 170| 32| } 171| 16| } 172| 2|} oqs_kem_efrodokem_976_aes_mul_add_as_plus_e: 27| 12|{ // Generate-and-multiply: generate matrix A (N x N) row-wise, multiply by s on the right. 28| | // Inputs: s, e (N x N_BAR) 29| | // Output: out = A*s + e (N x N_BAR) 30| 12|#if defined(OQS_DIST_X86_64_BUILD) 31| 12| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2)) { ------------------ | Branch (31:9): [True: 12, False: 0] ------------------ 32| 12| return frodo_mul_add_as_plus_e_avx2(out, s, e, seed_A); ------------------ | | 46| 12|#define frodo_mul_add_as_plus_e_avx2 oqs_kem_efrodokem_976_aes_mul_add_as_plus_e_avx2 ------------------ 33| 12| } else { 34| 0| return frodo_mul_add_as_plus_e_portable(out, s, e, seed_A); ------------------ | | 45| 0|#define frodo_mul_add_as_plus_e_portable oqs_kem_efrodokem_976_aes_mul_add_as_plus_e_portable ------------------ 35| 0| } 36| |#elif defined(OQS_USE_AVX2_INSTRUCTIONS) 37| | return frodo_mul_add_as_plus_e_avx2(out, s, e, seed_A); 38| |#else 39| | return frodo_mul_add_as_plus_e_portable(out, s, e, seed_A); 40| |#endif 41| 12|} oqs_kem_efrodokem_976_aes_mul_add_sa_plus_e: 44| 24|{ // Generate-and-multiply: generate matrix A (N x N) column-wise, multiply by s' on the left. 45| | // Inputs: s', e' (N_BAR x N) 46| | // Output: out = s'*A + e' (N_BAR x N) 47| 24|#if defined(USE_AES128_FOR_A) 48| 24| #if defined(OQS_DIST_X86_64_BUILD) 49| 24| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2)) { ------------------ | Branch (49:9): [True: 24, False: 0] ------------------ 50| 24| return frodo_mul_add_sa_plus_e_aes_avx2(out, s, e, seed_A); ------------------ | | 49| 24|#define frodo_mul_add_sa_plus_e_aes_avx2 oqs_kem_efrodokem_976_aes_mul_add_sa_plus_e_avx2 ------------------ 51| 24| } else { 52| 0| return frodo_mul_add_sa_plus_e_aes_portable(out, s, e, seed_A); ------------------ | | 48| 0|#define frodo_mul_add_sa_plus_e_aes_portable oqs_kem_efrodokem_976_aes_mul_add_sa_plus_e_portable ------------------ 53| 0| } 54| | #elif defined(OQS_USE_AVX2_INSTRUCTIONS) 55| | return frodo_mul_add_sa_plus_e_aes_avx2(out, s, e, seed_A); 56| | #else 57| | return frodo_mul_add_sa_plus_e_aes_portable(out, s, e, seed_A); 58| | #endif 59| |#elif defined(USE_SHAKE128_FOR_A) 60| | #if defined(OQS_DIST_X86_64_BUILD) 61| | if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2)) { 62| | return frodo_mul_add_sa_plus_e_shake_avx2(out, s, e, seed_A); 63| | } else { 64| | return frodo_mul_add_sa_plus_e_shake_portable(out, s, e, seed_A); 65| | } 66| | #elif defined(OQS_USE_AVX2_INSTRUCTIONS) 67| | return frodo_mul_add_sa_plus_e_shake_avx2(out, s, e, seed_A); 68| | #else 69| | return frodo_mul_add_sa_plus_e_shake_portable(out, s, e, seed_A); 70| | #endif 71| |#endif 72| 24|} oqs_kem_efrodokem_976_aes_mul_bs: 75| 12|{ // Multiply by s on the right 76| | // Inputs: b (N_BAR x N), s (N x N_BAR) 77| | // Output: out = b*s (N_BAR x N_BAR) 78| 12| int i, j, k; 79| | 80| 108| for (i = 0; i < PARAMS_NBAR; i++) { ------------------ | | 12| 108|#define PARAMS_NBAR 8 ------------------ | Branch (80:17): [True: 96, False: 12] ------------------ 81| 864| for (j = 0; j < PARAMS_NBAR; j++) { ------------------ | | 12| 864|#define PARAMS_NBAR 8 ------------------ | Branch (81:21): [True: 768, False: 96] ------------------ 82| 768| out[i*PARAMS_NBAR + j] = 0; ------------------ | | 12| 768|#define PARAMS_NBAR 8 ------------------ 83| 750k| for (k = 0; k < PARAMS_N; k++) { ------------------ | | 11| 750k|#define PARAMS_N 976 ------------------ | Branch (83:25): [True: 749k, False: 768] ------------------ 84| 749k| out[i*PARAMS_NBAR + j] += (uint16_t) ((uint32_t) b[i*PARAMS_N + k] * (uint32_t) s[j*PARAMS_N + k]); ------------------ | | 12| 749k|#define PARAMS_NBAR 8 ------------------ out[i*PARAMS_NBAR + j] += (uint16_t) ((uint32_t) b[i*PARAMS_N + k] * (uint32_t) s[j*PARAMS_N + k]); ------------------ | | 11| 749k|#define PARAMS_N 976 ------------------ out[i*PARAMS_NBAR + j] += (uint16_t) ((uint32_t) b[i*PARAMS_N + k] * (uint32_t) s[j*PARAMS_N + k]); ------------------ | | 11| 749k|#define PARAMS_N 976 ------------------ 85| 749k| } 86| 768| out[i*PARAMS_NBAR + j] = (uint32_t)(out[i*PARAMS_NBAR + j]) & ((1<>= PARAMS_EXTRACTED_BITS; ------------------ | | 15| 1.53k|#define PARAMS_EXTRACTED_BITS 3 ------------------ 147| 1.53k| pos++; 148| 1.53k| } 149| 192| } 150| 24|} oqs_kem_efrodokem_976_aes_key_decode: 154| 12|{ // Decoding 155| 12| unsigned int i, j, index = 0, npieces_word = 8; 156| 12| unsigned int nwords = (PARAMS_NBAR * PARAMS_NBAR) / 8; ------------------ | | 12| 12|#define PARAMS_NBAR 8 ------------------ unsigned int nwords = (PARAMS_NBAR * PARAMS_NBAR) / 8; ------------------ | | 12| 12|#define PARAMS_NBAR 8 ------------------ 157| 12| uint16_t temp, maskex=((uint16_t)1 << PARAMS_EXTRACTED_BITS) -1, maskq =((uint16_t)1 << PARAMS_LOGQ) -1; ------------------ | | 15| 12|#define PARAMS_EXTRACTED_BITS 3 ------------------ uint16_t temp, maskex=((uint16_t)1 << PARAMS_EXTRACTED_BITS) -1, maskq =((uint16_t)1 << PARAMS_LOGQ) -1; ------------------ | | 13| 12|#define PARAMS_LOGQ 16 ------------------ 158| 12| uint8_t *pos = (uint8_t*)out; 159| 12| uint64_t templong; 160| | 161| 108| for (i = 0; i < nwords; i++) { ------------------ | Branch (161:17): [True: 96, False: 12] ------------------ 162| 96| templong = 0; 163| 864| for (j = 0; j < npieces_word; j++) { // temp = floor(in*2^{-11}+0.5) ------------------ | Branch (163:21): [True: 768, False: 96] ------------------ 164| 768| temp = ((in[index] & maskq) + (1 << (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS - 1))) >> (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS); ------------------ | | 13| 768|#define PARAMS_LOGQ 16 ------------------ temp = ((in[index] & maskq) + (1 << (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS - 1))) >> (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS); ------------------ | | 15| 768|#define PARAMS_EXTRACTED_BITS 3 ------------------ temp = ((in[index] & maskq) + (1 << (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS - 1))) >> (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS); ------------------ | | 13| 768|#define PARAMS_LOGQ 16 ------------------ temp = ((in[index] & maskq) + (1 << (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS - 1))) >> (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS); ------------------ | | 15| 768|#define PARAMS_EXTRACTED_BITS 3 ------------------ 165| 768| templong |= ((uint64_t)(temp & maskex)) << (PARAMS_EXTRACTED_BITS * j); ------------------ | | 15| 768|#define PARAMS_EXTRACTED_BITS 3 ------------------ 166| 768| index++; 167| 768| } 168| 384| for (j = 0; j < PARAMS_EXTRACTED_BITS; j++) { ------------------ | | 15| 384|#define PARAMS_EXTRACTED_BITS 3 ------------------ | Branch (168:21): [True: 288, False: 96] ------------------ 169| 288| pos[i*PARAMS_EXTRACTED_BITS + j] = (templong >> (8*j)) & 0xFF; ------------------ | | 15| 288|#define PARAMS_EXTRACTED_BITS 3 ------------------ 170| 288| } 171| 96| } 172| 12|} oqs_kem_efrodokem_976_shake_mul_add_as_plus_e: 27| 12|{ // Generate-and-multiply: generate matrix A (N x N) row-wise, multiply by s on the right. 28| | // Inputs: s, e (N x N_BAR) 29| | // Output: out = A*s + e (N x N_BAR) 30| 12|#if defined(OQS_DIST_X86_64_BUILD) 31| 12| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2)) { ------------------ | Branch (31:9): [True: 12, False: 0] ------------------ 32| 12| return frodo_mul_add_as_plus_e_avx2(out, s, e, seed_A); ------------------ | | 46| 12|#define frodo_mul_add_as_plus_e_avx2 oqs_kem_efrodokem_976_shake_mul_add_as_plus_e_avx2 ------------------ 33| 12| } else { 34| 0| return frodo_mul_add_as_plus_e_portable(out, s, e, seed_A); ------------------ | | 45| 0|#define frodo_mul_add_as_plus_e_portable oqs_kem_efrodokem_976_shake_mul_add_as_plus_e_portable ------------------ 35| 0| } 36| |#elif defined(OQS_USE_AVX2_INSTRUCTIONS) 37| | return frodo_mul_add_as_plus_e_avx2(out, s, e, seed_A); 38| |#else 39| | return frodo_mul_add_as_plus_e_portable(out, s, e, seed_A); 40| |#endif 41| 12|} oqs_kem_efrodokem_976_shake_mul_add_sa_plus_e: 44| 24|{ // Generate-and-multiply: generate matrix A (N x N) column-wise, multiply by s' on the left. 45| | // Inputs: s', e' (N_BAR x N) 46| | // Output: out = s'*A + e' (N_BAR x N) 47| |#if defined(USE_AES128_FOR_A) 48| | #if defined(OQS_DIST_X86_64_BUILD) 49| | if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2)) { 50| | return frodo_mul_add_sa_plus_e_aes_avx2(out, s, e, seed_A); 51| | } else { 52| | return frodo_mul_add_sa_plus_e_aes_portable(out, s, e, seed_A); 53| | } 54| | #elif defined(OQS_USE_AVX2_INSTRUCTIONS) 55| | return frodo_mul_add_sa_plus_e_aes_avx2(out, s, e, seed_A); 56| | #else 57| | return frodo_mul_add_sa_plus_e_aes_portable(out, s, e, seed_A); 58| | #endif 59| |#elif defined(USE_SHAKE128_FOR_A) 60| | #if defined(OQS_DIST_X86_64_BUILD) 61| 24| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2)) { ------------------ | Branch (61:9): [True: 24, False: 0] ------------------ 62| 24| return frodo_mul_add_sa_plus_e_shake_avx2(out, s, e, seed_A); ------------------ | | 49| 24|#define frodo_mul_add_sa_plus_e_shake_avx2 oqs_kem_efrodokem_976_shake_mul_add_sa_plus_e_avx2 ------------------ 63| 24| } else { 64| 0| return frodo_mul_add_sa_plus_e_shake_portable(out, s, e, seed_A); ------------------ | | 48| 0|#define frodo_mul_add_sa_plus_e_shake_portable oqs_kem_efrodokem_976_shake_mul_add_sa_plus_e_portable ------------------ 65| 0| } 66| | #elif defined(OQS_USE_AVX2_INSTRUCTIONS) 67| | return frodo_mul_add_sa_plus_e_shake_avx2(out, s, e, seed_A); 68| | #else 69| | return frodo_mul_add_sa_plus_e_shake_portable(out, s, e, seed_A); 70| | #endif 71| 24|#endif 72| 24|} oqs_kem_efrodokem_976_shake_mul_bs: 75| 12|{ // Multiply by s on the right 76| | // Inputs: b (N_BAR x N), s (N x N_BAR) 77| | // Output: out = b*s (N_BAR x N_BAR) 78| 12| int i, j, k; 79| | 80| 108| for (i = 0; i < PARAMS_NBAR; i++) { ------------------ | | 12| 108|#define PARAMS_NBAR 8 ------------------ | Branch (80:17): [True: 96, False: 12] ------------------ 81| 864| for (j = 0; j < PARAMS_NBAR; j++) { ------------------ | | 12| 864|#define PARAMS_NBAR 8 ------------------ | Branch (81:21): [True: 768, False: 96] ------------------ 82| 768| out[i*PARAMS_NBAR + j] = 0; ------------------ | | 12| 768|#define PARAMS_NBAR 8 ------------------ 83| 750k| for (k = 0; k < PARAMS_N; k++) { ------------------ | | 11| 750k|#define PARAMS_N 976 ------------------ | Branch (83:25): [True: 749k, False: 768] ------------------ 84| 749k| out[i*PARAMS_NBAR + j] += (uint16_t) ((uint32_t) b[i*PARAMS_N + k] * (uint32_t) s[j*PARAMS_N + k]); ------------------ | | 12| 749k|#define PARAMS_NBAR 8 ------------------ out[i*PARAMS_NBAR + j] += (uint16_t) ((uint32_t) b[i*PARAMS_N + k] * (uint32_t) s[j*PARAMS_N + k]); ------------------ | | 11| 749k|#define PARAMS_N 976 ------------------ out[i*PARAMS_NBAR + j] += (uint16_t) ((uint32_t) b[i*PARAMS_N + k] * (uint32_t) s[j*PARAMS_N + k]); ------------------ | | 11| 749k|#define PARAMS_N 976 ------------------ 85| 749k| } 86| 768| out[i*PARAMS_NBAR + j] = (uint32_t)(out[i*PARAMS_NBAR + j]) & ((1<>= PARAMS_EXTRACTED_BITS; ------------------ | | 15| 1.53k|#define PARAMS_EXTRACTED_BITS 3 ------------------ 147| 1.53k| pos++; 148| 1.53k| } 149| 192| } 150| 24|} oqs_kem_efrodokem_976_shake_key_decode: 154| 12|{ // Decoding 155| 12| unsigned int i, j, index = 0, npieces_word = 8; 156| 12| unsigned int nwords = (PARAMS_NBAR * PARAMS_NBAR) / 8; ------------------ | | 12| 12|#define PARAMS_NBAR 8 ------------------ unsigned int nwords = (PARAMS_NBAR * PARAMS_NBAR) / 8; ------------------ | | 12| 12|#define PARAMS_NBAR 8 ------------------ 157| 12| uint16_t temp, maskex=((uint16_t)1 << PARAMS_EXTRACTED_BITS) -1, maskq =((uint16_t)1 << PARAMS_LOGQ) -1; ------------------ | | 15| 12|#define PARAMS_EXTRACTED_BITS 3 ------------------ uint16_t temp, maskex=((uint16_t)1 << PARAMS_EXTRACTED_BITS) -1, maskq =((uint16_t)1 << PARAMS_LOGQ) -1; ------------------ | | 13| 12|#define PARAMS_LOGQ 16 ------------------ 158| 12| uint8_t *pos = (uint8_t*)out; 159| 12| uint64_t templong; 160| | 161| 108| for (i = 0; i < nwords; i++) { ------------------ | Branch (161:17): [True: 96, False: 12] ------------------ 162| 96| templong = 0; 163| 864| for (j = 0; j < npieces_word; j++) { // temp = floor(in*2^{-11}+0.5) ------------------ | Branch (163:21): [True: 768, False: 96] ------------------ 164| 768| temp = ((in[index] & maskq) + (1 << (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS - 1))) >> (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS); ------------------ | | 13| 768|#define PARAMS_LOGQ 16 ------------------ temp = ((in[index] & maskq) + (1 << (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS - 1))) >> (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS); ------------------ | | 15| 768|#define PARAMS_EXTRACTED_BITS 3 ------------------ temp = ((in[index] & maskq) + (1 << (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS - 1))) >> (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS); ------------------ | | 13| 768|#define PARAMS_LOGQ 16 ------------------ temp = ((in[index] & maskq) + (1 << (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS - 1))) >> (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS); ------------------ | | 15| 768|#define PARAMS_EXTRACTED_BITS 3 ------------------ 165| 768| templong |= ((uint64_t)(temp & maskex)) << (PARAMS_EXTRACTED_BITS * j); ------------------ | | 15| 768|#define PARAMS_EXTRACTED_BITS 3 ------------------ 166| 768| index++; 167| 768| } 168| 384| for (j = 0; j < PARAMS_EXTRACTED_BITS; j++) { ------------------ | | 15| 384|#define PARAMS_EXTRACTED_BITS 3 ------------------ | Branch (168:21): [True: 288, False: 96] ------------------ 169| 288| pos[i*PARAMS_EXTRACTED_BITS + j] = (templong >> (8*j)) & 0xFF; ------------------ | | 15| 288|#define PARAMS_EXTRACTED_BITS 3 ------------------ 170| 288| } 171| 96| } 172| 12|} oqs_kem_efrodokem_1344_aes_mul_add_as_plus_e: 27| 8|{ // Generate-and-multiply: generate matrix A (N x N) row-wise, multiply by s on the right. 28| | // Inputs: s, e (N x N_BAR) 29| | // Output: out = A*s + e (N x N_BAR) 30| 8|#if defined(OQS_DIST_X86_64_BUILD) 31| 8| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2)) { ------------------ | Branch (31:9): [True: 8, False: 0] ------------------ 32| 8| return frodo_mul_add_as_plus_e_avx2(out, s, e, seed_A); ------------------ | | 46| 8|#define frodo_mul_add_as_plus_e_avx2 oqs_kem_efrodokem_1344_aes_mul_add_as_plus_e_avx2 ------------------ 33| 8| } else { 34| 0| return frodo_mul_add_as_plus_e_portable(out, s, e, seed_A); ------------------ | | 45| 0|#define frodo_mul_add_as_plus_e_portable oqs_kem_efrodokem_1344_aes_mul_add_as_plus_e_portable ------------------ 35| 0| } 36| |#elif defined(OQS_USE_AVX2_INSTRUCTIONS) 37| | return frodo_mul_add_as_plus_e_avx2(out, s, e, seed_A); 38| |#else 39| | return frodo_mul_add_as_plus_e_portable(out, s, e, seed_A); 40| |#endif 41| 8|} oqs_kem_efrodokem_1344_aes_mul_add_sa_plus_e: 44| 16|{ // Generate-and-multiply: generate matrix A (N x N) column-wise, multiply by s' on the left. 45| | // Inputs: s', e' (N_BAR x N) 46| | // Output: out = s'*A + e' (N_BAR x N) 47| 16|#if defined(USE_AES128_FOR_A) 48| 16| #if defined(OQS_DIST_X86_64_BUILD) 49| 16| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2)) { ------------------ | Branch (49:9): [True: 16, False: 0] ------------------ 50| 16| return frodo_mul_add_sa_plus_e_aes_avx2(out, s, e, seed_A); ------------------ | | 49| 16|#define frodo_mul_add_sa_plus_e_aes_avx2 oqs_kem_efrodokem_1344_aes_mul_add_sa_plus_e_avx2 ------------------ 51| 16| } else { 52| 0| return frodo_mul_add_sa_plus_e_aes_portable(out, s, e, seed_A); ------------------ | | 48| 0|#define frodo_mul_add_sa_plus_e_aes_portable oqs_kem_efrodokem_1344_aes_mul_add_sa_plus_e_portable ------------------ 53| 0| } 54| | #elif defined(OQS_USE_AVX2_INSTRUCTIONS) 55| | return frodo_mul_add_sa_plus_e_aes_avx2(out, s, e, seed_A); 56| | #else 57| | return frodo_mul_add_sa_plus_e_aes_portable(out, s, e, seed_A); 58| | #endif 59| |#elif defined(USE_SHAKE128_FOR_A) 60| | #if defined(OQS_DIST_X86_64_BUILD) 61| | if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2)) { 62| | return frodo_mul_add_sa_plus_e_shake_avx2(out, s, e, seed_A); 63| | } else { 64| | return frodo_mul_add_sa_plus_e_shake_portable(out, s, e, seed_A); 65| | } 66| | #elif defined(OQS_USE_AVX2_INSTRUCTIONS) 67| | return frodo_mul_add_sa_plus_e_shake_avx2(out, s, e, seed_A); 68| | #else 69| | return frodo_mul_add_sa_plus_e_shake_portable(out, s, e, seed_A); 70| | #endif 71| |#endif 72| 16|} oqs_kem_efrodokem_1344_aes_mul_bs: 75| 8|{ // Multiply by s on the right 76| | // Inputs: b (N_BAR x N), s (N x N_BAR) 77| | // Output: out = b*s (N_BAR x N_BAR) 78| 8| int i, j, k; 79| | 80| 72| for (i = 0; i < PARAMS_NBAR; i++) { ------------------ | | 12| 72|#define PARAMS_NBAR 8 ------------------ | Branch (80:17): [True: 64, False: 8] ------------------ 81| 576| for (j = 0; j < PARAMS_NBAR; j++) { ------------------ | | 12| 576|#define PARAMS_NBAR 8 ------------------ | Branch (81:21): [True: 512, False: 64] ------------------ 82| 512| out[i*PARAMS_NBAR + j] = 0; ------------------ | | 12| 512|#define PARAMS_NBAR 8 ------------------ 83| 688k| for (k = 0; k < PARAMS_N; k++) { ------------------ | | 11| 688k|#define PARAMS_N 1344 ------------------ | Branch (83:25): [True: 688k, False: 512] ------------------ 84| 688k| out[i*PARAMS_NBAR + j] += (uint16_t) ((uint32_t) b[i*PARAMS_N + k] * (uint32_t) s[j*PARAMS_N + k]); ------------------ | | 12| 688k|#define PARAMS_NBAR 8 ------------------ out[i*PARAMS_NBAR + j] += (uint16_t) ((uint32_t) b[i*PARAMS_N + k] * (uint32_t) s[j*PARAMS_N + k]); ------------------ | | 11| 688k|#define PARAMS_N 1344 ------------------ out[i*PARAMS_NBAR + j] += (uint16_t) ((uint32_t) b[i*PARAMS_N + k] * (uint32_t) s[j*PARAMS_N + k]); ------------------ | | 11| 688k|#define PARAMS_N 1344 ------------------ 85| 688k| } 86| 512| out[i*PARAMS_NBAR + j] = (uint32_t)(out[i*PARAMS_NBAR + j]) & ((1<>= PARAMS_EXTRACTED_BITS; ------------------ | | 15| 1.02k|#define PARAMS_EXTRACTED_BITS 4 ------------------ 147| 1.02k| pos++; 148| 1.02k| } 149| 128| } 150| 16|} oqs_kem_efrodokem_1344_aes_key_decode: 154| 8|{ // Decoding 155| 8| unsigned int i, j, index = 0, npieces_word = 8; 156| 8| unsigned int nwords = (PARAMS_NBAR * PARAMS_NBAR) / 8; ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ unsigned int nwords = (PARAMS_NBAR * PARAMS_NBAR) / 8; ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ 157| 8| uint16_t temp, maskex=((uint16_t)1 << PARAMS_EXTRACTED_BITS) -1, maskq =((uint16_t)1 << PARAMS_LOGQ) -1; ------------------ | | 15| 8|#define PARAMS_EXTRACTED_BITS 4 ------------------ uint16_t temp, maskex=((uint16_t)1 << PARAMS_EXTRACTED_BITS) -1, maskq =((uint16_t)1 << PARAMS_LOGQ) -1; ------------------ | | 13| 8|#define PARAMS_LOGQ 16 ------------------ 158| 8| uint8_t *pos = (uint8_t*)out; 159| 8| uint64_t templong; 160| | 161| 72| for (i = 0; i < nwords; i++) { ------------------ | Branch (161:17): [True: 64, False: 8] ------------------ 162| 64| templong = 0; 163| 576| for (j = 0; j < npieces_word; j++) { // temp = floor(in*2^{-11}+0.5) ------------------ | Branch (163:21): [True: 512, False: 64] ------------------ 164| 512| temp = ((in[index] & maskq) + (1 << (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS - 1))) >> (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS); ------------------ | | 13| 512|#define PARAMS_LOGQ 16 ------------------ temp = ((in[index] & maskq) + (1 << (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS - 1))) >> (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS); ------------------ | | 15| 512|#define PARAMS_EXTRACTED_BITS 4 ------------------ temp = ((in[index] & maskq) + (1 << (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS - 1))) >> (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS); ------------------ | | 13| 512|#define PARAMS_LOGQ 16 ------------------ temp = ((in[index] & maskq) + (1 << (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS - 1))) >> (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS); ------------------ | | 15| 512|#define PARAMS_EXTRACTED_BITS 4 ------------------ 165| 512| templong |= ((uint64_t)(temp & maskex)) << (PARAMS_EXTRACTED_BITS * j); ------------------ | | 15| 512|#define PARAMS_EXTRACTED_BITS 4 ------------------ 166| 512| index++; 167| 512| } 168| 320| for (j = 0; j < PARAMS_EXTRACTED_BITS; j++) { ------------------ | | 15| 320|#define PARAMS_EXTRACTED_BITS 4 ------------------ | Branch (168:21): [True: 256, False: 64] ------------------ 169| 256| pos[i*PARAMS_EXTRACTED_BITS + j] = (templong >> (8*j)) & 0xFF; ------------------ | | 15| 256|#define PARAMS_EXTRACTED_BITS 4 ------------------ 170| 256| } 171| 64| } 172| 8|} oqs_kem_efrodokem_1344_shake_mul_add_as_plus_e: 27| 5|{ // Generate-and-multiply: generate matrix A (N x N) row-wise, multiply by s on the right. 28| | // Inputs: s, e (N x N_BAR) 29| | // Output: out = A*s + e (N x N_BAR) 30| 5|#if defined(OQS_DIST_X86_64_BUILD) 31| 5| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2)) { ------------------ | Branch (31:9): [True: 5, False: 0] ------------------ 32| 5| return frodo_mul_add_as_plus_e_avx2(out, s, e, seed_A); ------------------ | | 46| 5|#define frodo_mul_add_as_plus_e_avx2 oqs_kem_efrodokem_1344_shake_mul_add_as_plus_e_avx2 ------------------ 33| 5| } else { 34| 0| return frodo_mul_add_as_plus_e_portable(out, s, e, seed_A); ------------------ | | 45| 0|#define frodo_mul_add_as_plus_e_portable oqs_kem_efrodokem_1344_shake_mul_add_as_plus_e_portable ------------------ 35| 0| } 36| |#elif defined(OQS_USE_AVX2_INSTRUCTIONS) 37| | return frodo_mul_add_as_plus_e_avx2(out, s, e, seed_A); 38| |#else 39| | return frodo_mul_add_as_plus_e_portable(out, s, e, seed_A); 40| |#endif 41| 5|} oqs_kem_efrodokem_1344_shake_mul_add_sa_plus_e: 44| 10|{ // Generate-and-multiply: generate matrix A (N x N) column-wise, multiply by s' on the left. 45| | // Inputs: s', e' (N_BAR x N) 46| | // Output: out = s'*A + e' (N_BAR x N) 47| |#if defined(USE_AES128_FOR_A) 48| | #if defined(OQS_DIST_X86_64_BUILD) 49| | if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2)) { 50| | return frodo_mul_add_sa_plus_e_aes_avx2(out, s, e, seed_A); 51| | } else { 52| | return frodo_mul_add_sa_plus_e_aes_portable(out, s, e, seed_A); 53| | } 54| | #elif defined(OQS_USE_AVX2_INSTRUCTIONS) 55| | return frodo_mul_add_sa_plus_e_aes_avx2(out, s, e, seed_A); 56| | #else 57| | return frodo_mul_add_sa_plus_e_aes_portable(out, s, e, seed_A); 58| | #endif 59| |#elif defined(USE_SHAKE128_FOR_A) 60| | #if defined(OQS_DIST_X86_64_BUILD) 61| 10| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2)) { ------------------ | Branch (61:9): [True: 10, False: 0] ------------------ 62| 10| return frodo_mul_add_sa_plus_e_shake_avx2(out, s, e, seed_A); ------------------ | | 49| 10|#define frodo_mul_add_sa_plus_e_shake_avx2 oqs_kem_efrodokem_1344_shake_mul_add_sa_plus_e_avx2 ------------------ 63| 10| } else { 64| 0| return frodo_mul_add_sa_plus_e_shake_portable(out, s, e, seed_A); ------------------ | | 48| 0|#define frodo_mul_add_sa_plus_e_shake_portable oqs_kem_efrodokem_1344_shake_mul_add_sa_plus_e_portable ------------------ 65| 0| } 66| | #elif defined(OQS_USE_AVX2_INSTRUCTIONS) 67| | return frodo_mul_add_sa_plus_e_shake_avx2(out, s, e, seed_A); 68| | #else 69| | return frodo_mul_add_sa_plus_e_shake_portable(out, s, e, seed_A); 70| | #endif 71| 10|#endif 72| 10|} oqs_kem_efrodokem_1344_shake_mul_bs: 75| 5|{ // Multiply by s on the right 76| | // Inputs: b (N_BAR x N), s (N x N_BAR) 77| | // Output: out = b*s (N_BAR x N_BAR) 78| 5| int i, j, k; 79| | 80| 45| for (i = 0; i < PARAMS_NBAR; i++) { ------------------ | | 12| 45|#define PARAMS_NBAR 8 ------------------ | Branch (80:17): [True: 40, False: 5] ------------------ 81| 360| for (j = 0; j < PARAMS_NBAR; j++) { ------------------ | | 12| 360|#define PARAMS_NBAR 8 ------------------ | Branch (81:21): [True: 320, False: 40] ------------------ 82| 320| out[i*PARAMS_NBAR + j] = 0; ------------------ | | 12| 320|#define PARAMS_NBAR 8 ------------------ 83| 430k| for (k = 0; k < PARAMS_N; k++) { ------------------ | | 11| 430k|#define PARAMS_N 1344 ------------------ | Branch (83:25): [True: 430k, False: 320] ------------------ 84| 430k| out[i*PARAMS_NBAR + j] += (uint16_t) ((uint32_t) b[i*PARAMS_N + k] * (uint32_t) s[j*PARAMS_N + k]); ------------------ | | 12| 430k|#define PARAMS_NBAR 8 ------------------ out[i*PARAMS_NBAR + j] += (uint16_t) ((uint32_t) b[i*PARAMS_N + k] * (uint32_t) s[j*PARAMS_N + k]); ------------------ | | 11| 430k|#define PARAMS_N 1344 ------------------ out[i*PARAMS_NBAR + j] += (uint16_t) ((uint32_t) b[i*PARAMS_N + k] * (uint32_t) s[j*PARAMS_N + k]); ------------------ | | 11| 430k|#define PARAMS_N 1344 ------------------ 85| 430k| } 86| 320| out[i*PARAMS_NBAR + j] = (uint32_t)(out[i*PARAMS_NBAR + j]) & ((1<>= PARAMS_EXTRACTED_BITS; ------------------ | | 15| 640|#define PARAMS_EXTRACTED_BITS 4 ------------------ 147| 640| pos++; 148| 640| } 149| 80| } 150| 10|} oqs_kem_efrodokem_1344_shake_key_decode: 154| 5|{ // Decoding 155| 5| unsigned int i, j, index = 0, npieces_word = 8; 156| 5| unsigned int nwords = (PARAMS_NBAR * PARAMS_NBAR) / 8; ------------------ | | 12| 5|#define PARAMS_NBAR 8 ------------------ unsigned int nwords = (PARAMS_NBAR * PARAMS_NBAR) / 8; ------------------ | | 12| 5|#define PARAMS_NBAR 8 ------------------ 157| 5| uint16_t temp, maskex=((uint16_t)1 << PARAMS_EXTRACTED_BITS) -1, maskq =((uint16_t)1 << PARAMS_LOGQ) -1; ------------------ | | 15| 5|#define PARAMS_EXTRACTED_BITS 4 ------------------ uint16_t temp, maskex=((uint16_t)1 << PARAMS_EXTRACTED_BITS) -1, maskq =((uint16_t)1 << PARAMS_LOGQ) -1; ------------------ | | 13| 5|#define PARAMS_LOGQ 16 ------------------ 158| 5| uint8_t *pos = (uint8_t*)out; 159| 5| uint64_t templong; 160| | 161| 45| for (i = 0; i < nwords; i++) { ------------------ | Branch (161:17): [True: 40, False: 5] ------------------ 162| 40| templong = 0; 163| 360| for (j = 0; j < npieces_word; j++) { // temp = floor(in*2^{-11}+0.5) ------------------ | Branch (163:21): [True: 320, False: 40] ------------------ 164| 320| temp = ((in[index] & maskq) + (1 << (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS - 1))) >> (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS); ------------------ | | 13| 320|#define PARAMS_LOGQ 16 ------------------ temp = ((in[index] & maskq) + (1 << (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS - 1))) >> (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS); ------------------ | | 15| 320|#define PARAMS_EXTRACTED_BITS 4 ------------------ temp = ((in[index] & maskq) + (1 << (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS - 1))) >> (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS); ------------------ | | 13| 320|#define PARAMS_LOGQ 16 ------------------ temp = ((in[index] & maskq) + (1 << (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS - 1))) >> (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS); ------------------ | | 15| 320|#define PARAMS_EXTRACTED_BITS 4 ------------------ 165| 320| templong |= ((uint64_t)(temp & maskex)) << (PARAMS_EXTRACTED_BITS * j); ------------------ | | 15| 320|#define PARAMS_EXTRACTED_BITS 4 ------------------ 166| 320| index++; 167| 320| } 168| 200| for (j = 0; j < PARAMS_EXTRACTED_BITS; j++) { ------------------ | | 15| 200|#define PARAMS_EXTRACTED_BITS 4 ------------------ | Branch (168:21): [True: 160, False: 40] ------------------ 169| 160| pos[i*PARAMS_EXTRACTED_BITS + j] = (templong >> (8*j)) & 0xFF; ------------------ | | 15| 160|#define PARAMS_EXTRACTED_BITS 4 ------------------ 170| 160| } 171| 40| } 172| 5|} oqs_kem_frodokem_640_shake_mul_add_sa_plus_e_avx2: 7| 6|{ // Generate-and-multiply: generate matrix A (N x N) column-wise, multiply by s' on the left. 8| | // Inputs: s', e' (N_BAR x N) 9| | // Output: out = s'*A + e' (N_BAR x N) 10| 6| int i, j, kk; 11| | 12| 15.3k| for (i = 0; i < (PARAMS_N*PARAMS_NBAR); i += 2) { ------------------ | | 11| 15.3k|#define PARAMS_N 640 ------------------ for (i = 0; i < (PARAMS_N*PARAMS_NBAR); i += 2) { ------------------ | | 12| 15.3k|#define PARAMS_NBAR 8 ------------------ | Branch (12:17): [True: 15.3k, False: 6] ------------------ 13| 15.3k| *((uint32_t*)&out[i]) = *((uint32_t*)&e[i]); 14| 15.3k| } 15| | 16| 6| int t=0; 17| 6| ALIGN_HEADER(32) uint16_t a_cols[4*PARAMS_N] ALIGN_FOOTER(32) = {0}; 18| | 19| 6| uint8_t seed_A_separated_0[2 + BYTES_SEED_A]; 20| 6| uint8_t seed_A_separated_1[2 + BYTES_SEED_A]; 21| 6| uint8_t seed_A_separated_2[2 + BYTES_SEED_A]; 22| 6| uint8_t seed_A_separated_3[2 + BYTES_SEED_A]; 23| 6| uint16_t* seed_A_origin_0 = (uint16_t*)&seed_A_separated_0; 24| 6| uint16_t* seed_A_origin_1 = (uint16_t*)&seed_A_separated_1; 25| 6| uint16_t* seed_A_origin_2 = (uint16_t*)&seed_A_separated_2; 26| 6| uint16_t* seed_A_origin_3 = (uint16_t*)&seed_A_separated_3; 27| 6| memcpy(&seed_A_separated_0[2], seed_A, BYTES_SEED_A); ------------------ | | 18| 6|#define BYTES_SEED_A 16 ------------------ 28| 6| memcpy(&seed_A_separated_1[2], seed_A, BYTES_SEED_A); ------------------ | | 18| 6|#define BYTES_SEED_A 16 ------------------ 29| 6| memcpy(&seed_A_separated_2[2], seed_A, BYTES_SEED_A); ------------------ | | 18| 6|#define BYTES_SEED_A 16 ------------------ 30| 6| memcpy(&seed_A_separated_3[2], seed_A, BYTES_SEED_A); ------------------ | | 18| 6|#define BYTES_SEED_A 16 ------------------ 31| | 32| 966| for (kk = 0; kk < PARAMS_N; kk+=4) { ------------------ | | 11| 966|#define PARAMS_N 640 ------------------ | Branch (32:18): [True: 960, False: 6] ------------------ 33| 960| seed_A_origin_0[0] = UINT16_TO_LE(kk + 0); ------------------ | | 35| 960| #define UINT16_TO_LE(n) (n) ------------------ 34| 960| seed_A_origin_1[0] = UINT16_TO_LE(kk + 1); ------------------ | | 35| 960| #define UINT16_TO_LE(n) (n) ------------------ 35| 960| seed_A_origin_2[0] = UINT16_TO_LE(kk + 2); ------------------ | | 35| 960| #define UINT16_TO_LE(n) (n) ------------------ 36| 960| seed_A_origin_3[0] = UINT16_TO_LE(kk + 3); ------------------ | | 35| 960| #define UINT16_TO_LE(n) (n) ------------------ 37| 960| OQS_SHA3_shake128_x4((unsigned char*)(a_cols), (unsigned char*)(a_cols + PARAMS_N), (unsigned char*)(a_cols + 2*PARAMS_N), (unsigned char*)(a_cols + 3*PARAMS_N), ------------------ | | 11| 960|#define PARAMS_N 640 ------------------ OQS_SHA3_shake128_x4((unsigned char*)(a_cols), (unsigned char*)(a_cols + PARAMS_N), (unsigned char*)(a_cols + 2*PARAMS_N), (unsigned char*)(a_cols + 3*PARAMS_N), ------------------ | | 11| 960|#define PARAMS_N 640 ------------------ OQS_SHA3_shake128_x4((unsigned char*)(a_cols), (unsigned char*)(a_cols + PARAMS_N), (unsigned char*)(a_cols + 2*PARAMS_N), (unsigned char*)(a_cols + 3*PARAMS_N), ------------------ | | 11| 960|#define PARAMS_N 640 ------------------ 38| 960| (unsigned long long)(2*PARAMS_N), seed_A_separated_0, seed_A_separated_1, seed_A_separated_2, seed_A_separated_3, 2 + BYTES_SEED_A); ------------------ | | 11| 960|#define PARAMS_N 640 ------------------ (unsigned long long)(2*PARAMS_N), seed_A_separated_0, seed_A_separated_1, seed_A_separated_2, seed_A_separated_3, 2 + BYTES_SEED_A); ------------------ | | 18| 960|#define BYTES_SEED_A 16 ------------------ 39| | 40| 8.64k| for (i = 0; i < PARAMS_NBAR; i++) { ------------------ | | 12| 8.64k|#define PARAMS_NBAR 8 ------------------ | Branch (40:21): [True: 7.68k, False: 960] ------------------ 41| 7.68k| __m256i a, b0, b1, b2, b3, acc[PARAMS_N/16]; 42| 7.68k| b0 = _mm256_set1_epi16(s[i*PARAMS_N + kk + 0]); ------------------ | | 11| 7.68k|#define PARAMS_N 640 ------------------ 43| 7.68k| b1 = _mm256_set1_epi16(s[i*PARAMS_N + kk + 1]); ------------------ | | 11| 7.68k|#define PARAMS_N 640 ------------------ 44| 7.68k| b2 = _mm256_set1_epi16(s[i*PARAMS_N + kk + 2]); ------------------ | | 11| 7.68k|#define PARAMS_N 640 ------------------ 45| 7.68k| b3 = _mm256_set1_epi16(s[i*PARAMS_N + kk + 3]); ------------------ | | 11| 7.68k|#define PARAMS_N 640 ------------------ 46| 314k| for (j = 0; j < PARAMS_N; j+=16) { // Matrix-vector multiplication ------------------ | | 11| 314k|#define PARAMS_N 640 ------------------ | Branch (46:25): [True: 307k, False: 7.68k] ------------------ 47| 307k| acc[j/16] = _mm256_load_si256((__m256i*)&out[i*PARAMS_N + j]); ------------------ | | 11| 307k|#define PARAMS_N 640 ------------------ 48| 307k| a = _mm256_load_si256((__m256i*)&a_cols[(t+0)*PARAMS_N + j]); ------------------ | | 11| 307k|#define PARAMS_N 640 ------------------ 49| 307k| a = _mm256_mullo_epi16(a, b0); 50| 307k| acc[j/16] = _mm256_add_epi16(a, acc[j/16]); 51| 307k| a = _mm256_load_si256((__m256i*)&a_cols[(t+1)*PARAMS_N + j]); ------------------ | | 11| 307k|#define PARAMS_N 640 ------------------ 52| 307k| a = _mm256_mullo_epi16(a, b1); 53| 307k| acc[j/16] = _mm256_add_epi16(a, acc[j/16]); 54| 307k| a = _mm256_load_si256((__m256i*)&a_cols[(t+2)*PARAMS_N + j]); ------------------ | | 11| 307k|#define PARAMS_N 640 ------------------ 55| 307k| a = _mm256_mullo_epi16(a, b2); 56| 307k| acc[j/16] = _mm256_add_epi16(a, acc[j/16]); 57| 307k| a = _mm256_load_si256((__m256i*)&a_cols[(t+3)*PARAMS_N + j]); ------------------ | | 11| 307k|#define PARAMS_N 640 ------------------ 58| 307k| a = _mm256_mullo_epi16(a, b3); 59| 307k| acc[j/16] = _mm256_add_epi16(a, acc[j/16]); 60| 307k| } 61| 314k| for (j = 0; j < PARAMS_N/16; j++) { ------------------ | | 11| 314k|#define PARAMS_N 640 ------------------ | Branch (61:25): [True: 307k, False: 7.68k] ------------------ 62| 307k| _mm256_store_si256((__m256i*)&out[i*PARAMS_N + 16*j], acc[j]); ------------------ | | 11| 307k|#define PARAMS_N 640 ------------------ 63| 307k| } 64| 7.68k| } 65| 960| } 66| | 67| 6| return 1; 68| 6|} oqs_kem_frodokem_976_shake_mul_add_sa_plus_e_avx2: 7| 22|{ // Generate-and-multiply: generate matrix A (N x N) column-wise, multiply by s' on the left. 8| | // Inputs: s', e' (N_BAR x N) 9| | // Output: out = s'*A + e' (N_BAR x N) 10| 22| int i, j, kk; 11| | 12| 85.9k| for (i = 0; i < (PARAMS_N*PARAMS_NBAR); i += 2) { ------------------ | | 11| 85.9k|#define PARAMS_N 976 ------------------ for (i = 0; i < (PARAMS_N*PARAMS_NBAR); i += 2) { ------------------ | | 12| 85.9k|#define PARAMS_NBAR 8 ------------------ | Branch (12:17): [True: 85.8k, False: 22] ------------------ 13| 85.8k| *((uint32_t*)&out[i]) = *((uint32_t*)&e[i]); 14| 85.8k| } 15| | 16| 22| int t=0; 17| 22| ALIGN_HEADER(32) uint16_t a_cols[4*PARAMS_N] ALIGN_FOOTER(32) = {0}; 18| | 19| 22| uint8_t seed_A_separated_0[2 + BYTES_SEED_A]; 20| 22| uint8_t seed_A_separated_1[2 + BYTES_SEED_A]; 21| 22| uint8_t seed_A_separated_2[2 + BYTES_SEED_A]; 22| 22| uint8_t seed_A_separated_3[2 + BYTES_SEED_A]; 23| 22| uint16_t* seed_A_origin_0 = (uint16_t*)&seed_A_separated_0; 24| 22| uint16_t* seed_A_origin_1 = (uint16_t*)&seed_A_separated_1; 25| 22| uint16_t* seed_A_origin_2 = (uint16_t*)&seed_A_separated_2; 26| 22| uint16_t* seed_A_origin_3 = (uint16_t*)&seed_A_separated_3; 27| 22| memcpy(&seed_A_separated_0[2], seed_A, BYTES_SEED_A); ------------------ | | 18| 22|#define BYTES_SEED_A 16 ------------------ 28| 22| memcpy(&seed_A_separated_1[2], seed_A, BYTES_SEED_A); ------------------ | | 18| 22|#define BYTES_SEED_A 16 ------------------ 29| 22| memcpy(&seed_A_separated_2[2], seed_A, BYTES_SEED_A); ------------------ | | 18| 22|#define BYTES_SEED_A 16 ------------------ 30| 22| memcpy(&seed_A_separated_3[2], seed_A, BYTES_SEED_A); ------------------ | | 18| 22|#define BYTES_SEED_A 16 ------------------ 31| | 32| 5.39k| for (kk = 0; kk < PARAMS_N; kk+=4) { ------------------ | | 11| 5.39k|#define PARAMS_N 976 ------------------ | Branch (32:18): [True: 5.36k, False: 22] ------------------ 33| 5.36k| seed_A_origin_0[0] = UINT16_TO_LE(kk + 0); ------------------ | | 35| 5.36k| #define UINT16_TO_LE(n) (n) ------------------ 34| 5.36k| seed_A_origin_1[0] = UINT16_TO_LE(kk + 1); ------------------ | | 35| 5.36k| #define UINT16_TO_LE(n) (n) ------------------ 35| 5.36k| seed_A_origin_2[0] = UINT16_TO_LE(kk + 2); ------------------ | | 35| 5.36k| #define UINT16_TO_LE(n) (n) ------------------ 36| 5.36k| seed_A_origin_3[0] = UINT16_TO_LE(kk + 3); ------------------ | | 35| 5.36k| #define UINT16_TO_LE(n) (n) ------------------ 37| 5.36k| OQS_SHA3_shake128_x4((unsigned char*)(a_cols), (unsigned char*)(a_cols + PARAMS_N), (unsigned char*)(a_cols + 2*PARAMS_N), (unsigned char*)(a_cols + 3*PARAMS_N), ------------------ | | 11| 5.36k|#define PARAMS_N 976 ------------------ OQS_SHA3_shake128_x4((unsigned char*)(a_cols), (unsigned char*)(a_cols + PARAMS_N), (unsigned char*)(a_cols + 2*PARAMS_N), (unsigned char*)(a_cols + 3*PARAMS_N), ------------------ | | 11| 5.36k|#define PARAMS_N 976 ------------------ OQS_SHA3_shake128_x4((unsigned char*)(a_cols), (unsigned char*)(a_cols + PARAMS_N), (unsigned char*)(a_cols + 2*PARAMS_N), (unsigned char*)(a_cols + 3*PARAMS_N), ------------------ | | 11| 5.36k|#define PARAMS_N 976 ------------------ 38| 5.36k| (unsigned long long)(2*PARAMS_N), seed_A_separated_0, seed_A_separated_1, seed_A_separated_2, seed_A_separated_3, 2 + BYTES_SEED_A); ------------------ | | 11| 5.36k|#define PARAMS_N 976 ------------------ (unsigned long long)(2*PARAMS_N), seed_A_separated_0, seed_A_separated_1, seed_A_separated_2, seed_A_separated_3, 2 + BYTES_SEED_A); ------------------ | | 18| 5.36k|#define BYTES_SEED_A 16 ------------------ 39| | 40| 48.3k| for (i = 0; i < PARAMS_NBAR; i++) { ------------------ | | 12| 48.3k|#define PARAMS_NBAR 8 ------------------ | Branch (40:21): [True: 42.9k, False: 5.36k] ------------------ 41| 42.9k| __m256i a, b0, b1, b2, b3, acc[PARAMS_N/16]; 42| 42.9k| b0 = _mm256_set1_epi16(s[i*PARAMS_N + kk + 0]); ------------------ | | 11| 42.9k|#define PARAMS_N 976 ------------------ 43| 42.9k| b1 = _mm256_set1_epi16(s[i*PARAMS_N + kk + 1]); ------------------ | | 11| 42.9k|#define PARAMS_N 976 ------------------ 44| 42.9k| b2 = _mm256_set1_epi16(s[i*PARAMS_N + kk + 2]); ------------------ | | 11| 42.9k|#define PARAMS_N 976 ------------------ 45| 42.9k| b3 = _mm256_set1_epi16(s[i*PARAMS_N + kk + 3]); ------------------ | | 11| 42.9k|#define PARAMS_N 976 ------------------ 46| 2.66M| for (j = 0; j < PARAMS_N; j+=16) { // Matrix-vector multiplication ------------------ | | 11| 2.66M|#define PARAMS_N 976 ------------------ | Branch (46:25): [True: 2.61M, False: 42.9k] ------------------ 47| 2.61M| acc[j/16] = _mm256_load_si256((__m256i*)&out[i*PARAMS_N + j]); ------------------ | | 11| 2.61M|#define PARAMS_N 976 ------------------ 48| 2.61M| a = _mm256_load_si256((__m256i*)&a_cols[(t+0)*PARAMS_N + j]); ------------------ | | 11| 2.61M|#define PARAMS_N 976 ------------------ 49| 2.61M| a = _mm256_mullo_epi16(a, b0); 50| 2.61M| acc[j/16] = _mm256_add_epi16(a, acc[j/16]); 51| 2.61M| a = _mm256_load_si256((__m256i*)&a_cols[(t+1)*PARAMS_N + j]); ------------------ | | 11| 2.61M|#define PARAMS_N 976 ------------------ 52| 2.61M| a = _mm256_mullo_epi16(a, b1); 53| 2.61M| acc[j/16] = _mm256_add_epi16(a, acc[j/16]); 54| 2.61M| a = _mm256_load_si256((__m256i*)&a_cols[(t+2)*PARAMS_N + j]); ------------------ | | 11| 2.61M|#define PARAMS_N 976 ------------------ 55| 2.61M| a = _mm256_mullo_epi16(a, b2); 56| 2.61M| acc[j/16] = _mm256_add_epi16(a, acc[j/16]); 57| 2.61M| a = _mm256_load_si256((__m256i*)&a_cols[(t+3)*PARAMS_N + j]); ------------------ | | 11| 2.61M|#define PARAMS_N 976 ------------------ 58| 2.61M| a = _mm256_mullo_epi16(a, b3); 59| 2.61M| acc[j/16] = _mm256_add_epi16(a, acc[j/16]); 60| 2.61M| } 61| 2.66M| for (j = 0; j < PARAMS_N/16; j++) { ------------------ | | 11| 2.66M|#define PARAMS_N 976 ------------------ | Branch (61:25): [True: 2.61M, False: 42.9k] ------------------ 62| 2.61M| _mm256_store_si256((__m256i*)&out[i*PARAMS_N + 16*j], acc[j]); ------------------ | | 11| 2.61M|#define PARAMS_N 976 ------------------ 63| 2.61M| } 64| 42.9k| } 65| 5.36k| } 66| | 67| 22| return 1; 68| 22|} oqs_kem_frodokem_1344_shake_mul_add_sa_plus_e_avx2: 7| 18|{ // Generate-and-multiply: generate matrix A (N x N) column-wise, multiply by s' on the left. 8| | // Inputs: s', e' (N_BAR x N) 9| | // Output: out = s'*A + e' (N_BAR x N) 10| 18| int i, j, kk; 11| | 12| 96.7k| for (i = 0; i < (PARAMS_N*PARAMS_NBAR); i += 2) { ------------------ | | 11| 96.7k|#define PARAMS_N 1344 ------------------ for (i = 0; i < (PARAMS_N*PARAMS_NBAR); i += 2) { ------------------ | | 12| 96.7k|#define PARAMS_NBAR 8 ------------------ | Branch (12:17): [True: 96.7k, False: 18] ------------------ 13| 96.7k| *((uint32_t*)&out[i]) = *((uint32_t*)&e[i]); 14| 96.7k| } 15| | 16| 18| int t=0; 17| 18| ALIGN_HEADER(32) uint16_t a_cols[4*PARAMS_N] ALIGN_FOOTER(32) = {0}; 18| | 19| 18| uint8_t seed_A_separated_0[2 + BYTES_SEED_A]; 20| 18| uint8_t seed_A_separated_1[2 + BYTES_SEED_A]; 21| 18| uint8_t seed_A_separated_2[2 + BYTES_SEED_A]; 22| 18| uint8_t seed_A_separated_3[2 + BYTES_SEED_A]; 23| 18| uint16_t* seed_A_origin_0 = (uint16_t*)&seed_A_separated_0; 24| 18| uint16_t* seed_A_origin_1 = (uint16_t*)&seed_A_separated_1; 25| 18| uint16_t* seed_A_origin_2 = (uint16_t*)&seed_A_separated_2; 26| 18| uint16_t* seed_A_origin_3 = (uint16_t*)&seed_A_separated_3; 27| 18| memcpy(&seed_A_separated_0[2], seed_A, BYTES_SEED_A); ------------------ | | 18| 18|#define BYTES_SEED_A 16 ------------------ 28| 18| memcpy(&seed_A_separated_1[2], seed_A, BYTES_SEED_A); ------------------ | | 18| 18|#define BYTES_SEED_A 16 ------------------ 29| 18| memcpy(&seed_A_separated_2[2], seed_A, BYTES_SEED_A); ------------------ | | 18| 18|#define BYTES_SEED_A 16 ------------------ 30| 18| memcpy(&seed_A_separated_3[2], seed_A, BYTES_SEED_A); ------------------ | | 18| 18|#define BYTES_SEED_A 16 ------------------ 31| | 32| 6.06k| for (kk = 0; kk < PARAMS_N; kk+=4) { ------------------ | | 11| 6.06k|#define PARAMS_N 1344 ------------------ | Branch (32:18): [True: 6.04k, False: 18] ------------------ 33| 6.04k| seed_A_origin_0[0] = UINT16_TO_LE(kk + 0); ------------------ | | 35| 6.04k| #define UINT16_TO_LE(n) (n) ------------------ 34| 6.04k| seed_A_origin_1[0] = UINT16_TO_LE(kk + 1); ------------------ | | 35| 6.04k| #define UINT16_TO_LE(n) (n) ------------------ 35| 6.04k| seed_A_origin_2[0] = UINT16_TO_LE(kk + 2); ------------------ | | 35| 6.04k| #define UINT16_TO_LE(n) (n) ------------------ 36| 6.04k| seed_A_origin_3[0] = UINT16_TO_LE(kk + 3); ------------------ | | 35| 6.04k| #define UINT16_TO_LE(n) (n) ------------------ 37| 6.04k| OQS_SHA3_shake128_x4((unsigned char*)(a_cols), (unsigned char*)(a_cols + PARAMS_N), (unsigned char*)(a_cols + 2*PARAMS_N), (unsigned char*)(a_cols + 3*PARAMS_N), ------------------ | | 11| 6.04k|#define PARAMS_N 1344 ------------------ OQS_SHA3_shake128_x4((unsigned char*)(a_cols), (unsigned char*)(a_cols + PARAMS_N), (unsigned char*)(a_cols + 2*PARAMS_N), (unsigned char*)(a_cols + 3*PARAMS_N), ------------------ | | 11| 6.04k|#define PARAMS_N 1344 ------------------ OQS_SHA3_shake128_x4((unsigned char*)(a_cols), (unsigned char*)(a_cols + PARAMS_N), (unsigned char*)(a_cols + 2*PARAMS_N), (unsigned char*)(a_cols + 3*PARAMS_N), ------------------ | | 11| 6.04k|#define PARAMS_N 1344 ------------------ 38| 6.04k| (unsigned long long)(2*PARAMS_N), seed_A_separated_0, seed_A_separated_1, seed_A_separated_2, seed_A_separated_3, 2 + BYTES_SEED_A); ------------------ | | 11| 6.04k|#define PARAMS_N 1344 ------------------ (unsigned long long)(2*PARAMS_N), seed_A_separated_0, seed_A_separated_1, seed_A_separated_2, seed_A_separated_3, 2 + BYTES_SEED_A); ------------------ | | 18| 6.04k|#define BYTES_SEED_A 16 ------------------ 39| | 40| 54.4k| for (i = 0; i < PARAMS_NBAR; i++) { ------------------ | | 12| 54.4k|#define PARAMS_NBAR 8 ------------------ | Branch (40:21): [True: 48.3k, False: 6.04k] ------------------ 41| 48.3k| __m256i a, b0, b1, b2, b3, acc[PARAMS_N/16]; 42| 48.3k| b0 = _mm256_set1_epi16(s[i*PARAMS_N + kk + 0]); ------------------ | | 11| 48.3k|#define PARAMS_N 1344 ------------------ 43| 48.3k| b1 = _mm256_set1_epi16(s[i*PARAMS_N + kk + 1]); ------------------ | | 11| 48.3k|#define PARAMS_N 1344 ------------------ 44| 48.3k| b2 = _mm256_set1_epi16(s[i*PARAMS_N + kk + 2]); ------------------ | | 11| 48.3k|#define PARAMS_N 1344 ------------------ 45| 48.3k| b3 = _mm256_set1_epi16(s[i*PARAMS_N + kk + 3]); ------------------ | | 11| 48.3k|#define PARAMS_N 1344 ------------------ 46| 4.11M| for (j = 0; j < PARAMS_N; j+=16) { // Matrix-vector multiplication ------------------ | | 11| 4.11M|#define PARAMS_N 1344 ------------------ | Branch (46:25): [True: 4.06M, False: 48.3k] ------------------ 47| 4.06M| acc[j/16] = _mm256_load_si256((__m256i*)&out[i*PARAMS_N + j]); ------------------ | | 11| 4.06M|#define PARAMS_N 1344 ------------------ 48| 4.06M| a = _mm256_load_si256((__m256i*)&a_cols[(t+0)*PARAMS_N + j]); ------------------ | | 11| 4.06M|#define PARAMS_N 1344 ------------------ 49| 4.06M| a = _mm256_mullo_epi16(a, b0); 50| 4.06M| acc[j/16] = _mm256_add_epi16(a, acc[j/16]); 51| 4.06M| a = _mm256_load_si256((__m256i*)&a_cols[(t+1)*PARAMS_N + j]); ------------------ | | 11| 4.06M|#define PARAMS_N 1344 ------------------ 52| 4.06M| a = _mm256_mullo_epi16(a, b1); 53| 4.06M| acc[j/16] = _mm256_add_epi16(a, acc[j/16]); 54| 4.06M| a = _mm256_load_si256((__m256i*)&a_cols[(t+2)*PARAMS_N + j]); ------------------ | | 11| 4.06M|#define PARAMS_N 1344 ------------------ 55| 4.06M| a = _mm256_mullo_epi16(a, b2); 56| 4.06M| acc[j/16] = _mm256_add_epi16(a, acc[j/16]); 57| 4.06M| a = _mm256_load_si256((__m256i*)&a_cols[(t+3)*PARAMS_N + j]); ------------------ | | 11| 4.06M|#define PARAMS_N 1344 ------------------ 58| 4.06M| a = _mm256_mullo_epi16(a, b3); 59| 4.06M| acc[j/16] = _mm256_add_epi16(a, acc[j/16]); 60| 4.06M| } 61| 4.11M| for (j = 0; j < PARAMS_N/16; j++) { ------------------ | | 11| 4.11M|#define PARAMS_N 1344 ------------------ | Branch (61:25): [True: 4.06M, False: 48.3k] ------------------ 62| 4.06M| _mm256_store_si256((__m256i*)&out[i*PARAMS_N + 16*j], acc[j]); ------------------ | | 11| 4.06M|#define PARAMS_N 1344 ------------------ 63| 4.06M| } 64| 48.3k| } 65| 6.04k| } 66| | 67| 18| return 1; 68| 18|} oqs_kem_efrodokem_640_shake_mul_add_sa_plus_e_avx2: 7| 4|{ // Generate-and-multiply: generate matrix A (N x N) column-wise, multiply by s' on the left. 8| | // Inputs: s', e' (N_BAR x N) 9| | // Output: out = s'*A + e' (N_BAR x N) 10| 4| int i, j, kk; 11| | 12| 10.2k| for (i = 0; i < (PARAMS_N*PARAMS_NBAR); i += 2) { ------------------ | | 11| 10.2k|#define PARAMS_N 640 ------------------ for (i = 0; i < (PARAMS_N*PARAMS_NBAR); i += 2) { ------------------ | | 12| 10.2k|#define PARAMS_NBAR 8 ------------------ | Branch (12:17): [True: 10.2k, False: 4] ------------------ 13| 10.2k| *((uint32_t*)&out[i]) = *((uint32_t*)&e[i]); 14| 10.2k| } 15| | 16| 4| int t=0; 17| 4| ALIGN_HEADER(32) uint16_t a_cols[4*PARAMS_N] ALIGN_FOOTER(32) = {0}; 18| | 19| 4| uint8_t seed_A_separated_0[2 + BYTES_SEED_A]; 20| 4| uint8_t seed_A_separated_1[2 + BYTES_SEED_A]; 21| 4| uint8_t seed_A_separated_2[2 + BYTES_SEED_A]; 22| 4| uint8_t seed_A_separated_3[2 + BYTES_SEED_A]; 23| 4| uint16_t* seed_A_origin_0 = (uint16_t*)&seed_A_separated_0; 24| 4| uint16_t* seed_A_origin_1 = (uint16_t*)&seed_A_separated_1; 25| 4| uint16_t* seed_A_origin_2 = (uint16_t*)&seed_A_separated_2; 26| 4| uint16_t* seed_A_origin_3 = (uint16_t*)&seed_A_separated_3; 27| 4| memcpy(&seed_A_separated_0[2], seed_A, BYTES_SEED_A); ------------------ | | 18| 4|#define BYTES_SEED_A 16 ------------------ 28| 4| memcpy(&seed_A_separated_1[2], seed_A, BYTES_SEED_A); ------------------ | | 18| 4|#define BYTES_SEED_A 16 ------------------ 29| 4| memcpy(&seed_A_separated_2[2], seed_A, BYTES_SEED_A); ------------------ | | 18| 4|#define BYTES_SEED_A 16 ------------------ 30| 4| memcpy(&seed_A_separated_3[2], seed_A, BYTES_SEED_A); ------------------ | | 18| 4|#define BYTES_SEED_A 16 ------------------ 31| | 32| 644| for (kk = 0; kk < PARAMS_N; kk+=4) { ------------------ | | 11| 644|#define PARAMS_N 640 ------------------ | Branch (32:18): [True: 640, False: 4] ------------------ 33| 640| seed_A_origin_0[0] = UINT16_TO_LE(kk + 0); ------------------ | | 35| 640| #define UINT16_TO_LE(n) (n) ------------------ 34| 640| seed_A_origin_1[0] = UINT16_TO_LE(kk + 1); ------------------ | | 35| 640| #define UINT16_TO_LE(n) (n) ------------------ 35| 640| seed_A_origin_2[0] = UINT16_TO_LE(kk + 2); ------------------ | | 35| 640| #define UINT16_TO_LE(n) (n) ------------------ 36| 640| seed_A_origin_3[0] = UINT16_TO_LE(kk + 3); ------------------ | | 35| 640| #define UINT16_TO_LE(n) (n) ------------------ 37| 640| OQS_SHA3_shake128_x4((unsigned char*)(a_cols), (unsigned char*)(a_cols + PARAMS_N), (unsigned char*)(a_cols + 2*PARAMS_N), (unsigned char*)(a_cols + 3*PARAMS_N), ------------------ | | 11| 640|#define PARAMS_N 640 ------------------ OQS_SHA3_shake128_x4((unsigned char*)(a_cols), (unsigned char*)(a_cols + PARAMS_N), (unsigned char*)(a_cols + 2*PARAMS_N), (unsigned char*)(a_cols + 3*PARAMS_N), ------------------ | | 11| 640|#define PARAMS_N 640 ------------------ OQS_SHA3_shake128_x4((unsigned char*)(a_cols), (unsigned char*)(a_cols + PARAMS_N), (unsigned char*)(a_cols + 2*PARAMS_N), (unsigned char*)(a_cols + 3*PARAMS_N), ------------------ | | 11| 640|#define PARAMS_N 640 ------------------ 38| 640| (unsigned long long)(2*PARAMS_N), seed_A_separated_0, seed_A_separated_1, seed_A_separated_2, seed_A_separated_3, 2 + BYTES_SEED_A); ------------------ | | 11| 640|#define PARAMS_N 640 ------------------ (unsigned long long)(2*PARAMS_N), seed_A_separated_0, seed_A_separated_1, seed_A_separated_2, seed_A_separated_3, 2 + BYTES_SEED_A); ------------------ | | 18| 640|#define BYTES_SEED_A 16 ------------------ 39| | 40| 5.76k| for (i = 0; i < PARAMS_NBAR; i++) { ------------------ | | 12| 5.76k|#define PARAMS_NBAR 8 ------------------ | Branch (40:21): [True: 5.12k, False: 640] ------------------ 41| 5.12k| __m256i a, b0, b1, b2, b3, acc[PARAMS_N/16]; 42| 5.12k| b0 = _mm256_set1_epi16(s[i*PARAMS_N + kk + 0]); ------------------ | | 11| 5.12k|#define PARAMS_N 640 ------------------ 43| 5.12k| b1 = _mm256_set1_epi16(s[i*PARAMS_N + kk + 1]); ------------------ | | 11| 5.12k|#define PARAMS_N 640 ------------------ 44| 5.12k| b2 = _mm256_set1_epi16(s[i*PARAMS_N + kk + 2]); ------------------ | | 11| 5.12k|#define PARAMS_N 640 ------------------ 45| 5.12k| b3 = _mm256_set1_epi16(s[i*PARAMS_N + kk + 3]); ------------------ | | 11| 5.12k|#define PARAMS_N 640 ------------------ 46| 209k| for (j = 0; j < PARAMS_N; j+=16) { // Matrix-vector multiplication ------------------ | | 11| 209k|#define PARAMS_N 640 ------------------ | Branch (46:25): [True: 204k, False: 5.12k] ------------------ 47| 204k| acc[j/16] = _mm256_load_si256((__m256i*)&out[i*PARAMS_N + j]); ------------------ | | 11| 204k|#define PARAMS_N 640 ------------------ 48| 204k| a = _mm256_load_si256((__m256i*)&a_cols[(t+0)*PARAMS_N + j]); ------------------ | | 11| 204k|#define PARAMS_N 640 ------------------ 49| 204k| a = _mm256_mullo_epi16(a, b0); 50| 204k| acc[j/16] = _mm256_add_epi16(a, acc[j/16]); 51| 204k| a = _mm256_load_si256((__m256i*)&a_cols[(t+1)*PARAMS_N + j]); ------------------ | | 11| 204k|#define PARAMS_N 640 ------------------ 52| 204k| a = _mm256_mullo_epi16(a, b1); 53| 204k| acc[j/16] = _mm256_add_epi16(a, acc[j/16]); 54| 204k| a = _mm256_load_si256((__m256i*)&a_cols[(t+2)*PARAMS_N + j]); ------------------ | | 11| 204k|#define PARAMS_N 640 ------------------ 55| 204k| a = _mm256_mullo_epi16(a, b2); 56| 204k| acc[j/16] = _mm256_add_epi16(a, acc[j/16]); 57| 204k| a = _mm256_load_si256((__m256i*)&a_cols[(t+3)*PARAMS_N + j]); ------------------ | | 11| 204k|#define PARAMS_N 640 ------------------ 58| 204k| a = _mm256_mullo_epi16(a, b3); 59| 204k| acc[j/16] = _mm256_add_epi16(a, acc[j/16]); 60| 204k| } 61| 209k| for (j = 0; j < PARAMS_N/16; j++) { ------------------ | | 11| 209k|#define PARAMS_N 640 ------------------ | Branch (61:25): [True: 204k, False: 5.12k] ------------------ 62| 204k| _mm256_store_si256((__m256i*)&out[i*PARAMS_N + 16*j], acc[j]); ------------------ | | 11| 204k|#define PARAMS_N 640 ------------------ 63| 204k| } 64| 5.12k| } 65| 640| } 66| | 67| 4| return 1; 68| 4|} oqs_kem_efrodokem_976_shake_mul_add_sa_plus_e_avx2: 7| 24|{ // Generate-and-multiply: generate matrix A (N x N) column-wise, multiply by s' on the left. 8| | // Inputs: s', e' (N_BAR x N) 9| | // Output: out = s'*A + e' (N_BAR x N) 10| 24| int i, j, kk; 11| | 12| 93.7k| for (i = 0; i < (PARAMS_N*PARAMS_NBAR); i += 2) { ------------------ | | 11| 93.7k|#define PARAMS_N 976 ------------------ for (i = 0; i < (PARAMS_N*PARAMS_NBAR); i += 2) { ------------------ | | 12| 93.7k|#define PARAMS_NBAR 8 ------------------ | Branch (12:17): [True: 93.6k, False: 24] ------------------ 13| 93.6k| *((uint32_t*)&out[i]) = *((uint32_t*)&e[i]); 14| 93.6k| } 15| | 16| 24| int t=0; 17| 24| ALIGN_HEADER(32) uint16_t a_cols[4*PARAMS_N] ALIGN_FOOTER(32) = {0}; 18| | 19| 24| uint8_t seed_A_separated_0[2 + BYTES_SEED_A]; 20| 24| uint8_t seed_A_separated_1[2 + BYTES_SEED_A]; 21| 24| uint8_t seed_A_separated_2[2 + BYTES_SEED_A]; 22| 24| uint8_t seed_A_separated_3[2 + BYTES_SEED_A]; 23| 24| uint16_t* seed_A_origin_0 = (uint16_t*)&seed_A_separated_0; 24| 24| uint16_t* seed_A_origin_1 = (uint16_t*)&seed_A_separated_1; 25| 24| uint16_t* seed_A_origin_2 = (uint16_t*)&seed_A_separated_2; 26| 24| uint16_t* seed_A_origin_3 = (uint16_t*)&seed_A_separated_3; 27| 24| memcpy(&seed_A_separated_0[2], seed_A, BYTES_SEED_A); ------------------ | | 18| 24|#define BYTES_SEED_A 16 ------------------ 28| 24| memcpy(&seed_A_separated_1[2], seed_A, BYTES_SEED_A); ------------------ | | 18| 24|#define BYTES_SEED_A 16 ------------------ 29| 24| memcpy(&seed_A_separated_2[2], seed_A, BYTES_SEED_A); ------------------ | | 18| 24|#define BYTES_SEED_A 16 ------------------ 30| 24| memcpy(&seed_A_separated_3[2], seed_A, BYTES_SEED_A); ------------------ | | 18| 24|#define BYTES_SEED_A 16 ------------------ 31| | 32| 5.88k| for (kk = 0; kk < PARAMS_N; kk+=4) { ------------------ | | 11| 5.88k|#define PARAMS_N 976 ------------------ | Branch (32:18): [True: 5.85k, False: 24] ------------------ 33| 5.85k| seed_A_origin_0[0] = UINT16_TO_LE(kk + 0); ------------------ | | 35| 5.85k| #define UINT16_TO_LE(n) (n) ------------------ 34| 5.85k| seed_A_origin_1[0] = UINT16_TO_LE(kk + 1); ------------------ | | 35| 5.85k| #define UINT16_TO_LE(n) (n) ------------------ 35| 5.85k| seed_A_origin_2[0] = UINT16_TO_LE(kk + 2); ------------------ | | 35| 5.85k| #define UINT16_TO_LE(n) (n) ------------------ 36| 5.85k| seed_A_origin_3[0] = UINT16_TO_LE(kk + 3); ------------------ | | 35| 5.85k| #define UINT16_TO_LE(n) (n) ------------------ 37| 5.85k| OQS_SHA3_shake128_x4((unsigned char*)(a_cols), (unsigned char*)(a_cols + PARAMS_N), (unsigned char*)(a_cols + 2*PARAMS_N), (unsigned char*)(a_cols + 3*PARAMS_N), ------------------ | | 11| 5.85k|#define PARAMS_N 976 ------------------ OQS_SHA3_shake128_x4((unsigned char*)(a_cols), (unsigned char*)(a_cols + PARAMS_N), (unsigned char*)(a_cols + 2*PARAMS_N), (unsigned char*)(a_cols + 3*PARAMS_N), ------------------ | | 11| 5.85k|#define PARAMS_N 976 ------------------ OQS_SHA3_shake128_x4((unsigned char*)(a_cols), (unsigned char*)(a_cols + PARAMS_N), (unsigned char*)(a_cols + 2*PARAMS_N), (unsigned char*)(a_cols + 3*PARAMS_N), ------------------ | | 11| 5.85k|#define PARAMS_N 976 ------------------ 38| 5.85k| (unsigned long long)(2*PARAMS_N), seed_A_separated_0, seed_A_separated_1, seed_A_separated_2, seed_A_separated_3, 2 + BYTES_SEED_A); ------------------ | | 11| 5.85k|#define PARAMS_N 976 ------------------ (unsigned long long)(2*PARAMS_N), seed_A_separated_0, seed_A_separated_1, seed_A_separated_2, seed_A_separated_3, 2 + BYTES_SEED_A); ------------------ | | 18| 5.85k|#define BYTES_SEED_A 16 ------------------ 39| | 40| 52.7k| for (i = 0; i < PARAMS_NBAR; i++) { ------------------ | | 12| 52.7k|#define PARAMS_NBAR 8 ------------------ | Branch (40:21): [True: 46.8k, False: 5.85k] ------------------ 41| 46.8k| __m256i a, b0, b1, b2, b3, acc[PARAMS_N/16]; 42| 46.8k| b0 = _mm256_set1_epi16(s[i*PARAMS_N + kk + 0]); ------------------ | | 11| 46.8k|#define PARAMS_N 976 ------------------ 43| 46.8k| b1 = _mm256_set1_epi16(s[i*PARAMS_N + kk + 1]); ------------------ | | 11| 46.8k|#define PARAMS_N 976 ------------------ 44| 46.8k| b2 = _mm256_set1_epi16(s[i*PARAMS_N + kk + 2]); ------------------ | | 11| 46.8k|#define PARAMS_N 976 ------------------ 45| 46.8k| b3 = _mm256_set1_epi16(s[i*PARAMS_N + kk + 3]); ------------------ | | 11| 46.8k|#define PARAMS_N 976 ------------------ 46| 2.90M| for (j = 0; j < PARAMS_N; j+=16) { // Matrix-vector multiplication ------------------ | | 11| 2.90M|#define PARAMS_N 976 ------------------ | Branch (46:25): [True: 2.85M, False: 46.8k] ------------------ 47| 2.85M| acc[j/16] = _mm256_load_si256((__m256i*)&out[i*PARAMS_N + j]); ------------------ | | 11| 2.85M|#define PARAMS_N 976 ------------------ 48| 2.85M| a = _mm256_load_si256((__m256i*)&a_cols[(t+0)*PARAMS_N + j]); ------------------ | | 11| 2.85M|#define PARAMS_N 976 ------------------ 49| 2.85M| a = _mm256_mullo_epi16(a, b0); 50| 2.85M| acc[j/16] = _mm256_add_epi16(a, acc[j/16]); 51| 2.85M| a = _mm256_load_si256((__m256i*)&a_cols[(t+1)*PARAMS_N + j]); ------------------ | | 11| 2.85M|#define PARAMS_N 976 ------------------ 52| 2.85M| a = _mm256_mullo_epi16(a, b1); 53| 2.85M| acc[j/16] = _mm256_add_epi16(a, acc[j/16]); 54| 2.85M| a = _mm256_load_si256((__m256i*)&a_cols[(t+2)*PARAMS_N + j]); ------------------ | | 11| 2.85M|#define PARAMS_N 976 ------------------ 55| 2.85M| a = _mm256_mullo_epi16(a, b2); 56| 2.85M| acc[j/16] = _mm256_add_epi16(a, acc[j/16]); 57| 2.85M| a = _mm256_load_si256((__m256i*)&a_cols[(t+3)*PARAMS_N + j]); ------------------ | | 11| 2.85M|#define PARAMS_N 976 ------------------ 58| 2.85M| a = _mm256_mullo_epi16(a, b3); 59| 2.85M| acc[j/16] = _mm256_add_epi16(a, acc[j/16]); 60| 2.85M| } 61| 2.90M| for (j = 0; j < PARAMS_N/16; j++) { ------------------ | | 11| 2.90M|#define PARAMS_N 976 ------------------ | Branch (61:25): [True: 2.85M, False: 46.8k] ------------------ 62| 2.85M| _mm256_store_si256((__m256i*)&out[i*PARAMS_N + 16*j], acc[j]); ------------------ | | 11| 2.85M|#define PARAMS_N 976 ------------------ 63| 2.85M| } 64| 46.8k| } 65| 5.85k| } 66| | 67| 24| return 1; 68| 24|} oqs_kem_efrodokem_1344_shake_mul_add_sa_plus_e_avx2: 7| 10|{ // Generate-and-multiply: generate matrix A (N x N) column-wise, multiply by s' on the left. 8| | // Inputs: s', e' (N_BAR x N) 9| | // Output: out = s'*A + e' (N_BAR x N) 10| 10| int i, j, kk; 11| | 12| 53.7k| for (i = 0; i < (PARAMS_N*PARAMS_NBAR); i += 2) { ------------------ | | 11| 53.7k|#define PARAMS_N 1344 ------------------ for (i = 0; i < (PARAMS_N*PARAMS_NBAR); i += 2) { ------------------ | | 12| 53.7k|#define PARAMS_NBAR 8 ------------------ | Branch (12:17): [True: 53.7k, False: 10] ------------------ 13| 53.7k| *((uint32_t*)&out[i]) = *((uint32_t*)&e[i]); 14| 53.7k| } 15| | 16| 10| int t=0; 17| 10| ALIGN_HEADER(32) uint16_t a_cols[4*PARAMS_N] ALIGN_FOOTER(32) = {0}; 18| | 19| 10| uint8_t seed_A_separated_0[2 + BYTES_SEED_A]; 20| 10| uint8_t seed_A_separated_1[2 + BYTES_SEED_A]; 21| 10| uint8_t seed_A_separated_2[2 + BYTES_SEED_A]; 22| 10| uint8_t seed_A_separated_3[2 + BYTES_SEED_A]; 23| 10| uint16_t* seed_A_origin_0 = (uint16_t*)&seed_A_separated_0; 24| 10| uint16_t* seed_A_origin_1 = (uint16_t*)&seed_A_separated_1; 25| 10| uint16_t* seed_A_origin_2 = (uint16_t*)&seed_A_separated_2; 26| 10| uint16_t* seed_A_origin_3 = (uint16_t*)&seed_A_separated_3; 27| 10| memcpy(&seed_A_separated_0[2], seed_A, BYTES_SEED_A); ------------------ | | 18| 10|#define BYTES_SEED_A 16 ------------------ 28| 10| memcpy(&seed_A_separated_1[2], seed_A, BYTES_SEED_A); ------------------ | | 18| 10|#define BYTES_SEED_A 16 ------------------ 29| 10| memcpy(&seed_A_separated_2[2], seed_A, BYTES_SEED_A); ------------------ | | 18| 10|#define BYTES_SEED_A 16 ------------------ 30| 10| memcpy(&seed_A_separated_3[2], seed_A, BYTES_SEED_A); ------------------ | | 18| 10|#define BYTES_SEED_A 16 ------------------ 31| | 32| 3.37k| for (kk = 0; kk < PARAMS_N; kk+=4) { ------------------ | | 11| 3.37k|#define PARAMS_N 1344 ------------------ | Branch (32:18): [True: 3.36k, False: 10] ------------------ 33| 3.36k| seed_A_origin_0[0] = UINT16_TO_LE(kk + 0); ------------------ | | 35| 3.36k| #define UINT16_TO_LE(n) (n) ------------------ 34| 3.36k| seed_A_origin_1[0] = UINT16_TO_LE(kk + 1); ------------------ | | 35| 3.36k| #define UINT16_TO_LE(n) (n) ------------------ 35| 3.36k| seed_A_origin_2[0] = UINT16_TO_LE(kk + 2); ------------------ | | 35| 3.36k| #define UINT16_TO_LE(n) (n) ------------------ 36| 3.36k| seed_A_origin_3[0] = UINT16_TO_LE(kk + 3); ------------------ | | 35| 3.36k| #define UINT16_TO_LE(n) (n) ------------------ 37| 3.36k| OQS_SHA3_shake128_x4((unsigned char*)(a_cols), (unsigned char*)(a_cols + PARAMS_N), (unsigned char*)(a_cols + 2*PARAMS_N), (unsigned char*)(a_cols + 3*PARAMS_N), ------------------ | | 11| 3.36k|#define PARAMS_N 1344 ------------------ OQS_SHA3_shake128_x4((unsigned char*)(a_cols), (unsigned char*)(a_cols + PARAMS_N), (unsigned char*)(a_cols + 2*PARAMS_N), (unsigned char*)(a_cols + 3*PARAMS_N), ------------------ | | 11| 3.36k|#define PARAMS_N 1344 ------------------ OQS_SHA3_shake128_x4((unsigned char*)(a_cols), (unsigned char*)(a_cols + PARAMS_N), (unsigned char*)(a_cols + 2*PARAMS_N), (unsigned char*)(a_cols + 3*PARAMS_N), ------------------ | | 11| 3.36k|#define PARAMS_N 1344 ------------------ 38| 3.36k| (unsigned long long)(2*PARAMS_N), seed_A_separated_0, seed_A_separated_1, seed_A_separated_2, seed_A_separated_3, 2 + BYTES_SEED_A); ------------------ | | 11| 3.36k|#define PARAMS_N 1344 ------------------ (unsigned long long)(2*PARAMS_N), seed_A_separated_0, seed_A_separated_1, seed_A_separated_2, seed_A_separated_3, 2 + BYTES_SEED_A); ------------------ | | 18| 3.36k|#define BYTES_SEED_A 16 ------------------ 39| | 40| 30.2k| for (i = 0; i < PARAMS_NBAR; i++) { ------------------ | | 12| 30.2k|#define PARAMS_NBAR 8 ------------------ | Branch (40:21): [True: 26.8k, False: 3.36k] ------------------ 41| 26.8k| __m256i a, b0, b1, b2, b3, acc[PARAMS_N/16]; 42| 26.8k| b0 = _mm256_set1_epi16(s[i*PARAMS_N + kk + 0]); ------------------ | | 11| 26.8k|#define PARAMS_N 1344 ------------------ 43| 26.8k| b1 = _mm256_set1_epi16(s[i*PARAMS_N + kk + 1]); ------------------ | | 11| 26.8k|#define PARAMS_N 1344 ------------------ 44| 26.8k| b2 = _mm256_set1_epi16(s[i*PARAMS_N + kk + 2]); ------------------ | | 11| 26.8k|#define PARAMS_N 1344 ------------------ 45| 26.8k| b3 = _mm256_set1_epi16(s[i*PARAMS_N + kk + 3]); ------------------ | | 11| 26.8k|#define PARAMS_N 1344 ------------------ 46| 2.28M| for (j = 0; j < PARAMS_N; j+=16) { // Matrix-vector multiplication ------------------ | | 11| 2.28M|#define PARAMS_N 1344 ------------------ | Branch (46:25): [True: 2.25M, False: 26.8k] ------------------ 47| 2.25M| acc[j/16] = _mm256_load_si256((__m256i*)&out[i*PARAMS_N + j]); ------------------ | | 11| 2.25M|#define PARAMS_N 1344 ------------------ 48| 2.25M| a = _mm256_load_si256((__m256i*)&a_cols[(t+0)*PARAMS_N + j]); ------------------ | | 11| 2.25M|#define PARAMS_N 1344 ------------------ 49| 2.25M| a = _mm256_mullo_epi16(a, b0); 50| 2.25M| acc[j/16] = _mm256_add_epi16(a, acc[j/16]); 51| 2.25M| a = _mm256_load_si256((__m256i*)&a_cols[(t+1)*PARAMS_N + j]); ------------------ | | 11| 2.25M|#define PARAMS_N 1344 ------------------ 52| 2.25M| a = _mm256_mullo_epi16(a, b1); 53| 2.25M| acc[j/16] = _mm256_add_epi16(a, acc[j/16]); 54| 2.25M| a = _mm256_load_si256((__m256i*)&a_cols[(t+2)*PARAMS_N + j]); ------------------ | | 11| 2.25M|#define PARAMS_N 1344 ------------------ 55| 2.25M| a = _mm256_mullo_epi16(a, b2); 56| 2.25M| acc[j/16] = _mm256_add_epi16(a, acc[j/16]); 57| 2.25M| a = _mm256_load_si256((__m256i*)&a_cols[(t+3)*PARAMS_N + j]); ------------------ | | 11| 2.25M|#define PARAMS_N 1344 ------------------ 58| 2.25M| a = _mm256_mullo_epi16(a, b3); 59| 2.25M| acc[j/16] = _mm256_add_epi16(a, acc[j/16]); 60| 2.25M| } 61| 2.28M| for (j = 0; j < PARAMS_N/16; j++) { ------------------ | | 11| 2.28M|#define PARAMS_N 1344 ------------------ | Branch (61:25): [True: 2.25M, False: 26.8k] ------------------ 62| 2.25M| _mm256_store_si256((__m256i*)&out[i*PARAMS_N + 16*j], acc[j]); ------------------ | | 11| 2.25M|#define PARAMS_N 1344 ------------------ 63| 2.25M| } 64| 26.8k| } 65| 3.36k| } 66| | 67| 10| return 1; 68| 10|} oqs_kem_frodokem_640_aes_sample_n: 8| 16|{ // Fills vector s with n samples from the noise distribution which requires 16 bits to sample. 9| | // The distribution is specified by its CDF. 10| | // Input: pseudo-random values (2*n bytes) passed in s. The input is overwritten by the output. 11| 16| unsigned int i, j; 12| 16| uint16_t cdf_table[CDF_TABLE_LEN] = CDF_TABLE; ------------------ | | 25| 16|#define CDF_TABLE {4643, 13363, 20579, 25843, 29227, 31145, 32103, 32525, 32689, 32745, 32762, 32766, 32767} ------------------ 13| | 14| 61.7k| for (i = 0; i < n; ++i) { ------------------ | Branch (14:17): [True: 61.6k, False: 16] ------------------ 15| 61.6k| uint16_t sample = 0; 16| 61.6k| uint16_t prnd = s[i] >> 1; // Drop the least significant bit 17| 61.6k| uint16_t sign = s[i] & 0x1; // Pick the least significant bit 18| | 19| | // No need to compare with the last value. 20| 802k| for (j = 0; j < (unsigned int)(CDF_TABLE_LEN - 1); j++) { ------------------ | | 26| 802k|#define CDF_TABLE_LEN 13 ------------------ | Branch (20:21): [True: 740k, False: 61.6k] ------------------ 21| | // Constant time comparison: 1 if CDF_TABLE[j] < s, 0 otherwise. Uses the fact that CDF_TABLE[j] and s fit in 15 bits. 22| 740k| sample += (uint16_t)(cdf_table[j] - prnd) >> 15; 23| 740k| } 24| | // Assuming that sign is either 0 or 1, flips sample iff sign = 1 25| 61.6k| s[i] = ((-sign) ^ sample) + sign; 26| 61.6k| } 27| 16|} oqs_kem_frodokem_640_shake_sample_n: 8| 24|{ // Fills vector s with n samples from the noise distribution which requires 16 bits to sample. 9| | // The distribution is specified by its CDF. 10| | // Input: pseudo-random values (2*n bytes) passed in s. The input is overwritten by the output. 11| 24| unsigned int i, j; 12| 24| uint16_t cdf_table[CDF_TABLE_LEN] = CDF_TABLE; ------------------ | | 25| 24|#define CDF_TABLE {4643, 13363, 20579, 25843, 29227, 31145, 32103, 32525, 32689, 32745, 32762, 32766, 32767} ------------------ 13| | 14| 92.5k| for (i = 0; i < n; ++i) { ------------------ | Branch (14:17): [True: 92.5k, False: 24] ------------------ 15| 92.5k| uint16_t sample = 0; 16| 92.5k| uint16_t prnd = s[i] >> 1; // Drop the least significant bit 17| 92.5k| uint16_t sign = s[i] & 0x1; // Pick the least significant bit 18| | 19| | // No need to compare with the last value. 20| 1.20M| for (j = 0; j < (unsigned int)(CDF_TABLE_LEN - 1); j++) { ------------------ | | 26| 1.20M|#define CDF_TABLE_LEN 13 ------------------ | Branch (20:21): [True: 1.11M, False: 92.5k] ------------------ 21| | // Constant time comparison: 1 if CDF_TABLE[j] < s, 0 otherwise. Uses the fact that CDF_TABLE[j] and s fit in 15 bits. 22| 1.11M| sample += (uint16_t)(cdf_table[j] - prnd) >> 15; 23| 1.11M| } 24| | // Assuming that sign is either 0 or 1, flips sample iff sign = 1 25| 92.5k| s[i] = ((-sign) ^ sample) + sign; 26| 92.5k| } 27| 24|} oqs_kem_frodokem_976_aes_sample_n: 8| 120|{ // Fills vector s with n samples from the noise distribution which requires 16 bits to sample. 9| | // The distribution is specified by its CDF. 10| | // Input: pseudo-random values (2*n bytes) passed in s. The input is overwritten by the output. 11| 120| unsigned int i, j; 12| 120| uint16_t cdf_table[CDF_TABLE_LEN] = CDF_TABLE; ------------------ | | 25| 120|#define CDF_TABLE {5638, 15915, 23689, 28571, 31116, 32217, 32613, 32731, 32760, 32766, 32767} ------------------ 13| | 14| 704k| for (i = 0; i < n; ++i) { ------------------ | Branch (14:17): [True: 704k, False: 120] ------------------ 15| 704k| uint16_t sample = 0; 16| 704k| uint16_t prnd = s[i] >> 1; // Drop the least significant bit 17| 704k| uint16_t sign = s[i] & 0x1; // Pick the least significant bit 18| | 19| | // No need to compare with the last value. 20| 7.75M| for (j = 0; j < (unsigned int)(CDF_TABLE_LEN - 1); j++) { ------------------ | | 26| 7.75M|#define CDF_TABLE_LEN 11 ------------------ | Branch (20:21): [True: 7.04M, False: 704k] ------------------ 21| | // Constant time comparison: 1 if CDF_TABLE[j] < s, 0 otherwise. Uses the fact that CDF_TABLE[j] and s fit in 15 bits. 22| 7.04M| sample += (uint16_t)(cdf_table[j] - prnd) >> 15; 23| 7.04M| } 24| | // Assuming that sign is either 0 or 1, flips sample iff sign = 1 25| 704k| s[i] = ((-sign) ^ sample) + sign; 26| 704k| } 27| 120|} oqs_kem_frodokem_976_shake_sample_n: 8| 88|{ // Fills vector s with n samples from the noise distribution which requires 16 bits to sample. 9| | // The distribution is specified by its CDF. 10| | // Input: pseudo-random values (2*n bytes) passed in s. The input is overwritten by the output. 11| 88| unsigned int i, j; 12| 88| uint16_t cdf_table[CDF_TABLE_LEN] = CDF_TABLE; ------------------ | | 25| 88|#define CDF_TABLE {5638, 15915, 23689, 28571, 31116, 32217, 32613, 32731, 32760, 32766, 32767} ------------------ 13| | 14| 516k| for (i = 0; i < n; ++i) { ------------------ | Branch (14:17): [True: 516k, False: 88] ------------------ 15| 516k| uint16_t sample = 0; 16| 516k| uint16_t prnd = s[i] >> 1; // Drop the least significant bit 17| 516k| uint16_t sign = s[i] & 0x1; // Pick the least significant bit 18| | 19| | // No need to compare with the last value. 20| 5.68M| for (j = 0; j < (unsigned int)(CDF_TABLE_LEN - 1); j++) { ------------------ | | 26| 5.68M|#define CDF_TABLE_LEN 11 ------------------ | Branch (20:21): [True: 5.16M, False: 516k] ------------------ 21| | // Constant time comparison: 1 if CDF_TABLE[j] < s, 0 otherwise. Uses the fact that CDF_TABLE[j] and s fit in 15 bits. 22| 5.16M| sample += (uint16_t)(cdf_table[j] - prnd) >> 15; 23| 5.16M| } 24| | // Assuming that sign is either 0 or 1, flips sample iff sign = 1 25| 516k| s[i] = ((-sign) ^ sample) + sign; 26| 516k| } 27| 88|} oqs_kem_frodokem_1344_aes_sample_n: 8| 64|{ // Fills vector s with n samples from the noise distribution which requires 16 bits to sample. 9| | // The distribution is specified by its CDF. 10| | // Input: pseudo-random values (2*n bytes) passed in s. The input is overwritten by the output. 11| 64| unsigned int i, j; 12| 64| uint16_t cdf_table[CDF_TABLE_LEN] = CDF_TABLE; ------------------ | | 25| 64|#define CDF_TABLE {9142, 23462, 30338, 32361, 32725, 32765, 32767} ------------------ 13| | 14| 517k| for (i = 0; i < n; ++i) { ------------------ | Branch (14:17): [True: 517k, False: 64] ------------------ 15| 517k| uint16_t sample = 0; 16| 517k| uint16_t prnd = s[i] >> 1; // Drop the least significant bit 17| 517k| uint16_t sign = s[i] & 0x1; // Pick the least significant bit 18| | 19| | // No need to compare with the last value. 20| 3.61M| for (j = 0; j < (unsigned int)(CDF_TABLE_LEN - 1); j++) { ------------------ | | 26| 3.61M|#define CDF_TABLE_LEN 7 ------------------ | Branch (20:21): [True: 3.10M, False: 517k] ------------------ 21| | // Constant time comparison: 1 if CDF_TABLE[j] < s, 0 otherwise. Uses the fact that CDF_TABLE[j] and s fit in 15 bits. 22| 3.10M| sample += (uint16_t)(cdf_table[j] - prnd) >> 15; 23| 3.10M| } 24| | // Assuming that sign is either 0 or 1, flips sample iff sign = 1 25| 517k| s[i] = ((-sign) ^ sample) + sign; 26| 517k| } 27| 64|} oqs_kem_frodokem_1344_shake_sample_n: 8| 72|{ // Fills vector s with n samples from the noise distribution which requires 16 bits to sample. 9| | // The distribution is specified by its CDF. 10| | // Input: pseudo-random values (2*n bytes) passed in s. The input is overwritten by the output. 11| 72| unsigned int i, j; 12| 72| uint16_t cdf_table[CDF_TABLE_LEN] = CDF_TABLE; ------------------ | | 25| 72|#define CDF_TABLE {9142, 23462, 30338, 32361, 32725, 32765, 32767} ------------------ 13| | 14| 581k| for (i = 0; i < n; ++i) { ------------------ | Branch (14:17): [True: 581k, False: 72] ------------------ 15| 581k| uint16_t sample = 0; 16| 581k| uint16_t prnd = s[i] >> 1; // Drop the least significant bit 17| 581k| uint16_t sign = s[i] & 0x1; // Pick the least significant bit 18| | 19| | // No need to compare with the last value. 20| 4.07M| for (j = 0; j < (unsigned int)(CDF_TABLE_LEN - 1); j++) { ------------------ | | 26| 4.07M|#define CDF_TABLE_LEN 7 ------------------ | Branch (20:21): [True: 3.49M, False: 581k] ------------------ 21| | // Constant time comparison: 1 if CDF_TABLE[j] < s, 0 otherwise. Uses the fact that CDF_TABLE[j] and s fit in 15 bits. 22| 3.49M| sample += (uint16_t)(cdf_table[j] - prnd) >> 15; 23| 3.49M| } 24| | // Assuming that sign is either 0 or 1, flips sample iff sign = 1 25| 581k| s[i] = ((-sign) ^ sample) + sign; 26| 581k| } 27| 72|} oqs_kem_efrodokem_640_aes_sample_n: 8| 32|{ // Fills vector s with n samples from the noise distribution which requires 16 bits to sample. 9| | // The distribution is specified by its CDF. 10| | // Input: pseudo-random values (2*n bytes) passed in s. The input is overwritten by the output. 11| 32| unsigned int i, j; 12| 32| uint16_t cdf_table[CDF_TABLE_LEN] = CDF_TABLE; ------------------ | | 23| 32|#define CDF_TABLE {4643, 13363, 20579, 25843, 29227, 31145, 32103, 32525, 32689, 32745, 32762, 32766, 32767} ------------------ 13| | 14| 123k| for (i = 0; i < n; ++i) { ------------------ | Branch (14:17): [True: 123k, False: 32] ------------------ 15| 123k| uint16_t sample = 0; 16| 123k| uint16_t prnd = s[i] >> 1; // Drop the least significant bit 17| 123k| uint16_t sign = s[i] & 0x1; // Pick the least significant bit 18| | 19| | // No need to compare with the last value. 20| 1.60M| for (j = 0; j < (unsigned int)(CDF_TABLE_LEN - 1); j++) { ------------------ | | 24| 1.60M|#define CDF_TABLE_LEN 13 ------------------ | Branch (20:21): [True: 1.48M, False: 123k] ------------------ 21| | // Constant time comparison: 1 if CDF_TABLE[j] < s, 0 otherwise. Uses the fact that CDF_TABLE[j] and s fit in 15 bits. 22| 1.48M| sample += (uint16_t)(cdf_table[j] - prnd) >> 15; 23| 1.48M| } 24| | // Assuming that sign is either 0 or 1, flips sample iff sign = 1 25| 123k| s[i] = ((-sign) ^ sample) + sign; 26| 123k| } 27| 32|} oqs_kem_efrodokem_640_shake_sample_n: 8| 16|{ // Fills vector s with n samples from the noise distribution which requires 16 bits to sample. 9| | // The distribution is specified by its CDF. 10| | // Input: pseudo-random values (2*n bytes) passed in s. The input is overwritten by the output. 11| 16| unsigned int i, j; 12| 16| uint16_t cdf_table[CDF_TABLE_LEN] = CDF_TABLE; ------------------ | | 23| 16|#define CDF_TABLE {4643, 13363, 20579, 25843, 29227, 31145, 32103, 32525, 32689, 32745, 32762, 32766, 32767} ------------------ 13| | 14| 61.7k| for (i = 0; i < n; ++i) { ------------------ | Branch (14:17): [True: 61.6k, False: 16] ------------------ 15| 61.6k| uint16_t sample = 0; 16| 61.6k| uint16_t prnd = s[i] >> 1; // Drop the least significant bit 17| 61.6k| uint16_t sign = s[i] & 0x1; // Pick the least significant bit 18| | 19| | // No need to compare with the last value. 20| 802k| for (j = 0; j < (unsigned int)(CDF_TABLE_LEN - 1); j++) { ------------------ | | 24| 802k|#define CDF_TABLE_LEN 13 ------------------ | Branch (20:21): [True: 740k, False: 61.6k] ------------------ 21| | // Constant time comparison: 1 if CDF_TABLE[j] < s, 0 otherwise. Uses the fact that CDF_TABLE[j] and s fit in 15 bits. 22| 740k| sample += (uint16_t)(cdf_table[j] - prnd) >> 15; 23| 740k| } 24| | // Assuming that sign is either 0 or 1, flips sample iff sign = 1 25| 61.6k| s[i] = ((-sign) ^ sample) + sign; 26| 61.6k| } 27| 16|} oqs_kem_efrodokem_976_aes_sample_n: 8| 96|{ // Fills vector s with n samples from the noise distribution which requires 16 bits to sample. 9| | // The distribution is specified by its CDF. 10| | // Input: pseudo-random values (2*n bytes) passed in s. The input is overwritten by the output. 11| 96| unsigned int i, j; 12| 96| uint16_t cdf_table[CDF_TABLE_LEN] = CDF_TABLE; ------------------ | | 23| 96|#define CDF_TABLE {5638, 15915, 23689, 28571, 31116, 32217, 32613, 32731, 32760, 32766, 32767} ------------------ 13| | 14| 563k| for (i = 0; i < n; ++i) { ------------------ | Branch (14:17): [True: 563k, False: 96] ------------------ 15| 563k| uint16_t sample = 0; 16| 563k| uint16_t prnd = s[i] >> 1; // Drop the least significant bit 17| 563k| uint16_t sign = s[i] & 0x1; // Pick the least significant bit 18| | 19| | // No need to compare with the last value. 20| 6.20M| for (j = 0; j < (unsigned int)(CDF_TABLE_LEN - 1); j++) { ------------------ | | 24| 6.20M|#define CDF_TABLE_LEN 11 ------------------ | Branch (20:21): [True: 5.63M, False: 563k] ------------------ 21| | // Constant time comparison: 1 if CDF_TABLE[j] < s, 0 otherwise. Uses the fact that CDF_TABLE[j] and s fit in 15 bits. 22| 5.63M| sample += (uint16_t)(cdf_table[j] - prnd) >> 15; 23| 5.63M| } 24| | // Assuming that sign is either 0 or 1, flips sample iff sign = 1 25| 563k| s[i] = ((-sign) ^ sample) + sign; 26| 563k| } 27| 96|} oqs_kem_efrodokem_976_shake_sample_n: 8| 96|{ // Fills vector s with n samples from the noise distribution which requires 16 bits to sample. 9| | // The distribution is specified by its CDF. 10| | // Input: pseudo-random values (2*n bytes) passed in s. The input is overwritten by the output. 11| 96| unsigned int i, j; 12| 96| uint16_t cdf_table[CDF_TABLE_LEN] = CDF_TABLE; ------------------ | | 23| 96|#define CDF_TABLE {5638, 15915, 23689, 28571, 31116, 32217, 32613, 32731, 32760, 32766, 32767} ------------------ 13| | 14| 563k| for (i = 0; i < n; ++i) { ------------------ | Branch (14:17): [True: 563k, False: 96] ------------------ 15| 563k| uint16_t sample = 0; 16| 563k| uint16_t prnd = s[i] >> 1; // Drop the least significant bit 17| 563k| uint16_t sign = s[i] & 0x1; // Pick the least significant bit 18| | 19| | // No need to compare with the last value. 20| 6.20M| for (j = 0; j < (unsigned int)(CDF_TABLE_LEN - 1); j++) { ------------------ | | 24| 6.20M|#define CDF_TABLE_LEN 11 ------------------ | Branch (20:21): [True: 5.63M, False: 563k] ------------------ 21| | // Constant time comparison: 1 if CDF_TABLE[j] < s, 0 otherwise. Uses the fact that CDF_TABLE[j] and s fit in 15 bits. 22| 5.63M| sample += (uint16_t)(cdf_table[j] - prnd) >> 15; 23| 5.63M| } 24| | // Assuming that sign is either 0 or 1, flips sample iff sign = 1 25| 563k| s[i] = ((-sign) ^ sample) + sign; 26| 563k| } 27| 96|} oqs_kem_efrodokem_1344_aes_sample_n: 8| 64|{ // Fills vector s with n samples from the noise distribution which requires 16 bits to sample. 9| | // The distribution is specified by its CDF. 10| | // Input: pseudo-random values (2*n bytes) passed in s. The input is overwritten by the output. 11| 64| unsigned int i, j; 12| 64| uint16_t cdf_table[CDF_TABLE_LEN] = CDF_TABLE; ------------------ | | 23| 64|#define CDF_TABLE {9142, 23462, 30338, 32361, 32725, 32765, 32767} ------------------ 13| | 14| 517k| for (i = 0; i < n; ++i) { ------------------ | Branch (14:17): [True: 517k, False: 64] ------------------ 15| 517k| uint16_t sample = 0; 16| 517k| uint16_t prnd = s[i] >> 1; // Drop the least significant bit 17| 517k| uint16_t sign = s[i] & 0x1; // Pick the least significant bit 18| | 19| | // No need to compare with the last value. 20| 3.61M| for (j = 0; j < (unsigned int)(CDF_TABLE_LEN - 1); j++) { ------------------ | | 24| 3.61M|#define CDF_TABLE_LEN 7 ------------------ | Branch (20:21): [True: 3.10M, False: 517k] ------------------ 21| | // Constant time comparison: 1 if CDF_TABLE[j] < s, 0 otherwise. Uses the fact that CDF_TABLE[j] and s fit in 15 bits. 22| 3.10M| sample += (uint16_t)(cdf_table[j] - prnd) >> 15; 23| 3.10M| } 24| | // Assuming that sign is either 0 or 1, flips sample iff sign = 1 25| 517k| s[i] = ((-sign) ^ sample) + sign; 26| 517k| } 27| 64|} oqs_kem_efrodokem_1344_shake_sample_n: 8| 40|{ // Fills vector s with n samples from the noise distribution which requires 16 bits to sample. 9| | // The distribution is specified by its CDF. 10| | // Input: pseudo-random values (2*n bytes) passed in s. The input is overwritten by the output. 11| 40| unsigned int i, j; 12| 40| uint16_t cdf_table[CDF_TABLE_LEN] = CDF_TABLE; ------------------ | | 23| 40|#define CDF_TABLE {9142, 23462, 30338, 32361, 32725, 32765, 32767} ------------------ 13| | 14| 323k| for (i = 0; i < n; ++i) { ------------------ | Branch (14:17): [True: 323k, False: 40] ------------------ 15| 323k| uint16_t sample = 0; 16| 323k| uint16_t prnd = s[i] >> 1; // Drop the least significant bit 17| 323k| uint16_t sign = s[i] & 0x1; // Pick the least significant bit 18| | 19| | // No need to compare with the last value. 20| 2.26M| for (j = 0; j < (unsigned int)(CDF_TABLE_LEN - 1); j++) { ------------------ | | 24| 2.26M|#define CDF_TABLE_LEN 7 ------------------ | Branch (20:21): [True: 1.93M, False: 323k] ------------------ 21| | // Constant time comparison: 1 if CDF_TABLE[j] < s, 0 otherwise. Uses the fact that CDF_TABLE[j] and s fit in 15 bits. 22| 1.93M| sample += (uint16_t)(cdf_table[j] - prnd) >> 15; 23| 1.93M| } 24| | // Assuming that sign is either 0 or 1, flips sample iff sign = 1 25| 323k| s[i] = ((-sign) ^ sample) + sign; 26| 323k| } 27| 40|} oqs_kem_frodokem_640_aes_pack: 15| 6|{ // Pack the input uint16 vector into a char output vector, copying lsb bits from each input element. 16| | // If inlen * lsb / 8 > outlen, only outlen * 8 bits are copied. 17| 6| memset(out, 0, outlen); 18| | 19| 6| size_t i = 0; // whole bytes already filled in 20| 6| size_t j = 0; // whole uint16_t already copied 21| 6| uint16_t w = 0; // the leftover, not yet copied 22| 6| unsigned char bits = 0; // the number of lsb in w 23| | 24| 38.6k| while (i < outlen && (j < inlen || ((j == inlen) && (bits > 0)))) { ------------------ | Branch (24:12): [True: 38.6k, False: 6] | Branch (24:27): [True: 38.6k, False: 6] | Branch (24:41): [True: 6, False: 0] | Branch (24:57): [True: 6, False: 0] ------------------ 25| | /* 26| | in: | | |********|********| 27| | ^ 28| | j 29| | w : | ****| 30| | ^ 31| | bits 32| | out:|**|**|**|**|**|**|**|**|* | 33| | ^^ 34| | ib 35| | */ 36| 38.6k| unsigned char b = 0; // bits in out[i] already filled in 37| 95.3k| while (b < 8) { ------------------ | Branch (37:16): [True: 56.6k, False: 38.6k] ------------------ 38| 56.6k| int nbits = min(8 - b, bits); ------------------ | | 11| 56.6k|#define min(x, y) (((x) < (y)) ? (x) : (y)) | | ------------------ | | | Branch (11:20): [True: 36.0k, False: 20.6k] | | ------------------ ------------------ 39| 56.6k| uint16_t mask = (1 << nbits) - 1; 40| 56.6k| unsigned char t = (w >> (bits - nbits)) & mask; // the bits to copy from w to out 41| 56.6k| out[i] = out[i] + (t << (8 - b - nbits)); 42| 56.6k| b += nbits; 43| 56.6k| bits -= nbits; 44| 56.6k| w &= ~(mask << bits); // not strictly necessary; mostly for debugging 45| | 46| 56.6k| if (bits == 0) { ------------------ | Branch (46:17): [True: 20.6k, False: 36.0k] ------------------ 47| 20.6k| if (j < inlen) { ------------------ | Branch (47:21): [True: 20.6k, False: 6] ------------------ 48| 20.6k| w = in[j]; 49| 20.6k| bits = lsb; 50| 20.6k| j++; 51| 20.6k| } else { 52| 6| break; // the input vector is exhausted 53| 6| } 54| 20.6k| } 55| 56.6k| } 56| 38.6k| if (b == 8) { // out[i] is filled in ------------------ | Branch (56:13): [True: 38.6k, False: 0] ------------------ 57| 38.6k| i++; 58| 38.6k| } 59| 38.6k| } 60| 6|} oqs_kem_frodokem_640_aes_unpack: 64| 8|{ // Unpack the input char vector into a uint16_t output vector, copying lsb bits 65| | // for each output element from input. outlen must be at least ceil(inlen * 8 / lsb). 66| 8| memset(out, 0, outlen * sizeof(uint16_t)); 67| | 68| 8| size_t i = 0; // whole uint16_t already filled in 69| 8| size_t j = 0; // whole bytes already copied 70| 8| unsigned char w = 0; // the leftover, not yet copied 71| 8| unsigned char bits = 0; // the number of lsb bits of w 72| | 73| 30.8k| while (i < outlen && (j < inlen || ((j == inlen) && (bits > 0)))) { ------------------ | Branch (73:12): [True: 30.8k, False: 8] | Branch (73:27): [True: 30.8k, False: 0] | Branch (73:41): [True: 0, False: 0] | Branch (73:57): [True: 0, False: 0] ------------------ 74| | /* 75| | in: | | | | | | |**|**|... 76| | ^ 77| | j 78| | w : | *| 79| | ^ 80| | bits 81| | out:| *****| *****| *** | |... 82| | ^ ^ 83| | i b 84| | */ 85| 30.8k| unsigned char b = 0; // bits in out[i] already filled in 86| 115k| while (b < lsb) { ------------------ | Branch (86:16): [True: 84.8k, False: 30.8k] ------------------ 87| 84.8k| int nbits = min(lsb - b, bits); ------------------ | | 11| 84.8k|#define min(x, y) (((x) < (y)) ? (x) : (y)) | | ------------------ | | | Branch (11:20): [True: 26.9k, False: 57.8k] | | ------------------ ------------------ 88| 84.8k| uint16_t mask = (1 << nbits) - 1; 89| 84.8k| unsigned char t = (w >> (bits - nbits)) & mask; // the bits to copy from w to out 90| 84.8k| out[i] = out[i] + (t << (lsb - b - nbits)); 91| 84.8k| b += nbits; 92| 84.8k| bits -= nbits; 93| 84.8k| w &= ~(mask << bits); // not strictly necessary; mostly for debugging 94| | 95| 84.8k| if (bits == 0) { ------------------ | Branch (95:17): [True: 57.8k, False: 26.9k] ------------------ 96| 57.8k| if (j < inlen) { ------------------ | Branch (96:21): [True: 57.8k, False: 8] ------------------ 97| 57.8k| w = in[j]; 98| 57.8k| bits = 8; 99| 57.8k| j++; 100| 57.8k| } else { 101| 8| break; // the input vector is exhausted 102| 8| } 103| 57.8k| } 104| 84.8k| } 105| 30.8k| if (b == lsb) { // out[i] is filled in ------------------ | Branch (105:13): [True: 30.8k, False: 0] ------------------ 106| 30.8k| i++; 107| 30.8k| } 108| 30.8k| } 109| 8|} oqs_kem_frodokem_640_aes_ct_verify: 113| 4|{ // Compare two arrays in constant time. 114| | // Returns 0 if the byte arrays are equal, -1 otherwise. 115| 4| uint16_t r = 0; 116| | 117| 10.3k| for (size_t i = 0; i < len; i++) { ------------------ | Branch (117:24): [True: 10.3k, False: 4] ------------------ 118| 10.3k| r |= a[i] ^ b[i]; 119| 10.3k| } 120| | 121| 4| r = (-(int16_t)(r >> 1) | -(int16_t)(r & 1)) >> (8*sizeof(uint16_t)-1); 122| 4| return (int8_t)r; 123| 4|} oqs_kem_frodokem_640_aes_ct_select: 127| 2|{ // Select one of the two input arrays to be moved to r 128| | // If (selector == 0) then load r with a, else if (selector == -1) load r with b 129| 2| OQS_MEM_BLACK_BOX(selector); ------------------ | | 58| 2| do { \ | | 59| 2| __asm__ volatile("" : "+r"(v) :); \ | | 60| 2| } while (0) | | ------------------ | | | Branch (60:14): [Folded, False: 2] | | ------------------ ------------------ 130| 34| for (size_t i = 0; i < len; i++) { ------------------ | Branch (130:24): [True: 32, False: 2] ------------------ 131| 32| r[i] = (~selector & a[i]) | (selector & b[i]); 132| 32| } 133| 2|} oqs_kem_frodokem_640_shake_pack: 15| 9|{ // Pack the input uint16 vector into a char output vector, copying lsb bits from each input element. 16| | // If inlen * lsb / 8 > outlen, only outlen * 8 bits are copied. 17| 9| memset(out, 0, outlen); 18| | 19| 9| size_t i = 0; // whole bytes already filled in 20| 9| size_t j = 0; // whole uint16_t already copied 21| 9| uint16_t w = 0; // the leftover, not yet copied 22| 9| unsigned char bits = 0; // the number of lsb in w 23| | 24| 57.9k| while (i < outlen && (j < inlen || ((j == inlen) && (bits > 0)))) { ------------------ | Branch (24:12): [True: 57.9k, False: 9] | Branch (24:27): [True: 57.9k, False: 9] | Branch (24:41): [True: 9, False: 0] | Branch (24:57): [True: 9, False: 0] ------------------ 25| | /* 26| | in: | | |********|********| 27| | ^ 28| | j 29| | w : | ****| 30| | ^ 31| | bits 32| | out:|**|**|**|**|**|**|**|**|* | 33| | ^^ 34| | ib 35| | */ 36| 57.9k| unsigned char b = 0; // bits in out[i] already filled in 37| 142k| while (b < 8) { ------------------ | Branch (37:16): [True: 85.0k, False: 57.9k] ------------------ 38| 85.0k| int nbits = min(8 - b, bits); ------------------ | | 11| 85.0k|#define min(x, y) (((x) < (y)) ? (x) : (y)) | | ------------------ | | | Branch (11:20): [True: 54.0k, False: 30.9k] | | ------------------ ------------------ 39| 85.0k| uint16_t mask = (1 << nbits) - 1; 40| 85.0k| unsigned char t = (w >> (bits - nbits)) & mask; // the bits to copy from w to out 41| 85.0k| out[i] = out[i] + (t << (8 - b - nbits)); 42| 85.0k| b += nbits; 43| 85.0k| bits -= nbits; 44| 85.0k| w &= ~(mask << bits); // not strictly necessary; mostly for debugging 45| | 46| 85.0k| if (bits == 0) { ------------------ | Branch (46:17): [True: 30.9k, False: 54.0k] ------------------ 47| 30.9k| if (j < inlen) { ------------------ | Branch (47:21): [True: 30.9k, False: 9] ------------------ 48| 30.9k| w = in[j]; 49| 30.9k| bits = lsb; 50| 30.9k| j++; 51| 30.9k| } else { 52| 9| break; // the input vector is exhausted 53| 9| } 54| 30.9k| } 55| 85.0k| } 56| 57.9k| if (b == 8) { // out[i] is filled in ------------------ | Branch (56:13): [True: 57.9k, False: 0] ------------------ 57| 57.9k| i++; 58| 57.9k| } 59| 57.9k| } 60| 9|} oqs_kem_frodokem_640_shake_unpack: 64| 12|{ // Unpack the input char vector into a uint16_t output vector, copying lsb bits 65| | // for each output element from input. outlen must be at least ceil(inlen * 8 / lsb). 66| 12| memset(out, 0, outlen * sizeof(uint16_t)); 67| | 68| 12| size_t i = 0; // whole uint16_t already filled in 69| 12| size_t j = 0; // whole bytes already copied 70| 12| unsigned char w = 0; // the leftover, not yet copied 71| 12| unsigned char bits = 0; // the number of lsb bits of w 72| | 73| 46.2k| while (i < outlen && (j < inlen || ((j == inlen) && (bits > 0)))) { ------------------ | Branch (73:12): [True: 46.2k, False: 12] | Branch (73:27): [True: 46.2k, False: 0] | Branch (73:41): [True: 0, False: 0] | Branch (73:57): [True: 0, False: 0] ------------------ 74| | /* 75| | in: | | | | | | |**|**|... 76| | ^ 77| | j 78| | w : | *| 79| | ^ 80| | bits 81| | out:| *****| *****| *** | |... 82| | ^ ^ 83| | i b 84| | */ 85| 46.2k| unsigned char b = 0; // bits in out[i] already filled in 86| 173k| while (b < lsb) { ------------------ | Branch (86:16): [True: 127k, False: 46.2k] ------------------ 87| 127k| int nbits = min(lsb - b, bits); ------------------ | | 11| 127k|#define min(x, y) (((x) < (y)) ? (x) : (y)) | | ------------------ | | | Branch (11:20): [True: 40.4k, False: 86.7k] | | ------------------ ------------------ 88| 127k| uint16_t mask = (1 << nbits) - 1; 89| 127k| unsigned char t = (w >> (bits - nbits)) & mask; // the bits to copy from w to out 90| 127k| out[i] = out[i] + (t << (lsb - b - nbits)); 91| 127k| b += nbits; 92| 127k| bits -= nbits; 93| 127k| w &= ~(mask << bits); // not strictly necessary; mostly for debugging 94| | 95| 127k| if (bits == 0) { ------------------ | Branch (95:17): [True: 86.7k, False: 40.4k] ------------------ 96| 86.7k| if (j < inlen) { ------------------ | Branch (96:21): [True: 86.7k, False: 12] ------------------ 97| 86.7k| w = in[j]; 98| 86.7k| bits = 8; 99| 86.7k| j++; 100| 86.7k| } else { 101| 12| break; // the input vector is exhausted 102| 12| } 103| 86.7k| } 104| 127k| } 105| 46.2k| if (b == lsb) { // out[i] is filled in ------------------ | Branch (105:13): [True: 46.2k, False: 0] ------------------ 106| 46.2k| i++; 107| 46.2k| } 108| 46.2k| } 109| 12|} oqs_kem_frodokem_640_shake_ct_verify: 113| 6|{ // Compare two arrays in constant time. 114| | // Returns 0 if the byte arrays are equal, -1 otherwise. 115| 6| uint16_t r = 0; 116| | 117| 15.5k| for (size_t i = 0; i < len; i++) { ------------------ | Branch (117:24): [True: 15.5k, False: 6] ------------------ 118| 15.5k| r |= a[i] ^ b[i]; 119| 15.5k| } 120| | 121| 6| r = (-(int16_t)(r >> 1) | -(int16_t)(r & 1)) >> (8*sizeof(uint16_t)-1); 122| 6| return (int8_t)r; 123| 6|} oqs_kem_frodokem_640_shake_ct_select: 127| 3|{ // Select one of the two input arrays to be moved to r 128| | // If (selector == 0) then load r with a, else if (selector == -1) load r with b 129| 3| OQS_MEM_BLACK_BOX(selector); ------------------ | | 58| 3| do { \ | | 59| 3| __asm__ volatile("" : "+r"(v) :); \ | | 60| 3| } while (0) | | ------------------ | | | Branch (60:14): [Folded, False: 3] | | ------------------ ------------------ 130| 51| for (size_t i = 0; i < len; i++) { ------------------ | Branch (130:24): [True: 48, False: 3] ------------------ 131| 48| r[i] = (~selector & a[i]) | (selector & b[i]); 132| 48| } 133| 3|} oqs_kem_frodokem_976_aes_pack: 15| 45|{ // Pack the input uint16 vector into a char output vector, copying lsb bits from each input element. 16| | // If inlen * lsb / 8 > outlen, only outlen * 8 bits are copied. 17| 45| memset(out, 0, outlen); 18| | 19| 45| size_t i = 0; // whole bytes already filled in 20| 45| size_t j = 0; // whole uint16_t already copied 21| 45| uint16_t w = 0; // the leftover, not yet copied 22| 45| unsigned char bits = 0; // the number of lsb in w 23| | 24| 470k| while (i < outlen && (j < inlen || ((j == inlen) && (bits > 0)))) { ------------------ | Branch (24:12): [True: 470k, False: 45] | Branch (24:27): [True: 470k, False: 90] | Branch (24:41): [True: 90, False: 0] | Branch (24:57): [True: 90, False: 0] ------------------ 25| | /* 26| | in: | | |********|********| 27| | ^ 28| | j 29| | w : | ****| 30| | ^ 31| | bits 32| | out:|**|**|**|**|**|**|**|**|* | 33| | ^^ 34| | ib 35| | */ 36| 470k| unsigned char b = 0; // bits in out[i] already filled in 37| 940k| while (b < 8) { ------------------ | Branch (37:16): [True: 470k, False: 470k] ------------------ 38| 470k| int nbits = min(8 - b, bits); ------------------ | | 11| 470k|#define min(x, y) (((x) < (y)) ? (x) : (y)) | | ------------------ | | | Branch (11:20): [True: 235k, False: 235k] | | ------------------ ------------------ 39| 470k| uint16_t mask = (1 << nbits) - 1; 40| 470k| unsigned char t = (w >> (bits - nbits)) & mask; // the bits to copy from w to out 41| 470k| out[i] = out[i] + (t << (8 - b - nbits)); 42| 470k| b += nbits; 43| 470k| bits -= nbits; 44| 470k| w &= ~(mask << bits); // not strictly necessary; mostly for debugging 45| | 46| 470k| if (bits == 0) { ------------------ | Branch (46:17): [True: 235k, False: 235k] ------------------ 47| 235k| if (j < inlen) { ------------------ | Branch (47:21): [True: 235k, False: 45] ------------------ 48| 235k| w = in[j]; 49| 235k| bits = lsb; 50| 235k| j++; 51| 235k| } else { 52| 45| break; // the input vector is exhausted 53| 45| } 54| 235k| } 55| 470k| } 56| 470k| if (b == 8) { // out[i] is filled in ------------------ | Branch (56:13): [True: 470k, False: 0] ------------------ 57| 470k| i++; 58| 470k| } 59| 470k| } 60| 45|} oqs_kem_frodokem_976_aes_unpack: 64| 60|{ // Unpack the input char vector into a uint16_t output vector, copying lsb bits 65| | // for each output element from input. outlen must be at least ceil(inlen * 8 / lsb). 66| 60| memset(out, 0, outlen * sizeof(uint16_t)); 67| | 68| 60| size_t i = 0; // whole uint16_t already filled in 69| 60| size_t j = 0; // whole bytes already copied 70| 60| unsigned char w = 0; // the leftover, not yet copied 71| 60| unsigned char bits = 0; // the number of lsb bits of w 72| | 73| 352k| while (i < outlen && (j < inlen || ((j == inlen) && (bits > 0)))) { ------------------ | Branch (73:12): [True: 352k, False: 60] | Branch (73:27): [True: 352k, False: 0] | Branch (73:41): [True: 0, False: 0] | Branch (73:57): [True: 0, False: 0] ------------------ 74| | /* 75| | in: | | | | | | |**|**|... 76| | ^ 77| | j 78| | w : | *| 79| | ^ 80| | bits 81| | out:| *****| *****| *** | |... 82| | ^ ^ 83| | i b 84| | */ 85| 352k| unsigned char b = 0; // bits in out[i] already filled in 86| 1.05M| while (b < lsb) { ------------------ | Branch (86:16): [True: 704k, False: 352k] ------------------ 87| 704k| int nbits = min(lsb - b, bits); ------------------ | | 11| 704k|#define min(x, y) (((x) < (y)) ? (x) : (y)) | | ------------------ | | | Branch (11:20): [True: 0, False: 704k] | | ------------------ ------------------ 88| 704k| uint16_t mask = (1 << nbits) - 1; 89| 704k| unsigned char t = (w >> (bits - nbits)) & mask; // the bits to copy from w to out 90| 704k| out[i] = out[i] + (t << (lsb - b - nbits)); 91| 704k| b += nbits; 92| 704k| bits -= nbits; 93| 704k| w &= ~(mask << bits); // not strictly necessary; mostly for debugging 94| | 95| 704k| if (bits == 0) { ------------------ | Branch (95:17): [True: 704k, False: 0] ------------------ 96| 704k| if (j < inlen) { ------------------ | Branch (96:21): [True: 704k, False: 60] ------------------ 97| 704k| w = in[j]; 98| 704k| bits = 8; 99| 704k| j++; 100| 704k| } else { 101| 60| break; // the input vector is exhausted 102| 60| } 103| 704k| } 104| 704k| } 105| 352k| if (b == lsb) { // out[i] is filled in ------------------ | Branch (105:13): [True: 352k, False: 0] ------------------ 106| 352k| i++; 107| 352k| } 108| 352k| } 109| 60|} oqs_kem_frodokem_976_aes_ct_verify: 113| 30|{ // Compare two arrays in constant time. 114| | // Returns 0 if the byte arrays are equal, -1 otherwise. 115| 30| uint16_t r = 0; 116| | 117| 118k| for (size_t i = 0; i < len; i++) { ------------------ | Branch (117:24): [True: 118k, False: 30] ------------------ 118| 118k| r |= a[i] ^ b[i]; 119| 118k| } 120| | 121| 30| r = (-(int16_t)(r >> 1) | -(int16_t)(r & 1)) >> (8*sizeof(uint16_t)-1); 122| 30| return (int8_t)r; 123| 30|} oqs_kem_frodokem_976_aes_ct_select: 127| 15|{ // Select one of the two input arrays to be moved to r 128| | // If (selector == 0) then load r with a, else if (selector == -1) load r with b 129| 15| OQS_MEM_BLACK_BOX(selector); ------------------ | | 58| 15| do { \ | | 59| 15| __asm__ volatile("" : "+r"(v) :); \ | | 60| 15| } while (0) | | ------------------ | | | Branch (60:14): [Folded, False: 15] | | ------------------ ------------------ 130| 375| for (size_t i = 0; i < len; i++) { ------------------ | Branch (130:24): [True: 360, False: 15] ------------------ 131| 360| r[i] = (~selector & a[i]) | (selector & b[i]); 132| 360| } 133| 15|} oqs_kem_frodokem_976_shake_pack: 15| 33|{ // Pack the input uint16 vector into a char output vector, copying lsb bits from each input element. 16| | // If inlen * lsb / 8 > outlen, only outlen * 8 bits are copied. 17| 33| memset(out, 0, outlen); 18| | 19| 33| size_t i = 0; // whole bytes already filled in 20| 33| size_t j = 0; // whole uint16_t already copied 21| 33| uint16_t w = 0; // the leftover, not yet copied 22| 33| unsigned char bits = 0; // the number of lsb in w 23| | 24| 344k| while (i < outlen && (j < inlen || ((j == inlen) && (bits > 0)))) { ------------------ | Branch (24:12): [True: 344k, False: 33] | Branch (24:27): [True: 344k, False: 66] | Branch (24:41): [True: 66, False: 0] | Branch (24:57): [True: 66, False: 0] ------------------ 25| | /* 26| | in: | | |********|********| 27| | ^ 28| | j 29| | w : | ****| 30| | ^ 31| | bits 32| | out:|**|**|**|**|**|**|**|**|* | 33| | ^^ 34| | ib 35| | */ 36| 344k| unsigned char b = 0; // bits in out[i] already filled in 37| 689k| while (b < 8) { ------------------ | Branch (37:16): [True: 344k, False: 344k] ------------------ 38| 344k| int nbits = min(8 - b, bits); ------------------ | | 11| 344k|#define min(x, y) (((x) < (y)) ? (x) : (y)) | | ------------------ | | | Branch (11:20): [True: 172k, False: 172k] | | ------------------ ------------------ 39| 344k| uint16_t mask = (1 << nbits) - 1; 40| 344k| unsigned char t = (w >> (bits - nbits)) & mask; // the bits to copy from w to out 41| 344k| out[i] = out[i] + (t << (8 - b - nbits)); 42| 344k| b += nbits; 43| 344k| bits -= nbits; 44| 344k| w &= ~(mask << bits); // not strictly necessary; mostly for debugging 45| | 46| 344k| if (bits == 0) { ------------------ | Branch (46:17): [True: 172k, False: 172k] ------------------ 47| 172k| if (j < inlen) { ------------------ | Branch (47:21): [True: 172k, False: 33] ------------------ 48| 172k| w = in[j]; 49| 172k| bits = lsb; 50| 172k| j++; 51| 172k| } else { 52| 33| break; // the input vector is exhausted 53| 33| } 54| 172k| } 55| 344k| } 56| 344k| if (b == 8) { // out[i] is filled in ------------------ | Branch (56:13): [True: 344k, False: 0] ------------------ 57| 344k| i++; 58| 344k| } 59| 344k| } 60| 33|} oqs_kem_frodokem_976_shake_unpack: 64| 44|{ // Unpack the input char vector into a uint16_t output vector, copying lsb bits 65| | // for each output element from input. outlen must be at least ceil(inlen * 8 / lsb). 66| 44| memset(out, 0, outlen * sizeof(uint16_t)); 67| | 68| 44| size_t i = 0; // whole uint16_t already filled in 69| 44| size_t j = 0; // whole bytes already copied 70| 44| unsigned char w = 0; // the leftover, not yet copied 71| 44| unsigned char bits = 0; // the number of lsb bits of w 72| | 73| 258k| while (i < outlen && (j < inlen || ((j == inlen) && (bits > 0)))) { ------------------ | Branch (73:12): [True: 258k, False: 44] | Branch (73:27): [True: 258k, False: 0] | Branch (73:41): [True: 0, False: 0] | Branch (73:57): [True: 0, False: 0] ------------------ 74| | /* 75| | in: | | | | | | |**|**|... 76| | ^ 77| | j 78| | w : | *| 79| | ^ 80| | bits 81| | out:| *****| *****| *** | |... 82| | ^ ^ 83| | i b 84| | */ 85| 258k| unsigned char b = 0; // bits in out[i] already filled in 86| 775k| while (b < lsb) { ------------------ | Branch (86:16): [True: 516k, False: 258k] ------------------ 87| 516k| int nbits = min(lsb - b, bits); ------------------ | | 11| 516k|#define min(x, y) (((x) < (y)) ? (x) : (y)) | | ------------------ | | | Branch (11:20): [True: 0, False: 516k] | | ------------------ ------------------ 88| 516k| uint16_t mask = (1 << nbits) - 1; 89| 516k| unsigned char t = (w >> (bits - nbits)) & mask; // the bits to copy from w to out 90| 516k| out[i] = out[i] + (t << (lsb - b - nbits)); 91| 516k| b += nbits; 92| 516k| bits -= nbits; 93| 516k| w &= ~(mask << bits); // not strictly necessary; mostly for debugging 94| | 95| 516k| if (bits == 0) { ------------------ | Branch (95:17): [True: 516k, False: 0] ------------------ 96| 516k| if (j < inlen) { ------------------ | Branch (96:21): [True: 516k, False: 44] ------------------ 97| 516k| w = in[j]; 98| 516k| bits = 8; 99| 516k| j++; 100| 516k| } else { 101| 44| break; // the input vector is exhausted 102| 44| } 103| 516k| } 104| 516k| } 105| 258k| if (b == lsb) { // out[i] is filled in ------------------ | Branch (105:13): [True: 258k, False: 0] ------------------ 106| 258k| i++; 107| 258k| } 108| 258k| } 109| 44|} oqs_kem_frodokem_976_shake_ct_verify: 113| 22|{ // Compare two arrays in constant time. 114| | // Returns 0 if the byte arrays are equal, -1 otherwise. 115| 22| uint16_t r = 0; 116| | 117| 86.6k| for (size_t i = 0; i < len; i++) { ------------------ | Branch (117:24): [True: 86.5k, False: 22] ------------------ 118| 86.5k| r |= a[i] ^ b[i]; 119| 86.5k| } 120| | 121| 22| r = (-(int16_t)(r >> 1) | -(int16_t)(r & 1)) >> (8*sizeof(uint16_t)-1); 122| 22| return (int8_t)r; 123| 22|} oqs_kem_frodokem_976_shake_ct_select: 127| 11|{ // Select one of the two input arrays to be moved to r 128| | // If (selector == 0) then load r with a, else if (selector == -1) load r with b 129| 11| OQS_MEM_BLACK_BOX(selector); ------------------ | | 58| 11| do { \ | | 59| 11| __asm__ volatile("" : "+r"(v) :); \ | | 60| 11| } while (0) | | ------------------ | | | Branch (60:14): [Folded, False: 11] | | ------------------ ------------------ 130| 275| for (size_t i = 0; i < len; i++) { ------------------ | Branch (130:24): [True: 264, False: 11] ------------------ 131| 264| r[i] = (~selector & a[i]) | (selector & b[i]); 132| 264| } 133| 11|} oqs_kem_frodokem_1344_aes_pack: 15| 24|{ // Pack the input uint16 vector into a char output vector, copying lsb bits from each input element. 16| | // If inlen * lsb / 8 > outlen, only outlen * 8 bits are copied. 17| 24| memset(out, 0, outlen); 18| | 19| 24| size_t i = 0; // whole bytes already filled in 20| 24| size_t j = 0; // whole uint16_t already copied 21| 24| uint16_t w = 0; // the leftover, not yet copied 22| 24| unsigned char bits = 0; // the number of lsb in w 23| | 24| 345k| while (i < outlen && (j < inlen || ((j == inlen) && (bits > 0)))) { ------------------ | Branch (24:12): [True: 345k, False: 24] | Branch (24:27): [True: 345k, False: 48] | Branch (24:41): [True: 48, False: 0] | Branch (24:57): [True: 48, False: 0] ------------------ 25| | /* 26| | in: | | |********|********| 27| | ^ 28| | j 29| | w : | ****| 30| | ^ 31| | bits 32| | out:|**|**|**|**|**|**|**|**|* | 33| | ^^ 34| | ib 35| | */ 36| 345k| unsigned char b = 0; // bits in out[i] already filled in 37| 690k| while (b < 8) { ------------------ | Branch (37:16): [True: 345k, False: 345k] ------------------ 38| 345k| int nbits = min(8 - b, bits); ------------------ | | 11| 345k|#define min(x, y) (((x) < (y)) ? (x) : (y)) | | ------------------ | | | Branch (11:20): [True: 172k, False: 172k] | | ------------------ ------------------ 39| 345k| uint16_t mask = (1 << nbits) - 1; 40| 345k| unsigned char t = (w >> (bits - nbits)) & mask; // the bits to copy from w to out 41| 345k| out[i] = out[i] + (t << (8 - b - nbits)); 42| 345k| b += nbits; 43| 345k| bits -= nbits; 44| 345k| w &= ~(mask << bits); // not strictly necessary; mostly for debugging 45| | 46| 345k| if (bits == 0) { ------------------ | Branch (46:17): [True: 172k, False: 172k] ------------------ 47| 172k| if (j < inlen) { ------------------ | Branch (47:21): [True: 172k, False: 24] ------------------ 48| 172k| w = in[j]; 49| 172k| bits = lsb; 50| 172k| j++; 51| 172k| } else { 52| 24| break; // the input vector is exhausted 53| 24| } 54| 172k| } 55| 345k| } 56| 345k| if (b == 8) { // out[i] is filled in ------------------ | Branch (56:13): [True: 345k, False: 0] ------------------ 57| 345k| i++; 58| 345k| } 59| 345k| } 60| 24|} oqs_kem_frodokem_1344_aes_unpack: 64| 32|{ // Unpack the input char vector into a uint16_t output vector, copying lsb bits 65| | // for each output element from input. outlen must be at least ceil(inlen * 8 / lsb). 66| 32| memset(out, 0, outlen * sizeof(uint16_t)); 67| | 68| 32| size_t i = 0; // whole uint16_t already filled in 69| 32| size_t j = 0; // whole bytes already copied 70| 32| unsigned char w = 0; // the leftover, not yet copied 71| 32| unsigned char bits = 0; // the number of lsb bits of w 72| | 73| 258k| while (i < outlen && (j < inlen || ((j == inlen) && (bits > 0)))) { ------------------ | Branch (73:12): [True: 258k, False: 32] | Branch (73:27): [True: 258k, False: 0] | Branch (73:41): [True: 0, False: 0] | Branch (73:57): [True: 0, False: 0] ------------------ 74| | /* 75| | in: | | | | | | |**|**|... 76| | ^ 77| | j 78| | w : | *| 79| | ^ 80| | bits 81| | out:| *****| *****| *** | |... 82| | ^ ^ 83| | i b 84| | */ 85| 258k| unsigned char b = 0; // bits in out[i] already filled in 86| 775k| while (b < lsb) { ------------------ | Branch (86:16): [True: 517k, False: 258k] ------------------ 87| 517k| int nbits = min(lsb - b, bits); ------------------ | | 11| 517k|#define min(x, y) (((x) < (y)) ? (x) : (y)) | | ------------------ | | | Branch (11:20): [True: 0, False: 517k] | | ------------------ ------------------ 88| 517k| uint16_t mask = (1 << nbits) - 1; 89| 517k| unsigned char t = (w >> (bits - nbits)) & mask; // the bits to copy from w to out 90| 517k| out[i] = out[i] + (t << (lsb - b - nbits)); 91| 517k| b += nbits; 92| 517k| bits -= nbits; 93| 517k| w &= ~(mask << bits); // not strictly necessary; mostly for debugging 94| | 95| 517k| if (bits == 0) { ------------------ | Branch (95:17): [True: 517k, False: 0] ------------------ 96| 517k| if (j < inlen) { ------------------ | Branch (96:21): [True: 517k, False: 32] ------------------ 97| 517k| w = in[j]; 98| 517k| bits = 8; 99| 517k| j++; 100| 517k| } else { 101| 32| break; // the input vector is exhausted 102| 32| } 103| 517k| } 104| 517k| } 105| 258k| if (b == lsb) { // out[i] is filled in ------------------ | Branch (105:13): [True: 258k, False: 0] ------------------ 106| 258k| i++; 107| 258k| } 108| 258k| } 109| 32|} oqs_kem_frodokem_1344_aes_ct_verify: 113| 16|{ // Compare two arrays in constant time. 114| | // Returns 0 if the byte arrays are equal, -1 otherwise. 115| 16| uint16_t r = 0; 116| | 117| 86.5k| for (size_t i = 0; i < len; i++) { ------------------ | Branch (117:24): [True: 86.5k, False: 16] ------------------ 118| 86.5k| r |= a[i] ^ b[i]; 119| 86.5k| } 120| | 121| 16| r = (-(int16_t)(r >> 1) | -(int16_t)(r & 1)) >> (8*sizeof(uint16_t)-1); 122| 16| return (int8_t)r; 123| 16|} oqs_kem_frodokem_1344_aes_ct_select: 127| 8|{ // Select one of the two input arrays to be moved to r 128| | // If (selector == 0) then load r with a, else if (selector == -1) load r with b 129| 8| OQS_MEM_BLACK_BOX(selector); ------------------ | | 58| 8| do { \ | | 59| 8| __asm__ volatile("" : "+r"(v) :); \ | | 60| 8| } while (0) | | ------------------ | | | Branch (60:14): [Folded, False: 8] | | ------------------ ------------------ 130| 264| for (size_t i = 0; i < len; i++) { ------------------ | Branch (130:24): [True: 256, False: 8] ------------------ 131| 256| r[i] = (~selector & a[i]) | (selector & b[i]); 132| 256| } 133| 8|} oqs_kem_frodokem_1344_shake_pack: 15| 27|{ // Pack the input uint16 vector into a char output vector, copying lsb bits from each input element. 16| | // If inlen * lsb / 8 > outlen, only outlen * 8 bits are copied. 17| 27| memset(out, 0, outlen); 18| | 19| 27| size_t i = 0; // whole bytes already filled in 20| 27| size_t j = 0; // whole uint16_t already copied 21| 27| uint16_t w = 0; // the leftover, not yet copied 22| 27| unsigned char bits = 0; // the number of lsb in w 23| | 24| 388k| while (i < outlen && (j < inlen || ((j == inlen) && (bits > 0)))) { ------------------ | Branch (24:12): [True: 388k, False: 27] | Branch (24:27): [True: 388k, False: 54] | Branch (24:41): [True: 54, False: 0] | Branch (24:57): [True: 54, False: 0] ------------------ 25| | /* 26| | in: | | |********|********| 27| | ^ 28| | j 29| | w : | ****| 30| | ^ 31| | bits 32| | out:|**|**|**|**|**|**|**|**|* | 33| | ^^ 34| | ib 35| | */ 36| 388k| unsigned char b = 0; // bits in out[i] already filled in 37| 776k| while (b < 8) { ------------------ | Branch (37:16): [True: 388k, False: 388k] ------------------ 38| 388k| int nbits = min(8 - b, bits); ------------------ | | 11| 388k|#define min(x, y) (((x) < (y)) ? (x) : (y)) | | ------------------ | | | Branch (11:20): [True: 194k, False: 194k] | | ------------------ ------------------ 39| 388k| uint16_t mask = (1 << nbits) - 1; 40| 388k| unsigned char t = (w >> (bits - nbits)) & mask; // the bits to copy from w to out 41| 388k| out[i] = out[i] + (t << (8 - b - nbits)); 42| 388k| b += nbits; 43| 388k| bits -= nbits; 44| 388k| w &= ~(mask << bits); // not strictly necessary; mostly for debugging 45| | 46| 388k| if (bits == 0) { ------------------ | Branch (46:17): [True: 194k, False: 194k] ------------------ 47| 194k| if (j < inlen) { ------------------ | Branch (47:21): [True: 194k, False: 27] ------------------ 48| 194k| w = in[j]; 49| 194k| bits = lsb; 50| 194k| j++; 51| 194k| } else { 52| 27| break; // the input vector is exhausted 53| 27| } 54| 194k| } 55| 388k| } 56| 388k| if (b == 8) { // out[i] is filled in ------------------ | Branch (56:13): [True: 388k, False: 0] ------------------ 57| 388k| i++; 58| 388k| } 59| 388k| } 60| 27|} oqs_kem_frodokem_1344_shake_unpack: 64| 36|{ // Unpack the input char vector into a uint16_t output vector, copying lsb bits 65| | // for each output element from input. outlen must be at least ceil(inlen * 8 / lsb). 66| 36| memset(out, 0, outlen * sizeof(uint16_t)); 67| | 68| 36| size_t i = 0; // whole uint16_t already filled in 69| 36| size_t j = 0; // whole bytes already copied 70| 36| unsigned char w = 0; // the leftover, not yet copied 71| 36| unsigned char bits = 0; // the number of lsb bits of w 72| | 73| 290k| while (i < outlen && (j < inlen || ((j == inlen) && (bits > 0)))) { ------------------ | Branch (73:12): [True: 290k, False: 36] | Branch (73:27): [True: 290k, False: 0] | Branch (73:41): [True: 0, False: 0] | Branch (73:57): [True: 0, False: 0] ------------------ 74| | /* 75| | in: | | | | | | |**|**|... 76| | ^ 77| | j 78| | w : | *| 79| | ^ 80| | bits 81| | out:| *****| *****| *** | |... 82| | ^ ^ 83| | i b 84| | */ 85| 290k| unsigned char b = 0; // bits in out[i] already filled in 86| 872k| while (b < lsb) { ------------------ | Branch (86:16): [True: 581k, False: 290k] ------------------ 87| 581k| int nbits = min(lsb - b, bits); ------------------ | | 11| 581k|#define min(x, y) (((x) < (y)) ? (x) : (y)) | | ------------------ | | | Branch (11:20): [True: 0, False: 581k] | | ------------------ ------------------ 88| 581k| uint16_t mask = (1 << nbits) - 1; 89| 581k| unsigned char t = (w >> (bits - nbits)) & mask; // the bits to copy from w to out 90| 581k| out[i] = out[i] + (t << (lsb - b - nbits)); 91| 581k| b += nbits; 92| 581k| bits -= nbits; 93| 581k| w &= ~(mask << bits); // not strictly necessary; mostly for debugging 94| | 95| 581k| if (bits == 0) { ------------------ | Branch (95:17): [True: 581k, False: 0] ------------------ 96| 581k| if (j < inlen) { ------------------ | Branch (96:21): [True: 581k, False: 36] ------------------ 97| 581k| w = in[j]; 98| 581k| bits = 8; 99| 581k| j++; 100| 581k| } else { 101| 36| break; // the input vector is exhausted 102| 36| } 103| 581k| } 104| 581k| } 105| 290k| if (b == lsb) { // out[i] is filled in ------------------ | Branch (105:13): [True: 290k, False: 0] ------------------ 106| 290k| i++; 107| 290k| } 108| 290k| } 109| 36|} oqs_kem_frodokem_1344_shake_ct_verify: 113| 18|{ // Compare two arrays in constant time. 114| | // Returns 0 if the byte arrays are equal, -1 otherwise. 115| 18| uint16_t r = 0; 116| | 117| 97.3k| for (size_t i = 0; i < len; i++) { ------------------ | Branch (117:24): [True: 97.3k, False: 18] ------------------ 118| 97.3k| r |= a[i] ^ b[i]; 119| 97.3k| } 120| | 121| 18| r = (-(int16_t)(r >> 1) | -(int16_t)(r & 1)) >> (8*sizeof(uint16_t)-1); 122| 18| return (int8_t)r; 123| 18|} oqs_kem_frodokem_1344_shake_ct_select: 127| 9|{ // Select one of the two input arrays to be moved to r 128| | // If (selector == 0) then load r with a, else if (selector == -1) load r with b 129| 9| OQS_MEM_BLACK_BOX(selector); ------------------ | | 58| 9| do { \ | | 59| 9| __asm__ volatile("" : "+r"(v) :); \ | | 60| 9| } while (0) | | ------------------ | | | Branch (60:14): [Folded, False: 9] | | ------------------ ------------------ 130| 297| for (size_t i = 0; i < len; i++) { ------------------ | Branch (130:24): [True: 288, False: 9] ------------------ 131| 288| r[i] = (~selector & a[i]) | (selector & b[i]); 132| 288| } 133| 9|} oqs_kem_efrodokem_640_aes_pack: 15| 12|{ // Pack the input uint16 vector into a char output vector, copying lsb bits from each input element. 16| | // If inlen * lsb / 8 > outlen, only outlen * 8 bits are copied. 17| 12| memset(out, 0, outlen); 18| | 19| 12| size_t i = 0; // whole bytes already filled in 20| 12| size_t j = 0; // whole uint16_t already copied 21| 12| uint16_t w = 0; // the leftover, not yet copied 22| 12| unsigned char bits = 0; // the number of lsb in w 23| | 24| 77.2k| while (i < outlen && (j < inlen || ((j == inlen) && (bits > 0)))) { ------------------ | Branch (24:12): [True: 77.2k, False: 12] | Branch (24:27): [True: 77.2k, False: 12] | Branch (24:41): [True: 12, False: 0] | Branch (24:57): [True: 12, False: 0] ------------------ 25| | /* 26| | in: | | |********|********| 27| | ^ 28| | j 29| | w : | ****| 30| | ^ 31| | bits 32| | out:|**|**|**|**|**|**|**|**|* | 33| | ^^ 34| | ib 35| | */ 36| 77.2k| unsigned char b = 0; // bits in out[i] already filled in 37| 190k| while (b < 8) { ------------------ | Branch (37:16): [True: 113k, False: 77.2k] ------------------ 38| 113k| int nbits = min(8 - b, bits); ------------------ | | 11| 113k|#define min(x, y) (((x) < (y)) ? (x) : (y)) | | ------------------ | | | Branch (11:20): [True: 72.1k, False: 41.2k] | | ------------------ ------------------ 39| 113k| uint16_t mask = (1 << nbits) - 1; 40| 113k| unsigned char t = (w >> (bits - nbits)) & mask; // the bits to copy from w to out 41| 113k| out[i] = out[i] + (t << (8 - b - nbits)); 42| 113k| b += nbits; 43| 113k| bits -= nbits; 44| 113k| w &= ~(mask << bits); // not strictly necessary; mostly for debugging 45| | 46| 113k| if (bits == 0) { ------------------ | Branch (46:17): [True: 41.2k, False: 72.1k] ------------------ 47| 41.2k| if (j < inlen) { ------------------ | Branch (47:21): [True: 41.2k, False: 12] ------------------ 48| 41.2k| w = in[j]; 49| 41.2k| bits = lsb; 50| 41.2k| j++; 51| 41.2k| } else { 52| 12| break; // the input vector is exhausted 53| 12| } 54| 41.2k| } 55| 113k| } 56| 77.2k| if (b == 8) { // out[i] is filled in ------------------ | Branch (56:13): [True: 77.2k, False: 0] ------------------ 57| 77.2k| i++; 58| 77.2k| } 59| 77.2k| } 60| 12|} oqs_kem_efrodokem_640_aes_unpack: 64| 16|{ // Unpack the input char vector into a uint16_t output vector, copying lsb bits 65| | // for each output element from input. outlen must be at least ceil(inlen * 8 / lsb). 66| 16| memset(out, 0, outlen * sizeof(uint16_t)); 67| | 68| 16| size_t i = 0; // whole uint16_t already filled in 69| 16| size_t j = 0; // whole bytes already copied 70| 16| unsigned char w = 0; // the leftover, not yet copied 71| 16| unsigned char bits = 0; // the number of lsb bits of w 72| | 73| 61.7k| while (i < outlen && (j < inlen || ((j == inlen) && (bits > 0)))) { ------------------ | Branch (73:12): [True: 61.6k, False: 16] | Branch (73:27): [True: 61.6k, False: 0] | Branch (73:41): [True: 0, False: 0] | Branch (73:57): [True: 0, False: 0] ------------------ 74| | /* 75| | in: | | | | | | |**|**|... 76| | ^ 77| | j 78| | w : | *| 79| | ^ 80| | bits 81| | out:| *****| *****| *** | |... 82| | ^ ^ 83| | i b 84| | */ 85| 61.6k| unsigned char b = 0; // bits in out[i] already filled in 86| 231k| while (b < lsb) { ------------------ | Branch (86:16): [True: 169k, False: 61.6k] ------------------ 87| 169k| int nbits = min(lsb - b, bits); ------------------ | | 11| 169k|#define min(x, y) (((x) < (y)) ? (x) : (y)) | | ------------------ | | | Branch (11:20): [True: 53.9k, False: 115k] | | ------------------ ------------------ 88| 169k| uint16_t mask = (1 << nbits) - 1; 89| 169k| unsigned char t = (w >> (bits - nbits)) & mask; // the bits to copy from w to out 90| 169k| out[i] = out[i] + (t << (lsb - b - nbits)); 91| 169k| b += nbits; 92| 169k| bits -= nbits; 93| 169k| w &= ~(mask << bits); // not strictly necessary; mostly for debugging 94| | 95| 169k| if (bits == 0) { ------------------ | Branch (95:17): [True: 115k, False: 53.9k] ------------------ 96| 115k| if (j < inlen) { ------------------ | Branch (96:21): [True: 115k, False: 16] ------------------ 97| 115k| w = in[j]; 98| 115k| bits = 8; 99| 115k| j++; 100| 115k| } else { 101| 16| break; // the input vector is exhausted 102| 16| } 103| 115k| } 104| 169k| } 105| 61.6k| if (b == lsb) { // out[i] is filled in ------------------ | Branch (105:13): [True: 61.6k, False: 0] ------------------ 106| 61.6k| i++; 107| 61.6k| } 108| 61.6k| } 109| 16|} oqs_kem_efrodokem_640_aes_ct_verify: 113| 8|{ // Compare two arrays in constant time. 114| | // Returns 0 if the byte arrays are equal, -1 otherwise. 115| 8| uint16_t r = 0; 116| | 117| 20.7k| for (size_t i = 0; i < len; i++) { ------------------ | Branch (117:24): [True: 20.7k, False: 8] ------------------ 118| 20.7k| r |= a[i] ^ b[i]; 119| 20.7k| } 120| | 121| 8| r = (-(int16_t)(r >> 1) | -(int16_t)(r & 1)) >> (8*sizeof(uint16_t)-1); 122| 8| return (int8_t)r; 123| 8|} oqs_kem_efrodokem_640_aes_ct_select: 127| 4|{ // Select one of the two input arrays to be moved to r 128| | // If (selector == 0) then load r with a, else if (selector == -1) load r with b 129| 4| OQS_MEM_BLACK_BOX(selector); ------------------ | | 58| 4| do { \ | | 59| 4| __asm__ volatile("" : "+r"(v) :); \ | | 60| 4| } while (0) | | ------------------ | | | Branch (60:14): [Folded, False: 4] | | ------------------ ------------------ 130| 68| for (size_t i = 0; i < len; i++) { ------------------ | Branch (130:24): [True: 64, False: 4] ------------------ 131| 64| r[i] = (~selector & a[i]) | (selector & b[i]); 132| 64| } 133| 4|} oqs_kem_efrodokem_640_shake_pack: 15| 6|{ // Pack the input uint16 vector into a char output vector, copying lsb bits from each input element. 16| | // If inlen * lsb / 8 > outlen, only outlen * 8 bits are copied. 17| 6| memset(out, 0, outlen); 18| | 19| 6| size_t i = 0; // whole bytes already filled in 20| 6| size_t j = 0; // whole uint16_t already copied 21| 6| uint16_t w = 0; // the leftover, not yet copied 22| 6| unsigned char bits = 0; // the number of lsb in w 23| | 24| 38.6k| while (i < outlen && (j < inlen || ((j == inlen) && (bits > 0)))) { ------------------ | Branch (24:12): [True: 38.6k, False: 6] | Branch (24:27): [True: 38.6k, False: 6] | Branch (24:41): [True: 6, False: 0] | Branch (24:57): [True: 6, False: 0] ------------------ 25| | /* 26| | in: | | |********|********| 27| | ^ 28| | j 29| | w : | ****| 30| | ^ 31| | bits 32| | out:|**|**|**|**|**|**|**|**|* | 33| | ^^ 34| | ib 35| | */ 36| 38.6k| unsigned char b = 0; // bits in out[i] already filled in 37| 95.3k| while (b < 8) { ------------------ | Branch (37:16): [True: 56.6k, False: 38.6k] ------------------ 38| 56.6k| int nbits = min(8 - b, bits); ------------------ | | 11| 56.6k|#define min(x, y) (((x) < (y)) ? (x) : (y)) | | ------------------ | | | Branch (11:20): [True: 36.0k, False: 20.6k] | | ------------------ ------------------ 39| 56.6k| uint16_t mask = (1 << nbits) - 1; 40| 56.6k| unsigned char t = (w >> (bits - nbits)) & mask; // the bits to copy from w to out 41| 56.6k| out[i] = out[i] + (t << (8 - b - nbits)); 42| 56.6k| b += nbits; 43| 56.6k| bits -= nbits; 44| 56.6k| w &= ~(mask << bits); // not strictly necessary; mostly for debugging 45| | 46| 56.6k| if (bits == 0) { ------------------ | Branch (46:17): [True: 20.6k, False: 36.0k] ------------------ 47| 20.6k| if (j < inlen) { ------------------ | Branch (47:21): [True: 20.6k, False: 6] ------------------ 48| 20.6k| w = in[j]; 49| 20.6k| bits = lsb; 50| 20.6k| j++; 51| 20.6k| } else { 52| 6| break; // the input vector is exhausted 53| 6| } 54| 20.6k| } 55| 56.6k| } 56| 38.6k| if (b == 8) { // out[i] is filled in ------------------ | Branch (56:13): [True: 38.6k, False: 0] ------------------ 57| 38.6k| i++; 58| 38.6k| } 59| 38.6k| } 60| 6|} oqs_kem_efrodokem_640_shake_unpack: 64| 8|{ // Unpack the input char vector into a uint16_t output vector, copying lsb bits 65| | // for each output element from input. outlen must be at least ceil(inlen * 8 / lsb). 66| 8| memset(out, 0, outlen * sizeof(uint16_t)); 67| | 68| 8| size_t i = 0; // whole uint16_t already filled in 69| 8| size_t j = 0; // whole bytes already copied 70| 8| unsigned char w = 0; // the leftover, not yet copied 71| 8| unsigned char bits = 0; // the number of lsb bits of w 72| | 73| 30.8k| while (i < outlen && (j < inlen || ((j == inlen) && (bits > 0)))) { ------------------ | Branch (73:12): [True: 30.8k, False: 8] | Branch (73:27): [True: 30.8k, False: 0] | Branch (73:41): [True: 0, False: 0] | Branch (73:57): [True: 0, False: 0] ------------------ 74| | /* 75| | in: | | | | | | |**|**|... 76| | ^ 77| | j 78| | w : | *| 79| | ^ 80| | bits 81| | out:| *****| *****| *** | |... 82| | ^ ^ 83| | i b 84| | */ 85| 30.8k| unsigned char b = 0; // bits in out[i] already filled in 86| 115k| while (b < lsb) { ------------------ | Branch (86:16): [True: 84.8k, False: 30.8k] ------------------ 87| 84.8k| int nbits = min(lsb - b, bits); ------------------ | | 11| 84.8k|#define min(x, y) (((x) < (y)) ? (x) : (y)) | | ------------------ | | | Branch (11:20): [True: 26.9k, False: 57.8k] | | ------------------ ------------------ 88| 84.8k| uint16_t mask = (1 << nbits) - 1; 89| 84.8k| unsigned char t = (w >> (bits - nbits)) & mask; // the bits to copy from w to out 90| 84.8k| out[i] = out[i] + (t << (lsb - b - nbits)); 91| 84.8k| b += nbits; 92| 84.8k| bits -= nbits; 93| 84.8k| w &= ~(mask << bits); // not strictly necessary; mostly for debugging 94| | 95| 84.8k| if (bits == 0) { ------------------ | Branch (95:17): [True: 57.8k, False: 26.9k] ------------------ 96| 57.8k| if (j < inlen) { ------------------ | Branch (96:21): [True: 57.8k, False: 8] ------------------ 97| 57.8k| w = in[j]; 98| 57.8k| bits = 8; 99| 57.8k| j++; 100| 57.8k| } else { 101| 8| break; // the input vector is exhausted 102| 8| } 103| 57.8k| } 104| 84.8k| } 105| 30.8k| if (b == lsb) { // out[i] is filled in ------------------ | Branch (105:13): [True: 30.8k, False: 0] ------------------ 106| 30.8k| i++; 107| 30.8k| } 108| 30.8k| } 109| 8|} oqs_kem_efrodokem_640_shake_ct_verify: 113| 4|{ // Compare two arrays in constant time. 114| | // Returns 0 if the byte arrays are equal, -1 otherwise. 115| 4| uint16_t r = 0; 116| | 117| 10.3k| for (size_t i = 0; i < len; i++) { ------------------ | Branch (117:24): [True: 10.3k, False: 4] ------------------ 118| 10.3k| r |= a[i] ^ b[i]; 119| 10.3k| } 120| | 121| 4| r = (-(int16_t)(r >> 1) | -(int16_t)(r & 1)) >> (8*sizeof(uint16_t)-1); 122| 4| return (int8_t)r; 123| 4|} oqs_kem_efrodokem_640_shake_ct_select: 127| 2|{ // Select one of the two input arrays to be moved to r 128| | // If (selector == 0) then load r with a, else if (selector == -1) load r with b 129| 2| OQS_MEM_BLACK_BOX(selector); ------------------ | | 58| 2| do { \ | | 59| 2| __asm__ volatile("" : "+r"(v) :); \ | | 60| 2| } while (0) | | ------------------ | | | Branch (60:14): [Folded, False: 2] | | ------------------ ------------------ 130| 34| for (size_t i = 0; i < len; i++) { ------------------ | Branch (130:24): [True: 32, False: 2] ------------------ 131| 32| r[i] = (~selector & a[i]) | (selector & b[i]); 132| 32| } 133| 2|} oqs_kem_efrodokem_976_aes_pack: 15| 36|{ // Pack the input uint16 vector into a char output vector, copying lsb bits from each input element. 16| | // If inlen * lsb / 8 > outlen, only outlen * 8 bits are copied. 17| 36| memset(out, 0, outlen); 18| | 19| 36| size_t i = 0; // whole bytes already filled in 20| 36| size_t j = 0; // whole uint16_t already copied 21| 36| uint16_t w = 0; // the leftover, not yet copied 22| 36| unsigned char bits = 0; // the number of lsb in w 23| | 24| 376k| while (i < outlen && (j < inlen || ((j == inlen) && (bits > 0)))) { ------------------ | Branch (24:12): [True: 376k, False: 36] | Branch (24:27): [True: 376k, False: 72] | Branch (24:41): [True: 72, False: 0] | Branch (24:57): [True: 72, False: 0] ------------------ 25| | /* 26| | in: | | |********|********| 27| | ^ 28| | j 29| | w : | ****| 30| | ^ 31| | bits 32| | out:|**|**|**|**|**|**|**|**|* | 33| | ^^ 34| | ib 35| | */ 36| 376k| unsigned char b = 0; // bits in out[i] already filled in 37| 752k| while (b < 8) { ------------------ | Branch (37:16): [True: 376k, False: 376k] ------------------ 38| 376k| int nbits = min(8 - b, bits); ------------------ | | 11| 376k|#define min(x, y) (((x) < (y)) ? (x) : (y)) | | ------------------ | | | Branch (11:20): [True: 188k, False: 188k] | | ------------------ ------------------ 39| 376k| uint16_t mask = (1 << nbits) - 1; 40| 376k| unsigned char t = (w >> (bits - nbits)) & mask; // the bits to copy from w to out 41| 376k| out[i] = out[i] + (t << (8 - b - nbits)); 42| 376k| b += nbits; 43| 376k| bits -= nbits; 44| 376k| w &= ~(mask << bits); // not strictly necessary; mostly for debugging 45| | 46| 376k| if (bits == 0) { ------------------ | Branch (46:17): [True: 188k, False: 188k] ------------------ 47| 188k| if (j < inlen) { ------------------ | Branch (47:21): [True: 188k, False: 36] ------------------ 48| 188k| w = in[j]; 49| 188k| bits = lsb; 50| 188k| j++; 51| 188k| } else { 52| 36| break; // the input vector is exhausted 53| 36| } 54| 188k| } 55| 376k| } 56| 376k| if (b == 8) { // out[i] is filled in ------------------ | Branch (56:13): [True: 376k, False: 0] ------------------ 57| 376k| i++; 58| 376k| } 59| 376k| } 60| 36|} oqs_kem_efrodokem_976_aes_unpack: 64| 48|{ // Unpack the input char vector into a uint16_t output vector, copying lsb bits 65| | // for each output element from input. outlen must be at least ceil(inlen * 8 / lsb). 66| 48| memset(out, 0, outlen * sizeof(uint16_t)); 67| | 68| 48| size_t i = 0; // whole uint16_t already filled in 69| 48| size_t j = 0; // whole bytes already copied 70| 48| unsigned char w = 0; // the leftover, not yet copied 71| 48| unsigned char bits = 0; // the number of lsb bits of w 72| | 73| 281k| while (i < outlen && (j < inlen || ((j == inlen) && (bits > 0)))) { ------------------ | Branch (73:12): [True: 281k, False: 48] | Branch (73:27): [True: 281k, False: 0] | Branch (73:41): [True: 0, False: 0] | Branch (73:57): [True: 0, False: 0] ------------------ 74| | /* 75| | in: | | | | | | |**|**|... 76| | ^ 77| | j 78| | w : | *| 79| | ^ 80| | bits 81| | out:| *****| *****| *** | |... 82| | ^ ^ 83| | i b 84| | */ 85| 281k| unsigned char b = 0; // bits in out[i] already filled in 86| 845k| while (b < lsb) { ------------------ | Branch (86:16): [True: 563k, False: 281k] ------------------ 87| 563k| int nbits = min(lsb - b, bits); ------------------ | | 11| 563k|#define min(x, y) (((x) < (y)) ? (x) : (y)) | | ------------------ | | | Branch (11:20): [True: 0, False: 563k] | | ------------------ ------------------ 88| 563k| uint16_t mask = (1 << nbits) - 1; 89| 563k| unsigned char t = (w >> (bits - nbits)) & mask; // the bits to copy from w to out 90| 563k| out[i] = out[i] + (t << (lsb - b - nbits)); 91| 563k| b += nbits; 92| 563k| bits -= nbits; 93| 563k| w &= ~(mask << bits); // not strictly necessary; mostly for debugging 94| | 95| 563k| if (bits == 0) { ------------------ | Branch (95:17): [True: 563k, False: 0] ------------------ 96| 563k| if (j < inlen) { ------------------ | Branch (96:21): [True: 563k, False: 48] ------------------ 97| 563k| w = in[j]; 98| 563k| bits = 8; 99| 563k| j++; 100| 563k| } else { 101| 48| break; // the input vector is exhausted 102| 48| } 103| 563k| } 104| 563k| } 105| 281k| if (b == lsb) { // out[i] is filled in ------------------ | Branch (105:13): [True: 281k, False: 0] ------------------ 106| 281k| i++; 107| 281k| } 108| 281k| } 109| 48|} oqs_kem_efrodokem_976_aes_ct_verify: 113| 24|{ // Compare two arrays in constant time. 114| | // Returns 0 if the byte arrays are equal, -1 otherwise. 115| 24| uint16_t r = 0; 116| | 117| 94.4k| for (size_t i = 0; i < len; i++) { ------------------ | Branch (117:24): [True: 94.4k, False: 24] ------------------ 118| 94.4k| r |= a[i] ^ b[i]; 119| 94.4k| } 120| | 121| 24| r = (-(int16_t)(r >> 1) | -(int16_t)(r & 1)) >> (8*sizeof(uint16_t)-1); 122| 24| return (int8_t)r; 123| 24|} oqs_kem_efrodokem_976_aes_ct_select: 127| 12|{ // Select one of the two input arrays to be moved to r 128| | // If (selector == 0) then load r with a, else if (selector == -1) load r with b 129| 12| OQS_MEM_BLACK_BOX(selector); ------------------ | | 58| 12| do { \ | | 59| 12| __asm__ volatile("" : "+r"(v) :); \ | | 60| 12| } while (0) | | ------------------ | | | Branch (60:14): [Folded, False: 12] | | ------------------ ------------------ 130| 300| for (size_t i = 0; i < len; i++) { ------------------ | Branch (130:24): [True: 288, False: 12] ------------------ 131| 288| r[i] = (~selector & a[i]) | (selector & b[i]); 132| 288| } 133| 12|} oqs_kem_efrodokem_976_shake_pack: 15| 36|{ // Pack the input uint16 vector into a char output vector, copying lsb bits from each input element. 16| | // If inlen * lsb / 8 > outlen, only outlen * 8 bits are copied. 17| 36| memset(out, 0, outlen); 18| | 19| 36| size_t i = 0; // whole bytes already filled in 20| 36| size_t j = 0; // whole uint16_t already copied 21| 36| uint16_t w = 0; // the leftover, not yet copied 22| 36| unsigned char bits = 0; // the number of lsb in w 23| | 24| 376k| while (i < outlen && (j < inlen || ((j == inlen) && (bits > 0)))) { ------------------ | Branch (24:12): [True: 376k, False: 36] | Branch (24:27): [True: 376k, False: 72] | Branch (24:41): [True: 72, False: 0] | Branch (24:57): [True: 72, False: 0] ------------------ 25| | /* 26| | in: | | |********|********| 27| | ^ 28| | j 29| | w : | ****| 30| | ^ 31| | bits 32| | out:|**|**|**|**|**|**|**|**|* | 33| | ^^ 34| | ib 35| | */ 36| 376k| unsigned char b = 0; // bits in out[i] already filled in 37| 752k| while (b < 8) { ------------------ | Branch (37:16): [True: 376k, False: 376k] ------------------ 38| 376k| int nbits = min(8 - b, bits); ------------------ | | 11| 376k|#define min(x, y) (((x) < (y)) ? (x) : (y)) | | ------------------ | | | Branch (11:20): [True: 188k, False: 188k] | | ------------------ ------------------ 39| 376k| uint16_t mask = (1 << nbits) - 1; 40| 376k| unsigned char t = (w >> (bits - nbits)) & mask; // the bits to copy from w to out 41| 376k| out[i] = out[i] + (t << (8 - b - nbits)); 42| 376k| b += nbits; 43| 376k| bits -= nbits; 44| 376k| w &= ~(mask << bits); // not strictly necessary; mostly for debugging 45| | 46| 376k| if (bits == 0) { ------------------ | Branch (46:17): [True: 188k, False: 188k] ------------------ 47| 188k| if (j < inlen) { ------------------ | Branch (47:21): [True: 188k, False: 36] ------------------ 48| 188k| w = in[j]; 49| 188k| bits = lsb; 50| 188k| j++; 51| 188k| } else { 52| 36| break; // the input vector is exhausted 53| 36| } 54| 188k| } 55| 376k| } 56| 376k| if (b == 8) { // out[i] is filled in ------------------ | Branch (56:13): [True: 376k, False: 0] ------------------ 57| 376k| i++; 58| 376k| } 59| 376k| } 60| 36|} oqs_kem_efrodokem_976_shake_unpack: 64| 48|{ // Unpack the input char vector into a uint16_t output vector, copying lsb bits 65| | // for each output element from input. outlen must be at least ceil(inlen * 8 / lsb). 66| 48| memset(out, 0, outlen * sizeof(uint16_t)); 67| | 68| 48| size_t i = 0; // whole uint16_t already filled in 69| 48| size_t j = 0; // whole bytes already copied 70| 48| unsigned char w = 0; // the leftover, not yet copied 71| 48| unsigned char bits = 0; // the number of lsb bits of w 72| | 73| 281k| while (i < outlen && (j < inlen || ((j == inlen) && (bits > 0)))) { ------------------ | Branch (73:12): [True: 281k, False: 48] | Branch (73:27): [True: 281k, False: 0] | Branch (73:41): [True: 0, False: 0] | Branch (73:57): [True: 0, False: 0] ------------------ 74| | /* 75| | in: | | | | | | |**|**|... 76| | ^ 77| | j 78| | w : | *| 79| | ^ 80| | bits 81| | out:| *****| *****| *** | |... 82| | ^ ^ 83| | i b 84| | */ 85| 281k| unsigned char b = 0; // bits in out[i] already filled in 86| 845k| while (b < lsb) { ------------------ | Branch (86:16): [True: 563k, False: 281k] ------------------ 87| 563k| int nbits = min(lsb - b, bits); ------------------ | | 11| 563k|#define min(x, y) (((x) < (y)) ? (x) : (y)) | | ------------------ | | | Branch (11:20): [True: 0, False: 563k] | | ------------------ ------------------ 88| 563k| uint16_t mask = (1 << nbits) - 1; 89| 563k| unsigned char t = (w >> (bits - nbits)) & mask; // the bits to copy from w to out 90| 563k| out[i] = out[i] + (t << (lsb - b - nbits)); 91| 563k| b += nbits; 92| 563k| bits -= nbits; 93| 563k| w &= ~(mask << bits); // not strictly necessary; mostly for debugging 94| | 95| 563k| if (bits == 0) { ------------------ | Branch (95:17): [True: 563k, False: 0] ------------------ 96| 563k| if (j < inlen) { ------------------ | Branch (96:21): [True: 563k, False: 48] ------------------ 97| 563k| w = in[j]; 98| 563k| bits = 8; 99| 563k| j++; 100| 563k| } else { 101| 48| break; // the input vector is exhausted 102| 48| } 103| 563k| } 104| 563k| } 105| 281k| if (b == lsb) { // out[i] is filled in ------------------ | Branch (105:13): [True: 281k, False: 0] ------------------ 106| 281k| i++; 107| 281k| } 108| 281k| } 109| 48|} oqs_kem_efrodokem_976_shake_ct_verify: 113| 24|{ // Compare two arrays in constant time. 114| | // Returns 0 if the byte arrays are equal, -1 otherwise. 115| 24| uint16_t r = 0; 116| | 117| 94.4k| for (size_t i = 0; i < len; i++) { ------------------ | Branch (117:24): [True: 94.4k, False: 24] ------------------ 118| 94.4k| r |= a[i] ^ b[i]; 119| 94.4k| } 120| | 121| 24| r = (-(int16_t)(r >> 1) | -(int16_t)(r & 1)) >> (8*sizeof(uint16_t)-1); 122| 24| return (int8_t)r; 123| 24|} oqs_kem_efrodokem_976_shake_ct_select: 127| 12|{ // Select one of the two input arrays to be moved to r 128| | // If (selector == 0) then load r with a, else if (selector == -1) load r with b 129| 12| OQS_MEM_BLACK_BOX(selector); ------------------ | | 58| 12| do { \ | | 59| 12| __asm__ volatile("" : "+r"(v) :); \ | | 60| 12| } while (0) | | ------------------ | | | Branch (60:14): [Folded, False: 12] | | ------------------ ------------------ 130| 300| for (size_t i = 0; i < len; i++) { ------------------ | Branch (130:24): [True: 288, False: 12] ------------------ 131| 288| r[i] = (~selector & a[i]) | (selector & b[i]); 132| 288| } 133| 12|} oqs_kem_efrodokem_1344_aes_pack: 15| 24|{ // Pack the input uint16 vector into a char output vector, copying lsb bits from each input element. 16| | // If inlen * lsb / 8 > outlen, only outlen * 8 bits are copied. 17| 24| memset(out, 0, outlen); 18| | 19| 24| size_t i = 0; // whole bytes already filled in 20| 24| size_t j = 0; // whole uint16_t already copied 21| 24| uint16_t w = 0; // the leftover, not yet copied 22| 24| unsigned char bits = 0; // the number of lsb in w 23| | 24| 345k| while (i < outlen && (j < inlen || ((j == inlen) && (bits > 0)))) { ------------------ | Branch (24:12): [True: 345k, False: 24] | Branch (24:27): [True: 345k, False: 48] | Branch (24:41): [True: 48, False: 0] | Branch (24:57): [True: 48, False: 0] ------------------ 25| | /* 26| | in: | | |********|********| 27| | ^ 28| | j 29| | w : | ****| 30| | ^ 31| | bits 32| | out:|**|**|**|**|**|**|**|**|* | 33| | ^^ 34| | ib 35| | */ 36| 345k| unsigned char b = 0; // bits in out[i] already filled in 37| 690k| while (b < 8) { ------------------ | Branch (37:16): [True: 345k, False: 345k] ------------------ 38| 345k| int nbits = min(8 - b, bits); ------------------ | | 11| 345k|#define min(x, y) (((x) < (y)) ? (x) : (y)) | | ------------------ | | | Branch (11:20): [True: 172k, False: 172k] | | ------------------ ------------------ 39| 345k| uint16_t mask = (1 << nbits) - 1; 40| 345k| unsigned char t = (w >> (bits - nbits)) & mask; // the bits to copy from w to out 41| 345k| out[i] = out[i] + (t << (8 - b - nbits)); 42| 345k| b += nbits; 43| 345k| bits -= nbits; 44| 345k| w &= ~(mask << bits); // not strictly necessary; mostly for debugging 45| | 46| 345k| if (bits == 0) { ------------------ | Branch (46:17): [True: 172k, False: 172k] ------------------ 47| 172k| if (j < inlen) { ------------------ | Branch (47:21): [True: 172k, False: 24] ------------------ 48| 172k| w = in[j]; 49| 172k| bits = lsb; 50| 172k| j++; 51| 172k| } else { 52| 24| break; // the input vector is exhausted 53| 24| } 54| 172k| } 55| 345k| } 56| 345k| if (b == 8) { // out[i] is filled in ------------------ | Branch (56:13): [True: 345k, False: 0] ------------------ 57| 345k| i++; 58| 345k| } 59| 345k| } 60| 24|} oqs_kem_efrodokem_1344_aes_unpack: 64| 32|{ // Unpack the input char vector into a uint16_t output vector, copying lsb bits 65| | // for each output element from input. outlen must be at least ceil(inlen * 8 / lsb). 66| 32| memset(out, 0, outlen * sizeof(uint16_t)); 67| | 68| 32| size_t i = 0; // whole uint16_t already filled in 69| 32| size_t j = 0; // whole bytes already copied 70| 32| unsigned char w = 0; // the leftover, not yet copied 71| 32| unsigned char bits = 0; // the number of lsb bits of w 72| | 73| 258k| while (i < outlen && (j < inlen || ((j == inlen) && (bits > 0)))) { ------------------ | Branch (73:12): [True: 258k, False: 32] | Branch (73:27): [True: 258k, False: 0] | Branch (73:41): [True: 0, False: 0] | Branch (73:57): [True: 0, False: 0] ------------------ 74| | /* 75| | in: | | | | | | |**|**|... 76| | ^ 77| | j 78| | w : | *| 79| | ^ 80| | bits 81| | out:| *****| *****| *** | |... 82| | ^ ^ 83| | i b 84| | */ 85| 258k| unsigned char b = 0; // bits in out[i] already filled in 86| 775k| while (b < lsb) { ------------------ | Branch (86:16): [True: 517k, False: 258k] ------------------ 87| 517k| int nbits = min(lsb - b, bits); ------------------ | | 11| 517k|#define min(x, y) (((x) < (y)) ? (x) : (y)) | | ------------------ | | | Branch (11:20): [True: 0, False: 517k] | | ------------------ ------------------ 88| 517k| uint16_t mask = (1 << nbits) - 1; 89| 517k| unsigned char t = (w >> (bits - nbits)) & mask; // the bits to copy from w to out 90| 517k| out[i] = out[i] + (t << (lsb - b - nbits)); 91| 517k| b += nbits; 92| 517k| bits -= nbits; 93| 517k| w &= ~(mask << bits); // not strictly necessary; mostly for debugging 94| | 95| 517k| if (bits == 0) { ------------------ | Branch (95:17): [True: 517k, False: 0] ------------------ 96| 517k| if (j < inlen) { ------------------ | Branch (96:21): [True: 517k, False: 32] ------------------ 97| 517k| w = in[j]; 98| 517k| bits = 8; 99| 517k| j++; 100| 517k| } else { 101| 32| break; // the input vector is exhausted 102| 32| } 103| 517k| } 104| 517k| } 105| 258k| if (b == lsb) { // out[i] is filled in ------------------ | Branch (105:13): [True: 258k, False: 0] ------------------ 106| 258k| i++; 107| 258k| } 108| 258k| } 109| 32|} oqs_kem_efrodokem_1344_aes_ct_verify: 113| 16|{ // Compare two arrays in constant time. 114| | // Returns 0 if the byte arrays are equal, -1 otherwise. 115| 16| uint16_t r = 0; 116| | 117| 86.5k| for (size_t i = 0; i < len; i++) { ------------------ | Branch (117:24): [True: 86.5k, False: 16] ------------------ 118| 86.5k| r |= a[i] ^ b[i]; 119| 86.5k| } 120| | 121| 16| r = (-(int16_t)(r >> 1) | -(int16_t)(r & 1)) >> (8*sizeof(uint16_t)-1); 122| 16| return (int8_t)r; 123| 16|} oqs_kem_efrodokem_1344_aes_ct_select: 127| 8|{ // Select one of the two input arrays to be moved to r 128| | // If (selector == 0) then load r with a, else if (selector == -1) load r with b 129| 8| OQS_MEM_BLACK_BOX(selector); ------------------ | | 58| 8| do { \ | | 59| 8| __asm__ volatile("" : "+r"(v) :); \ | | 60| 8| } while (0) | | ------------------ | | | Branch (60:14): [Folded, False: 8] | | ------------------ ------------------ 130| 264| for (size_t i = 0; i < len; i++) { ------------------ | Branch (130:24): [True: 256, False: 8] ------------------ 131| 256| r[i] = (~selector & a[i]) | (selector & b[i]); 132| 256| } 133| 8|} oqs_kem_efrodokem_1344_shake_pack: 15| 15|{ // Pack the input uint16 vector into a char output vector, copying lsb bits from each input element. 16| | // If inlen * lsb / 8 > outlen, only outlen * 8 bits are copied. 17| 15| memset(out, 0, outlen); 18| | 19| 15| size_t i = 0; // whole bytes already filled in 20| 15| size_t j = 0; // whole uint16_t already copied 21| 15| uint16_t w = 0; // the leftover, not yet copied 22| 15| unsigned char bits = 0; // the number of lsb in w 23| | 24| 215k| while (i < outlen && (j < inlen || ((j == inlen) && (bits > 0)))) { ------------------ | Branch (24:12): [True: 215k, False: 15] | Branch (24:27): [True: 215k, False: 30] | Branch (24:41): [True: 30, False: 0] | Branch (24:57): [True: 30, False: 0] ------------------ 25| | /* 26| | in: | | |********|********| 27| | ^ 28| | j 29| | w : | ****| 30| | ^ 31| | bits 32| | out:|**|**|**|**|**|**|**|**|* | 33| | ^^ 34| | ib 35| | */ 36| 215k| unsigned char b = 0; // bits in out[i] already filled in 37| 431k| while (b < 8) { ------------------ | Branch (37:16): [True: 215k, False: 215k] ------------------ 38| 215k| int nbits = min(8 - b, bits); ------------------ | | 11| 215k|#define min(x, y) (((x) < (y)) ? (x) : (y)) | | ------------------ | | | Branch (11:20): [True: 107k, False: 107k] | | ------------------ ------------------ 39| 215k| uint16_t mask = (1 << nbits) - 1; 40| 215k| unsigned char t = (w >> (bits - nbits)) & mask; // the bits to copy from w to out 41| 215k| out[i] = out[i] + (t << (8 - b - nbits)); 42| 215k| b += nbits; 43| 215k| bits -= nbits; 44| 215k| w &= ~(mask << bits); // not strictly necessary; mostly for debugging 45| | 46| 215k| if (bits == 0) { ------------------ | Branch (46:17): [True: 107k, False: 107k] ------------------ 47| 107k| if (j < inlen) { ------------------ | Branch (47:21): [True: 107k, False: 15] ------------------ 48| 107k| w = in[j]; 49| 107k| bits = lsb; 50| 107k| j++; 51| 107k| } else { 52| 15| break; // the input vector is exhausted 53| 15| } 54| 107k| } 55| 215k| } 56| 215k| if (b == 8) { // out[i] is filled in ------------------ | Branch (56:13): [True: 215k, False: 0] ------------------ 57| 215k| i++; 58| 215k| } 59| 215k| } 60| 15|} oqs_kem_efrodokem_1344_shake_unpack: 64| 20|{ // Unpack the input char vector into a uint16_t output vector, copying lsb bits 65| | // for each output element from input. outlen must be at least ceil(inlen * 8 / lsb). 66| 20| memset(out, 0, outlen * sizeof(uint16_t)); 67| | 68| 20| size_t i = 0; // whole uint16_t already filled in 69| 20| size_t j = 0; // whole bytes already copied 70| 20| unsigned char w = 0; // the leftover, not yet copied 71| 20| unsigned char bits = 0; // the number of lsb bits of w 72| | 73| 161k| while (i < outlen && (j < inlen || ((j == inlen) && (bits > 0)))) { ------------------ | Branch (73:12): [True: 161k, False: 20] | Branch (73:27): [True: 161k, False: 0] | Branch (73:41): [True: 0, False: 0] | Branch (73:57): [True: 0, False: 0] ------------------ 74| | /* 75| | in: | | | | | | |**|**|... 76| | ^ 77| | j 78| | w : | *| 79| | ^ 80| | bits 81| | out:| *****| *****| *** | |... 82| | ^ ^ 83| | i b 84| | */ 85| 161k| unsigned char b = 0; // bits in out[i] already filled in 86| 484k| while (b < lsb) { ------------------ | Branch (86:16): [True: 323k, False: 161k] ------------------ 87| 323k| int nbits = min(lsb - b, bits); ------------------ | | 11| 323k|#define min(x, y) (((x) < (y)) ? (x) : (y)) | | ------------------ | | | Branch (11:20): [True: 0, False: 323k] | | ------------------ ------------------ 88| 323k| uint16_t mask = (1 << nbits) - 1; 89| 323k| unsigned char t = (w >> (bits - nbits)) & mask; // the bits to copy from w to out 90| 323k| out[i] = out[i] + (t << (lsb - b - nbits)); 91| 323k| b += nbits; 92| 323k| bits -= nbits; 93| 323k| w &= ~(mask << bits); // not strictly necessary; mostly for debugging 94| | 95| 323k| if (bits == 0) { ------------------ | Branch (95:17): [True: 323k, False: 0] ------------------ 96| 323k| if (j < inlen) { ------------------ | Branch (96:21): [True: 323k, False: 20] ------------------ 97| 323k| w = in[j]; 98| 323k| bits = 8; 99| 323k| j++; 100| 323k| } else { 101| 20| break; // the input vector is exhausted 102| 20| } 103| 323k| } 104| 323k| } 105| 161k| if (b == lsb) { // out[i] is filled in ------------------ | Branch (105:13): [True: 161k, False: 0] ------------------ 106| 161k| i++; 107| 161k| } 108| 161k| } 109| 20|} oqs_kem_efrodokem_1344_shake_ct_verify: 113| 10|{ // Compare two arrays in constant time. 114| | // Returns 0 if the byte arrays are equal, -1 otherwise. 115| 10| uint16_t r = 0; 116| | 117| 54.0k| for (size_t i = 0; i < len; i++) { ------------------ | Branch (117:24): [True: 54.0k, False: 10] ------------------ 118| 54.0k| r |= a[i] ^ b[i]; 119| 54.0k| } 120| | 121| 10| r = (-(int16_t)(r >> 1) | -(int16_t)(r & 1)) >> (8*sizeof(uint16_t)-1); 122| 10| return (int8_t)r; 123| 10|} oqs_kem_efrodokem_1344_shake_ct_select: 127| 5|{ // Select one of the two input arrays to be moved to r 128| | // If (selector == 0) then load r with a, else if (selector == -1) load r with b 129| 5| OQS_MEM_BLACK_BOX(selector); ------------------ | | 58| 5| do { \ | | 59| 5| __asm__ volatile("" : "+r"(v) :); \ | | 60| 5| } while (0) | | ------------------ | | | Branch (60:14): [Folded, False: 5] | | ------------------ ------------------ 130| 165| for (size_t i = 0; i < len; i++) { ------------------ | Branch (130:24): [True: 160, False: 5] ------------------ 131| 160| r[i] = (~selector & a[i]) | (selector & b[i]); 132| 160| } 133| 5|} OQS_KEM_efrodokem_1344_aes_new: 9| 8|OQS_KEM *OQS_KEM_efrodokem_1344_aes_new(void) { 10| | 11| 8| OQS_KEM *kem = OQS_MEM_calloc(1, sizeof(OQS_KEM)); 12| 8| if (kem == NULL) { ------------------ | Branch (12:6): [True: 0, False: 8] ------------------ 13| 0| return NULL; 14| 0| } 15| 8| kem->method_name = OQS_KEM_alg_efrodokem_1344_aes; ------------------ | | 115| 8|#define OQS_KEM_alg_efrodokem_1344_aes "eFrodoKEM-1344-AES" ------------------ 16| 8| kem->alg_version = "https://github.com/microsoft/PQCrypto-LWEKE/commit/a2f9dec8917ccc3464b3378d46b140fa7353320d"; 17| | 18| 8| kem->claimed_nist_level = 5; 19| 8| kem->ind_cca = true; 20| | 21| 8| kem->length_public_key = OQS_KEM_efrodokem_1344_aes_length_public_key; ------------------ | | 159| 8|#define OQS_KEM_efrodokem_1344_aes_length_public_key 21520 ------------------ 22| 8| kem->length_secret_key = OQS_KEM_efrodokem_1344_aes_length_secret_key; ------------------ | | 160| 8|#define OQS_KEM_efrodokem_1344_aes_length_secret_key 43088 ------------------ 23| 8| kem->length_ciphertext = OQS_KEM_efrodokem_1344_aes_length_ciphertext; ------------------ | | 161| 8|#define OQS_KEM_efrodokem_1344_aes_length_ciphertext 21632 ------------------ 24| 8| kem->length_shared_secret = OQS_KEM_efrodokem_1344_aes_length_shared_secret; ------------------ | | 162| 8|#define OQS_KEM_efrodokem_1344_aes_length_shared_secret 32 ------------------ 25| 8| kem->length_keypair_seed = OQS_KEM_efrodokem_1344_aes_length_keypair_seed; ------------------ | | 163| 8|#define OQS_KEM_efrodokem_1344_aes_length_keypair_seed 0 ------------------ 26| 8| kem->length_encaps_seed = OQS_KEM_efrodokem_1344_aes_length_encaps_seed; ------------------ | | 164| 8|#define OQS_KEM_efrodokem_1344_aes_length_encaps_seed 0 ------------------ 27| | 28| 8| kem->keypair = OQS_KEM_efrodokem_1344_aes_keypair; 29| 8| kem->keypair_derand = OQS_KEM_efrodokem_1344_aes_keypair_derand; 30| 8| kem->encaps = OQS_KEM_efrodokem_1344_aes_encaps; 31| 8| kem->encaps_derand = OQS_KEM_efrodokem_1344_aes_encaps_derand; 32| 8| kem->decaps = OQS_KEM_efrodokem_1344_aes_decaps; 33| | 34| 8| return kem; 35| 8|} OQS_KEM_efrodokem_1344_shake_new: 9| 5|OQS_KEM *OQS_KEM_efrodokem_1344_shake_new(void) { 10| | 11| 5| OQS_KEM *kem = OQS_MEM_calloc(1, sizeof(OQS_KEM)); 12| 5| if (kem == NULL) { ------------------ | Branch (12:6): [True: 0, False: 5] ------------------ 13| 0| return NULL; 14| 0| } 15| 5| kem->method_name = OQS_KEM_alg_efrodokem_1344_shake; ------------------ | | 117| 5|#define OQS_KEM_alg_efrodokem_1344_shake "eFrodoKEM-1344-SHAKE" ------------------ 16| 5| kem->alg_version = "https://github.com/microsoft/PQCrypto-LWEKE/commit/a2f9dec8917ccc3464b3378d46b140fa7353320d"; 17| | 18| 5| kem->claimed_nist_level = 5; 19| 5| kem->ind_cca = true; 20| | 21| 5| kem->length_public_key = OQS_KEM_efrodokem_1344_shake_length_public_key; ------------------ | | 174| 5|#define OQS_KEM_efrodokem_1344_shake_length_public_key 21520 ------------------ 22| 5| kem->length_secret_key = OQS_KEM_efrodokem_1344_shake_length_secret_key; ------------------ | | 175| 5|#define OQS_KEM_efrodokem_1344_shake_length_secret_key 43088 ------------------ 23| 5| kem->length_ciphertext = OQS_KEM_efrodokem_1344_shake_length_ciphertext; ------------------ | | 176| 5|#define OQS_KEM_efrodokem_1344_shake_length_ciphertext 21632 ------------------ 24| 5| kem->length_shared_secret = OQS_KEM_efrodokem_1344_shake_length_shared_secret; ------------------ | | 177| 5|#define OQS_KEM_efrodokem_1344_shake_length_shared_secret 32 ------------------ 25| 5| kem->length_keypair_seed = OQS_KEM_efrodokem_1344_shake_length_keypair_seed; ------------------ | | 178| 5|#define OQS_KEM_efrodokem_1344_shake_length_keypair_seed 0 ------------------ 26| 5| kem->length_encaps_seed = OQS_KEM_efrodokem_1344_shake_length_encaps_seed; ------------------ | | 179| 5|#define OQS_KEM_efrodokem_1344_shake_length_encaps_seed 0 ------------------ 27| | 28| 5| kem->keypair = OQS_KEM_efrodokem_1344_shake_keypair; 29| 5| kem->keypair_derand = OQS_KEM_efrodokem_1344_shake_keypair_derand; 30| 5| kem->encaps = OQS_KEM_efrodokem_1344_shake_encaps; 31| 5| kem->encaps_derand = OQS_KEM_efrodokem_1344_shake_encaps_derand; 32| 5| kem->decaps = OQS_KEM_efrodokem_1344_shake_decaps; 33| | 34| 5| return kem; 35| 5|} OQS_KEM_efrodokem_640_aes_new: 9| 4|OQS_KEM *OQS_KEM_efrodokem_640_aes_new(void) { 10| | 11| 4| OQS_KEM *kem = OQS_MEM_calloc(1, sizeof(OQS_KEM)); 12| 4| if (kem == NULL) { ------------------ | Branch (12:6): [True: 0, False: 4] ------------------ 13| 0| return NULL; 14| 0| } 15| 4| kem->method_name = OQS_KEM_alg_efrodokem_640_aes; ------------------ | | 107| 4|#define OQS_KEM_alg_efrodokem_640_aes "eFrodoKEM-640-AES" ------------------ 16| 4| kem->alg_version = "https://github.com/microsoft/PQCrypto-LWEKE/commit/a2f9dec8917ccc3464b3378d46b140fa7353320d"; 17| | 18| 4| kem->claimed_nist_level = 1; 19| 4| kem->ind_cca = true; 20| | 21| 4| kem->length_public_key = OQS_KEM_efrodokem_640_aes_length_public_key; ------------------ | | 99| 4|#define OQS_KEM_efrodokem_640_aes_length_public_key 9616 ------------------ 22| 4| kem->length_secret_key = OQS_KEM_efrodokem_640_aes_length_secret_key; ------------------ | | 100| 4|#define OQS_KEM_efrodokem_640_aes_length_secret_key 19888 ------------------ 23| 4| kem->length_ciphertext = OQS_KEM_efrodokem_640_aes_length_ciphertext; ------------------ | | 101| 4|#define OQS_KEM_efrodokem_640_aes_length_ciphertext 9720 ------------------ 24| 4| kem->length_shared_secret = OQS_KEM_efrodokem_640_aes_length_shared_secret; ------------------ | | 102| 4|#define OQS_KEM_efrodokem_640_aes_length_shared_secret 16 ------------------ 25| 4| kem->length_keypair_seed = OQS_KEM_efrodokem_640_aes_length_keypair_seed; ------------------ | | 103| 4|#define OQS_KEM_efrodokem_640_aes_length_keypair_seed 0 ------------------ 26| 4| kem->length_encaps_seed = OQS_KEM_efrodokem_640_aes_length_encaps_seed; ------------------ | | 104| 4|#define OQS_KEM_efrodokem_640_aes_length_encaps_seed 0 ------------------ 27| | 28| 4| kem->keypair = OQS_KEM_efrodokem_640_aes_keypair; 29| 4| kem->keypair_derand = OQS_KEM_efrodokem_640_aes_keypair_derand; 30| 4| kem->encaps = OQS_KEM_efrodokem_640_aes_encaps; 31| 4| kem->encaps_derand = OQS_KEM_efrodokem_640_aes_encaps_derand; 32| 4| kem->decaps = OQS_KEM_efrodokem_640_aes_decaps; 33| | 34| 4| return kem; 35| 4|} OQS_KEM_efrodokem_640_shake_new: 9| 2|OQS_KEM *OQS_KEM_efrodokem_640_shake_new(void) { 10| | 11| 2| OQS_KEM *kem = OQS_MEM_calloc(1, sizeof(OQS_KEM)); 12| 2| if (kem == NULL) { ------------------ | Branch (12:6): [True: 0, False: 2] ------------------ 13| 0| return NULL; 14| 0| } 15| 2| kem->method_name = OQS_KEM_alg_efrodokem_640_shake; ------------------ | | 109| 2|#define OQS_KEM_alg_efrodokem_640_shake "eFrodoKEM-640-SHAKE" ------------------ 16| 2| kem->alg_version = "https://github.com/microsoft/PQCrypto-LWEKE/commit/a2f9dec8917ccc3464b3378d46b140fa7353320d"; 17| | 18| 2| kem->claimed_nist_level = 1; 19| 2| kem->ind_cca = true; 20| | 21| 2| kem->length_public_key = OQS_KEM_efrodokem_640_shake_length_public_key; ------------------ | | 114| 2|#define OQS_KEM_efrodokem_640_shake_length_public_key 9616 ------------------ 22| 2| kem->length_secret_key = OQS_KEM_efrodokem_640_shake_length_secret_key; ------------------ | | 115| 2|#define OQS_KEM_efrodokem_640_shake_length_secret_key 19888 ------------------ 23| 2| kem->length_ciphertext = OQS_KEM_efrodokem_640_shake_length_ciphertext; ------------------ | | 116| 2|#define OQS_KEM_efrodokem_640_shake_length_ciphertext 9720 ------------------ 24| 2| kem->length_shared_secret = OQS_KEM_efrodokem_640_shake_length_shared_secret; ------------------ | | 117| 2|#define OQS_KEM_efrodokem_640_shake_length_shared_secret 16 ------------------ 25| 2| kem->length_keypair_seed = OQS_KEM_efrodokem_640_shake_length_keypair_seed; ------------------ | | 118| 2|#define OQS_KEM_efrodokem_640_shake_length_keypair_seed 0 ------------------ 26| 2| kem->length_encaps_seed = OQS_KEM_efrodokem_640_shake_length_encaps_seed; ------------------ | | 119| 2|#define OQS_KEM_efrodokem_640_shake_length_encaps_seed 0 ------------------ 27| | 28| 2| kem->keypair = OQS_KEM_efrodokem_640_shake_keypair; 29| 2| kem->keypair_derand = OQS_KEM_efrodokem_640_shake_keypair_derand; 30| 2| kem->encaps = OQS_KEM_efrodokem_640_shake_encaps; 31| 2| kem->encaps_derand = OQS_KEM_efrodokem_640_shake_encaps_derand; 32| 2| kem->decaps = OQS_KEM_efrodokem_640_shake_decaps; 33| | 34| 2| return kem; 35| 2|} OQS_KEM_efrodokem_976_aes_new: 9| 12|OQS_KEM *OQS_KEM_efrodokem_976_aes_new(void) { 10| | 11| 12| OQS_KEM *kem = OQS_MEM_calloc(1, sizeof(OQS_KEM)); 12| 12| if (kem == NULL) { ------------------ | Branch (12:6): [True: 0, False: 12] ------------------ 13| 0| return NULL; 14| 0| } 15| 12| kem->method_name = OQS_KEM_alg_efrodokem_976_aes; ------------------ | | 111| 12|#define OQS_KEM_alg_efrodokem_976_aes "eFrodoKEM-976-AES" ------------------ 16| 12| kem->alg_version = "https://github.com/microsoft/PQCrypto-LWEKE/commit/a2f9dec8917ccc3464b3378d46b140fa7353320d"; 17| | 18| 12| kem->claimed_nist_level = 3; 19| 12| kem->ind_cca = true; 20| | 21| 12| kem->length_public_key = OQS_KEM_efrodokem_976_aes_length_public_key; ------------------ | | 129| 12|#define OQS_KEM_efrodokem_976_aes_length_public_key 15632 ------------------ 22| 12| kem->length_secret_key = OQS_KEM_efrodokem_976_aes_length_secret_key; ------------------ | | 130| 12|#define OQS_KEM_efrodokem_976_aes_length_secret_key 31296 ------------------ 23| 12| kem->length_ciphertext = OQS_KEM_efrodokem_976_aes_length_ciphertext; ------------------ | | 131| 12|#define OQS_KEM_efrodokem_976_aes_length_ciphertext 15744 ------------------ 24| 12| kem->length_shared_secret = OQS_KEM_efrodokem_976_aes_length_shared_secret; ------------------ | | 132| 12|#define OQS_KEM_efrodokem_976_aes_length_shared_secret 24 ------------------ 25| 12| kem->length_keypair_seed = OQS_KEM_efrodokem_976_aes_length_keypair_seed; ------------------ | | 133| 12|#define OQS_KEM_efrodokem_976_aes_length_keypair_seed 0 ------------------ 26| 12| kem->length_encaps_seed = OQS_KEM_efrodokem_976_aes_length_encaps_seed; ------------------ | | 134| 12|#define OQS_KEM_efrodokem_976_aes_length_encaps_seed 0 ------------------ 27| | 28| 12| kem->keypair = OQS_KEM_efrodokem_976_aes_keypair; 29| 12| kem->keypair_derand = OQS_KEM_efrodokem_976_aes_keypair_derand; 30| 12| kem->encaps = OQS_KEM_efrodokem_976_aes_encaps; 31| 12| kem->encaps_derand = OQS_KEM_efrodokem_976_aes_encaps_derand; 32| 12| kem->decaps = OQS_KEM_efrodokem_976_aes_decaps; 33| | 34| 12| return kem; 35| 12|} OQS_KEM_efrodokem_976_shake_new: 9| 12|OQS_KEM *OQS_KEM_efrodokem_976_shake_new(void) { 10| | 11| 12| OQS_KEM *kem = OQS_MEM_calloc(1, sizeof(OQS_KEM)); 12| 12| if (kem == NULL) { ------------------ | Branch (12:6): [True: 0, False: 12] ------------------ 13| 0| return NULL; 14| 0| } 15| 12| kem->method_name = OQS_KEM_alg_efrodokem_976_shake; ------------------ | | 113| 12|#define OQS_KEM_alg_efrodokem_976_shake "eFrodoKEM-976-SHAKE" ------------------ 16| 12| kem->alg_version = "https://github.com/microsoft/PQCrypto-LWEKE/commit/a2f9dec8917ccc3464b3378d46b140fa7353320d"; 17| | 18| 12| kem->claimed_nist_level = 3; 19| 12| kem->ind_cca = true; 20| | 21| 12| kem->length_public_key = OQS_KEM_efrodokem_976_shake_length_public_key; ------------------ | | 144| 12|#define OQS_KEM_efrodokem_976_shake_length_public_key 15632 ------------------ 22| 12| kem->length_secret_key = OQS_KEM_efrodokem_976_shake_length_secret_key; ------------------ | | 145| 12|#define OQS_KEM_efrodokem_976_shake_length_secret_key 31296 ------------------ 23| 12| kem->length_ciphertext = OQS_KEM_efrodokem_976_shake_length_ciphertext; ------------------ | | 146| 12|#define OQS_KEM_efrodokem_976_shake_length_ciphertext 15744 ------------------ 24| 12| kem->length_shared_secret = OQS_KEM_efrodokem_976_shake_length_shared_secret; ------------------ | | 147| 12|#define OQS_KEM_efrodokem_976_shake_length_shared_secret 24 ------------------ 25| 12| kem->length_keypair_seed = OQS_KEM_efrodokem_976_shake_length_keypair_seed; ------------------ | | 148| 12|#define OQS_KEM_efrodokem_976_shake_length_keypair_seed 0 ------------------ 26| 12| kem->length_encaps_seed = OQS_KEM_efrodokem_976_shake_length_encaps_seed; ------------------ | | 149| 12|#define OQS_KEM_efrodokem_976_shake_length_encaps_seed 0 ------------------ 27| | 28| 12| kem->keypair = OQS_KEM_efrodokem_976_shake_keypair; 29| 12| kem->keypair_derand = OQS_KEM_efrodokem_976_shake_keypair_derand; 30| 12| kem->encaps = OQS_KEM_efrodokem_976_shake_encaps; 31| 12| kem->encaps_derand = OQS_KEM_efrodokem_976_shake_encaps_derand; 32| 12| kem->decaps = OQS_KEM_efrodokem_976_shake_decaps; 33| | 34| 12| return kem; 35| 12|} OQS_KEM_frodokem_1344_aes_new: 9| 8|OQS_KEM *OQS_KEM_frodokem_1344_aes_new(void) { 10| | 11| 8| OQS_KEM *kem = OQS_MEM_calloc(1, sizeof(OQS_KEM)); 12| 8| if (kem == NULL) { ------------------ | Branch (12:6): [True: 0, False: 8] ------------------ 13| 0| return NULL; 14| 0| } 15| 8| kem->method_name = OQS_KEM_alg_frodokem_1344_aes; ------------------ | | 103| 8|#define OQS_KEM_alg_frodokem_1344_aes "FrodoKEM-1344-AES" ------------------ 16| 8| kem->alg_version = "https://github.com/microsoft/PQCrypto-LWEKE/commit/a2f9dec8917ccc3464b3378d46b140fa7353320d"; 17| | 18| 8| kem->claimed_nist_level = 5; 19| 8| kem->ind_cca = true; 20| | 21| 8| kem->length_public_key = OQS_KEM_frodokem_1344_aes_length_public_key; ------------------ | | 69| 8|#define OQS_KEM_frodokem_1344_aes_length_public_key 21520 ------------------ 22| 8| kem->length_secret_key = OQS_KEM_frodokem_1344_aes_length_secret_key; ------------------ | | 70| 8|#define OQS_KEM_frodokem_1344_aes_length_secret_key 43088 ------------------ 23| 8| kem->length_ciphertext = OQS_KEM_frodokem_1344_aes_length_ciphertext; ------------------ | | 71| 8|#define OQS_KEM_frodokem_1344_aes_length_ciphertext 21696 ------------------ 24| 8| kem->length_shared_secret = OQS_KEM_frodokem_1344_aes_length_shared_secret; ------------------ | | 72| 8|#define OQS_KEM_frodokem_1344_aes_length_shared_secret 32 ------------------ 25| 8| kem->length_keypair_seed = OQS_KEM_frodokem_1344_aes_length_keypair_seed; ------------------ | | 73| 8|#define OQS_KEM_frodokem_1344_aes_length_keypair_seed 0 ------------------ 26| 8| kem->length_encaps_seed = OQS_KEM_frodokem_1344_aes_length_encaps_seed; ------------------ | | 74| 8|#define OQS_KEM_frodokem_1344_aes_length_encaps_seed 0 ------------------ 27| | 28| 8| kem->keypair = OQS_KEM_frodokem_1344_aes_keypair; 29| 8| kem->keypair_derand = OQS_KEM_frodokem_1344_aes_keypair_derand; 30| 8| kem->encaps = OQS_KEM_frodokem_1344_aes_encaps; 31| 8| kem->encaps_derand = OQS_KEM_frodokem_1344_aes_encaps_derand; 32| 8| kem->decaps = OQS_KEM_frodokem_1344_aes_decaps; 33| | 34| 8| return kem; 35| 8|} OQS_KEM_frodokem_1344_shake_new: 9| 9|OQS_KEM *OQS_KEM_frodokem_1344_shake_new(void) { 10| | 11| 9| OQS_KEM *kem = OQS_MEM_calloc(1, sizeof(OQS_KEM)); 12| 9| if (kem == NULL) { ------------------ | Branch (12:6): [True: 0, False: 9] ------------------ 13| 0| return NULL; 14| 0| } 15| 9| kem->method_name = OQS_KEM_alg_frodokem_1344_shake; ------------------ | | 105| 9|#define OQS_KEM_alg_frodokem_1344_shake "FrodoKEM-1344-SHAKE" ------------------ 16| 9| kem->alg_version = "https://github.com/microsoft/PQCrypto-LWEKE/commit/a2f9dec8917ccc3464b3378d46b140fa7353320d"; 17| | 18| 9| kem->claimed_nist_level = 5; 19| 9| kem->ind_cca = true; 20| | 21| 9| kem->length_public_key = OQS_KEM_frodokem_1344_shake_length_public_key; ------------------ | | 84| 9|#define OQS_KEM_frodokem_1344_shake_length_public_key 21520 ------------------ 22| 9| kem->length_secret_key = OQS_KEM_frodokem_1344_shake_length_secret_key; ------------------ | | 85| 9|#define OQS_KEM_frodokem_1344_shake_length_secret_key 43088 ------------------ 23| 9| kem->length_ciphertext = OQS_KEM_frodokem_1344_shake_length_ciphertext; ------------------ | | 86| 9|#define OQS_KEM_frodokem_1344_shake_length_ciphertext 21696 ------------------ 24| 9| kem->length_shared_secret = OQS_KEM_frodokem_1344_shake_length_shared_secret; ------------------ | | 87| 9|#define OQS_KEM_frodokem_1344_shake_length_shared_secret 32 ------------------ 25| 9| kem->length_keypair_seed = OQS_KEM_frodokem_1344_shake_length_keypair_seed; ------------------ | | 88| 9|#define OQS_KEM_frodokem_1344_shake_length_keypair_seed 0 ------------------ 26| 9| kem->length_encaps_seed = OQS_KEM_frodokem_1344_shake_length_encaps_seed; ------------------ | | 89| 9|#define OQS_KEM_frodokem_1344_shake_length_encaps_seed 0 ------------------ 27| | 28| 9| kem->keypair = OQS_KEM_frodokem_1344_shake_keypair; 29| 9| kem->keypair_derand = OQS_KEM_frodokem_1344_shake_keypair_derand; 30| 9| kem->encaps = OQS_KEM_frodokem_1344_shake_encaps; 31| 9| kem->encaps_derand = OQS_KEM_frodokem_1344_shake_encaps_derand; 32| 9| kem->decaps = OQS_KEM_frodokem_1344_shake_decaps; 33| | 34| 9| return kem; 35| 9|} OQS_KEM_frodokem_640_aes_new: 9| 2|OQS_KEM *OQS_KEM_frodokem_640_aes_new(void) { 10| | 11| 2| OQS_KEM *kem = OQS_MEM_calloc(1, sizeof(OQS_KEM)); 12| 2| if (kem == NULL) { ------------------ | Branch (12:6): [True: 0, False: 2] ------------------ 13| 0| return NULL; 14| 0| } 15| 2| kem->method_name = OQS_KEM_alg_frodokem_640_aes; ------------------ | | 95| 2|#define OQS_KEM_alg_frodokem_640_aes "FrodoKEM-640-AES" ------------------ 16| 2| kem->alg_version = "https://github.com/microsoft/PQCrypto-LWEKE/commit/a2f9dec8917ccc3464b3378d46b140fa7353320d"; 17| | 18| 2| kem->claimed_nist_level = 1; 19| 2| kem->ind_cca = true; 20| | 21| 2| kem->length_public_key = OQS_KEM_frodokem_640_aes_length_public_key; ------------------ | | 9| 2|#define OQS_KEM_frodokem_640_aes_length_public_key 9616 ------------------ 22| 2| kem->length_secret_key = OQS_KEM_frodokem_640_aes_length_secret_key; ------------------ | | 10| 2|#define OQS_KEM_frodokem_640_aes_length_secret_key 19888 ------------------ 23| 2| kem->length_ciphertext = OQS_KEM_frodokem_640_aes_length_ciphertext; ------------------ | | 11| 2|#define OQS_KEM_frodokem_640_aes_length_ciphertext 9752 ------------------ 24| 2| kem->length_shared_secret = OQS_KEM_frodokem_640_aes_length_shared_secret; ------------------ | | 12| 2|#define OQS_KEM_frodokem_640_aes_length_shared_secret 16 ------------------ 25| 2| kem->length_keypair_seed = OQS_KEM_frodokem_640_aes_length_keypair_seed; ------------------ | | 13| 2|#define OQS_KEM_frodokem_640_aes_length_keypair_seed 0 ------------------ 26| 2| kem->length_encaps_seed = OQS_KEM_frodokem_640_aes_length_encaps_seed; ------------------ | | 14| 2|#define OQS_KEM_frodokem_640_aes_length_encaps_seed 0 ------------------ 27| | 28| 2| kem->keypair = OQS_KEM_frodokem_640_aes_keypair; 29| 2| kem->keypair_derand = OQS_KEM_frodokem_640_aes_keypair_derand; 30| 2| kem->encaps = OQS_KEM_frodokem_640_aes_encaps; 31| 2| kem->encaps_derand = OQS_KEM_frodokem_640_aes_encaps_derand; 32| 2| kem->decaps = OQS_KEM_frodokem_640_aes_decaps; 33| | 34| 2| return kem; 35| 2|} OQS_KEM_frodokem_640_shake_new: 9| 3|OQS_KEM *OQS_KEM_frodokem_640_shake_new(void) { 10| | 11| 3| OQS_KEM *kem = OQS_MEM_calloc(1, sizeof(OQS_KEM)); 12| 3| if (kem == NULL) { ------------------ | Branch (12:6): [True: 0, False: 3] ------------------ 13| 0| return NULL; 14| 0| } 15| 3| kem->method_name = OQS_KEM_alg_frodokem_640_shake; ------------------ | | 97| 3|#define OQS_KEM_alg_frodokem_640_shake "FrodoKEM-640-SHAKE" ------------------ 16| 3| kem->alg_version = "https://github.com/microsoft/PQCrypto-LWEKE/commit/a2f9dec8917ccc3464b3378d46b140fa7353320d"; 17| | 18| 3| kem->claimed_nist_level = 1; 19| 3| kem->ind_cca = true; 20| | 21| 3| kem->length_public_key = OQS_KEM_frodokem_640_shake_length_public_key; ------------------ | | 24| 3|#define OQS_KEM_frodokem_640_shake_length_public_key 9616 ------------------ 22| 3| kem->length_secret_key = OQS_KEM_frodokem_640_shake_length_secret_key; ------------------ | | 25| 3|#define OQS_KEM_frodokem_640_shake_length_secret_key 19888 ------------------ 23| 3| kem->length_ciphertext = OQS_KEM_frodokem_640_shake_length_ciphertext; ------------------ | | 26| 3|#define OQS_KEM_frodokem_640_shake_length_ciphertext 9752 ------------------ 24| 3| kem->length_shared_secret = OQS_KEM_frodokem_640_shake_length_shared_secret; ------------------ | | 27| 3|#define OQS_KEM_frodokem_640_shake_length_shared_secret 16 ------------------ 25| 3| kem->length_keypair_seed = OQS_KEM_frodokem_640_shake_length_keypair_seed; ------------------ | | 28| 3|#define OQS_KEM_frodokem_640_shake_length_keypair_seed 0 ------------------ 26| 3| kem->length_encaps_seed = OQS_KEM_frodokem_640_shake_length_encaps_seed; ------------------ | | 29| 3|#define OQS_KEM_frodokem_640_shake_length_encaps_seed 0 ------------------ 27| | 28| 3| kem->keypair = OQS_KEM_frodokem_640_shake_keypair; 29| 3| kem->keypair_derand = OQS_KEM_frodokem_640_shake_keypair_derand; 30| 3| kem->encaps = OQS_KEM_frodokem_640_shake_encaps; 31| 3| kem->encaps_derand = OQS_KEM_frodokem_640_shake_encaps_derand; 32| 3| kem->decaps = OQS_KEM_frodokem_640_shake_decaps; 33| | 34| 3| return kem; 35| 3|} OQS_KEM_frodokem_976_aes_new: 9| 15|OQS_KEM *OQS_KEM_frodokem_976_aes_new(void) { 10| | 11| 15| OQS_KEM *kem = OQS_MEM_calloc(1, sizeof(OQS_KEM)); 12| 15| if (kem == NULL) { ------------------ | Branch (12:6): [True: 0, False: 15] ------------------ 13| 0| return NULL; 14| 0| } 15| 15| kem->method_name = OQS_KEM_alg_frodokem_976_aes; ------------------ | | 99| 15|#define OQS_KEM_alg_frodokem_976_aes "FrodoKEM-976-AES" ------------------ 16| 15| kem->alg_version = "https://github.com/microsoft/PQCrypto-LWEKE/commit/a2f9dec8917ccc3464b3378d46b140fa7353320d"; 17| | 18| 15| kem->claimed_nist_level = 3; 19| 15| kem->ind_cca = true; 20| | 21| 15| kem->length_public_key = OQS_KEM_frodokem_976_aes_length_public_key; ------------------ | | 39| 15|#define OQS_KEM_frodokem_976_aes_length_public_key 15632 ------------------ 22| 15| kem->length_secret_key = OQS_KEM_frodokem_976_aes_length_secret_key; ------------------ | | 40| 15|#define OQS_KEM_frodokem_976_aes_length_secret_key 31296 ------------------ 23| 15| kem->length_ciphertext = OQS_KEM_frodokem_976_aes_length_ciphertext; ------------------ | | 41| 15|#define OQS_KEM_frodokem_976_aes_length_ciphertext 15792 ------------------ 24| 15| kem->length_shared_secret = OQS_KEM_frodokem_976_aes_length_shared_secret; ------------------ | | 42| 15|#define OQS_KEM_frodokem_976_aes_length_shared_secret 24 ------------------ 25| 15| kem->length_keypair_seed = OQS_KEM_frodokem_976_aes_length_keypair_seed; ------------------ | | 43| 15|#define OQS_KEM_frodokem_976_aes_length_keypair_seed 0 ------------------ 26| 15| kem->length_encaps_seed = OQS_KEM_frodokem_976_aes_length_encaps_seed; ------------------ | | 44| 15|#define OQS_KEM_frodokem_976_aes_length_encaps_seed 0 ------------------ 27| | 28| 15| kem->keypair = OQS_KEM_frodokem_976_aes_keypair; 29| 15| kem->keypair_derand = OQS_KEM_frodokem_976_aes_keypair_derand; 30| 15| kem->encaps = OQS_KEM_frodokem_976_aes_encaps; 31| 15| kem->encaps_derand = OQS_KEM_frodokem_976_aes_encaps_derand; 32| 15| kem->decaps = OQS_KEM_frodokem_976_aes_decaps; 33| | 34| 15| return kem; 35| 15|} OQS_KEM_frodokem_976_shake_new: 9| 11|OQS_KEM *OQS_KEM_frodokem_976_shake_new(void) { 10| | 11| 11| OQS_KEM *kem = OQS_MEM_calloc(1, sizeof(OQS_KEM)); 12| 11| if (kem == NULL) { ------------------ | Branch (12:6): [True: 0, False: 11] ------------------ 13| 0| return NULL; 14| 0| } 15| 11| kem->method_name = OQS_KEM_alg_frodokem_976_shake; ------------------ | | 101| 11|#define OQS_KEM_alg_frodokem_976_shake "FrodoKEM-976-SHAKE" ------------------ 16| 11| kem->alg_version = "https://github.com/microsoft/PQCrypto-LWEKE/commit/a2f9dec8917ccc3464b3378d46b140fa7353320d"; 17| | 18| 11| kem->claimed_nist_level = 3; 19| 11| kem->ind_cca = true; 20| | 21| 11| kem->length_public_key = OQS_KEM_frodokem_976_shake_length_public_key; ------------------ | | 54| 11|#define OQS_KEM_frodokem_976_shake_length_public_key 15632 ------------------ 22| 11| kem->length_secret_key = OQS_KEM_frodokem_976_shake_length_secret_key; ------------------ | | 55| 11|#define OQS_KEM_frodokem_976_shake_length_secret_key 31296 ------------------ 23| 11| kem->length_ciphertext = OQS_KEM_frodokem_976_shake_length_ciphertext; ------------------ | | 56| 11|#define OQS_KEM_frodokem_976_shake_length_ciphertext 15792 ------------------ 24| 11| kem->length_shared_secret = OQS_KEM_frodokem_976_shake_length_shared_secret; ------------------ | | 57| 11|#define OQS_KEM_frodokem_976_shake_length_shared_secret 24 ------------------ 25| 11| kem->length_keypair_seed = OQS_KEM_frodokem_976_shake_length_keypair_seed; ------------------ | | 58| 11|#define OQS_KEM_frodokem_976_shake_length_keypair_seed 0 ------------------ 26| 11| kem->length_encaps_seed = OQS_KEM_frodokem_976_shake_length_encaps_seed; ------------------ | | 59| 11|#define OQS_KEM_frodokem_976_shake_length_encaps_seed 0 ------------------ 27| | 28| 11| kem->keypair = OQS_KEM_frodokem_976_shake_keypair; 29| 11| kem->keypair_derand = OQS_KEM_frodokem_976_shake_keypair_derand; 30| 11| kem->encaps = OQS_KEM_frodokem_976_shake_encaps; 31| 11| kem->encaps_derand = OQS_KEM_frodokem_976_shake_encaps_derand; 32| 11| kem->decaps = OQS_KEM_frodokem_976_shake_decaps; 33| | 34| 11| return kem; 35| 11|} OQS_KEM_hqc_1_new: 9| 38|OQS_KEM *OQS_KEM_hqc_1_new(void) { 10| | 11| 38| OQS_KEM *kem = OQS_MEM_calloc(1, sizeof(OQS_KEM)); 12| 38| if (kem == NULL) { ------------------ | Branch (12:6): [True: 0, False: 38] ------------------ 13| 0| return NULL; 14| 0| } 15| 38| kem->method_name = OQS_KEM_alg_hqc_1; ------------------ | | 62| 38|#define OQS_KEM_alg_hqc_1 "HQC-1" ------------------ 16| 38| kem->alg_version = "https://gitlab.com/pqc-hqc/hqc@161cd4f"; 17| | 18| 38| kem->claimed_nist_level = 1; 19| 38| kem->ind_cca = true; 20| | 21| 38| kem->length_public_key = OQS_KEM_hqc_1_length_public_key; ------------------ | | 9| 38|#define OQS_KEM_hqc_1_length_public_key 2241 ------------------ 22| 38| kem->length_secret_key = OQS_KEM_hqc_1_length_secret_key; ------------------ | | 10| 38|#define OQS_KEM_hqc_1_length_secret_key 2321 ------------------ 23| 38| kem->length_ciphertext = OQS_KEM_hqc_1_length_ciphertext; ------------------ | | 11| 38|#define OQS_KEM_hqc_1_length_ciphertext 4433 ------------------ 24| 38| kem->length_shared_secret = OQS_KEM_hqc_1_length_shared_secret; ------------------ | | 12| 38|#define OQS_KEM_hqc_1_length_shared_secret 32 ------------------ 25| 38| kem->length_keypair_seed = OQS_KEM_hqc_1_length_keypair_seed; ------------------ | | 13| 38|#define OQS_KEM_hqc_1_length_keypair_seed 0 ------------------ 26| 38| kem->length_encaps_seed = OQS_KEM_hqc_1_length_encaps_seed; ------------------ | | 14| 38|#define OQS_KEM_hqc_1_length_encaps_seed 0 ------------------ 27| | 28| 38| kem->keypair = OQS_KEM_hqc_1_keypair; 29| 38| kem->keypair_derand = OQS_KEM_hqc_1_keypair_derand; 30| 38| kem->encaps = OQS_KEM_hqc_1_encaps; 31| 38| kem->encaps_derand = OQS_KEM_hqc_1_encaps_derand; 32| 38| kem->decaps = OQS_KEM_hqc_1_decaps; 33| | 34| 38| return kem; 35| 38|} OQS_KEM_hqc_1_keypair: 48| 38|OQS_API OQS_STATUS OQS_KEM_hqc_1_keypair(uint8_t *public_key, uint8_t *secret_key) { 49| 38| return (OQS_STATUS) PQCHQC_HQC1_C_crypto_kem_keypair(public_key, secret_key); 50| 38|} OQS_KEM_hqc_1_encaps: 60| 38|OQS_API OQS_STATUS OQS_KEM_hqc_1_encaps(uint8_t *ciphertext, uint8_t *shared_secret, const uint8_t *public_key) { 61| 38| return (OQS_STATUS) PQCHQC_HQC1_C_crypto_kem_enc(ciphertext, shared_secret, public_key); 62| 38|} OQS_KEM_hqc_1_decaps: 64| 38|OQS_API OQS_STATUS OQS_KEM_hqc_1_decaps(uint8_t *shared_secret, const uint8_t *ciphertext, const uint8_t *secret_key) { 65| 38| return (OQS_STATUS) PQCHQC_HQC1_C_crypto_kem_dec(shared_secret, ciphertext, secret_key); 66| 38|} OQS_KEM_hqc_3_new: 9| 44|OQS_KEM *OQS_KEM_hqc_3_new(void) { 10| | 11| 44| OQS_KEM *kem = OQS_MEM_calloc(1, sizeof(OQS_KEM)); 12| 44| if (kem == NULL) { ------------------ | Branch (12:6): [True: 0, False: 44] ------------------ 13| 0| return NULL; 14| 0| } 15| 44| kem->method_name = OQS_KEM_alg_hqc_3; ------------------ | | 64| 44|#define OQS_KEM_alg_hqc_3 "HQC-3" ------------------ 16| 44| kem->alg_version = "https://gitlab.com/pqc-hqc/hqc@161cd4f"; 17| | 18| 44| kem->claimed_nist_level = 3; 19| 44| kem->ind_cca = true; 20| | 21| 44| kem->length_public_key = OQS_KEM_hqc_3_length_public_key; ------------------ | | 24| 44|#define OQS_KEM_hqc_3_length_public_key 4514 ------------------ 22| 44| kem->length_secret_key = OQS_KEM_hqc_3_length_secret_key; ------------------ | | 25| 44|#define OQS_KEM_hqc_3_length_secret_key 4602 ------------------ 23| 44| kem->length_ciphertext = OQS_KEM_hqc_3_length_ciphertext; ------------------ | | 26| 44|#define OQS_KEM_hqc_3_length_ciphertext 8978 ------------------ 24| 44| kem->length_shared_secret = OQS_KEM_hqc_3_length_shared_secret; ------------------ | | 27| 44|#define OQS_KEM_hqc_3_length_shared_secret 32 ------------------ 25| 44| kem->length_keypair_seed = OQS_KEM_hqc_3_length_keypair_seed; ------------------ | | 28| 44|#define OQS_KEM_hqc_3_length_keypair_seed 0 ------------------ 26| 44| kem->length_encaps_seed = OQS_KEM_hqc_3_length_encaps_seed; ------------------ | | 29| 44|#define OQS_KEM_hqc_3_length_encaps_seed 0 ------------------ 27| | 28| 44| kem->keypair = OQS_KEM_hqc_3_keypair; 29| 44| kem->keypair_derand = OQS_KEM_hqc_3_keypair_derand; 30| 44| kem->encaps = OQS_KEM_hqc_3_encaps; 31| 44| kem->encaps_derand = OQS_KEM_hqc_3_encaps_derand; 32| 44| kem->decaps = OQS_KEM_hqc_3_decaps; 33| | 34| 44| return kem; 35| 44|} OQS_KEM_hqc_3_keypair: 48| 44|OQS_API OQS_STATUS OQS_KEM_hqc_3_keypair(uint8_t *public_key, uint8_t *secret_key) { 49| 44| return (OQS_STATUS) PQCHQC_HQC3_C_crypto_kem_keypair(public_key, secret_key); 50| 44|} OQS_KEM_hqc_3_encaps: 60| 44|OQS_API OQS_STATUS OQS_KEM_hqc_3_encaps(uint8_t *ciphertext, uint8_t *shared_secret, const uint8_t *public_key) { 61| 44| return (OQS_STATUS) PQCHQC_HQC3_C_crypto_kem_enc(ciphertext, shared_secret, public_key); 62| 44|} OQS_KEM_hqc_3_decaps: 64| 44|OQS_API OQS_STATUS OQS_KEM_hqc_3_decaps(uint8_t *shared_secret, const uint8_t *ciphertext, const uint8_t *secret_key) { 65| 44| return (OQS_STATUS) PQCHQC_HQC3_C_crypto_kem_dec(shared_secret, ciphertext, secret_key); 66| 44|} OQS_KEM_hqc_5_new: 9| 40|OQS_KEM *OQS_KEM_hqc_5_new(void) { 10| | 11| 40| OQS_KEM *kem = OQS_MEM_calloc(1, sizeof(OQS_KEM)); 12| 40| if (kem == NULL) { ------------------ | Branch (12:6): [True: 0, False: 40] ------------------ 13| 0| return NULL; 14| 0| } 15| 40| kem->method_name = OQS_KEM_alg_hqc_5; ------------------ | | 66| 40|#define OQS_KEM_alg_hqc_5 "HQC-5" ------------------ 16| 40| kem->alg_version = "https://gitlab.com/pqc-hqc/hqc@161cd4f"; 17| | 18| 40| kem->claimed_nist_level = 5; 19| 40| kem->ind_cca = true; 20| | 21| 40| kem->length_public_key = OQS_KEM_hqc_5_length_public_key; ------------------ | | 39| 40|#define OQS_KEM_hqc_5_length_public_key 7237 ------------------ 22| 40| kem->length_secret_key = OQS_KEM_hqc_5_length_secret_key; ------------------ | | 40| 40|#define OQS_KEM_hqc_5_length_secret_key 7333 ------------------ 23| 40| kem->length_ciphertext = OQS_KEM_hqc_5_length_ciphertext; ------------------ | | 41| 40|#define OQS_KEM_hqc_5_length_ciphertext 14421 ------------------ 24| 40| kem->length_shared_secret = OQS_KEM_hqc_5_length_shared_secret; ------------------ | | 42| 40|#define OQS_KEM_hqc_5_length_shared_secret 32 ------------------ 25| 40| kem->length_keypair_seed = OQS_KEM_hqc_5_length_keypair_seed; ------------------ | | 43| 40|#define OQS_KEM_hqc_5_length_keypair_seed 0 ------------------ 26| 40| kem->length_encaps_seed = OQS_KEM_hqc_5_length_encaps_seed; ------------------ | | 44| 40|#define OQS_KEM_hqc_5_length_encaps_seed 0 ------------------ 27| | 28| 40| kem->keypair = OQS_KEM_hqc_5_keypair; 29| 40| kem->keypair_derand = OQS_KEM_hqc_5_keypair_derand; 30| 40| kem->encaps = OQS_KEM_hqc_5_encaps; 31| 40| kem->encaps_derand = OQS_KEM_hqc_5_encaps_derand; 32| 40| kem->decaps = OQS_KEM_hqc_5_decaps; 33| | 34| 40| return kem; 35| 40|} OQS_KEM_hqc_5_keypair: 48| 40|OQS_API OQS_STATUS OQS_KEM_hqc_5_keypair(uint8_t *public_key, uint8_t *secret_key) { 49| 40| return (OQS_STATUS) PQCHQC_HQC5_C_crypto_kem_keypair(public_key, secret_key); 50| 40|} OQS_KEM_hqc_5_encaps: 60| 40|OQS_API OQS_STATUS OQS_KEM_hqc_5_encaps(uint8_t *ciphertext, uint8_t *shared_secret, const uint8_t *public_key) { 61| 40| return (OQS_STATUS) PQCHQC_HQC5_C_crypto_kem_enc(ciphertext, shared_secret, public_key); 62| 40|} OQS_KEM_hqc_5_decaps: 64| 40|OQS_API OQS_STATUS OQS_KEM_hqc_5_decaps(uint8_t *shared_secret, const uint8_t *ciphertext, const uint8_t *secret_key) { 65| 40| return (OQS_STATUS) PQCHQC_HQC5_C_crypto_kem_dec(shared_secret, ciphertext, secret_key); 66| 40|} PQCHQC_HQC1_C_code_encode: 27| 76|void code_encode(uint64_t *em, const uint64_t *m) { 28| 76| uint64_t tmp[VEC_N1_SIZE_64] = {0}; 29| | 30| 76| reed_solomon_encode(tmp, m); ------------------ | | 84| 76|#define reed_solomon_encode PQCHQC_NAMESPACE(reed_solomon_encode) | | ------------------ | | | | 17| 76|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 76|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 76|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 31| 76| reed_muller_encode(em, tmp); ------------------ | | 14| 76|#define reed_muller_encode PQCHQC_NAMESPACE(reed_muller_encode) | | ------------------ | | | | 17| 76|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 76|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 76|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 32| | 33| |#ifdef VERBOSE 34| | printf("\n\nReed-Solomon code word: "); 35| | vect_print(tmp, VEC_N1_SIZE_BYTES); 36| | printf("\n\nConcatenated code word: "); 37| | vect_print(em, VEC_N1N2_SIZE_BYTES); 38| |#endif 39| | // Zeroize sensitive data 40| 76| memset_zero(tmp, sizeof tmp); ------------------ | | 22| 76|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 76|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 76|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 76|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 76|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 41| 76|} PQCHQC_HQC1_C_code_decode: 49| 38|void code_decode(uint64_t *m, const uint64_t *em) { 50| 38| uint64_t tmp[VEC_N1_SIZE_64] = {0}; 51| | 52| 38| reed_muller_decode(tmp, em); ------------------ | | 15| 38|#define reed_muller_decode PQCHQC_NAMESPACE(reed_muller_decode) | | ------------------ | | | | 17| 38|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 38|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 38|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 53| 38| reed_solomon_decode(m, tmp); ------------------ | | 85| 38|#define reed_solomon_decode PQCHQC_NAMESPACE(reed_solomon_decode) | | ------------------ | | | | 17| 38|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 38|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 38|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 54| | 55| |#ifdef VERBOSE 56| | printf("\n\nReed-Muller decoding result (the input for the Reed-Solomon decoding algorithm): "); 57| | vect_print(tmp, VEC_N1_SIZE_BYTES); 58| |#endif 59| | 60| | // Zeroize sensitive data 61| 38| memset_zero(tmp, sizeof tmp); ------------------ | | 22| 38|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 38|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 38|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 38|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 38|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 62| 38|} PQCHQC_HQC1_C_fft: 274| 38|void fft(uint16_t *w, const uint16_t *f, size_t f_coeffs) { 275| 38| uint16_t betas[PARAM_M - 1] = {0}; 276| 38| uint16_t betas_sums[1 << (PARAM_M - 1)] = {0}; 277| 38| uint16_t f0[1 << (PARAM_FFT - 1)] = {0}; 278| 38| uint16_t f1[1 << (PARAM_FFT - 1)] = {0}; 279| 38| uint16_t deltas[PARAM_M - 1] = {0}; 280| 38| uint16_t u[1 << (PARAM_M - 1)] = {0}; 281| 38| uint16_t v[1 << (PARAM_M - 1)] = {0}; 282| | 283| 38| size_t i, k; 284| | 285| | // Follows Gao and Mateer algorithm 286| 38| compute_fft_betas(betas); 287| | 288| | // Step 1: PARAM_FFT > 1, nothing to do 289| | 290| | // Compute gammas sums 291| 38| compute_subset_sums(betas_sums, betas, PARAM_M - 1); ------------------ | | 41| 38|#define PARAM_M 8 ///< Define the degree m of the Galois field GF(2^m) ------------------ 292| | 293| | // Step 2: beta_m = 1, nothing to do 294| | 295| | // Step 3 296| 38| radix(f0, f1, f, PARAM_FFT); ------------------ | | 46| 38|#define PARAM_FFT 4 ///< Exponent for additive FFT (2^PARAM_FFT points) ------------------ 297| | 298| | // Step 4: Compute deltas 299| 304| for (i = 0; i < PARAM_M - 1; ++i) { ------------------ | | 41| 304|#define PARAM_M 8 ///< Define the degree m of the Galois field GF(2^m) ------------------ | Branch (299:17): [True: 266, False: 38] ------------------ 300| 266| deltas[i] = gf_square(betas[i]) ^ betas[i]; ------------------ | | 52| 266|#define gf_square PQCHQC_NAMESPACE(gf_square) | | ------------------ | | | | 17| 266|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 266|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 266|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 301| 266| } 302| | 303| | // Step 5 304| 38| fft_rec(u, f0, (f_coeffs + 1) / 2, PARAM_M - 1, PARAM_FFT - 1, deltas); ------------------ | | 41| 38|#define PARAM_M 8 ///< Define the degree m of the Galois field GF(2^m) ------------------ fft_rec(u, f0, (f_coeffs + 1) / 2, PARAM_M - 1, PARAM_FFT - 1, deltas); ------------------ | | 46| 38|#define PARAM_FFT 4 ///< Exponent for additive FFT (2^PARAM_FFT points) ------------------ 305| 38| fft_rec(v, f1, f_coeffs / 2, PARAM_M - 1, PARAM_FFT - 1, deltas); ------------------ | | 41| 38|#define PARAM_M 8 ///< Define the degree m of the Galois field GF(2^m) ------------------ fft_rec(v, f1, f_coeffs / 2, PARAM_M - 1, PARAM_FFT - 1, deltas); ------------------ | | 46| 38|#define PARAM_FFT 4 ///< Exponent for additive FFT (2^PARAM_FFT points) ------------------ 306| | 307| 38| k = 1 << (PARAM_M - 1); ------------------ | | 41| 38|#define PARAM_M 8 ///< Define the degree m of the Galois field GF(2^m) ------------------ 308| | // Step 6, 7 and error polynomial computation 309| 38| memcpy(w + k, v, 2 * k); 310| | 311| | // Check if 0 is root 312| 38| w[0] = u[0]; 313| | 314| | // Check if 1 is root 315| 38| w[k] ^= u[0]; 316| | 317| | // Find other roots 318| 4.86k| for (i = 1; i < k; ++i) { ------------------ | Branch (318:17): [True: 4.82k, False: 38] ------------------ 319| 4.82k| w[i] = u[i] ^ gf_mul(betas_sums[i], v[i]); ------------------ | | 51| 4.82k|#define gf_mul PQCHQC_NAMESPACE(gf_mul) | | ------------------ | | | | 17| 4.82k|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 4.82k|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 4.82k|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 320| 4.82k| w[k + i] ^= w[i]; 321| 4.82k| } 322| 38|} PQCHQC_HQC1_C_fft_retrieve_error_poly: 331| 38|void fft_retrieve_error_poly(uint8_t *error, const uint16_t *w) { 332| 38| uint16_t gammas[PARAM_M - 1] = {0}; 333| 38| uint16_t gammas_sums[1 << (PARAM_M - 1)] = {0}; 334| 38| uint16_t k; 335| 38| size_t i, index; 336| | 337| 38| compute_fft_betas(gammas); 338| 38| compute_subset_sums(gammas_sums, gammas, PARAM_M - 1); ------------------ | | 41| 38|#define PARAM_M 8 ///< Define the degree m of the Galois field GF(2^m) ------------------ 339| | 340| 38| k = 1 << (PARAM_M - 1); ------------------ | | 41| 38|#define PARAM_M 8 ///< Define the degree m of the Galois field GF(2^m) ------------------ 341| 38| error[0] ^= 1 ^ ((uint16_t)-w[0] >> 15); 342| 38| error[0] ^= 1 ^ ((uint16_t)-w[k] >> 15); 343| | 344| 4.86k| for (i = 1; i < k; ++i) { ------------------ | Branch (344:17): [True: 4.82k, False: 38] ------------------ 345| 4.82k| index = PARAM_GF_MUL_ORDER - gf_log[gammas_sums[i]]; ------------------ | | 43| 4.82k|#define PARAM_GF_MUL_ORDER 255 ///< Size of the multiplicative group of GF(2^PARAM_M) (2^PARAM_M−1) ------------------ 346| 4.82k| error[index] ^= 1 ^ ((uint16_t)-w[i] >> 15); 347| | 348| 4.82k| index = PARAM_GF_MUL_ORDER - gf_log[gammas_sums[i] ^ 1]; ------------------ | | 43| 4.82k|#define PARAM_GF_MUL_ORDER 255 ///< Size of the multiplicative group of GF(2^PARAM_M) (2^PARAM_M−1) ------------------ 349| 4.82k| error[index] ^= 1 ^ ((uint16_t)-w[k + i] >> 15); 350| 4.82k| } 351| 38|} fft.c:compute_fft_betas: 29| 244|static void compute_fft_betas(uint16_t *betas) { 30| 244| size_t i; 31| 1.95k| for (i = 0; i < PARAM_M - 1; ++i) { ------------------ | | 41| 1.95k|#define PARAM_M 8 ///< Define the degree m of the Galois field GF(2^m) ------------------ | Branch (31:17): [True: 1.70k, False: 244] ------------------ 32| 1.70k| betas[i] = 1 << (PARAM_M - 1 - i); ------------------ | | 41| 1.70k|#define PARAM_M 8 ///< Define the degree m of the Galois field GF(2^m) ------------------ 33| 1.70k| } 34| 244|} fft.c:compute_subset_sums: 46| 1.64k|static void compute_subset_sums(uint16_t *subset_sums, const uint16_t *set, uint16_t set_size) { 47| 1.64k| uint16_t i, j; 48| 1.64k| subset_sums[0] = 0; 49| | 50| 9.94k| for (i = 0; i < set_size; ++i) { ------------------ | Branch (50:17): [True: 8.30k, False: 1.64k] ------------------ 51| 79.8k| for (j = 0; j < (1 << i); ++j) { ------------------ | Branch (51:21): [True: 71.5k, False: 8.30k] ------------------ 52| 71.5k| subset_sums[(1 << i) + j] = set[i] ^ subset_sums[j]; 53| 71.5k| } 54| 8.30k| } 55| 1.64k|} fft.c:radix: 69| 1.69k|static void radix(uint16_t *f0, uint16_t *f1, const uint16_t *f, uint32_t m_f) { 70| 1.69k| switch (m_f) { 71| 374| case 4: ------------------ | Branch (71:9): [True: 374, False: 1.32k] ------------------ 72| 374| f0[4] = f[8] ^ f[12]; 73| 374| f0[6] = f[12] ^ f[14]; 74| 374| f0[7] = f[14] ^ f[15]; 75| 374| f1[5] = f[11] ^ f[13]; 76| 374| f1[6] = f[13] ^ f[14]; 77| 374| f1[7] = f[15]; 78| 374| f0[5] = f[10] ^ f[12] ^ f1[5]; 79| 374| f1[4] = f[9] ^ f[13] ^ f0[5]; 80| | 81| 374| f0[0] = f[0]; 82| 374| f1[3] = f[7] ^ f[11] ^ f[15]; 83| 374| f0[3] = f[6] ^ f[10] ^ f[14] ^ f1[3]; 84| 374| f0[2] = f[4] ^ f0[4] ^ f0[3] ^ f1[3]; 85| 374| f1[1] = f[3] ^ f[5] ^ f[9] ^ f[13] ^ f1[3]; 86| 374| f1[2] = f[3] ^ f1[1] ^ f0[3]; 87| 374| f0[1] = f[2] ^ f0[2] ^ f1[1]; 88| 374| f1[0] = f[1] ^ f0[1]; 89| 374| break; 90| | 91| 412| case 3: ------------------ | Branch (91:9): [True: 412, False: 1.28k] ------------------ 92| 412| f0[0] = f[0]; 93| 412| f0[2] = f[4] ^ f[6]; 94| 412| f0[3] = f[6] ^ f[7]; 95| 412| f1[1] = f[3] ^ f[5] ^ f[7]; 96| 412| f1[2] = f[5] ^ f[6]; 97| 412| f1[3] = f[7]; 98| 412| f0[1] = f[2] ^ f0[2] ^ f1[1]; 99| 412| f1[0] = f[1] ^ f0[1]; 100| 412| break; 101| | 102| 824| case 2: ------------------ | Branch (102:9): [True: 824, False: 870] ------------------ 103| 824| f0[0] = f[0]; 104| 824| f0[1] = f[2] ^ f[3]; 105| 824| f1[0] = f[1] ^ f0[1]; 106| 824| f1[1] = f[3]; 107| 824| break; 108| | 109| 0| case 1: ------------------ | Branch (109:9): [True: 0, False: 1.69k] ------------------ 110| 0| f0[0] = f[0]; 111| 0| f1[0] = f[1]; 112| 0| break; 113| | 114| 84| default: ------------------ | Branch (114:9): [True: 84, False: 1.61k] ------------------ 115| 84| radix_big(f0, f1, f, m_f); 116| 84| break; 117| 1.69k| } 118| 1.69k|} fft.c:radix_big: 131| 84|static void radix_big(uint16_t *f0, uint16_t *f1, const uint16_t *f, uint32_t m_f) { 132| 84| uint16_t Q[2 * (1 << (PARAM_FFT - 2)) + 1] = {0}; 133| 84| uint16_t R[2 * (1 << (PARAM_FFT - 2)) + 1] = {0}; 134| | 135| 84| uint16_t Q0[1 << (PARAM_FFT - 2)] = {0}; 136| 84| uint16_t Q1[1 << (PARAM_FFT - 2)] = {0}; 137| 84| uint16_t R0[1 << (PARAM_FFT - 2)] = {0}; 138| 84| uint16_t R1[1 << (PARAM_FFT - 2)] = {0}; 139| | 140| 84| size_t i, n; 141| | 142| 84| n = 1; 143| 84| n <<= (m_f - 2); 144| 84| memcpy(Q, f + 3 * n, 2 * n); 145| 84| memcpy(Q + n, f + 3 * n, 2 * n); 146| 84| memcpy(R, f, 4 * n); 147| | 148| 756| for (i = 0; i < n; ++i) { ------------------ | Branch (148:17): [True: 672, False: 84] ------------------ 149| 672| Q[i] ^= f[2 * n + i]; 150| 672| R[n + i] ^= Q[i]; 151| 672| } 152| | 153| 84| radix(Q0, Q1, Q, m_f - 1); 154| 84| radix(R0, R1, R, m_f - 1); 155| | 156| 84| memcpy(f0, R0, 2 * n); 157| 84| memcpy(f0 + n, Q0, 2 * n); 158| 84| memcpy(f1, R1, 2 * n); 159| 84| memcpy(f1 + n, Q1, 2 * n); 160| 84|} fft.c:fft_rec: 174| 2.62k|static void fft_rec(uint16_t *w, uint16_t *f, size_t f_coeffs, uint8_t m, uint32_t m_f, const uint16_t *betas) { 175| 2.62k| uint16_t f0[1 << (PARAM_FFT - 2)] = {0}; 176| 2.62k| uint16_t f1[1 << (PARAM_FFT - 2)] = {0}; 177| 2.62k| uint16_t gammas[PARAM_M - 2] = {0}; 178| 2.62k| uint16_t deltas[PARAM_M - 2] = {0}; 179| 2.62k| uint16_t gammas_sums[1 << (PARAM_M - 2)] = {0}; 180| 2.62k| uint16_t u[1 << (PARAM_M - 2)] = {0}; 181| 2.62k| uint16_t v[1 << (PARAM_M - 2)] = {0}; 182| 2.62k| uint16_t tmp[PARAM_M - (PARAM_FFT - 1)] = {0}; 183| | 184| 2.62k| uint16_t beta_m_pow; 185| 2.62k| size_t i, j, k; 186| 2.62k| size_t x; 187| | 188| | // Step 1 189| 2.62k| if (m_f == 1) { ------------------ | Branch (189:9): [True: 1.21k, False: 1.40k] ------------------ 190| 6.38k| for (i = 0; i < m; ++i) { ------------------ | Branch (190:21): [True: 5.16k, False: 1.21k] ------------------ 191| 5.16k| tmp[i] = gf_mul(betas[i], f[1]); ------------------ | | 51| 5.16k|#define gf_mul PQCHQC_NAMESPACE(gf_mul) | | ------------------ | | | | 17| 5.16k|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 5.16k|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 5.16k|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 192| 5.16k| } 193| | 194| 1.21k| w[0] = f[0]; 195| 1.21k| x = 1; 196| 6.38k| for (j = 0; j < m; ++j) { ------------------ | Branch (196:21): [True: 5.16k, False: 1.21k] ------------------ 197| 28.2k| for (k = 0; k < x; ++k) { ------------------ | Branch (197:25): [True: 23.1k, False: 5.16k] ------------------ 198| 23.1k| w[x + k] = w[k] ^ tmp[j]; 199| 23.1k| } 200| 5.16k| x <<= 1; 201| 5.16k| } 202| | 203| 1.21k| return; 204| 1.21k| } 205| | 206| | // Step 2: compute g 207| 1.40k| if (betas[m - 1] != 1) { ------------------ | Branch (207:9): [True: 1.40k, False: 0] ------------------ 208| 1.40k| beta_m_pow = 1; 209| 1.40k| x = 1; 210| 1.40k| x <<= m_f; 211| 9.28k| for (i = 1; i < x; ++i) { ------------------ | Branch (211:21): [True: 7.87k, False: 1.40k] ------------------ 212| 7.87k| beta_m_pow = gf_mul(beta_m_pow, betas[m - 1]); ------------------ | | 51| 7.87k|#define gf_mul PQCHQC_NAMESPACE(gf_mul) | | ------------------ | | | | 17| 7.87k|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 7.87k|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 7.87k|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 213| 7.87k| f[i] = gf_mul(beta_m_pow, f[i]); ------------------ | | 51| 7.87k|#define gf_mul PQCHQC_NAMESPACE(gf_mul) | | ------------------ | | | | 17| 7.87k|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 7.87k|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 7.87k|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 214| 7.87k| } 215| 1.40k| } 216| | 217| | // Step 3 218| 1.40k| radix(f0, f1, f, m_f); 219| | 220| | // Step 4: compute gammas and deltas 221| 7.99k| for (i = 0; i + 1 < m; ++i) { ------------------ | Branch (221:17): [True: 6.59k, False: 1.40k] ------------------ 222| 6.59k| gammas[i] = gf_mul(betas[i], gf_inverse(betas[m - 1])); ------------------ | | 51| 6.59k|#define gf_mul PQCHQC_NAMESPACE(gf_mul) | | ------------------ | | | | 17| 6.59k|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 6.59k|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 6.59k|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ gammas[i] = gf_mul(betas[i], gf_inverse(betas[m - 1])); ------------------ | | 53| 6.59k|#define gf_inverse PQCHQC_NAMESPACE(gf_inverse) | | ------------------ | | | | 17| 6.59k|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 6.59k|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 6.59k|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 223| 6.59k| deltas[i] = gf_square(gammas[i]) ^ gammas[i]; ------------------ | | 52| 6.59k|#define gf_square PQCHQC_NAMESPACE(gf_square) | | ------------------ | | | | 17| 6.59k|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 6.59k|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 6.59k|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 224| 6.59k| } 225| | 226| | // Compute gammas sums 227| 1.40k| compute_subset_sums(gammas_sums, gammas, m - 1); 228| | 229| | // Step 5 230| 1.40k| fft_rec(u, f0, (f_coeffs + 1) / 2, m - 1, m_f - 1, deltas); 231| | 232| 1.40k| k = 1; 233| 1.40k| k <<= ((m - 1) & 0xf); // &0xf is to let the compiler know that m-1 is small. 234| 1.40k| if (f_coeffs <= 3) { // 3-coefficient polynomial f case: f1 is constant ------------------ | Branch (234:9): [True: 432, False: 972] ------------------ 235| 432| w[0] = u[0]; 236| 432| w[k] = u[0] ^ f1[0]; 237| 6.91k| for (i = 1; i < k; ++i) { ------------------ | Branch (237:21): [True: 6.48k, False: 432] ------------------ 238| 6.48k| w[i] = u[i] ^ gf_mul(gammas_sums[i], f1[0]); ------------------ | | 51| 6.48k|#define gf_mul PQCHQC_NAMESPACE(gf_mul) | | ------------------ | | | | 17| 6.48k|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 6.48k|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 6.48k|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 239| 6.48k| w[k + i] = w[i] ^ f1[0]; 240| 6.48k| } 241| 972| } else { 242| 972| fft_rec(v, f1, f_coeffs / 2, m - 1, m_f - 1, deltas); 243| | 244| | // Step 6 245| 972| memcpy(w + k, v, 2 * k); 246| 972| w[0] = u[0]; 247| 972| w[k] ^= u[0]; 248| 35.0k| for (i = 1; i < k; ++i) { ------------------ | Branch (248:21): [True: 34.1k, False: 972] ------------------ 249| 34.1k| w[i] = u[i] ^ gf_mul(gammas_sums[i], v[i]); ------------------ | | 51| 34.1k|#define gf_mul PQCHQC_NAMESPACE(gf_mul) | | ------------------ | | | | 17| 34.1k|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 34.1k|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 34.1k|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 250| 34.1k| w[k + i] ^= w[i]; 251| 34.1k| } 252| 972| } 253| 1.40k|} PQCHQC_HQC1_C_gf_mul: 153| 189k|uint16_t gf_mul(uint16_t a, uint16_t b) { 154| 189k| uint8_t c[2] = {0}; 155| 189k| gf_carryless_mul(c, (uint8_t)a, (uint8_t)b); 156| 189k| uint16_t tmp = (uint16_t)(c[0] ^ (c[1] << 8)); 157| 189k| return gf_reduce(tmp); 158| 189k|} PQCHQC_HQC1_C_gf_square: 165| 22.4k|uint16_t gf_square(uint16_t a) { 166| 22.4k| uint32_t b = a; 167| 22.4k| uint32_t s = b & 1; 168| 179k| for (size_t i = 1; i < PARAM_M; ++i) { ------------------ | | 41| 179k|#define PARAM_M 8 ///< Define the degree m of the Galois field GF(2^m) ------------------ | Branch (168:24): [True: 157k, False: 22.4k] ------------------ 169| 157k| b <<= 1; 170| 157k| s ^= b & (1 << 2 * i); 171| 157k| } 172| | 173| 22.4k| return gf_reduce(s); 174| 22.4k|} PQCHQC_HQC1_C_gf_inverse: 182| 3.49k|uint16_t gf_inverse(uint16_t a) { 183| 3.49k| uint16_t inv = a; 184| 3.49k| uint16_t tmp1, tmp2; 185| | 186| 3.49k| inv = gf_square(a); /* a^2 */ ------------------ | | 52| 3.49k|#define gf_square PQCHQC_NAMESPACE(gf_square) | | ------------------ | | | | 17| 3.49k|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 3.49k|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 3.49k|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 187| 3.49k| tmp1 = gf_mul(inv, a); /* a^3 */ ------------------ | | 51| 3.49k|#define gf_mul PQCHQC_NAMESPACE(gf_mul) | | ------------------ | | | | 17| 3.49k|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 3.49k|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 3.49k|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 188| 3.49k| inv = gf_square(inv); /* a^4 */ ------------------ | | 52| 3.49k|#define gf_square PQCHQC_NAMESPACE(gf_square) | | ------------------ | | | | 17| 3.49k|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 3.49k|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 3.49k|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 189| 3.49k| tmp2 = gf_mul(inv, tmp1); /* a^7 */ ------------------ | | 51| 3.49k|#define gf_mul PQCHQC_NAMESPACE(gf_mul) | | ------------------ | | | | 17| 3.49k|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 3.49k|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 3.49k|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 190| 3.49k| tmp1 = gf_mul(inv, tmp2); /* a^11 */ ------------------ | | 51| 3.49k|#define gf_mul PQCHQC_NAMESPACE(gf_mul) | | ------------------ | | | | 17| 3.49k|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 3.49k|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 3.49k|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 191| 3.49k| inv = gf_mul(tmp1, inv); /* a^15 */ ------------------ | | 51| 3.49k|#define gf_mul PQCHQC_NAMESPACE(gf_mul) | | ------------------ | | | | 17| 3.49k|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 3.49k|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 3.49k|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 192| 3.49k| inv = gf_square(inv); /* a^30 */ ------------------ | | 52| 3.49k|#define gf_square PQCHQC_NAMESPACE(gf_square) | | ------------------ | | | | 17| 3.49k|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 3.49k|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 3.49k|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 193| 3.49k| inv = gf_square(inv); /* a^60 */ ------------------ | | 52| 3.49k|#define gf_square PQCHQC_NAMESPACE(gf_square) | | ------------------ | | | | 17| 3.49k|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 3.49k|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 3.49k|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 194| 3.49k| inv = gf_square(inv); /* a^120 */ ------------------ | | 52| 3.49k|#define gf_square PQCHQC_NAMESPACE(gf_square) | | ------------------ | | | | 17| 3.49k|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 3.49k|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 3.49k|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 195| 3.49k| inv = gf_mul(inv, tmp2); /* a^127 */ ------------------ | | 51| 3.49k|#define gf_mul PQCHQC_NAMESPACE(gf_mul) | | ------------------ | | | | 17| 3.49k|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 3.49k|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 3.49k|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 196| 3.49k| inv = gf_square(inv); /* a^254 */ ------------------ | | 52| 3.49k|#define gf_square PQCHQC_NAMESPACE(gf_square) | | ------------------ | | | | 17| 3.49k|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 3.49k|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 3.49k|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 197| 3.49k| return inv; 198| 3.49k|} gf.c:gf_carryless_mul: 109| 1.16M|static void gf_carryless_mul(uint8_t *c, uint8_t a, uint8_t b) { 110| 1.16M| uint16_t h = 0, l = 0, g, u[4]; 111| 1.16M| u[0] = 0; 112| 1.16M| u[1] = b & ((1UL << 7) - 1UL); 113| 1.16M| u[2] = u[1] << 1; 114| 1.16M| u[3] = u[2] ^ u[1]; 115| | 116| 1.16M| g = 0; 117| 1.16M| uint16_t tmp1 = a & 3; 118| | 119| 5.80M| for (int i = 0; i < 4; i++) { ------------------ | Branch (119:21): [True: 4.64M, False: 1.16M] ------------------ 120| 4.64M| uint32_t tmp2 = tmp1 - i; 121| 4.64M| g ^= (u[i] & -(1 - ((tmp2 | -tmp2) >> 31))); 122| 4.64M| } 123| | 124| 1.16M| l = g; 125| 1.16M| h = 0; 126| | 127| 4.64M| for (uint8_t i = 2; i < 8; i += 2) { ------------------ | Branch (127:25): [True: 3.48M, False: 1.16M] ------------------ 128| 3.48M| g = 0; 129| 3.48M| uint16_t tmp3 = (a >> i) & 3; 130| 17.4M| for (int j = 0; j < 4; ++j) { ------------------ | Branch (130:25): [True: 13.9M, False: 3.48M] ------------------ 131| 13.9M| uint32_t tmp2 = tmp3 - j; 132| 13.9M| g ^= (u[j] & -(1 - ((tmp2 | -tmp2) >> 31))); 133| 13.9M| } 134| | 135| 3.48M| l ^= g << i; 136| 3.48M| h ^= g >> (8 - i); 137| 3.48M| } 138| | 139| 1.16M| uint16_t mask = (-((b >> 7) & 1)); 140| 1.16M| l ^= ((a << 7) & mask); 141| 1.16M| h ^= ((a >> (1)) & mask); 142| | 143| 1.16M| c[0] = l; 144| 1.16M| c[1] = h; 145| 1.16M|} gf.c:gf_reduce: 76| 1.26M|uint16_t gf_reduce(uint16_t x) { 77| 1.26M| uint64_t mod; 78| 1.26M| const int reduction_steps = 2; // For deg(x) = 2 * (8 - 1) = 14, reduce twice to bring degree < 8 79| 1.26M| const size_t gf_reduction_tap_count = 3; // Number of feedback positions 80| | 81| 3.79M| for (int i = 0; i < reduction_steps; ++i) { ------------------ | Branch (81:21): [True: 2.53M, False: 1.26M] ------------------ 82| 2.53M| mod = x >> PARAM_M; // Extract upper bits ------------------ | | 41| 2.53M|#define PARAM_M 8 ///< Define the degree m of the Galois field GF(2^m) ------------------ 83| 2.53M| x &= (1 << PARAM_M) - 1; // Keep lower bits ------------------ | | 41| 2.53M|#define PARAM_M 8 ///< Define the degree m of the Galois field GF(2^m) ------------------ 84| 2.53M| x ^= mod; // Pre-XOR with no shift 85| | 86| 2.53M| uint16_t z1 = 0; 87| 10.1M| for (size_t j = gf_reduction_tap_count; j; --j) { ------------------ | Branch (87:49): [True: 7.59M, False: 2.53M] ------------------ 88| 7.59M| uint16_t z2 = gf_reduction_taps[j - 1]; 89| 7.59M| uint16_t dist = z2 - z1; 90| 7.59M| mod <<= dist; 91| 7.59M| x ^= mod; 92| 7.59M| z1 = z2; 93| 7.59M| } 94| 2.53M| } 95| | 96| 1.26M| return x; 97| 1.26M|} PQCHQC_HQC1_C_vect_mul: 151| 228|void vect_mul(uint64_t *o, const uint64_t *a1, const uint64_t *a2) { 152| 228| uint64_t unreduced[2 * VEC_N_SIZE_64]; 153| 228| uint64_t tmp_buffer[TMP_BUFFER_WORDS]; 154| | 155| | /* multiply via Karatsuba into unreduced */ 156| 228| karatsuba_mul(unreduced, a1, a2, VEC_N_SIZE_64, tmp_buffer); ------------------ | | 36| 228|#define VEC_N_SIZE_64 CEIL_DIVIDE(PARAM_N, 64) ///< Size of array to store PARAM_N bits in 64-bit words | | ------------------ | | | | 12| 228|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [Folded, False: 228] | | | | ------------------ | | ------------------ ------------------ 157| | 158| | /* reduce modulo X^n - 1 */ 159| 228| reduce(o, unreduced); 160| 228|} gf2x.c:karatsuba_mul: 74| 633k|static void karatsuba_mul(uint64_t *r, const uint64_t *a, const uint64_t *b, size_t n, uint64_t *tmp_buffer) { 75| 633k| if (n <= KARATSUBA_THRESHOLD) { ------------------ | | 22| 633k|#define KARATSUBA_THRESHOLD 16 ------------------ | Branch (75:9): [True: 422k, False: 211k] ------------------ 76| 422k| schoolbook_mul(r, a, b, n); 77| 422k| return; 78| 422k| } 79| | 80| 211k| size_t m = n >> 1; 81| 211k| size_t n0 = m; 82| 211k| size_t n1 = n - m; 83| | 84| | /* take successive chunks of tmp_buffer for each intermediate result */ 85| 211k| uint64_t *z0 = tmp_buffer; /* low-half product, size 2*n words */ 86| 211k| uint64_t *z2 = z0 + 2 * n; /* high-half product, size 2*n words */ 87| 211k| uint64_t *zmid = z2 + 2 * n; /* middle product, size 2*n words */ 88| | 89| | /* ta and tb hold the sums of low and high halves: */ 90| | /* ta[i] = a0[i] XOR a1[i], tb[i] = b0[i] XOR b1[i] for i < n1 */ 91| 211k| uint64_t *ta = zmid + 2 * n; 92| 211k| uint64_t *tb = ta + n; 93| | 94| | /* buffer for child recursions */ 95| 211k| uint64_t *child_buffer = tmp_buffer + 8 * n; 96| | 97| | /* 1) low * low */ 98| 211k| karatsuba_mul(z0, a, b, n0, child_buffer); 99| | 100| | /* 2) high * high */ 101| 211k| karatsuba_mul(z2, a + m, b + m, n1, child_buffer); 102| | 103| | /* 3) (a0+a1)*(b0+b1) */ 104| 4.48M| for (size_t i = 0; i < n1; i++) { ------------------ | Branch (104:24): [True: 4.26M, False: 211k] ------------------ 105| 4.26M| uint64_t loa = (i < n0 ? a[i] : 0); ------------------ | Branch (105:25): [True: 4.17M, False: 92.4k] ------------------ 106| 4.26M| uint64_t lob = (i < n0 ? b[i] : 0); ------------------ | Branch (106:25): [True: 4.17M, False: 92.4k] ------------------ 107| 4.26M| ta[i] = loa ^ a[m + i]; 108| 4.26M| tb[i] = lob ^ b[m + i]; 109| 4.26M| } 110| 211k| karatsuba_mul(zmid, ta, tb, n1, child_buffer); 111| | 112| | /* 4) assemble into r */ 113| 211k| memset(r, 0, 2 * n * sizeof(uint64_t)); 114| 8.56M| for (size_t i = 0; i < 2 * n0; i++) r[i] ^= z0[i]; ------------------ | Branch (114:24): [True: 8.35M, False: 211k] ------------------ 115| 8.74M| for (size_t i = 0; i < 2 * n1; i++) r[2 * m + i] ^= z2[i]; ------------------ | Branch (115:24): [True: 8.53M, False: 211k] ------------------ 116| 8.74M| for (size_t i = 0; i < 2 * n1; i++) { ------------------ | Branch (116:24): [True: 8.53M, False: 211k] ------------------ 117| 8.53M| uint64_t z0i = (i < 2 * n0 ? z0[i] : 0); ------------------ | Branch (117:25): [True: 8.35M, False: 184k] ------------------ 118| 8.53M| uint64_t z2i = (i < 2 * n1 ? z2[i] : 0); ------------------ | Branch (118:25): [True: 8.53M, False: 0] ------------------ 119| 8.53M| uint64_t mid = zmid[i] ^ z0i ^ z2i; 120| 8.53M| r[m + i] ^= mid; 121| 8.53M| } 122| 211k|} gf2x.c:schoolbook_mul: 39| 422k|static void schoolbook_mul(uint64_t *r, const uint64_t *a, const uint64_t *b, size_t n) { 40| 422k| memset(r, 0, 2 * n * sizeof(uint64_t)); 41| 5.11M| for (size_t i = 0; i < n; i++) { ------------------ | Branch (41:24): [True: 4.69M, False: 422k] ------------------ 42| 4.69M| uint64_t ai = a[i]; 43| 305M| for (int bit = 0; bit < 64; bit++) { ------------------ | Branch (43:27): [True: 300M, False: 4.69M] ------------------ 44| 300M| uint64_t mask = -((ai >> bit) & 1ULL); 45| 300M| size_t base = i; 46| 300M| int sh = bit; 47| 300M| int inv = 64 - sh; 48| 300M| if (sh == 0) { ------------------ | Branch (48:17): [True: 4.69M, False: 295M] ------------------ 49| 59.8M| for (size_t j = 0; j < n; j++) { ------------------ | Branch (49:36): [True: 55.1M, False: 4.69M] ------------------ 50| 55.1M| r[base + j] ^= b[j] & mask; 51| 55.1M| } 52| 295M| } else { 53| 3.77G| for (size_t j = 0; j < n; j++) { ------------------ | Branch (53:36): [True: 3.47G, False: 295M] ------------------ 54| 3.47G| r[base + j] ^= (b[j] << sh) & mask; 55| 3.47G| r[base + j + 1] ^= (b[j] >> inv) & mask; 56| 3.47G| } 57| 295M| } 58| 300M| } 59| 4.69M| } 60| 422k|} gf2x.c:reduce: 133| 732|static void reduce(uint64_t *o, const uint64_t *a) { 134| 428k| for (size_t i = 0; i < VEC_N_SIZE_64; i++) { ------------------ | | 36| 428k|#define VEC_N_SIZE_64 CEIL_DIVIDE(PARAM_N, 64) ///< Size of array to store PARAM_N bits in 64-bit words | | ------------------ | | | | 12| 428k|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [Folded, False: 428k] | | | | ------------------ | | ------------------ ------------------ | Branch (134:24): [True: 427k, False: 732] ------------------ 135| 427k| uint64_t r = a[i + VEC_N_SIZE_64 - 1] >> (PARAM_N & 0x3F); ------------------ | | 36| 427k|#define VEC_N_SIZE_64 CEIL_DIVIDE(PARAM_N, 64) ///< Size of array to store PARAM_N bits in 64-bit words | | ------------------ | | | | 12| 427k|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [Folded, False: 427k] | | | | ------------------ | | ------------------ ------------------ uint64_t r = a[i + VEC_N_SIZE_64 - 1] >> (PARAM_N & 0x3F); ------------------ | | 15| 427k|#define PARAM_N 17669 ///< Define the parameter n of the scheme ------------------ 136| 427k| uint64_t carry = a[i + VEC_N_SIZE_64] << (64 - (PARAM_N & 0x3F)); ------------------ | | 36| 427k|#define VEC_N_SIZE_64 CEIL_DIVIDE(PARAM_N, 64) ///< Size of array to store PARAM_N bits in 64-bit words | | ------------------ | | | | 12| 427k|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [Folded, False: 427k] | | | | ------------------ | | ------------------ ------------------ uint64_t carry = a[i + VEC_N_SIZE_64] << (64 - (PARAM_N & 0x3F)); ------------------ | | 15| 427k|#define PARAM_N 17669 ///< Define the parameter n of the scheme ------------------ 137| 427k| o[i] = a[i] ^ r ^ carry; 138| 427k| } 139| 732| o[VEC_N_SIZE_64 - 1] &= BITMASK(PARAM_N, 64); ------------------ | | 36| 732|#define VEC_N_SIZE_64 CEIL_DIVIDE(PARAM_N, 64) ///< Size of array to store PARAM_N bits in 64-bit words | | ------------------ | | | | 12| 732|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [Folded, False: 732] | | | | ------------------ | | ------------------ ------------------ o[VEC_N_SIZE_64 - 1] &= BITMASK(PARAM_N, 64); ------------------ | | 13| 732|#define BITMASK(a, size) ((((uint64_t) 1UL) << (a % size)) - 1) /*!< Create a mask*/ ------------------ 140| 732|} PQCHQC_HQC1_C_hqc_pke_keygen: 30| 38|void hqc_pke_keygen(uint8_t *ek_pke, uint8_t *dk_pke, uint8_t *seed) { 31| 38| uint8_t keypair_seed[2 * SEED_BYTES] = {0}; 32| 38| uint8_t *seed_dk = keypair_seed; 33| 38| uint8_t *seed_ek = keypair_seed + SEED_BYTES; ------------------ | | 52| 38|#define SEED_BYTES 32 ///< Define the size of the seed in bytes ------------------ 34| 38| shake256_xof_ctx dk_xof_ctx = {0}; 35| 38| shake256_xof_ctx ek_xof_ctx = {0}; 36| | 37| 38| uint64_t x[VEC_N_SIZE_64] = {0}; 38| 38| uint64_t y[VEC_N_SIZE_64] = {0}; 39| 38| uint64_t h[VEC_N_SIZE_64] = {0}; 40| 38| uint64_t s[VEC_N_SIZE_64] = {0}; 41| | 42| | // Derive keypair seeds 43| 38| hash_i(keypair_seed, seed); ------------------ | | 79| 38|#define hash_i PQCHQC_NAMESPACE(hash_i) | | ------------------ | | | | 17| 38|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 38|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 38|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 44| | 45| | // Compute decryption key 46| 38| xof_init(&dk_xof_ctx, seed_dk, SEED_BYTES); ------------------ | | 74| 38|#define xof_init PQCHQC_NAMESPACE(xof_init) | | ------------------ | | | | 17| 38|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 38|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 38|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ xof_init(&dk_xof_ctx, seed_dk, SEED_BYTES); ------------------ | | 52| 38|#define SEED_BYTES 32 ///< Define the size of the seed in bytes ------------------ 47| 38| vect_sample_fixed_weight1(&dk_xof_ctx, y, PARAM_OMEGA); ------------------ | | 16| 38|#define vect_sample_fixed_weight1 PQCHQC_NAMESPACE(vect_sample_fixed_weight1) | | ------------------ | | | | 17| 38|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 38|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 38|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ vect_sample_fixed_weight1(&dk_xof_ctx, y, PARAM_OMEGA); ------------------ | | 19| 38|#define PARAM_OMEGA 66 ///< Define the parameter omega of the scheme ------------------ 48| 38| vect_sample_fixed_weight1(&dk_xof_ctx, x, PARAM_OMEGA); ------------------ | | 16| 38|#define vect_sample_fixed_weight1 PQCHQC_NAMESPACE(vect_sample_fixed_weight1) | | ------------------ | | | | 17| 38|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 38|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 38|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ vect_sample_fixed_weight1(&dk_xof_ctx, x, PARAM_OMEGA); ------------------ | | 19| 38|#define PARAM_OMEGA 66 ///< Define the parameter omega of the scheme ------------------ 49| 38| xof_ctx_release(&dk_xof_ctx); ------------------ | | 76| 38|#define xof_ctx_release PQCHQC_NAMESPACE(xof_ctx_release) | | ------------------ | | | | 17| 38|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 38|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 38|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 50| | 51| | // Compute encryption key 52| 38| xof_init(&ek_xof_ctx, seed_ek, SEED_BYTES); ------------------ | | 74| 38|#define xof_init PQCHQC_NAMESPACE(xof_init) | | ------------------ | | | | 17| 38|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 38|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 38|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ xof_init(&ek_xof_ctx, seed_ek, SEED_BYTES); ------------------ | | 52| 38|#define SEED_BYTES 32 ///< Define the size of the seed in bytes ------------------ 53| 38| vect_set_random(&ek_xof_ctx, h); ------------------ | | 18| 38|#define vect_set_random PQCHQC_NAMESPACE(vect_set_random) | | ------------------ | | | | 17| 38|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 38|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 38|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 54| 38| xof_ctx_release(&ek_xof_ctx); ------------------ | | 76| 38|#define xof_ctx_release PQCHQC_NAMESPACE(xof_ctx_release) | | ------------------ | | | | 17| 38|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 38|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 38|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 55| 38| vect_mul(s, y, h); ------------------ | | 12| 38|#define vect_mul PQCHQC_NAMESPACE(vect_mul) | | ------------------ | | | | 17| 38|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 38|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 38|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 56| 38| vect_add(s, x, s, VEC_N_SIZE_64); ------------------ | | 19| 38|#define vect_add PQCHQC_NAMESPACE(vect_add) | | ------------------ | | | | 17| 38|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 38|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 38|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ vect_add(s, x, s, VEC_N_SIZE_64); ------------------ | | 36| 38|#define VEC_N_SIZE_64 CEIL_DIVIDE(PARAM_N, 64) ///< Size of array to store PARAM_N bits in 64-bit words | | ------------------ | | | | 12| 38|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [Folded, False: 38] | | | | ------------------ | | ------------------ ------------------ 57| | 58| | // Parse encryption key to string 59| 38| memcpy(ek_pke, seed_ek, SEED_BYTES); ------------------ | | 52| 38|#define SEED_BYTES 32 ///< Define the size of the seed in bytes ------------------ 60| 38| memcpy(ek_pke + SEED_BYTES, s, VEC_N_SIZE_BYTES); ------------------ | | 52| 38|#define SEED_BYTES 32 ///< Define the size of the seed in bytes ------------------ memcpy(ek_pke + SEED_BYTES, s, VEC_N_SIZE_BYTES); ------------------ | | 31| 38|#define VEC_N_SIZE_BYTES CEIL_DIVIDE(PARAM_N, 8) ///< Size of array to store PARAM_N bits in bytes | | ------------------ | | | | 12| 38|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [Folded, False: 38] | | | | ------------------ | | ------------------ ------------------ 61| | 62| | // Parse decryption key to string 63| 38| memcpy(dk_pke, seed_dk, SEED_BYTES); ------------------ | | 52| 38|#define SEED_BYTES 32 ///< Define the size of the seed in bytes ------------------ 64| | 65| |#ifdef VERBOSE 66| | printf("\n\nseed_dk: "); 67| | for (int i = 0; i < SEED_BYTES; ++i) printf("%02x", seed_dk[i]); 68| | printf("\n\nseed_ek: "); 69| | for (int i = 0; i < SEED_BYTES; ++i) printf("%02x", seed_ek[i]); 70| | printf("\n\ny: "); 71| | vect_print(y, VEC_N_SIZE_BYTES); 72| | printf("\n\nx: "); 73| | vect_print(x, VEC_N_SIZE_BYTES); 74| | printf("\n\nh: "); 75| | vect_print(h, VEC_N_SIZE_BYTES); 76| | printf("\n\ns: "); 77| | vect_print(s, VEC_N_SIZE_BYTES); 78| |#endif 79| | 80| | // Zeroize sensitive data 81| 38| memset_zero(keypair_seed, sizeof keypair_seed); ------------------ | | 22| 38|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 38|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 38|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 38|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 38|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 82| 38| memset_zero(x, sizeof x); ------------------ | | 22| 38|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 38|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 38|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 38|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 38|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 83| 38| memset_zero(y, sizeof y); ------------------ | | 22| 38|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 38|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 38|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 38|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 38|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 84| 38| memset_zero(&dk_xof_ctx, sizeof dk_xof_ctx); ------------------ | | 22| 38|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 38|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 38|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 38|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 38|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 85| 38|} PQCHQC_HQC1_C_hqc_pke_encrypt: 99| 76|void hqc_pke_encrypt(ciphertext_pke_t *c_pke, const uint8_t *ek_pke, const uint64_t *m, const uint8_t *theta) { 100| 76| shake256_xof_ctx theta_xof_ctx = {0}; 101| 76| uint64_t h[VEC_N_SIZE_64] = {0}; 102| 76| uint64_t s[VEC_N_SIZE_64] = {0}; 103| 76| uint64_t r1[VEC_N_SIZE_64] = {0}; 104| 76| uint64_t r2[VEC_N_SIZE_64] = {0}; 105| 76| uint64_t e[VEC_N_SIZE_64] = {0}; 106| 76| uint64_t tmp[VEC_N_SIZE_64] = {0}; 107| | 108| | // Initialize Xof using theta 109| 76| xof_init(&theta_xof_ctx, theta, SEED_BYTES); ------------------ | | 74| 76|#define xof_init PQCHQC_NAMESPACE(xof_init) | | ------------------ | | | | 17| 76|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 76|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 76|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ xof_init(&theta_xof_ctx, theta, SEED_BYTES); ------------------ | | 52| 76|#define SEED_BYTES 32 ///< Define the size of the seed in bytes ------------------ 110| | 111| | // Retrieve h and s from public key 112| 76| hqc_ek_pke_from_string(h, s, ek_pke); ------------------ | | 15| 76|#define hqc_ek_pke_from_string PQCHQC_NAMESPACE(hqc_ek_pke_from_string) | | ------------------ | | | | 17| 76|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 76|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 76|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 113| | 114| | // Generate re, e and r1 115| 76| vect_sample_fixed_weight2(&theta_xof_ctx, r2, PARAM_OMEGA_R); ------------------ | | 17| 76|#define vect_sample_fixed_weight2 PQCHQC_NAMESPACE(vect_sample_fixed_weight2) | | ------------------ | | | | 17| 76|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 76|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 76|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ vect_sample_fixed_weight2(&theta_xof_ctx, r2, PARAM_OMEGA_R); ------------------ | | 21| 76|#define PARAM_OMEGA_R 75 ///< Define the parameter omega_r of the scheme ------------------ 116| 76| vect_sample_fixed_weight2(&theta_xof_ctx, e, PARAM_OMEGA_E); ------------------ | | 17| 76|#define vect_sample_fixed_weight2 PQCHQC_NAMESPACE(vect_sample_fixed_weight2) | | ------------------ | | | | 17| 76|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 76|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 76|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ vect_sample_fixed_weight2(&theta_xof_ctx, e, PARAM_OMEGA_E); ------------------ | | 20| 76|#define PARAM_OMEGA_E 75 ///< Define the parameter omega_e of the scheme ------------------ 117| 76| vect_sample_fixed_weight2(&theta_xof_ctx, r1, PARAM_OMEGA_R); ------------------ | | 17| 76|#define vect_sample_fixed_weight2 PQCHQC_NAMESPACE(vect_sample_fixed_weight2) | | ------------------ | | | | 17| 76|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 76|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 76|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ vect_sample_fixed_weight2(&theta_xof_ctx, r1, PARAM_OMEGA_R); ------------------ | | 21| 76|#define PARAM_OMEGA_R 75 ///< Define the parameter omega_r of the scheme ------------------ 118| 76| xof_ctx_release(&theta_xof_ctx); ------------------ | | 76| 76|#define xof_ctx_release PQCHQC_NAMESPACE(xof_ctx_release) | | ------------------ | | | | 17| 76|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 76|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 76|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 119| | 120| | // Compute u = r1 + r2.h 121| 76| vect_mul(c_pke->u, r2, h); ------------------ | | 12| 76|#define vect_mul PQCHQC_NAMESPACE(vect_mul) | | ------------------ | | | | 17| 76|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 76|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 76|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 122| 76| vect_add(c_pke->u, r1, c_pke->u, VEC_N_SIZE_64); ------------------ | | 19| 76|#define vect_add PQCHQC_NAMESPACE(vect_add) | | ------------------ | | | | 17| 76|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 76|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 76|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ vect_add(c_pke->u, r1, c_pke->u, VEC_N_SIZE_64); ------------------ | | 36| 76|#define VEC_N_SIZE_64 CEIL_DIVIDE(PARAM_N, 64) ///< Size of array to store PARAM_N bits in 64-bit words | | ------------------ | | | | 12| 76|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [Folded, False: 76] | | | | ------------------ | | ------------------ ------------------ 123| | 124| | // Compute v = C.encode(m) 125| 76| code_encode(c_pke->v, m); ------------------ | | 14| 76|#define code_encode PQCHQC_NAMESPACE(code_encode) | | ------------------ | | | | 17| 76|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 76|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 76|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 126| | 127| | // Compute v = C.encode(m) + Truncate(s.r2 + e) 128| 76| vect_mul(tmp, r2, s); ------------------ | | 12| 76|#define vect_mul PQCHQC_NAMESPACE(vect_mul) | | ------------------ | | | | 17| 76|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 76|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 76|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 129| 76| vect_add(tmp, e, tmp, VEC_N_SIZE_64); ------------------ | | 19| 76|#define vect_add PQCHQC_NAMESPACE(vect_add) | | ------------------ | | | | 17| 76|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 76|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 76|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ vect_add(tmp, e, tmp, VEC_N_SIZE_64); ------------------ | | 36| 76|#define VEC_N_SIZE_64 CEIL_DIVIDE(PARAM_N, 64) ///< Size of array to store PARAM_N bits in 64-bit words | | ------------------ | | | | 12| 76|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [Folded, False: 76] | | | | ------------------ | | ------------------ ------------------ 130| 76| vect_truncate(tmp); ------------------ | | 21| 76|#define vect_truncate PQCHQC_NAMESPACE(vect_truncate) | | ------------------ | | | | 17| 76|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 76|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 76|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 131| 76| vect_add(c_pke->v, c_pke->v, tmp, VEC_N1N2_SIZE_64); ------------------ | | 19| 76|#define vect_add PQCHQC_NAMESPACE(vect_add) | | ------------------ | | | | 17| 76|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 76|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 76|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ vect_add(c_pke->v, c_pke->v, tmp, VEC_N1N2_SIZE_64); ------------------ | | 38| 76|#define VEC_N1N2_SIZE_64 CEIL_DIVIDE(PARAM_N1N2, 64) ///< Size of array to store PARAM_N1N2 bits in 64-bit words | | ------------------ | | | | 12| 76|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [True: 76, Folded] | | | | ------------------ | | ------------------ ------------------ 132| | 133| |#ifdef VERBOSE 134| | printf("\n\nh: "); 135| | vect_print(h, VEC_N_SIZE_BYTES); 136| | printf("\n\ns: "); 137| | vect_print(s, VEC_N_SIZE_BYTES); 138| | printf("\n\nr1: "); 139| | vect_print(r1, VEC_N_SIZE_BYTES); 140| | printf("\n\nr2: "); 141| | vect_print(r2, VEC_N_SIZE_BYTES); 142| | printf("\n\ne: "); 143| | vect_print(e, VEC_N_SIZE_BYTES); 144| | printf("\n\nTruncate(s.r2 + e): "); 145| | vect_print(tmp, VEC_N1N2_SIZE_BYTES); 146| | printf("\n\nc_pke->u: "); 147| | vect_print(c_pke->u, VEC_N_SIZE_BYTES); 148| | printf("\n\nc_pke->v: "); 149| | vect_print(c_pke->v, VEC_N1N2_SIZE_BYTES); 150| |#endif 151| | 152| | // Zeroize sensitive data 153| 76| memset_zero(r1, sizeof r1); ------------------ | | 22| 76|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 76|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 76|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 76|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 76|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 154| 76| memset_zero(r2, sizeof r2); ------------------ | | 22| 76|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 76|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 76|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 76|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 76|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 155| 76| memset_zero(e, sizeof e); ------------------ | | 22| 76|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 76|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 76|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 76|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 76|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 156| 76| memset_zero(tmp, sizeof tmp); ------------------ | | 22| 76|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 76|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 76|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 76|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 76|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 157| 76| memset_zero(&theta_xof_ctx, sizeof theta_xof_ctx); ------------------ | | 22| 76|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 76|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 76|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 76|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 76|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 158| 76|} PQCHQC_HQC1_C_hqc_pke_decrypt: 173| 38|uint8_t hqc_pke_decrypt(uint64_t *m, const uint8_t *dk_pke, const ciphertext_pke_t *c_pke) { 174| 38| uint64_t y[VEC_N_SIZE_64] = {0}; 175| 38| uint64_t tmp1[VEC_N_SIZE_64] = {0}; 176| 38| uint64_t tmp2[VEC_N_SIZE_64] = {0}; 177| | 178| | // Parse decryption key dk_pke 179| 38| hqc_dk_pke_from_string(y, dk_pke); ------------------ | | 14| 38|#define hqc_dk_pke_from_string PQCHQC_NAMESPACE(hqc_dk_pke_from_string) | | ------------------ | | | | 17| 38|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 38|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 38|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 180| | 181| | // Compute u.y 182| 38| vect_mul(tmp1, y, c_pke->u); ------------------ | | 12| 38|#define vect_mul PQCHQC_NAMESPACE(vect_mul) | | ------------------ | | | | 17| 38|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 38|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 38|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 183| | // Truncate(u.y) 184| 38| vect_truncate(tmp1); ------------------ | | 21| 38|#define vect_truncate PQCHQC_NAMESPACE(vect_truncate) | | ------------------ | | | | 17| 38|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 38|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 38|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 185| | // Compute v - Truncate(u.y) 186| 38| vect_add(tmp2, c_pke->v, tmp1, VEC_N1N2_SIZE_64); ------------------ | | 19| 38|#define vect_add PQCHQC_NAMESPACE(vect_add) | | ------------------ | | | | 17| 38|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 38|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 38|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ vect_add(tmp2, c_pke->v, tmp1, VEC_N1N2_SIZE_64); ------------------ | | 38| 38|#define VEC_N1N2_SIZE_64 CEIL_DIVIDE(PARAM_N1N2, 64) ///< Size of array to store PARAM_N1N2 bits in 64-bit words | | ------------------ | | | | 12| 38|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [True: 38, Folded] | | | | ------------------ | | ------------------ ------------------ 187| | 188| |#ifdef VERBOSE 189| | printf("\n\nc_pke.u: "); 190| | vect_print(c_pke->u, VEC_N_SIZE_BYTES); 191| | printf("\n\nc_pke.v: "); 192| | vect_print(c_pke->v, VEC_N1N2_SIZE_BYTES); 193| | printf("\n\ny: "); 194| | vect_print(y, VEC_N_SIZE_BYTES); 195| | printf("\n\nTruncate(u.y): "); 196| | vect_print(tmp1, VEC_N1N2_SIZE_BYTES); 197| | printf("\n\nv - Truncate(u.y): "); 198| | vect_print(tmp2, VEC_N1N2_SIZE_BYTES); 199| |#endif 200| | 201| | // Compute plaintext m 202| 38| code_decode(m, tmp2); ------------------ | | 15| 38|#define code_decode PQCHQC_NAMESPACE(code_decode) | | ------------------ | | | | 17| 38|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 38|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 38|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 203| | 204| | // Zeroize sensitive data 205| 38| memset_zero(y, sizeof y); ------------------ | | 22| 38|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 38|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 38|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 38|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 38|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 206| 38| memset_zero(tmp1, sizeof tmp1); ------------------ | | 22| 38|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 38|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 38|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 38|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 38|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 207| 38| memset_zero(tmp2, sizeof tmp2); ------------------ | | 22| 38|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 38|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 38|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 38|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 38|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 208| | 209| 38| return 0; 210| 38|} PQCHQC_HQC1_C_crypto_kem_keypair: 39| 38|int crypto_kem_keypair(uint8_t *ek_kem, uint8_t *dk_kem) { 40| |#ifdef VERBOSE 41| | printf("\n\n\n### KEYGEN ###"); 42| |#endif 43| 38| uint8_t seed_kem[SEED_BYTES] = {0}; 44| 38| uint8_t sigma[PARAM_SECURITY_BYTES] = {0}; 45| 38| uint8_t seed_pke[SEED_BYTES] = {0}; 46| 38| shake256_xof_ctx ctx_kem; 47| | 48| 38| uint8_t ek_pke[PUBLIC_KEY_BYTES] = {0}; 49| 38| uint8_t dk_pke[SEED_BYTES] = {0}; 50| | 51| 38| prng_get_bytes(seed_kem, SEED_BYTES); ------------------ | | 73| 38|#define prng_get_bytes PQCHQC_NAMESPACE(prng_get_bytes) | | ------------------ | | | | 17| 38|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 38|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 38|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ prng_get_bytes(seed_kem, SEED_BYTES); ------------------ | | 52| 38|#define SEED_BYTES 32 ///< Define the size of the seed in bytes ------------------ 52| | 53| | // Compute seed_pke and randomness sigma 54| 38| xof_init(&ctx_kem, seed_kem, SEED_BYTES); ------------------ | | 74| 38|#define xof_init PQCHQC_NAMESPACE(xof_init) | | ------------------ | | | | 17| 38|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 38|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 38|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ xof_init(&ctx_kem, seed_kem, SEED_BYTES); ------------------ | | 52| 38|#define SEED_BYTES 32 ///< Define the size of the seed in bytes ------------------ 55| 38| xof_get_bytes(&ctx_kem, seed_pke, SEED_BYTES); ------------------ | | 75| 38|#define xof_get_bytes PQCHQC_NAMESPACE(xof_get_bytes) | | ------------------ | | | | 17| 38|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 38|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 38|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ xof_get_bytes(&ctx_kem, seed_pke, SEED_BYTES); ------------------ | | 52| 38|#define SEED_BYTES 32 ///< Define the size of the seed in bytes ------------------ 56| 38| xof_get_bytes(&ctx_kem, sigma, PARAM_SECURITY_BYTES); ------------------ | | 75| 38|#define xof_get_bytes PQCHQC_NAMESPACE(xof_get_bytes) | | ------------------ | | | | 17| 38|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 38|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 38|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ xof_get_bytes(&ctx_kem, sigma, PARAM_SECURITY_BYTES); ------------------ | | 23| 38|#define PARAM_SECURITY_BYTES 16 ///< Define the security level in bytes ------------------ 57| 38| xof_ctx_release(&ctx_kem); ------------------ | | 76| 38|#define xof_ctx_release PQCHQC_NAMESPACE(xof_ctx_release) | | ------------------ | | | | 17| 38|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 38|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 38|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 58| | 59| | // Compute HQC-PKE keypair 60| 38| hqc_pke_keygen(ek_pke, dk_pke, seed_pke); ------------------ | | 14| 38|#define hqc_pke_keygen PQCHQC_NAMESPACE(hqc_pke_keygen) | | ------------------ | | | | 17| 38|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 38|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 38|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 61| | 62| | // Compute HQC-KEM keypair 63| 38| memcpy(ek_kem, ek_pke, PUBLIC_KEY_BYTES); ------------------ | | 27| 38|#define PUBLIC_KEY_BYTES CRYPTO_PUBLICKEYBYTES ///< Define the size of the public key in bytes | | ------------------ | | | | 12| 38|#define CRYPTO_PUBLICKEYBYTES 2241 | | ------------------ ------------------ 64| 38| memcpy(dk_kem, ek_kem, PUBLIC_KEY_BYTES); ------------------ | | 27| 38|#define PUBLIC_KEY_BYTES CRYPTO_PUBLICKEYBYTES ///< Define the size of the public key in bytes | | ------------------ | | | | 12| 38|#define CRYPTO_PUBLICKEYBYTES 2241 | | ------------------ ------------------ 65| 38| memcpy(dk_kem + PUBLIC_KEY_BYTES, dk_pke, SEED_BYTES); ------------------ | | 27| 38|#define PUBLIC_KEY_BYTES CRYPTO_PUBLICKEYBYTES ///< Define the size of the public key in bytes | | ------------------ | | | | 12| 38|#define CRYPTO_PUBLICKEYBYTES 2241 | | ------------------ ------------------ memcpy(dk_kem + PUBLIC_KEY_BYTES, dk_pke, SEED_BYTES); ------------------ | | 52| 38|#define SEED_BYTES 32 ///< Define the size of the seed in bytes ------------------ 66| 38| memcpy(dk_kem + PUBLIC_KEY_BYTES + SEED_BYTES, sigma, PARAM_SECURITY_BYTES); ------------------ | | 27| 38|#define PUBLIC_KEY_BYTES CRYPTO_PUBLICKEYBYTES ///< Define the size of the public key in bytes | | ------------------ | | | | 12| 38|#define CRYPTO_PUBLICKEYBYTES 2241 | | ------------------ ------------------ memcpy(dk_kem + PUBLIC_KEY_BYTES + SEED_BYTES, sigma, PARAM_SECURITY_BYTES); ------------------ | | 52| 38|#define SEED_BYTES 32 ///< Define the size of the seed in bytes ------------------ memcpy(dk_kem + PUBLIC_KEY_BYTES + SEED_BYTES, sigma, PARAM_SECURITY_BYTES); ------------------ | | 23| 38|#define PARAM_SECURITY_BYTES 16 ///< Define the security level in bytes ------------------ 67| 38| memcpy(dk_kem + PUBLIC_KEY_BYTES + SEED_BYTES + PARAM_SECURITY_BYTES, seed_kem, SEED_BYTES); ------------------ | | 27| 38|#define PUBLIC_KEY_BYTES CRYPTO_PUBLICKEYBYTES ///< Define the size of the public key in bytes | | ------------------ | | | | 12| 38|#define CRYPTO_PUBLICKEYBYTES 2241 | | ------------------ ------------------ memcpy(dk_kem + PUBLIC_KEY_BYTES + SEED_BYTES + PARAM_SECURITY_BYTES, seed_kem, SEED_BYTES); ------------------ | | 52| 38|#define SEED_BYTES 32 ///< Define the size of the seed in bytes ------------------ memcpy(dk_kem + PUBLIC_KEY_BYTES + SEED_BYTES + PARAM_SECURITY_BYTES, seed_kem, SEED_BYTES); ------------------ | | 23| 38|#define PARAM_SECURITY_BYTES 16 ///< Define the security level in bytes ------------------ memcpy(dk_kem + PUBLIC_KEY_BYTES + SEED_BYTES + PARAM_SECURITY_BYTES, seed_kem, SEED_BYTES); ------------------ | | 52| 38|#define SEED_BYTES 32 ///< Define the size of the seed in bytes ------------------ 68| | 69| |#ifdef VERBOSE 70| | printf("\n\nseed_kem: "); 71| | for (int i = 0; i < SEED_BYTES; ++i) printf("%02x", seed_kem[i]); 72| | printf("\n\nseed_pke: "); 73| | for (int i = 0; i < SEED_BYTES; ++i) printf("%02x", seed_pke[i]); 74| | printf("\n\nsigma: "); 75| | for (int i = 0; i < PARAM_SECURITY_BYTES; ++i) printf("%02x", sigma[i]); 76| |#endif 77| | 78| | // Zeroize sensitive data 79| 38| memset_zero(seed_kem, sizeof seed_kem); ------------------ | | 22| 38|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 38|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 38|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 38|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 38|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 80| 38| memset_zero(sigma, sizeof sigma); ------------------ | | 22| 38|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 38|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 38|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 38|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 38|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 81| 38| memset_zero(seed_pke, sizeof seed_pke); ------------------ | | 22| 38|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 38|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 38|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 38|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 38|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 82| 38| memset_zero(dk_pke, sizeof dk_pke); ------------------ | | 22| 38|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 38|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 38|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 38|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 38|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 83| | 84| 38| return 0; 85| 38|} PQCHQC_HQC1_C_crypto_kem_enc: 105| 38|int crypto_kem_enc(uint8_t *c_kem, uint8_t *K, const uint8_t *ek_kem) { 106| |#ifdef VERBOSE 107| | printf("\n\n\n\n### ENCAPS ###"); 108| |#endif 109| | 110| 38| uint8_t m[PARAM_SECURITY_BYTES] = {0}; 111| 38| uint8_t K_theta[SHARED_SECRET_BYTES + SEED_BYTES] = {0}; 112| 38| uint8_t theta[SEED_BYTES] = {0}; 113| 38| uint8_t hash_ek_kem[SEED_BYTES] = {0}; 114| 38| ciphertext_kem_t c_kem_t = {0}; 115| | 116| | // Sample message m and salt 117| 38| prng_get_bytes(m, PARAM_SECURITY_BYTES); ------------------ | | 73| 38|#define prng_get_bytes PQCHQC_NAMESPACE(prng_get_bytes) | | ------------------ | | | | 17| 38|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 38|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 38|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ prng_get_bytes(m, PARAM_SECURITY_BYTES); ------------------ | | 23| 38|#define PARAM_SECURITY_BYTES 16 ///< Define the security level in bytes ------------------ 118| 38| prng_get_bytes(c_kem_t.salt, SALT_BYTES); ------------------ | | 73| 38|#define prng_get_bytes PQCHQC_NAMESPACE(prng_get_bytes) | | ------------------ | | | | 17| 38|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 38|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 38|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ prng_get_bytes(c_kem_t.salt, SALT_BYTES); ------------------ | | 53| 38|#define SALT_BYTES 16 ///< Define the size of a salt in bytes ------------------ 119| | 120| | // Compute shared key K and ciphertext c_kem 121| 38| hash_h(hash_ek_kem, ek_kem); ------------------ | | 78| 38|#define hash_h PQCHQC_NAMESPACE(hash_h) | | ------------------ | | | | 17| 38|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 38|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 38|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 122| 38| hash_g(K_theta, hash_ek_kem, m, c_kem_t.salt); ------------------ | | 77| 38|#define hash_g PQCHQC_NAMESPACE(hash_g) | | ------------------ | | | | 17| 38|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 38|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 38|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 123| 38| memcpy(theta, K_theta + SEED_BYTES, SEED_BYTES); ------------------ | | 52| 38|#define SEED_BYTES 32 ///< Define the size of the seed in bytes ------------------ memcpy(theta, K_theta + SEED_BYTES, SEED_BYTES); ------------------ | | 52| 38|#define SEED_BYTES 32 ///< Define the size of the seed in bytes ------------------ 124| 38| hqc_pke_encrypt(&c_kem_t.c_pke, ek_kem, (uint64_t *)m, theta); ------------------ | | 15| 38|#define hqc_pke_encrypt PQCHQC_NAMESPACE(hqc_pke_encrypt) | | ------------------ | | | | 17| 38|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 38|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 38|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 125| | 126| 38| hqc_c_kem_to_string(c_kem, &c_kem_t); ------------------ | | 16| 38|#define hqc_c_kem_to_string PQCHQC_NAMESPACE(hqc_c_kem_to_string) | | ------------------ | | | | 17| 38|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 38|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 38|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 127| 38| memcpy(K, K_theta, SHARED_SECRET_BYTES); ------------------ | | 28| 38|#define SHARED_SECRET_BYTES CRYPTO_BYTES ///< Define the size of the shared secret in bytes | | ------------------ | | | | 13| 38|#define CRYPTO_BYTES 32 | | ------------------ ------------------ 128| | 129| |#ifdef VERBOSE 130| | printf("\n\nek_kem: "); 131| | for (int i = 0; i < PUBLIC_KEY_BYTES; ++i) printf("%02x", ek_kem[i]); 132| | printf("\n\nm: "); 133| | vect_print((uint64_t *)m, PARAM_SECURITY_BYTES); 134| | printf("\n\nsalt: "); 135| | for (int i = 0; i < SALT_BYTES; ++i) printf("%02x", c_kem_t.salt[i]); 136| | printf("\n\nH(ek_kem): "); 137| | for (int i = 0; i < SEED_BYTES; ++i) printf("%02x", hash_ek_kem[i]); 138| | printf("\n\ntheta: "); 139| | for (int i = 0; i < SEED_BYTES; ++i) printf("%02x", theta[i]); 140| | printf("\n\nc_kem: "); 141| | for (int i = 0; i < CIPHERTEXT_BYTES; ++i) printf("%02x", c_kem[i]); 142| | printf("\n\nK: "); 143| | for (int i = 0; i < SHARED_SECRET_BYTES; ++i) printf("%02x", K[i]); 144| |#endif 145| | 146| | // Zeroize sensitive data 147| 38| memset_zero(m, sizeof m); ------------------ | | 22| 38|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 38|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 38|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 38|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 38|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 148| 38| memset_zero(K_theta, sizeof K_theta); ------------------ | | 22| 38|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 38|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 38|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 38|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 38|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 149| 38| memset_zero(theta, sizeof theta); ------------------ | | 22| 38|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 38|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 38|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 38|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 38|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 150| | 151| 38| return 0; 152| 38|} PQCHQC_HQC1_C_crypto_kem_dec: 166| 38|int crypto_kem_dec(uint8_t *K_prime, const uint8_t *c_kem, const uint8_t *dk_kem) { 167| |#ifdef VERBOSE 168| | printf("\n\n\n\n### DECAPS ###"); 169| |#endif 170| | 171| 38| uint8_t ek_pke[PUBLIC_KEY_BYTES] = {0}; 172| 38| uint8_t dk_pke[SEED_BYTES] = {0}; 173| 38| uint8_t sigma[PARAM_SECURITY_BYTES] = {0}; 174| 38| uint8_t m_prime[PARAM_SECURITY_BYTES] = {0}; 175| 38| uint8_t hash_ek_kem[SEED_BYTES] = {0}; 176| 38| uint8_t K_theta_prime[SHARED_SECRET_BYTES + SEED_BYTES] = {0}; 177| 38| uint8_t K_bar[SHARED_SECRET_BYTES] = {0}; 178| 38| uint8_t theta_prime[SEED_BYTES] = {0}; 179| 38| ciphertext_kem_t c_kem_t = {0}; 180| 38| ciphertext_kem_t c_kem_prime_t = {0}; 181| 38| uint8_t result; 182| | 183| | // Parse decapsulation key dk_kem 184| 38| memcpy(ek_pke, dk_kem, PUBLIC_KEY_BYTES); ------------------ | | 27| 38|#define PUBLIC_KEY_BYTES CRYPTO_PUBLICKEYBYTES ///< Define the size of the public key in bytes | | ------------------ | | | | 12| 38|#define CRYPTO_PUBLICKEYBYTES 2241 | | ------------------ ------------------ 185| 38| memcpy(dk_pke, dk_kem + PUBLIC_KEY_BYTES, SEED_BYTES); ------------------ | | 27| 38|#define PUBLIC_KEY_BYTES CRYPTO_PUBLICKEYBYTES ///< Define the size of the public key in bytes | | ------------------ | | | | 12| 38|#define CRYPTO_PUBLICKEYBYTES 2241 | | ------------------ ------------------ memcpy(dk_pke, dk_kem + PUBLIC_KEY_BYTES, SEED_BYTES); ------------------ | | 52| 38|#define SEED_BYTES 32 ///< Define the size of the seed in bytes ------------------ 186| 38| memcpy(sigma, dk_kem + PUBLIC_KEY_BYTES + SEED_BYTES, PARAM_SECURITY_BYTES); ------------------ | | 27| 38|#define PUBLIC_KEY_BYTES CRYPTO_PUBLICKEYBYTES ///< Define the size of the public key in bytes | | ------------------ | | | | 12| 38|#define CRYPTO_PUBLICKEYBYTES 2241 | | ------------------ ------------------ memcpy(sigma, dk_kem + PUBLIC_KEY_BYTES + SEED_BYTES, PARAM_SECURITY_BYTES); ------------------ | | 52| 38|#define SEED_BYTES 32 ///< Define the size of the seed in bytes ------------------ memcpy(sigma, dk_kem + PUBLIC_KEY_BYTES + SEED_BYTES, PARAM_SECURITY_BYTES); ------------------ | | 23| 38|#define PARAM_SECURITY_BYTES 16 ///< Define the security level in bytes ------------------ 187| | 188| | // Parse ciphertext c_kem 189| 38| hqc_c_kem_from_string(&c_kem_t.c_pke, c_kem_t.salt, c_kem); ------------------ | | 17| 38|#define hqc_c_kem_from_string PQCHQC_NAMESPACE(hqc_c_kem_from_string) | | ------------------ | | | | 17| 38|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 38|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 38|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 190| | 191| | // Compute message m_prime 192| 38| result = hqc_pke_decrypt((uint64_t *)m_prime, dk_pke, &c_kem_t.c_pke); ------------------ | | 16| 38|#define hqc_pke_decrypt PQCHQC_NAMESPACE(hqc_pke_decrypt) | | ------------------ | | | | 17| 38|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 38|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 38|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 193| | 194| | // Compute shared key K_prime and ciphertext c_kem_prime 195| 38| hash_h(hash_ek_kem, ek_pke); ------------------ | | 78| 38|#define hash_h PQCHQC_NAMESPACE(hash_h) | | ------------------ | | | | 17| 38|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 38|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 38|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 196| 38| hash_g(K_theta_prime, hash_ek_kem, m_prime, c_kem_t.salt); ------------------ | | 77| 38|#define hash_g PQCHQC_NAMESPACE(hash_g) | | ------------------ | | | | 17| 38|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 38|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 38|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 197| 38| memcpy(K_prime, K_theta_prime, SHARED_SECRET_BYTES); ------------------ | | 28| 38|#define SHARED_SECRET_BYTES CRYPTO_BYTES ///< Define the size of the shared secret in bytes | | ------------------ | | | | 13| 38|#define CRYPTO_BYTES 32 | | ------------------ ------------------ 198| 38| memcpy(theta_prime, K_theta_prime + SHARED_SECRET_BYTES, SEED_BYTES); ------------------ | | 28| 38|#define SHARED_SECRET_BYTES CRYPTO_BYTES ///< Define the size of the shared secret in bytes | | ------------------ | | | | 13| 38|#define CRYPTO_BYTES 32 | | ------------------ ------------------ memcpy(theta_prime, K_theta_prime + SHARED_SECRET_BYTES, SEED_BYTES); ------------------ | | 52| 38|#define SEED_BYTES 32 ///< Define the size of the seed in bytes ------------------ 199| | 200| 38| hqc_pke_encrypt(&c_kem_prime_t.c_pke, ek_pke, (uint64_t *)m_prime, theta_prime); ------------------ | | 15| 38|#define hqc_pke_encrypt PQCHQC_NAMESPACE(hqc_pke_encrypt) | | ------------------ | | | | 17| 38|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 38|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 38|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 201| 38| memcpy(c_kem_prime_t.salt, c_kem_t.salt, SALT_BYTES); ------------------ | | 53| 38|#define SALT_BYTES 16 ///< Define the size of a salt in bytes ------------------ 202| | 203| | // Compute rejection key K_bar 204| 38| hash_j(K_bar, hash_ek_kem, sigma, &c_kem_t); ------------------ | | 80| 38|#define hash_j PQCHQC_NAMESPACE(hash_j) | | ------------------ | | | | 17| 38|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 38|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 38|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 205| 38| result |= vect_compare((uint8_t *)c_kem_t.c_pke.u, (uint8_t *)c_kem_prime_t.c_pke.u, VEC_N_SIZE_BYTES); ------------------ | | 20| 38|#define vect_compare PQCHQC_NAMESPACE(vect_compare) | | ------------------ | | | | 17| 38|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 38|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 38|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ result |= vect_compare((uint8_t *)c_kem_t.c_pke.u, (uint8_t *)c_kem_prime_t.c_pke.u, VEC_N_SIZE_BYTES); ------------------ | | 31| 38|#define VEC_N_SIZE_BYTES CEIL_DIVIDE(PARAM_N, 8) ///< Size of array to store PARAM_N bits in bytes | | ------------------ | | | | 12| 38|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [Folded, False: 38] | | | | ------------------ | | ------------------ ------------------ 206| 38| result |= vect_compare((uint8_t *)c_kem_t.c_pke.v, (uint8_t *)c_kem_prime_t.c_pke.v, VEC_N1N2_SIZE_BYTES); ------------------ | | 20| 38|#define vect_compare PQCHQC_NAMESPACE(vect_compare) | | ------------------ | | | | 17| 38|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 38|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 38|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ result |= vect_compare((uint8_t *)c_kem_t.c_pke.v, (uint8_t *)c_kem_prime_t.c_pke.v, VEC_N1N2_SIZE_BYTES); ------------------ | | 34| 38|#define VEC_N1N2_SIZE_BYTES CEIL_DIVIDE(PARAM_N1N2, 8) ///< Size of array to store PARAM_N1N2 bits in bytes | | ------------------ | | | | 12| 38|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [True: 38, Folded] | | | | ------------------ | | ------------------ ------------------ 207| 38| result |= vect_compare(c_kem_t.salt, c_kem_prime_t.salt, SALT_BYTES); ------------------ | | 20| 38|#define vect_compare PQCHQC_NAMESPACE(vect_compare) | | ------------------ | | | | 17| 38|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 38|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 38|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ result |= vect_compare(c_kem_t.salt, c_kem_prime_t.salt, SALT_BYTES); ------------------ | | 53| 38|#define SALT_BYTES 16 ///< Define the size of a salt in bytes ------------------ 208| 38| result -= 1; 209| 1.25k| for (size_t i = 0; i < SHARED_SECRET_BYTES; ++i) { ------------------ | | 28| 1.25k|#define SHARED_SECRET_BYTES CRYPTO_BYTES ///< Define the size of the shared secret in bytes | | ------------------ | | | | 13| 1.25k|#define CRYPTO_BYTES 32 | | ------------------ ------------------ | Branch (209:24): [True: 1.21k, False: 38] ------------------ 210| 1.21k| K_prime[i] = (K_prime[i] & result) ^ (K_bar[i] & ~result); 211| 1.21k| } 212| | 213| |#ifdef VERBOSE 214| | printf("\n\nek_pke: "); 215| | for (int i = 0; i < PUBLIC_KEY_BYTES; ++i) printf("%02x", ek_pke[i]); 216| | printf("\n\ndk_pke: "); 217| | for (int i = 0; i < SEED_BYTES; ++i) printf("%02x", dk_pke[i]); 218| | printf("\n\nc_kem: "); 219| | for (int i = 0; i < CIPHERTEXT_BYTES; ++i) printf("%02x", c_kem[i]); 220| | printf("\n\nm_prime: "); 221| | vect_print((uint64_t *)m_prime, PARAM_SECURITY_BYTES); 222| | printf("\n\nH(ek_kem): "); 223| | for (int i = 0; i < SEED_BYTES; ++i) printf("%02x", hash_ek_kem[i]); 224| | printf("\n\ntheta_prime: "); 225| | for (int i = 0; i < SEED_BYTES; ++i) printf("%02x", theta_prime[i]); 226| | printf("\n\n\n# Checking Ciphertext - Begin #"); 227| | printf("\n\nc_kem_prime_t.c_pke.u: "); 228| | vect_print(c_kem_prime_t.c_pke.u, VEC_N_SIZE_BYTES); 229| | printf("\n\nc_kem_prime_t.c_pke.v: "); 230| | vect_print(c_kem_prime_t.c_pke.v, VEC_N1N2_SIZE_BYTES); 231| | printf("\n\nsalt: "); 232| | for (int i = 0; i < SALT_BYTES; ++i) printf("%02x", c_kem_prime_t.salt[i]); 233| | printf("\n\n# Checking Ciphertext - End #\n"); 234| | printf("\n\nK_prime: "); 235| | for (int i = 0; i < SHARED_SECRET_BYTES; ++i) printf("%02x", K_prime[i]); 236| |#endif 237| | 238| | // Zeroize sensitive data 239| 38| memset_zero(dk_pke, sizeof dk_pke); ------------------ | | 22| 38|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 38|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 38|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 38|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 38|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 240| 38| memset_zero(sigma, sizeof sigma); ------------------ | | 22| 38|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 38|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 38|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 38|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 38|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 241| 38| memset_zero(m_prime, sizeof m_prime); ------------------ | | 22| 38|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 38|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 38|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 38|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 38|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 242| 38| memset_zero(K_theta_prime, sizeof K_theta_prime); ------------------ | | 22| 38|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 38|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 38|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 38|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 38|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 243| 38| memset_zero(K_bar, sizeof K_bar); ------------------ | | 22| 38|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 38|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 38|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 38|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 38|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 244| 38| memset_zero(theta_prime, sizeof theta_prime); ------------------ | | 22| 38|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 38|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 38|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 38|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 38|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 245| | 246| 38| return 0; 247| 38|} PQCHQC_HQC1_C_hqc_dk_pke_from_string: 19| 38|void hqc_dk_pke_from_string(uint64_t *y, const uint8_t *dk_pke) { 20| 38| shake256_xof_ctx dk_xof_ctx = {0}; 21| 38| xof_init(&dk_xof_ctx, dk_pke, SEED_BYTES); ------------------ | | 74| 38|#define xof_init PQCHQC_NAMESPACE(xof_init) | | ------------------ | | | | 17| 38|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 38|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 38|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ xof_init(&dk_xof_ctx, dk_pke, SEED_BYTES); ------------------ | | 52| 38|#define SEED_BYTES 32 ///< Define the size of the seed in bytes ------------------ 22| 38| vect_sample_fixed_weight1(&dk_xof_ctx, y, PARAM_OMEGA); ------------------ | | 16| 38|#define vect_sample_fixed_weight1 PQCHQC_NAMESPACE(vect_sample_fixed_weight1) | | ------------------ | | | | 17| 38|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 38|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 38|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ vect_sample_fixed_weight1(&dk_xof_ctx, y, PARAM_OMEGA); ------------------ | | 19| 38|#define PARAM_OMEGA 66 ///< Define the parameter omega of the scheme ------------------ 23| 38| xof_ctx_release(&dk_xof_ctx); ------------------ | | 76| 38|#define xof_ctx_release PQCHQC_NAMESPACE(xof_ctx_release) | | ------------------ | | | | 17| 38|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 38|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 38|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 24| | 25| | // Zeroize sensitive data 26| 38| memset_zero(&dk_xof_ctx, sizeof dk_xof_ctx); ------------------ | | 22| 38|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 38|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 38|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 38|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 38|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 27| 38|} PQCHQC_HQC1_C_hqc_ek_pke_from_string: 36| 76|void hqc_ek_pke_from_string(uint64_t *h, uint64_t *s, const uint8_t *ek_pke) { 37| 76| shake256_xof_ctx ek_xof_ctx = {0}; 38| | 39| 76| xof_init(&ek_xof_ctx, ek_pke, SEED_BYTES); ------------------ | | 74| 76|#define xof_init PQCHQC_NAMESPACE(xof_init) | | ------------------ | | | | 17| 76|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 76|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 76|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ xof_init(&ek_xof_ctx, ek_pke, SEED_BYTES); ------------------ | | 52| 76|#define SEED_BYTES 32 ///< Define the size of the seed in bytes ------------------ 40| 76| vect_set_random(&ek_xof_ctx, h); ------------------ | | 18| 76|#define vect_set_random PQCHQC_NAMESPACE(vect_set_random) | | ------------------ | | | | 17| 76|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 76|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 76|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 41| 76| xof_ctx_release(&ek_xof_ctx); ------------------ | | 76| 76|#define xof_ctx_release PQCHQC_NAMESPACE(xof_ctx_release) | | ------------------ | | | | 17| 76|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 76|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 76|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 42| | 43| 76| memcpy(s, ek_pke + SEED_BYTES, VEC_N_SIZE_BYTES); ------------------ | | 52| 76|#define SEED_BYTES 32 ///< Define the size of the seed in bytes ------------------ memcpy(s, ek_pke + SEED_BYTES, VEC_N_SIZE_BYTES); ------------------ | | 31| 76|#define VEC_N_SIZE_BYTES CEIL_DIVIDE(PARAM_N, 8) ///< Size of array to store PARAM_N bits in bytes | | ------------------ | | | | 12| 76|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [Folded, False: 76] | | | | ------------------ | | ------------------ ------------------ 44| 76|} PQCHQC_HQC1_C_hqc_c_kem_to_string: 52| 38|void hqc_c_kem_to_string(uint8_t *ct, const ciphertext_kem_t *c_kem) { 53| 38| memcpy(ct, c_kem->c_pke.u, VEC_N_SIZE_BYTES); ------------------ | | 31| 38|#define VEC_N_SIZE_BYTES CEIL_DIVIDE(PARAM_N, 8) ///< Size of array to store PARAM_N bits in bytes | | ------------------ | | | | 12| 38|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [Folded, False: 38] | | | | ------------------ | | ------------------ ------------------ 54| 38| memcpy(ct + VEC_N_SIZE_BYTES, c_kem->c_pke.v, VEC_N1N2_SIZE_BYTES); ------------------ | | 31| 38|#define VEC_N_SIZE_BYTES CEIL_DIVIDE(PARAM_N, 8) ///< Size of array to store PARAM_N bits in bytes | | ------------------ | | | | 12| 38|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [Folded, False: 38] | | | | ------------------ | | ------------------ ------------------ memcpy(ct + VEC_N_SIZE_BYTES, c_kem->c_pke.v, VEC_N1N2_SIZE_BYTES); ------------------ | | 34| 38|#define VEC_N1N2_SIZE_BYTES CEIL_DIVIDE(PARAM_N1N2, 8) ///< Size of array to store PARAM_N1N2 bits in bytes | | ------------------ | | | | 12| 38|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [True: 38, Folded] | | | | ------------------ | | ------------------ ------------------ 55| 38| memcpy(ct + VEC_N_SIZE_BYTES + VEC_N1N2_SIZE_BYTES, c_kem->salt, SALT_BYTES); ------------------ | | 31| 38|#define VEC_N_SIZE_BYTES CEIL_DIVIDE(PARAM_N, 8) ///< Size of array to store PARAM_N bits in bytes | | ------------------ | | | | 12| 38|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [Folded, False: 38] | | | | ------------------ | | ------------------ ------------------ memcpy(ct + VEC_N_SIZE_BYTES + VEC_N1N2_SIZE_BYTES, c_kem->salt, SALT_BYTES); ------------------ | | 34| 38|#define VEC_N1N2_SIZE_BYTES CEIL_DIVIDE(PARAM_N1N2, 8) ///< Size of array to store PARAM_N1N2 bits in bytes | | ------------------ | | | | 12| 38|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [True: 38, Folded] | | | | ------------------ | | ------------------ ------------------ memcpy(ct + VEC_N_SIZE_BYTES + VEC_N1N2_SIZE_BYTES, c_kem->salt, SALT_BYTES); ------------------ | | 53| 38|#define SALT_BYTES 16 ///< Define the size of a salt in bytes ------------------ 56| 38|} PQCHQC_HQC1_C_hqc_c_kem_from_string: 65| 38|void hqc_c_kem_from_string(ciphertext_pke_t *c_pke, uint8_t *salt, const uint8_t *ct) { 66| 38| memcpy(c_pke->u, ct, VEC_N_SIZE_BYTES); ------------------ | | 31| 38|#define VEC_N_SIZE_BYTES CEIL_DIVIDE(PARAM_N, 8) ///< Size of array to store PARAM_N bits in bytes | | ------------------ | | | | 12| 38|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [Folded, False: 38] | | | | ------------------ | | ------------------ ------------------ 67| 38| memcpy(c_pke->v, ct + VEC_N_SIZE_BYTES, VEC_N1N2_SIZE_BYTES); ------------------ | | 31| 38|#define VEC_N_SIZE_BYTES CEIL_DIVIDE(PARAM_N, 8) ///< Size of array to store PARAM_N bits in bytes | | ------------------ | | | | 12| 38|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [Folded, False: 38] | | | | ------------------ | | ------------------ ------------------ memcpy(c_pke->v, ct + VEC_N_SIZE_BYTES, VEC_N1N2_SIZE_BYTES); ------------------ | | 34| 38|#define VEC_N1N2_SIZE_BYTES CEIL_DIVIDE(PARAM_N1N2, 8) ///< Size of array to store PARAM_N1N2 bits in bytes | | ------------------ | | | | 12| 38|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [True: 38, Folded] | | | | ------------------ | | ------------------ ------------------ 68| 38| memcpy(salt, ct + VEC_N_SIZE_BYTES + VEC_N1N2_SIZE_BYTES, SALT_BYTES); ------------------ | | 31| 38|#define VEC_N_SIZE_BYTES CEIL_DIVIDE(PARAM_N, 8) ///< Size of array to store PARAM_N bits in bytes | | ------------------ | | | | 12| 38|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [Folded, False: 38] | | | | ------------------ | | ------------------ ------------------ memcpy(salt, ct + VEC_N_SIZE_BYTES + VEC_N1N2_SIZE_BYTES, SALT_BYTES); ------------------ | | 34| 38|#define VEC_N1N2_SIZE_BYTES CEIL_DIVIDE(PARAM_N1N2, 8) ///< Size of array to store PARAM_N1N2 bits in bytes | | ------------------ | | | | 12| 38|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [True: 38, Folded] | | | | ------------------ | | ------------------ ------------------ memcpy(salt, ct + VEC_N_SIZE_BYTES + VEC_N1N2_SIZE_BYTES, SALT_BYTES); ------------------ | | 53| 38|#define SALT_BYTES 16 ///< Define the size of a salt in bytes ------------------ 69| 38|} PQCHQC_HQC1_C_reed_muller_encode: 174| 76|void reed_muller_encode(uint64_t *cdw, const uint64_t *msg) { 175| 76| uint8_t *message_array = (uint8_t *)msg; 176| 76| rm_codeword_t *codeArray = (rm_codeword_t *)cdw; 177| 3.57k| for (size_t i = 0; i < VEC_N1_SIZE_BYTES; i++) { ------------------ | | 33| 3.57k|#define VEC_N1_SIZE_BYTES PARAM_N1 ///< Size of array to store PARAM_N1 bits in bytes | | ------------------ | | | | 16| 3.57k|#define PARAM_N1 46 ///< Define the parameter n1 of the scheme (length of Reed–Solomon code) | | ------------------ ------------------ | Branch (177:24): [True: 3.49k, False: 76] ------------------ 178| | // fill entries i * MULTIPLICITY to (i+1) * MULTIPLICITY 179| 3.49k| int32_t pos = i * MULTIPLICITY; ------------------ | | 18| 3.49k|#define MULTIPLICITY CEIL_DIVIDE(PARAM_N2, 128) | | ------------------ | | | | 12| 3.49k|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [True: 3.49k, Folded] | | | | ------------------ | | ------------------ ------------------ 180| | // encode first word 181| 3.49k| encode(&codeArray[pos], message_array[i]); 182| | // copy to other identical codewords 183| 10.4k| for (size_t copy = 1; copy < MULTIPLICITY; copy++) { ------------------ | | 18| 10.4k|#define MULTIPLICITY CEIL_DIVIDE(PARAM_N2, 128) | | ------------------ | | | | 12| 10.4k|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [True: 10.4k, Folded] | | | | ------------------ | | ------------------ ------------------ | Branch (183:31): [True: 6.99k, False: 3.49k] ------------------ 184| 6.99k| memcpy(&codeArray[pos + copy], &codeArray[pos], sizeof(rm_codeword_t)); 185| 6.99k| } 186| 3.49k| } 187| 76|} PQCHQC_HQC1_C_reed_muller_decode: 198| 38|void reed_muller_decode(uint64_t *msg, const uint64_t *cdw) { 199| 38| uint8_t *message_array = (uint8_t *)msg; 200| 38| rm_codeword_t *codeArray = (rm_codeword_t *)cdw; 201| 38| rm_expanded_cdw expanded; 202| 1.78k| for (size_t i = 0; i < VEC_N1_SIZE_BYTES; i++) { ------------------ | | 33| 1.78k|#define VEC_N1_SIZE_BYTES PARAM_N1 ///< Size of array to store PARAM_N1 bits in bytes | | ------------------ | | | | 16| 1.78k|#define PARAM_N1 46 ///< Define the parameter n1 of the scheme (length of Reed–Solomon code) | | ------------------ ------------------ | Branch (202:24): [True: 1.74k, False: 38] ------------------ 203| | // collect the codewords 204| 1.74k| expand_and_sum(&expanded, &codeArray[i * MULTIPLICITY]); ------------------ | | 18| 1.74k|#define MULTIPLICITY CEIL_DIVIDE(PARAM_N2, 128) | | ------------------ | | | | 12| 1.74k|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [True: 1.74k, Folded] | | | | ------------------ | | ------------------ ------------------ 205| | // apply hadamard transform 206| 1.74k| rm_expanded_cdw transform; 207| 1.74k| hadamard(&expanded, &transform); 208| | // fix the first entry to get the half Hadamard transform 209| 1.74k| transform[0] -= 64 * MULTIPLICITY; ------------------ | | 18| 1.74k|#define MULTIPLICITY CEIL_DIVIDE(PARAM_N2, 128) | | ------------------ | | | | 12| 1.74k|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [True: 1.74k, Folded] | | | | ------------------ | | ------------------ ------------------ 210| | // finish the decoding 211| 1.74k| message_array[i] = find_peaks(&transform); 212| 1.74k| } 213| 38|} reed_muller.c:encode: 59| 15.6k|static void encode(rm_codeword_t *word, int32_t message) { 60| 15.6k| int32_t first_word; 61| | 62| 15.6k| first_word = BIT0MASK(message >> 7); ------------------ | | 34| 15.6k|#define BIT0MASK(x) (int32_t)(-((x) & 1)) ------------------ 63| | 64| 15.6k| first_word ^= BIT0MASK(message >> 0) & 0xaaaaaaaa; ------------------ | | 34| 15.6k|#define BIT0MASK(x) (int32_t)(-((x) & 1)) ------------------ 65| 15.6k| first_word ^= BIT0MASK(message >> 1) & 0xcccccccc; ------------------ | | 34| 15.6k|#define BIT0MASK(x) (int32_t)(-((x) & 1)) ------------------ 66| 15.6k| first_word ^= BIT0MASK(message >> 2) & 0xf0f0f0f0; ------------------ | | 34| 15.6k|#define BIT0MASK(x) (int32_t)(-((x) & 1)) ------------------ 67| 15.6k| first_word ^= BIT0MASK(message >> 3) & 0xff00ff00; ------------------ | | 34| 15.6k|#define BIT0MASK(x) (int32_t)(-((x) & 1)) ------------------ 68| 15.6k| first_word ^= BIT0MASK(message >> 4) & 0xffff0000; ------------------ | | 34| 15.6k|#define BIT0MASK(x) (int32_t)(-((x) & 1)) ------------------ 69| | 70| 15.6k| word->u32[0] = first_word; 71| | 72| 15.6k| first_word ^= BIT0MASK(message >> 5); ------------------ | | 34| 15.6k|#define BIT0MASK(x) (int32_t)(-((x) & 1)) ------------------ 73| 15.6k| word->u32[1] = first_word; 74| 15.6k| first_word ^= BIT0MASK(message >> 6); ------------------ | | 34| 15.6k|#define BIT0MASK(x) (int32_t)(-((x) & 1)) ------------------ 75| 15.6k| word->u32[3] = first_word; 76| 15.6k| first_word ^= BIT0MASK(message >> 5); ------------------ | | 34| 15.6k|#define BIT0MASK(x) (int32_t)(-((x) & 1)) ------------------ 77| 15.6k| word->u32[2] = first_word; 78| 15.6k| return; 79| 15.6k|} reed_muller.c:expand_and_sum: 121| 7.81k|static void expand_and_sum(rm_expanded_cdw *dest, rm_codeword_t src[]) { 122| | // start with the first copy 123| 39.0k| for (int32_t part = 0; part < 4; part++) { ------------------ | Branch (123:28): [True: 31.2k, False: 7.81k] ------------------ 124| 1.03M| for (int32_t bit = 0; bit < 32; bit++) { ------------------ | Branch (124:31): [True: 999k, False: 31.2k] ------------------ 125| 999k| (*dest)[part * 32 + bit] = src[0].u32[part] >> bit & 1; 126| 999k| } 127| 31.2k| } 128| | // sum the rest of the copies 129| 35.5k| for (int32_t copy = 1; copy < MULTIPLICITY; copy++) { ------------------ | | 18| 35.5k|#define MULTIPLICITY CEIL_DIVIDE(PARAM_N2, 128) | | ------------------ | | | | 12| 35.5k|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [True: 35.5k, Folded] | | | | ------------------ | | ------------------ ------------------ | Branch (129:28): [True: 27.7k, False: 7.81k] ------------------ 130| 138k| for (int32_t part = 0; part < 4; part++) { ------------------ | Branch (130:32): [True: 111k, False: 27.7k] ------------------ 131| 3.66M| for (int32_t bit = 0; bit < 32; bit++) { ------------------ | Branch (131:35): [True: 3.55M, False: 111k] ------------------ 132| 3.55M| (*dest)[part * 32 + bit] += src[copy].u32[part] >> bit & 1; 133| 3.55M| } 134| 111k| } 135| 27.7k| } 136| 7.81k|} reed_muller.c:hadamard: 90| 7.81k|static void hadamard(rm_expanded_cdw *src, rm_expanded_cdw *dst) { 91| | // the passes move data: 92| | // src -> dst -> src -> dst -> src -> dst -> src -> dst 93| | // using p1 and p2 alternately 94| 7.81k| rm_expanded_cdw *p1 = src; 95| 7.81k| rm_expanded_cdw *p2 = dst; 96| 62.4k| for (int32_t pass = 0; pass < 7; pass++) { ------------------ | Branch (96:28): [True: 54.6k, False: 7.81k] ------------------ 97| 3.55M| for (int32_t i = 0; i < 64; i++) { ------------------ | Branch (97:29): [True: 3.49M, False: 54.6k] ------------------ 98| 3.49M| (*p2)[i] = (*p1)[2 * i] + (*p1)[2 * i + 1]; 99| 3.49M| (*p2)[i + 64] = (*p1)[2 * i] - (*p1)[2 * i + 1]; 100| 3.49M| } 101| | // swap p1, p2 for next round 102| 54.6k| rm_expanded_cdw *p3 = p1; 103| 54.6k| p1 = p2; 104| 54.6k| p2 = p3; 105| 54.6k| } 106| 7.81k|} reed_muller.c:find_peaks: 147| 7.81k|static int32_t find_peaks(rm_expanded_cdw *transform) { 148| 7.81k| int32_t peak_abs_value = 0; 149| 7.81k| int32_t peak_value = 0; 150| 7.81k| int32_t peak_pos = 0; 151| 1.00M| for (int32_t i = 0; i < 128; i++) { ------------------ | Branch (151:25): [True: 999k, False: 7.81k] ------------------ 152| | // get absolute value 153| 999k| int32_t t = (*transform)[i]; 154| 999k| int32_t pos_mask = -(t > 0); 155| 999k| int32_t absolute = (pos_mask & t) | (~pos_mask & -t); 156| 999k| peak_value = absolute > peak_abs_value ? t : peak_value; ------------------ | Branch (156:22): [True: 38.1k, False: 961k] ------------------ 157| 999k| peak_pos = absolute > peak_abs_value ? i : peak_pos; ------------------ | Branch (157:20): [True: 38.1k, False: 961k] ------------------ 158| 999k| peak_abs_value = absolute > peak_abs_value ? absolute : peak_abs_value; ------------------ | Branch (158:26): [True: 38.1k, False: 961k] ------------------ 159| 999k| } 160| | // set bit 7 161| 7.81k| peak_pos |= 128 * (peak_value > 0); 162| 7.81k| return peak_pos; 163| 7.81k|} PQCHQC_HQC1_C_reed_solomon_encode: 84| 76|void reed_solomon_encode(uint64_t *cdw, const uint64_t *msg) { 85| 76| size_t i, j, k; 86| 76| uint8_t gate_value = 0; 87| | 88| 76| uint16_t tmp[PARAM_G] = {0}; 89| 76| uint16_t PARAM_RS_POLY[] = {RS_POLY_COEFS}; ------------------ | | 49| 76| 89, 69, 153, 116, 176, 117, 111, 75, 73, 233, 242, 233, 65, 210, 21, 139, 103, 173, 67, 118, \ | | 50| 76| 105, 210, 174, 110, 74, 69, 228, 82, 255, 181, 1 ///< Coefficients of the Reed–Solomon generator polynomial ------------------ 90| | 91| 76| uint8_t msg_bytes[PARAM_K] = {0}; 92| 76| uint8_t cdw_bytes[PARAM_N1] = {0}; 93| | 94| 76| memcpy(msg_bytes, msg, PARAM_K); ------------------ | | 44| 76|#define PARAM_K 16 ///< Define the size of the information bits of the Reed–Solomon code ------------------ 95| | 96| 1.29k| for (i = 0; i < PARAM_K; ++i) { ------------------ | | 44| 1.29k|#define PARAM_K 16 ///< Define the size of the information bits of the Reed–Solomon code ------------------ | Branch (96:17): [True: 1.21k, False: 76] ------------------ 97| 1.21k| gate_value = msg_bytes[PARAM_K - 1 - i] ^ cdw_bytes[PARAM_N1 - PARAM_K - 1]; ------------------ | | 44| 1.21k|#define PARAM_K 16 ///< Define the size of the information bits of the Reed–Solomon code ------------------ gate_value = msg_bytes[PARAM_K - 1 - i] ^ cdw_bytes[PARAM_N1 - PARAM_K - 1]; ------------------ | | 16| 1.21k|#define PARAM_N1 46 ///< Define the parameter n1 of the scheme (length of Reed–Solomon code) ------------------ gate_value = msg_bytes[PARAM_K - 1 - i] ^ cdw_bytes[PARAM_N1 - PARAM_K - 1]; ------------------ | | 44| 1.21k|#define PARAM_K 16 ///< Define the size of the information bits of the Reed–Solomon code ------------------ 98| | 99| 38.9k| for (j = 0; j < PARAM_G; ++j) { ------------------ | | 45| 38.9k|#define PARAM_G 31 ///< Define the size of the generator polynomial of the Reed–Solomon code ------------------ | Branch (99:21): [True: 37.6k, False: 1.21k] ------------------ 100| 37.6k| tmp[j] = gf_mul(gate_value, PARAM_RS_POLY[j]); ------------------ | | 51| 37.6k|#define gf_mul PQCHQC_NAMESPACE(gf_mul) | | ------------------ | | | | 17| 37.6k|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 37.6k|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 37.6k|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 101| 37.6k| } 102| | 103| 36.4k| for (k = PARAM_N1 - PARAM_K - 1; k; --k) { ------------------ | | 16| 1.21k|#define PARAM_N1 46 ///< Define the parameter n1 of the scheme (length of Reed–Solomon code) ------------------ for (k = PARAM_N1 - PARAM_K - 1; k; --k) { ------------------ | | 44| 1.21k|#define PARAM_K 16 ///< Define the size of the information bits of the Reed–Solomon code ------------------ | Branch (103:42): [True: 35.2k, False: 1.21k] ------------------ 104| 35.2k| cdw_bytes[k] = cdw_bytes[k - 1] ^ tmp[k]; 105| 35.2k| } 106| | 107| 1.21k| cdw_bytes[0] = tmp[0]; 108| 1.21k| } 109| | 110| 76| memcpy(cdw_bytes + PARAM_N1 - PARAM_K, msg_bytes, PARAM_K); ------------------ | | 16| 76|#define PARAM_N1 46 ///< Define the parameter n1 of the scheme (length of Reed–Solomon code) ------------------ memcpy(cdw_bytes + PARAM_N1 - PARAM_K, msg_bytes, PARAM_K); ------------------ | | 44| 76|#define PARAM_K 16 ///< Define the size of the information bits of the Reed–Solomon code ------------------ memcpy(cdw_bytes + PARAM_N1 - PARAM_K, msg_bytes, PARAM_K); ------------------ | | 44| 76|#define PARAM_K 16 ///< Define the size of the information bits of the Reed–Solomon code ------------------ 111| 76| memcpy(cdw, cdw_bytes, PARAM_N1); ------------------ | | 16| 76|#define PARAM_N1 46 ///< Define the parameter n1 of the scheme (length of Reed–Solomon code) ------------------ 112| 76|} PQCHQC_HQC1_C_reed_solomon_decode: 353| 38|void reed_solomon_decode(uint64_t *msg, uint64_t *cdw) { 354| 38| uint8_t cdw_bytes[PARAM_N1] = {0}; 355| 38| uint16_t syndromes[2 * PARAM_DELTA] = {0}; 356| 38| uint16_t sigma[1 << PARAM_FFT] = {0}; 357| 38| uint8_t error[1 << PARAM_M] = {0}; 358| 38| uint16_t z[PARAM_N1] = {0}; 359| 38| uint16_t error_values[PARAM_N1] = {0}; 360| 38| uint16_t deg; 361| | 362| | // Copy the vector in an array of bytes 363| 38| memcpy(cdw_bytes, cdw, PARAM_N1); ------------------ | | 16| 38|#define PARAM_N1 46 ///< Define the parameter n1 of the scheme (length of Reed–Solomon code) ------------------ 364| | 365| | // Calculate the 2*PARAM_DELTA syndromes 366| 38| compute_syndromes(syndromes, cdw_bytes); 367| | 368| | // Compute the error locator polynomial sigma 369| | // Sigma's degree is at most PARAM_DELTA but the FFT requires the extra room 370| 38| deg = compute_elp(sigma, syndromes); 371| | 372| | // Compute the error polynomial error 373| 38| compute_roots(error, sigma); 374| | 375| | // Compute the polynomial z(x) 376| 38| compute_z_poly(z, sigma, deg, syndromes); 377| | 378| | // Compute the error values 379| 38| compute_error_values(error_values, z, error); 380| | 381| | // Correct the errors 382| 38| correct_errors(cdw_bytes, error_values); 383| | 384| | // Retrieve the message from the decoded codeword 385| 38| memcpy(msg, cdw_bytes + (PARAM_G - 1), PARAM_K); ------------------ | | 45| 38|#define PARAM_G 31 ///< Define the size of the generator polynomial of the Reed–Solomon code ------------------ memcpy(msg, cdw_bytes + (PARAM_G - 1), PARAM_K); ------------------ | | 44| 38|#define PARAM_K 16 ///< Define the size of the information bits of the Reed–Solomon code ------------------ 386| | 387| |#ifdef VERBOSE 388| | printf("\n\nThe syndromes: "); 389| | for (size_t i = 0; i < 2 * PARAM_DELTA; ++i) { 390| | printf("%u ", syndromes[i]); 391| | } 392| | printf("\n\nThe error locator polynomial: sigma(x) = "); 393| | bool first_coeff = true; 394| | if (sigma[0]) { 395| | printf("%u", sigma[0]); 396| | first_coeff = false; 397| | } 398| | for (size_t i = 1; i < (1 << PARAM_FFT); ++i) { 399| | if (sigma[i] == 0) 400| | continue; 401| | if (!first_coeff) 402| | printf(" + "); 403| | first_coeff = false; 404| | if (sigma[i] != 1) 405| | printf("%u ", sigma[i]); 406| | if (i == 1) 407| | printf("x"); 408| | else 409| | printf("x^%zu", i); 410| | } 411| | if (first_coeff) 412| | printf("0"); 413| | 414| | printf("\n\nThe polynomial: z(x) = "); 415| | bool first_coeff_1 = true; 416| | if (z[0]) { 417| | printf("%u", z[0]); 418| | first_coeff_1 = false; 419| | } 420| | for (size_t i = 1; i < (PARAM_DELTA + 1); ++i) { 421| | if (z[i] == 0) 422| | continue; 423| | if (!first_coeff_1) 424| | printf(" + "); 425| | first_coeff_1 = false; 426| | if (z[i] != 1) 427| | printf("%u ", z[i]); 428| | if (i == 1) 429| | printf("x"); 430| | else 431| | printf("x^%zu", i); 432| | } 433| | if (first_coeff_1) 434| | printf("0"); 435| | 436| | printf("\n\nThe pairs of (error locator numbers, error values): "); 437| | size_t j = 0; 438| | for (size_t i = 0; i < PARAM_N1; ++i) { 439| | if (error[i]) { 440| | printf("(%zu, %d) ", i, error_values[j]); 441| | j++; 442| | } 443| | } 444| | printf("\n"); 445| |#endif 446| | 447| | // Zeroize sensitive data 448| 38| memset_zero(cdw_bytes, sizeof cdw_bytes); ------------------ | | 22| 38|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 38|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 38|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 38|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 38|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 449| 38|} reed_solomon.c:compute_syndromes: 120| 122|void compute_syndromes(uint16_t *syndromes, uint8_t *cdw) { 121| 4.99k| for (size_t i = 0; i < 2 * PARAM_DELTA; ++i) { ------------------ | | 40| 4.99k|#define PARAM_DELTA 15 ///< Define the error-correcting capacity (delta) of the Reed–Solomon code ------------------ | Branch (121:24): [True: 4.86k, False: 122] ------------------ 122| 340k| for (size_t j = 1; j < PARAM_N1; ++j) { ------------------ | | 16| 340k|#define PARAM_N1 46 ///< Define the parameter n1 of the scheme (length of Reed–Solomon code) ------------------ | Branch (122:28): [True: 335k, False: 4.86k] ------------------ 123| 335k| syndromes[i] ^= gf_mul(cdw[j], alpha_ij_pow[i][j - 1]); ------------------ | | 51| 335k|#define gf_mul PQCHQC_NAMESPACE(gf_mul) | | ------------------ | | | | 17| 335k|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 335k|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 335k|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 124| 335k| } 125| 4.86k| syndromes[i] ^= cdw[0]; 126| 4.86k| } 127| 122|} reed_solomon.c:compute_elp: 143| 122|static uint16_t compute_elp(uint16_t *sigma, const uint16_t *syndromes) { 144| 122| uint16_t deg_sigma = 0; 145| 122| uint16_t deg_sigma_p = 0; 146| 122| uint16_t deg_sigma_copy = 0; 147| 122| uint16_t sigma_copy[PARAM_DELTA + 1] = {0}; 148| 122| uint16_t X_sigma_p[PARAM_DELTA + 1] = {0, 1}; 149| 122| uint16_t pp = (uint16_t)-1; // 2*rho 150| 122| uint16_t d_p = 1; 151| 122| uint16_t d = syndromes[0]; 152| | 153| 122| uint16_t mask1, mask2, mask12; 154| 122| uint16_t deg_X, deg_X_sigma_p; 155| 122| uint16_t dd; 156| 122| uint16_t mu; 157| | 158| 122| uint16_t i; 159| | 160| 122| sigma[0] = 1; 161| 4.86k| for (mu = 0; (mu < (2 * PARAM_DELTA)); ++mu) { ------------------ | | 40| 4.86k|#define PARAM_DELTA 15 ///< Define the error-correcting capacity (delta) of the Reed–Solomon code ------------------ | Branch (161:18): [True: 4.86k, False: 0] ------------------ 162| | // Save sigma in case we need it to update X_sigma_p 163| 4.86k| memcpy(sigma_copy, sigma, 2 * (PARAM_DELTA)); ------------------ | | 40| 4.86k|#define PARAM_DELTA 15 ///< Define the error-correcting capacity (delta) of the Reed–Solomon code ------------------ 164| 4.86k| deg_sigma_copy = deg_sigma; 165| | 166| 4.86k| dd = gf_mul(d, gf_inverse(d_p)); ------------------ | | 51| 4.86k|#define gf_mul PQCHQC_NAMESPACE(gf_mul) | | ------------------ | | | | 17| 4.86k|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 4.86k|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 4.86k|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ dd = gf_mul(d, gf_inverse(d_p)); ------------------ | | 53| 4.86k|#define gf_inverse PQCHQC_NAMESPACE(gf_inverse) | | ------------------ | | | | 17| 4.86k|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 4.86k|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 4.86k|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 167| | 168| 86.2k| for (i = 1; (i <= mu + 1) && (i <= PARAM_DELTA); ++i) { ------------------ | | 40| 83.8k|#define PARAM_DELTA 15 ///< Define the error-correcting capacity (delta) of the Reed–Solomon code ------------------ | Branch (168:21): [True: 83.8k, False: 2.43k] | Branch (168:38): [True: 81.3k, False: 2.43k] ------------------ 169| 81.3k| sigma[i] ^= gf_mul(dd, X_sigma_p[i]); ------------------ | | 51| 81.3k|#define gf_mul PQCHQC_NAMESPACE(gf_mul) | | ------------------ | | | | 17| 81.3k|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 81.3k|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 81.3k|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 170| 81.3k| } 171| | 172| 4.86k| deg_X = mu - pp; 173| 4.86k| deg_X_sigma_p = deg_X + deg_sigma_p; 174| | 175| | // mask1 = 0xffff if(d != 0) and 0 otherwise 176| 4.86k| mask1 = -((uint16_t)-d >> 15); 177| | 178| | // mask2 = 0xffff if(deg_X_sigma_p > deg_sigma) and 0 otherwise 179| 4.86k| mask2 = -((uint16_t)(deg_sigma - deg_X_sigma_p) >> 15); 180| | 181| | // mask12 = 0xffff if the deg_sigma increased and 0 otherwise 182| 4.86k| volatile uint16_t mask12__ = mask1 & mask2; 183| 4.86k| mask12 = mask12__; 184| 4.86k| deg_sigma ^= mask12 & (deg_X_sigma_p ^ deg_sigma); 185| | 186| 4.86k| if (mu == (2 * PARAM_DELTA - 1)) { ------------------ | | 40| 4.86k|#define PARAM_DELTA 15 ///< Define the error-correcting capacity (delta) of the Reed–Solomon code ------------------ | Branch (186:13): [True: 122, False: 4.74k] ------------------ 187| 122| break; 188| 122| } 189| | 190| 4.74k| pp ^= mask12 & (mu ^ pp); 191| 4.74k| d_p ^= mask12 & (d ^ d_p); 192| 109k| for (i = PARAM_DELTA; i; --i) { ------------------ | | 40| 4.74k|#define PARAM_DELTA 15 ///< Define the error-correcting capacity (delta) of the Reed–Solomon code ------------------ | Branch (192:31): [True: 104k, False: 4.74k] ------------------ 193| 104k| X_sigma_p[i] = (mask12 & sigma_copy[i - 1]) ^ (~mask12 & X_sigma_p[i - 1]); 194| 104k| } 195| | 196| 4.74k| deg_sigma_p ^= mask12 & (deg_sigma_copy ^ deg_sigma_p); 197| 4.74k| d = syndromes[mu + 1]; 198| | 199| 83.7k| for (i = 1; (i <= mu + 1) && (i <= PARAM_DELTA); ++i) { ------------------ | | 40| 81.2k|#define PARAM_DELTA 15 ///< Define the error-correcting capacity (delta) of the Reed–Solomon code ------------------ | Branch (199:21): [True: 81.2k, False: 2.43k] | Branch (199:38): [True: 78.9k, False: 2.31k] ------------------ 200| 78.9k| d ^= gf_mul(sigma[i], syndromes[mu + 1 - i]); ------------------ | | 51| 78.9k|#define gf_mul PQCHQC_NAMESPACE(gf_mul) | | ------------------ | | | | 17| 78.9k|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 78.9k|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 78.9k|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 201| 78.9k| } 202| 4.74k| } 203| | 204| 122| return deg_sigma; 205| 122|} reed_solomon.c:compute_roots: 215| 122|static void compute_roots(uint8_t *error, uint16_t *sigma) { 216| 122| uint16_t w[1 << PARAM_M] = {0}; 217| | 218| 122| fft(w, sigma, PARAM_DELTA + 1); ------------------ | | 13| 122|#define fft PQCHQC_NAMESPACE(fft) | | ------------------ | | | | 17| 122|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 122|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 122|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ fft(w, sigma, PARAM_DELTA + 1); ------------------ | | 40| 122|#define PARAM_DELTA 15 ///< Define the error-correcting capacity (delta) of the Reed–Solomon code ------------------ 219| 122| fft_retrieve_error_poly(error, w); ------------------ | | 14| 122|#define fft_retrieve_error_poly PQCHQC_NAMESPACE(fft_retrieve_error_poly) | | ------------------ | | | | 17| 122|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 122|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 122|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 220| 122|} reed_solomon.c:compute_z_poly: 232| 122|static void compute_z_poly(uint16_t *z, const uint16_t *sigma, const uint16_t degree, const uint16_t *syndromes) { 233| 122| size_t i, j; 234| 122| uint16_t mask; 235| | 236| 122| z[0] = 1; 237| | 238| 2.55k| for (i = 1; i < PARAM_DELTA + 1; ++i) { ------------------ | | 40| 2.55k|#define PARAM_DELTA 15 ///< Define the error-correcting capacity (delta) of the Reed–Solomon code ------------------ | Branch (238:17): [True: 2.43k, False: 122] ------------------ 239| 2.43k| mask = -((uint16_t)(i - degree - 1) >> 15); 240| 2.43k| z[i] = mask & sigma[i]; 241| 2.43k| } 242| | 243| 122| z[1] ^= syndromes[0]; 244| | 245| 2.43k| for (i = 2; i <= PARAM_DELTA; ++i) { ------------------ | | 40| 2.43k|#define PARAM_DELTA 15 ///< Define the error-correcting capacity (delta) of the Reed–Solomon code ------------------ | Branch (245:17): [True: 2.31k, False: 122] ------------------ 246| 2.31k| mask = -((uint16_t)(i - degree - 1) >> 15); 247| 2.31k| z[i] ^= mask & syndromes[i - 1]; 248| | 249| 27.8k| for (j = 1; j < i; ++j) { ------------------ | Branch (249:21): [True: 25.5k, False: 2.31k] ------------------ 250| 25.5k| z[i] ^= mask & gf_mul(sigma[j], syndromes[i - j - 1]); ------------------ | | 51| 25.5k|#define gf_mul PQCHQC_NAMESPACE(gf_mul) | | ------------------ | | | | 17| 25.5k|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 25.5k|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 25.5k|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 251| 25.5k| } 252| 2.31k| } 253| 122|} reed_solomon.c:compute_error_values: 264| 122|static void compute_error_values(uint16_t *error_values, const uint16_t *z, const uint8_t *error) { 265| 122| uint16_t beta_j[PARAM_DELTA] = {0}; 266| 122| uint16_t e_j[PARAM_DELTA] = {0}; 267| | 268| 122| uint16_t delta_counter; 269| 122| uint16_t delta_real_value; 270| 122| uint16_t found; 271| 122| uint16_t mask1; 272| 122| uint16_t mask2; 273| 122| uint16_t tmp1; 274| 122| uint16_t tmp2; 275| 122| uint16_t inverse; 276| 122| uint16_t inverse_power_j; 277| | 278| | // Compute the beta_{j_i} page 31 of the documentation 279| 122| delta_counter = 0; 280| 7.93k| for (size_t i = 0; i < PARAM_N1; i++) { ------------------ | | 16| 7.93k|#define PARAM_N1 46 ///< Define the parameter n1 of the scheme (length of Reed–Solomon code) ------------------ | Branch (280:24): [True: 7.81k, False: 122] ------------------ 281| 7.81k| found = 0; 282| 7.81k| mask1 = (uint16_t)(-((int32_t)error[i]) >> 31); // error[i] != 0 283| 177k| for (size_t j = 0; j < PARAM_DELTA; j++) { ------------------ | | 40| 177k|#define PARAM_DELTA 15 ///< Define the error-correcting capacity (delta) of the Reed–Solomon code ------------------ | Branch (283:28): [True: 170k, False: 7.81k] ------------------ 284| 170k| mask2 = ~((uint16_t)(-((int32_t)j ^ delta_counter) >> 31)); // j == delta_counter 285| 170k| beta_j[j] += mask1 & mask2 & gf_exp[i]; 286| 170k| found += mask1 & mask2 & 1; 287| 170k| } 288| 7.81k| delta_counter += found; 289| 7.81k| } 290| 122| delta_real_value = delta_counter; 291| | 292| | // Compute the e_{j_i} page 31 of the documentation 293| 2.55k| for (size_t i = 0; i < PARAM_DELTA; ++i) { ------------------ | | 40| 2.55k|#define PARAM_DELTA 15 ///< Define the error-correcting capacity (delta) of the Reed–Solomon code ------------------ | Branch (293:24): [True: 2.43k, False: 122] ------------------ 294| 2.43k| tmp1 = 1; 295| 2.43k| tmp2 = 1; 296| 2.43k| inverse = gf_inverse(beta_j[i]); ------------------ | | 53| 2.43k|#define gf_inverse PQCHQC_NAMESPACE(gf_inverse) | | ------------------ | | | | 17| 2.43k|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 2.43k|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 2.43k|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 297| 2.43k| inverse_power_j = 1; 298| | 299| 55.8k| for (size_t j = 1; j <= PARAM_DELTA; ++j) { ------------------ | | 40| 55.8k|#define PARAM_DELTA 15 ///< Define the error-correcting capacity (delta) of the Reed–Solomon code ------------------ | Branch (299:28): [True: 53.4k, False: 2.43k] ------------------ 300| 53.4k| inverse_power_j = gf_mul(inverse_power_j, inverse); ------------------ | | 51| 53.4k|#define gf_mul PQCHQC_NAMESPACE(gf_mul) | | ------------------ | | | | 17| 53.4k|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 53.4k|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 53.4k|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 301| 53.4k| tmp1 ^= gf_mul(inverse_power_j, z[j]); ------------------ | | 51| 53.4k|#define gf_mul PQCHQC_NAMESPACE(gf_mul) | | ------------------ | | | | 17| 53.4k|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 53.4k|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 53.4k|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 302| 53.4k| } 303| 53.4k| for (size_t k = 1; k < PARAM_DELTA; ++k) { ------------------ | | 40| 53.4k|#define PARAM_DELTA 15 ///< Define the error-correcting capacity (delta) of the Reed–Solomon code ------------------ | Branch (303:28): [True: 51.0k, False: 2.43k] ------------------ 304| 51.0k| tmp2 = gf_mul(tmp2, (1 ^ gf_mul(inverse, beta_j[(i + k) % PARAM_DELTA]))); ------------------ | | 51| 51.0k|#define gf_mul PQCHQC_NAMESPACE(gf_mul) | | ------------------ | | | | 17| 51.0k|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 51.0k|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 51.0k|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ tmp2 = gf_mul(tmp2, (1 ^ gf_mul(inverse, beta_j[(i + k) % PARAM_DELTA]))); ------------------ | | 51| 51.0k|#define gf_mul PQCHQC_NAMESPACE(gf_mul) | | ------------------ | | | | 17| 51.0k|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 51.0k|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 51.0k|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ tmp2 = gf_mul(tmp2, (1 ^ gf_mul(inverse, beta_j[(i + k) % PARAM_DELTA]))); ------------------ | | 40| 51.0k|#define PARAM_DELTA 15 ///< Define the error-correcting capacity (delta) of the Reed–Solomon code ------------------ 305| 51.0k| } 306| 2.43k| mask1 = (uint16_t)(((int16_t)i - delta_real_value) >> 15); // i < delta_real_value 307| 2.43k| e_j[i] = mask1 & gf_mul(tmp1, gf_inverse(tmp2)); ------------------ | | 51| 2.43k|#define gf_mul PQCHQC_NAMESPACE(gf_mul) | | ------------------ | | | | 17| 2.43k|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 2.43k|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 2.43k|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ e_j[i] = mask1 & gf_mul(tmp1, gf_inverse(tmp2)); ------------------ | | 53| 2.43k|#define gf_inverse PQCHQC_NAMESPACE(gf_inverse) | | ------------------ | | | | 17| 2.43k|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 2.43k|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 2.43k|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 308| 2.43k| } 309| | 310| | // Place the delta e_{j_i} values at the right coordinates of the output vector 311| 122| delta_counter = 0; 312| 7.93k| for (size_t i = 0; i < PARAM_N1; ++i) { ------------------ | | 16| 7.93k|#define PARAM_N1 46 ///< Define the parameter n1 of the scheme (length of Reed–Solomon code) ------------------ | Branch (312:24): [True: 7.81k, False: 122] ------------------ 313| 7.81k| found = 0; 314| 7.81k| mask1 = (uint16_t)(-((int32_t)error[i]) >> 31); // error[i] != 0 315| 177k| for (size_t j = 0; j < PARAM_DELTA; j++) { ------------------ | | 40| 177k|#define PARAM_DELTA 15 ///< Define the error-correcting capacity (delta) of the Reed–Solomon code ------------------ | Branch (315:28): [True: 170k, False: 7.81k] ------------------ 316| 170k| mask2 = ~((uint16_t)(-((int32_t)j ^ delta_counter) >> 31)); // j == delta_counter 317| 170k| error_values[i] += mask1 & mask2 & e_j[j]; 318| 170k| found += mask1 & mask2 & 1; 319| 170k| } 320| 7.81k| delta_counter += found; 321| 7.81k| } 322| 122|} reed_solomon.c:correct_errors: 330| 122|static void correct_errors(uint8_t *cdw, const uint16_t *error_values) { 331| 7.93k| for (size_t i = 0; i < PARAM_N1; ++i) { ------------------ | | 16| 7.93k|#define PARAM_N1 46 ///< Define the parameter n1 of the scheme (length of Reed–Solomon code) ------------------ | Branch (331:24): [True: 7.81k, False: 122] ------------------ 332| 7.81k| cdw[i] ^= error_values[i]; 333| 7.81k| } 334| 122|} PQCHQC_HQC1_C_prng_get_bytes: 20| 114|void prng_get_bytes(uint8_t *output, uint32_t outlen) { 21| 114| OQS_randombytes(output, outlen); 22| 114|} PQCHQC_HQC1_C_xof_init: 70| 304|void xof_init(shake256_xof_ctx *xof_ctx, const uint8_t *seed, uint32_t seed_size) { 71| 304| uint8_t xof_domain = HQC_XOF_DOMAIN; ------------------ | | 50| 304|#define HQC_XOF_DOMAIN 1 ------------------ 72| 304| OQS_SHA3_shake256_inc_init(xof_ctx); 73| 304| OQS_SHA3_shake256_inc_absorb(xof_ctx, seed, seed_size); 74| 304| OQS_SHA3_shake256_inc_absorb(xof_ctx, &xof_domain, 1); 75| 304| OQS_SHA3_shake256_inc_finalize(xof_ctx); 76| 304|} PQCHQC_HQC1_C_xof_get_bytes: 89| 7.99k|void xof_get_bytes(shake256_xof_ctx *xof_ctx, uint8_t *output, uint32_t output_size) { 90| 7.99k| OQS_SHA3_shake256_inc_squeeze(output, output_size, xof_ctx); 91| 7.99k|} PQCHQC_HQC1_C_xof_ctx_release: 96| 304|void xof_ctx_release(shake256_xof_ctx *xof_ctx) { 97| 304| OQS_SHA3_shake256_inc_ctx_release(xof_ctx); 98| 304|} PQCHQC_HQC1_C_hash_i: 109| 38|void hash_i(uint8_t *output, const uint8_t *seed) { 110| 38| sha3_512_ctx i_hash_ctx = {0}; 111| 38| uint8_t i_domain = HQC_I_FCT_DOMAIN; ------------------ | | 65| 38|#define HQC_I_FCT_DOMAIN 2 ------------------ 112| 38| OQS_SHA3_sha3_512_inc_init(&i_hash_ctx); 113| 38| OQS_SHA3_sha3_512_inc_absorb(&i_hash_ctx, seed, SEED_BYTES); ------------------ | | 52| 38|#define SEED_BYTES 32 ///< Define the size of the seed in bytes ------------------ 114| 38| OQS_SHA3_sha3_512_inc_absorb(&i_hash_ctx, &i_domain, 1); 115| 38| OQS_SHA3_sha3_512_inc_finalize(output, &i_hash_ctx); 116| 38| OQS_SHA3_sha3_512_inc_ctx_release(&i_hash_ctx); 117| 38|} PQCHQC_HQC1_C_hash_h: 125| 76|void hash_h(uint8_t *output, const uint8_t ek_kem[PUBLIC_KEY_BYTES]) { 126| 76| sha3_256_ctx h_hash_ctx = {0}; 127| 76| uint8_t h_domain = HQC_H_FCT_DOMAIN; ------------------ | | 60| 76|#define HQC_H_FCT_DOMAIN 1 ------------------ 128| 76| OQS_SHA3_sha3_256_inc_init(&h_hash_ctx); 129| 76| OQS_SHA3_sha3_256_inc_absorb(&h_hash_ctx, ek_kem, PUBLIC_KEY_BYTES); ------------------ | | 27| 76|#define PUBLIC_KEY_BYTES CRYPTO_PUBLICKEYBYTES ///< Define the size of the public key in bytes | | ------------------ | | | | 12| 76|#define CRYPTO_PUBLICKEYBYTES 2241 | | ------------------ ------------------ 130| 76| OQS_SHA3_sha3_256_inc_absorb(&h_hash_ctx, &h_domain, 1); 131| 76| OQS_SHA3_sha3_256_inc_finalize(output, &h_hash_ctx); 132| 76| OQS_SHA3_sha3_256_inc_ctx_release(&h_hash_ctx); 133| 76|} PQCHQC_HQC1_C_hash_g: 144| 76| const uint8_t salt[SALT_BYTES]) { 145| 76| sha3_512_ctx g_hash_ctx = {0}; 146| 76| uint8_t i_domain = HQC_G_FCT_DOMAIN; ------------------ | | 55| 76|#define HQC_G_FCT_DOMAIN 0 ------------------ 147| 76| OQS_SHA3_sha3_512_inc_init(&g_hash_ctx); 148| 76| OQS_SHA3_sha3_512_inc_absorb(&g_hash_ctx, hash_ek_kem, SEED_BYTES); ------------------ | | 52| 76|#define SEED_BYTES 32 ///< Define the size of the seed in bytes ------------------ 149| 76| OQS_SHA3_sha3_512_inc_absorb(&g_hash_ctx, m, PARAM_SECURITY_BYTES); ------------------ | | 23| 76|#define PARAM_SECURITY_BYTES 16 ///< Define the security level in bytes ------------------ 150| 76| OQS_SHA3_sha3_512_inc_absorb(&g_hash_ctx, salt, SALT_BYTES); ------------------ | | 53| 76|#define SALT_BYTES 16 ///< Define the size of a salt in bytes ------------------ 151| 76| OQS_SHA3_sha3_512_inc_absorb(&g_hash_ctx, &i_domain, 1); 152| 76| OQS_SHA3_sha3_512_inc_finalize(output, &g_hash_ctx); 153| 76| OQS_SHA3_sha3_512_inc_ctx_release(&g_hash_ctx); 154| 76|} PQCHQC_HQC1_C_hash_j: 165| 38| const ciphertext_kem_t *c_kem) { 166| 38| sha3_256_ctx k_hash_ctx = {0}; 167| 38| uint8_t k_domain = HQC_J_FCT_DOMAIN; ------------------ | | 70| 38|#define HQC_J_FCT_DOMAIN 3 ------------------ 168| 38| OQS_SHA3_sha3_256_inc_init(&k_hash_ctx); 169| 38| OQS_SHA3_sha3_256_inc_absorb(&k_hash_ctx, hash_ek_kem, SEED_BYTES); ------------------ | | 52| 38|#define SEED_BYTES 32 ///< Define the size of the seed in bytes ------------------ 170| 38| OQS_SHA3_sha3_256_inc_absorb(&k_hash_ctx, sigma, PARAM_SECURITY_BYTES); ------------------ | | 23| 38|#define PARAM_SECURITY_BYTES 16 ///< Define the security level in bytes ------------------ 171| 38| OQS_SHA3_sha3_256_inc_absorb(&k_hash_ctx, (uint8_t *)c_kem->c_pke.u, VEC_N_SIZE_BYTES); ------------------ | | 31| 38|#define VEC_N_SIZE_BYTES CEIL_DIVIDE(PARAM_N, 8) ///< Size of array to store PARAM_N bits in bytes | | ------------------ | | | | 12| 38|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [Folded, False: 38] | | | | ------------------ | | ------------------ ------------------ 172| 38| OQS_SHA3_sha3_256_inc_absorb(&k_hash_ctx, (uint8_t *)c_kem->c_pke.v, VEC_N1N2_SIZE_BYTES); ------------------ | | 34| 38|#define VEC_N1N2_SIZE_BYTES CEIL_DIVIDE(PARAM_N1N2, 8) ///< Size of array to store PARAM_N1N2 bits in bytes | | ------------------ | | | | 12| 38|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [True: 38, Folded] | | | | ------------------ | | ------------------ ------------------ 173| 38| OQS_SHA3_sha3_256_inc_absorb(&k_hash_ctx, c_kem->salt, SALT_BYTES); ------------------ | | 53| 38|#define SALT_BYTES 16 ///< Define the size of a salt in bytes ------------------ 174| 38| OQS_SHA3_sha3_256_inc_absorb(&k_hash_ctx, &k_domain, 1); 175| 38| OQS_SHA3_sha3_256_inc_finalize(output, &k_hash_ctx); 176| 38| OQS_SHA3_sha3_256_inc_ctx_release(&k_hash_ctx); 177| 38|} PQCHQC_HQC1_C_vect_generate_random_support1: 62| 114|void vect_generate_random_support1(shake256_xof_ctx *ctx, uint32_t *support, uint16_t weight) { 63| 114| uint8_t rand_bytes[3] = {0}; 64| 114| uint32_t candidate = 0; 65| | 66| 7.69k| for (size_t i = 0; i < weight;) { ------------------ | Branch (66:24): [True: 7.57k, False: 114] ------------------ 67| 7.57k| xof_get_bytes(ctx, rand_bytes, 3); ------------------ | | 75| 7.57k|#define xof_get_bytes PQCHQC_NAMESPACE(xof_get_bytes) | | ------------------ | | | | 17| 7.57k|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 7.57k|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 7.57k|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 68| 7.57k| candidate = rand_bytes[0] | (rand_bytes[1] << 8) | (rand_bytes[2] << 16); 69| | 70| 7.57k| if (candidate >= UTILS_REJECTION_THRESHOLD) { ------------------ | | 56| 7.57k|#define UTILS_REJECTION_THRESHOLD 16767881 ///< Rejection threshold for uniform sampling in [0, PARAM_N) ------------------ | Branch (70:13): [True: 10, False: 7.56k] ------------------ 71| 10| continue; 72| 10| } 73| 7.56k| candidate = barrett_reduce(candidate); 74| | 75| 7.56k| int is_position_available = 1; 76| 253k| for (size_t j = 0; j < i; j++) { ------------------ | Branch (76:28): [True: 245k, False: 7.52k] ------------------ 77| 245k| if (candidate == support[j]) { ------------------ | Branch (77:17): [True: 43, False: 245k] ------------------ 78| 43| is_position_available = 0; 79| 43| break; 80| 43| } 81| 245k| } 82| | 83| 7.56k| if (is_position_available == 1) { ------------------ | Branch (83:13): [True: 7.52k, False: 43] ------------------ 84| 7.52k| support[i] = candidate; 85| 7.52k| i++; 86| 7.52k| } 87| 7.56k| } 88| 114|} PQCHQC_HQC1_C_vect_generate_random_support2: 99| 228|void vect_generate_random_support2(shake256_xof_ctx *ctx, uint32_t *support, uint16_t weight) { 100| 228| uint32_t rand_u32[PARAM_OMEGA_R] = {0}; 101| | 102| 228| xof_get_bytes(ctx, (uint8_t *)&rand_u32, 4 * weight); ------------------ | | 75| 228|#define xof_get_bytes PQCHQC_NAMESPACE(xof_get_bytes) | | ------------------ | | | | 17| 228|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 228|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 228|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 103| | 104| 17.3k| for (size_t i = 0; i < weight; ++i) { ------------------ | Branch (104:24): [True: 17.1k, False: 228] ------------------ 105| 17.1k| uint64_t buff = rand_u32[i]; 106| 17.1k| support[i] = i + ((buff * (PARAM_N - i)) >> 32); ------------------ | | 15| 17.1k|#define PARAM_N 17669 ///< Define the parameter n of the scheme ------------------ 107| 17.1k| } 108| | 109| 17.1k| for (int32_t i = (weight - 1); i-- > 0;) { ------------------ | Branch (109:36): [True: 16.8k, False: 228] ------------------ 110| 16.8k| uint32_t found = 0; 111| | 112| 649k| for (size_t j = i + 1; j < weight; ++j) { ------------------ | Branch (112:32): [True: 632k, False: 16.8k] ------------------ 113| 632k| found |= compare_u32(support[j], support[i]); 114| 632k| } 115| | 116| 16.8k| uint32_t mask = -found; 117| 16.8k| support[i] = (mask & i) ^ (~mask & support[i]); 118| 16.8k| } 119| 228|} PQCHQC_HQC1_C_vect_write_support_to_vector: 131| 342|void vect_write_support_to_vector(uint64_t *v, uint32_t *support, uint16_t weight) { 132| 342| uint32_t index_tab[PARAM_OMEGA_R] = {0}; 133| 342| uint64_t bit_tab[PARAM_OMEGA_R] = {0}; 134| | 135| 24.9k| for (size_t i = 0; i < weight; i++) { ------------------ | Branch (135:24): [True: 24.6k, False: 342] ------------------ 136| 24.6k| index_tab[i] = support[i] >> 6; 137| 24.6k| int32_t pos = support[i] & 0x3f; 138| 24.6k| bit_tab[i] = ((uint64_t)1) << pos; 139| 24.6k| } 140| | 141| 342| uint64_t val = 0; 142| 95.0k| for (uint32_t i = 0; i < VEC_N_SIZE_64; i++) { ------------------ | | 36| 95.0k|#define VEC_N_SIZE_64 CEIL_DIVIDE(PARAM_N, 64) ///< Size of array to store PARAM_N bits in 64-bit words | | ------------------ | | | | 12| 95.0k|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [Folded, False: 95.0k] | | | | ------------------ | | ------------------ ------------------ | Branch (142:26): [True: 94.7k, False: 342] ------------------ 143| 94.7k| val = 0; 144| 6.91M| for (uint32_t j = 0; j < weight; j++) { ------------------ | Branch (144:30): [True: 6.82M, False: 94.7k] ------------------ 145| 6.82M| uint32_t tmp = i - index_tab[j]; 146| 6.82M| int val1 = 1 ^ ((tmp | -tmp) >> 31); 147| 6.82M| uint64_t mask = -val1; 148| 6.82M| val |= (bit_tab[j] & mask); 149| 6.82M| } 150| 94.7k| v[i] |= val; 151| 94.7k| } 152| 342|} PQCHQC_HQC1_C_vect_sample_fixed_weight1: 169| 114|void vect_sample_fixed_weight1(shake256_xof_ctx *ctx, uint64_t *v, uint16_t weight) { 170| 114| uint32_t support[PARAM_OMEGA_R] = {0}; 171| 114| vect_generate_random_support1(ctx, support, weight); ------------------ | | 13| 114|#define vect_generate_random_support1 PQCHQC_NAMESPACE(vect_generate_random_support1) | | ------------------ | | | | 17| 114|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 114|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 114|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 172| 114| vect_write_support_to_vector(v, support, weight); ------------------ | | 15| 114|#define vect_write_support_to_vector PQCHQC_NAMESPACE(vect_write_support_to_vector) | | ------------------ | | | | 17| 114|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 114|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 114|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 173| 114|} PQCHQC_HQC1_C_vect_sample_fixed_weight2: 188| 228|void vect_sample_fixed_weight2(shake256_xof_ctx *ctx, uint64_t *v, uint16_t weight) { 189| 228| uint32_t support[PARAM_OMEGA_R] = {0}; 190| 228| vect_generate_random_support2(ctx, support, weight); ------------------ | | 14| 228|#define vect_generate_random_support2 PQCHQC_NAMESPACE(vect_generate_random_support2) | | ------------------ | | | | 17| 228|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 228|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 228|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 191| 228| vect_write_support_to_vector(v, support, weight); ------------------ | | 15| 228|#define vect_write_support_to_vector PQCHQC_NAMESPACE(vect_write_support_to_vector) | | ------------------ | | | | 17| 228|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 228|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 228|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 192| 228|} PQCHQC_HQC1_C_vect_set_random: 203| 114|void vect_set_random(shake256_xof_ctx *ctx, uint64_t *v) { 204| 114| xof_get_bytes(ctx, (uint8_t *)v, VEC_N_SIZE_BYTES); ------------------ | | 75| 114|#define xof_get_bytes PQCHQC_NAMESPACE(xof_get_bytes) | | ------------------ | | | | 17| 114|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 114|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 114|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ xof_get_bytes(ctx, (uint8_t *)v, VEC_N_SIZE_BYTES); ------------------ | | 31| 114|#define VEC_N_SIZE_BYTES CEIL_DIVIDE(PARAM_N, 8) ///< Size of array to store PARAM_N bits in bytes | | ------------------ | | | | 12| 114|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [Folded, False: 114] | | | | ------------------ | | ------------------ ------------------ 205| 114| v[VEC_N_SIZE_64 - 1] &= BITMASK(PARAM_N, 64); ------------------ | | 36| 114|#define VEC_N_SIZE_64 CEIL_DIVIDE(PARAM_N, 64) ///< Size of array to store PARAM_N bits in 64-bit words | | ------------------ | | | | 12| 114|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [Folded, False: 114] | | | | ------------------ | | ------------------ ------------------ v[VEC_N_SIZE_64 - 1] &= BITMASK(PARAM_N, 64); ------------------ | | 13| 114|#define BITMASK(a, size) ((((uint64_t) 1UL) << (a % size)) - 1) /*!< Create a mask*/ ------------------ 206| 114|} PQCHQC_HQC1_C_vect_add: 216| 304|void vect_add(uint64_t *o, const uint64_t *v1, const uint64_t *v2, uint32_t size) { 217| 84.3k| for (uint32_t i = 0; i < size; ++i) { ------------------ | Branch (217:26): [True: 84.0k, False: 304] ------------------ 218| 84.0k| o[i] = v1[i] ^ v2[i]; 219| 84.0k| } 220| 304|} PQCHQC_HQC1_C_vect_compare: 233| 114|uint8_t vect_compare(const uint8_t *v1, const uint8_t *v2, uint32_t size) { 234| 114| uint16_t r = 0x0100; 235| | 236| 168k| for (size_t i = 0; i < size; i++) { ------------------ | Branch (236:24): [True: 168k, False: 114] ------------------ 237| 168k| r |= v1[i] ^ v2[i]; 238| 168k| } 239| | 240| 114| return (r - 1) >> 8; 241| 114|} PQCHQC_HQC1_C_vect_truncate: 249| 114|void vect_truncate(uint64_t *v) { 250| 114| size_t orig_words = (PARAM_N + 63) / 64; ------------------ | | 15| 114|#define PARAM_N 17669 ///< Define the parameter n of the scheme ------------------ 251| 114| size_t new_full_words = PARAM_N1N2 / 64; ------------------ | | 18| 114|#define PARAM_N1N2 17664 ///< Define the length in bits of the concatenated code ------------------ 252| 114| size_t remaining_bits = PARAM_N1N2 % 64; ------------------ | | 18| 114|#define PARAM_N1N2 17664 ///< Define the length in bits of the concatenated code ------------------ 253| | 254| | // Mask the last word if there's a partial word 255| 114| if (remaining_bits > 0) { ------------------ | Branch (255:9): [True: 0, False: 114] ------------------ 256| 0| uint64_t mask = (UINT64_C(1) << remaining_bits) - 1; 257| 0| v[new_full_words] &= mask; 258| 0| new_full_words++; // keep that partial word 259| 0| } 260| | 261| | // Zero out all subsequent words up to the original length 262| 228| for (size_t i = new_full_words; i < orig_words; i++) { ------------------ | Branch (262:37): [True: 114, False: 114] ------------------ 263| 114| v[i] = 0; 264| 114| } 265| 114|} vector.c:barrett_reduce: 35| 36.5k|static inline uint32_t barrett_reduce(uint32_t x) { 36| 36.5k| uint64_t q = ((uint64_t)x * PARAM_N_MU) >> 32; ------------------ | | 55| 36.5k|#define PARAM_N_MU 243079ULL ///< Define a precomputed multiplier for Barrett reduction mu = floor(2^32 / PARAM_N) ------------------ 37| 36.5k| uint32_t r = x - (uint32_t)(q * PARAM_N); ------------------ | | 15| 36.5k|#define PARAM_N 17669 ///< Define the parameter n of the scheme ------------------ 38| | 39| 36.5k| uint32_t reduce_flag = (((r - PARAM_N) >> 31) ^ 1); ------------------ | | 15| 36.5k|#define PARAM_N 17669 ///< Define the parameter n of the scheme ------------------ 40| 36.5k| uint32_t mask = -reduce_flag; 41| 36.5k| r -= mask & PARAM_N; ------------------ | | 15| 36.5k|#define PARAM_N 17669 ///< Define the parameter n of the scheme ------------------ 42| 36.5k| return r; 43| 36.5k|} vector.c:compare_u32: 23| 4.97M|static inline uint32_t compare_u32(const uint32_t v1, const uint32_t v2) { 24| 4.97M| return 1 ^ (((v1 - v2) | (v2 - v1)) >> 31); 25| 4.97M|} PQCHQC_HQC3_C_code_encode: 27| 88|void code_encode(uint64_t *em, const uint64_t *m) { 28| 88| uint64_t tmp[VEC_N1_SIZE_64] = {0}; 29| | 30| 88| reed_solomon_encode(tmp, m); ------------------ | | 119| 88|#define reed_solomon_encode PQCHQC_NAMESPACE(reed_solomon_encode) | | ------------------ | | | | 17| 88|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 88|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 88|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 31| 88| reed_muller_encode(em, tmp); ------------------ | | 14| 88|#define reed_muller_encode PQCHQC_NAMESPACE(reed_muller_encode) | | ------------------ | | | | 17| 88|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 88|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 88|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 32| | 33| |#ifdef VERBOSE 34| | printf("\n\nReed-Solomon code word: "); 35| | vect_print(tmp, VEC_N1_SIZE_BYTES); 36| | printf("\n\nConcatenated code word: "); 37| | vect_print(em, VEC_N1N2_SIZE_BYTES); 38| |#endif 39| | // Zeroize sensitive data 40| 88| memset_zero(tmp, sizeof tmp); ------------------ | | 22| 88|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 88|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 88|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 88|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 88|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 41| 88|} PQCHQC_HQC3_C_code_decode: 49| 44|void code_decode(uint64_t *m, const uint64_t *em) { 50| 44| uint64_t tmp[VEC_N1_SIZE_64] = {0}; 51| | 52| 44| reed_muller_decode(tmp, em); ------------------ | | 15| 44|#define reed_muller_decode PQCHQC_NAMESPACE(reed_muller_decode) | | ------------------ | | | | 17| 44|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 44|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 44|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 53| 44| reed_solomon_decode(m, tmp); ------------------ | | 120| 44|#define reed_solomon_decode PQCHQC_NAMESPACE(reed_solomon_decode) | | ------------------ | | | | 17| 44|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 44|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 44|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 54| | 55| |#ifdef VERBOSE 56| | printf("\n\nReed-Muller decoding result (the input for the Reed-Solomon decoding algorithm): "); 57| | vect_print(tmp, VEC_N1_SIZE_BYTES); 58| |#endif 59| | 60| | // Zeroize sensitive data 61| 44| memset_zero(tmp, sizeof tmp); ------------------ | | 22| 44|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 44|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 44|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 44|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 44|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 62| 44|} PQCHQC_HQC3_C_fft: 274| 44|void fft(uint16_t *w, const uint16_t *f, size_t f_coeffs) { 275| 44| uint16_t betas[PARAM_M - 1] = {0}; 276| 44| uint16_t betas_sums[1 << (PARAM_M - 1)] = {0}; 277| 44| uint16_t f0[1 << (PARAM_FFT - 1)] = {0}; 278| 44| uint16_t f1[1 << (PARAM_FFT - 1)] = {0}; 279| 44| uint16_t deltas[PARAM_M - 1] = {0}; 280| 44| uint16_t u[1 << (PARAM_M - 1)] = {0}; 281| 44| uint16_t v[1 << (PARAM_M - 1)] = {0}; 282| | 283| 44| size_t i, k; 284| | 285| | // Follows Gao and Mateer algorithm 286| 44| compute_fft_betas(betas); 287| | 288| | // Step 1: PARAM_FFT > 1, nothing to do 289| | 290| | // Compute gammas sums 291| 44| compute_subset_sums(betas_sums, betas, PARAM_M - 1); ------------------ | | 41| 44|#define PARAM_M 8 ///< Define the degree m of the Galois field GF(2^m) ------------------ 292| | 293| | // Step 2: beta_m = 1, nothing to do 294| | 295| | // Step 3 296| 44| radix(f0, f1, f, PARAM_FFT); ------------------ | | 46| 44|#define PARAM_FFT 5 ///< Exponent for additive FFT (2^PARAM_FFT points) ------------------ 297| | 298| | // Step 4: Compute deltas 299| 352| for (i = 0; i < PARAM_M - 1; ++i) { ------------------ | | 41| 352|#define PARAM_M 8 ///< Define the degree m of the Galois field GF(2^m) ------------------ | Branch (299:17): [True: 308, False: 44] ------------------ 300| 308| deltas[i] = gf_square(betas[i]) ^ betas[i]; ------------------ | | 52| 308|#define gf_square PQCHQC_NAMESPACE(gf_square) | | ------------------ | | | | 17| 308|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 308|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 308|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 301| 308| } 302| | 303| | // Step 5 304| 44| fft_rec(u, f0, (f_coeffs + 1) / 2, PARAM_M - 1, PARAM_FFT - 1, deltas); ------------------ | | 41| 44|#define PARAM_M 8 ///< Define the degree m of the Galois field GF(2^m) ------------------ fft_rec(u, f0, (f_coeffs + 1) / 2, PARAM_M - 1, PARAM_FFT - 1, deltas); ------------------ | | 46| 44|#define PARAM_FFT 5 ///< Exponent for additive FFT (2^PARAM_FFT points) ------------------ 305| 44| fft_rec(v, f1, f_coeffs / 2, PARAM_M - 1, PARAM_FFT - 1, deltas); ------------------ | | 41| 44|#define PARAM_M 8 ///< Define the degree m of the Galois field GF(2^m) ------------------ fft_rec(v, f1, f_coeffs / 2, PARAM_M - 1, PARAM_FFT - 1, deltas); ------------------ | | 46| 44|#define PARAM_FFT 5 ///< Exponent for additive FFT (2^PARAM_FFT points) ------------------ 306| | 307| 44| k = 1 << (PARAM_M - 1); ------------------ | | 41| 44|#define PARAM_M 8 ///< Define the degree m of the Galois field GF(2^m) ------------------ 308| | // Step 6, 7 and error polynomial computation 309| 44| memcpy(w + k, v, 2 * k); 310| | 311| | // Check if 0 is root 312| 44| w[0] = u[0]; 313| | 314| | // Check if 1 is root 315| 44| w[k] ^= u[0]; 316| | 317| | // Find other roots 318| 5.63k| for (i = 1; i < k; ++i) { ------------------ | Branch (318:17): [True: 5.58k, False: 44] ------------------ 319| 5.58k| w[i] = u[i] ^ gf_mul(betas_sums[i], v[i]); ------------------ | | 51| 5.58k|#define gf_mul PQCHQC_NAMESPACE(gf_mul) | | ------------------ | | | | 17| 5.58k|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 5.58k|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 5.58k|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 320| 5.58k| w[k + i] ^= w[i]; 321| 5.58k| } 322| 44|} PQCHQC_HQC3_C_fft_retrieve_error_poly: 331| 44|void fft_retrieve_error_poly(uint8_t *error, const uint16_t *w) { 332| 44| uint16_t gammas[PARAM_M - 1] = {0}; 333| 44| uint16_t gammas_sums[1 << (PARAM_M - 1)] = {0}; 334| 44| uint16_t k; 335| 44| size_t i, index; 336| | 337| 44| compute_fft_betas(gammas); 338| 44| compute_subset_sums(gammas_sums, gammas, PARAM_M - 1); ------------------ | | 41| 44|#define PARAM_M 8 ///< Define the degree m of the Galois field GF(2^m) ------------------ 339| | 340| 44| k = 1 << (PARAM_M - 1); ------------------ | | 41| 44|#define PARAM_M 8 ///< Define the degree m of the Galois field GF(2^m) ------------------ 341| 44| error[0] ^= 1 ^ ((uint16_t)-w[0] >> 15); 342| 44| error[0] ^= 1 ^ ((uint16_t)-w[k] >> 15); 343| | 344| 5.63k| for (i = 1; i < k; ++i) { ------------------ | Branch (344:17): [True: 5.58k, False: 44] ------------------ 345| 5.58k| index = PARAM_GF_MUL_ORDER - gf_log[gammas_sums[i]]; ------------------ | | 43| 5.58k|#define PARAM_GF_MUL_ORDER 255 ///< Size of the multiplicative group of GF(2^PARAM_M) (i.e., 2^PARAM_M−1) ------------------ 346| 5.58k| error[index] ^= 1 ^ ((uint16_t)-w[i] >> 15); 347| | 348| 5.58k| index = PARAM_GF_MUL_ORDER - gf_log[gammas_sums[i] ^ 1]; ------------------ | | 43| 5.58k|#define PARAM_GF_MUL_ORDER 255 ///< Size of the multiplicative group of GF(2^PARAM_M) (i.e., 2^PARAM_M−1) ------------------ 349| 5.58k| error[index] ^= 1 ^ ((uint16_t)-w[k + i] >> 15); 350| 5.58k| } 351| 44|} PQCHQC_HQC3_C_gf_mul: 153| 293k|uint16_t gf_mul(uint16_t a, uint16_t b) { 154| 293k| uint8_t c[2] = {0}; 155| 293k| gf_carryless_mul(c, (uint8_t)a, (uint8_t)b); 156| 293k| uint16_t tmp = (uint16_t)(c[0] ^ (c[1] << 8)); 157| 293k| return gf_reduce(tmp); 158| 293k|} PQCHQC_HQC3_C_gf_square: 165| 36.9k|uint16_t gf_square(uint16_t a) { 166| 36.9k| uint32_t b = a; 167| 36.9k| uint32_t s = b & 1; 168| 295k| for (size_t i = 1; i < PARAM_M; ++i) { ------------------ | | 41| 295k|#define PARAM_M 8 ///< Define the degree m of the Galois field GF(2^m) ------------------ | Branch (168:24): [True: 258k, False: 36.9k] ------------------ 169| 258k| b <<= 1; 170| 258k| s ^= b & (1 << 2 * i); 171| 258k| } 172| | 173| 36.9k| return gf_reduce(s); 174| 36.9k|} PQCHQC_HQC3_C_gf_inverse: 182| 5.63k|uint16_t gf_inverse(uint16_t a) { 183| 5.63k| uint16_t inv = a; 184| 5.63k| uint16_t tmp1, tmp2; 185| | 186| 5.63k| inv = gf_square(a); /* a^2 */ ------------------ | | 52| 5.63k|#define gf_square PQCHQC_NAMESPACE(gf_square) | | ------------------ | | | | 17| 5.63k|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 5.63k|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 5.63k|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 187| 5.63k| tmp1 = gf_mul(inv, a); /* a^3 */ ------------------ | | 51| 5.63k|#define gf_mul PQCHQC_NAMESPACE(gf_mul) | | ------------------ | | | | 17| 5.63k|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 5.63k|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 5.63k|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 188| 5.63k| inv = gf_square(inv); /* a^4 */ ------------------ | | 52| 5.63k|#define gf_square PQCHQC_NAMESPACE(gf_square) | | ------------------ | | | | 17| 5.63k|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 5.63k|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 5.63k|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 189| 5.63k| tmp2 = gf_mul(inv, tmp1); /* a^7 */ ------------------ | | 51| 5.63k|#define gf_mul PQCHQC_NAMESPACE(gf_mul) | | ------------------ | | | | 17| 5.63k|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 5.63k|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 5.63k|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 190| 5.63k| tmp1 = gf_mul(inv, tmp2); /* a^11 */ ------------------ | | 51| 5.63k|#define gf_mul PQCHQC_NAMESPACE(gf_mul) | | ------------------ | | | | 17| 5.63k|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 5.63k|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 5.63k|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 191| 5.63k| inv = gf_mul(tmp1, inv); /* a^15 */ ------------------ | | 51| 5.63k|#define gf_mul PQCHQC_NAMESPACE(gf_mul) | | ------------------ | | | | 17| 5.63k|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 5.63k|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 5.63k|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 192| 5.63k| inv = gf_square(inv); /* a^30 */ ------------------ | | 52| 5.63k|#define gf_square PQCHQC_NAMESPACE(gf_square) | | ------------------ | | | | 17| 5.63k|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 5.63k|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 5.63k|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 193| 5.63k| inv = gf_square(inv); /* a^60 */ ------------------ | | 52| 5.63k|#define gf_square PQCHQC_NAMESPACE(gf_square) | | ------------------ | | | | 17| 5.63k|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 5.63k|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 5.63k|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 194| 5.63k| inv = gf_square(inv); /* a^120 */ ------------------ | | 52| 5.63k|#define gf_square PQCHQC_NAMESPACE(gf_square) | | ------------------ | | | | 17| 5.63k|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 5.63k|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 5.63k|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 195| 5.63k| inv = gf_mul(inv, tmp2); /* a^127 */ ------------------ | | 51| 5.63k|#define gf_mul PQCHQC_NAMESPACE(gf_mul) | | ------------------ | | | | 17| 5.63k|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 5.63k|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 5.63k|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 196| 5.63k| inv = gf_square(inv); /* a^254 */ ------------------ | | 52| 5.63k|#define gf_square PQCHQC_NAMESPACE(gf_square) | | ------------------ | | | | 17| 5.63k|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 5.63k|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 5.63k|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 197| 5.63k| return inv; 198| 5.63k|} PQCHQC_HQC3_C_vect_mul: 151| 264|void vect_mul(uint64_t *o, const uint64_t *a1, const uint64_t *a2) { 152| 264| uint64_t unreduced[2 * VEC_N_SIZE_64]; 153| 264| uint64_t tmp_buffer[TMP_BUFFER_WORDS]; 154| | 155| | /* multiply via Karatsuba into unreduced */ 156| 264| karatsuba_mul(unreduced, a1, a2, VEC_N_SIZE_64, tmp_buffer); ------------------ | | 36| 264|#define VEC_N_SIZE_64 CEIL_DIVIDE(PARAM_N, 64) ///< Size of array to store PARAM_N bits in 64-bit words | | ------------------ | | | | 12| 264|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [Folded, False: 264] | | | | ------------------ | | ------------------ ------------------ 157| | 158| | /* reduce modulo X^n - 1 */ 159| 264| reduce(o, unreduced); 160| 264|} PQCHQC_HQC3_C_hqc_pke_keygen: 30| 44|void hqc_pke_keygen(uint8_t *ek_pke, uint8_t *dk_pke, uint8_t *seed) { 31| 44| uint8_t keypair_seed[2 * SEED_BYTES] = {0}; 32| 44| uint8_t *seed_dk = keypair_seed; 33| 44| uint8_t *seed_ek = keypair_seed + SEED_BYTES; ------------------ | | 52| 44|#define SEED_BYTES 32 ///< Define the size of the seed in bytes ------------------ 34| 44| shake256_xof_ctx dk_xof_ctx = {0}; 35| 44| shake256_xof_ctx ek_xof_ctx = {0}; 36| | 37| 44| uint64_t x[VEC_N_SIZE_64] = {0}; 38| 44| uint64_t y[VEC_N_SIZE_64] = {0}; 39| 44| uint64_t h[VEC_N_SIZE_64] = {0}; 40| 44| uint64_t s[VEC_N_SIZE_64] = {0}; 41| | 42| | // Derive keypair seeds 43| 44| hash_i(keypair_seed, seed); ------------------ | | 79| 44|#define hash_i PQCHQC_NAMESPACE(hash_i) | | ------------------ | | | | 17| 44|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 44|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 44|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 44| | 45| | // Compute decryption key 46| 44| xof_init(&dk_xof_ctx, seed_dk, SEED_BYTES); ------------------ | | 74| 44|#define xof_init PQCHQC_NAMESPACE(xof_init) | | ------------------ | | | | 17| 44|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 44|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 44|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ xof_init(&dk_xof_ctx, seed_dk, SEED_BYTES); ------------------ | | 52| 44|#define SEED_BYTES 32 ///< Define the size of the seed in bytes ------------------ 47| 44| vect_sample_fixed_weight1(&dk_xof_ctx, y, PARAM_OMEGA); ------------------ | | 16| 44|#define vect_sample_fixed_weight1 PQCHQC_NAMESPACE(vect_sample_fixed_weight1) | | ------------------ | | | | 17| 44|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 44|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 44|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ vect_sample_fixed_weight1(&dk_xof_ctx, y, PARAM_OMEGA); ------------------ | | 19| 44|#define PARAM_OMEGA 100 ///< Define the parameter omega of the scheme ------------------ 48| 44| vect_sample_fixed_weight1(&dk_xof_ctx, x, PARAM_OMEGA); ------------------ | | 16| 44|#define vect_sample_fixed_weight1 PQCHQC_NAMESPACE(vect_sample_fixed_weight1) | | ------------------ | | | | 17| 44|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 44|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 44|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ vect_sample_fixed_weight1(&dk_xof_ctx, x, PARAM_OMEGA); ------------------ | | 19| 44|#define PARAM_OMEGA 100 ///< Define the parameter omega of the scheme ------------------ 49| 44| xof_ctx_release(&dk_xof_ctx); ------------------ | | 76| 44|#define xof_ctx_release PQCHQC_NAMESPACE(xof_ctx_release) | | ------------------ | | | | 17| 44|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 44|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 44|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 50| | 51| | // Compute encryption key 52| 44| xof_init(&ek_xof_ctx, seed_ek, SEED_BYTES); ------------------ | | 74| 44|#define xof_init PQCHQC_NAMESPACE(xof_init) | | ------------------ | | | | 17| 44|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 44|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 44|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ xof_init(&ek_xof_ctx, seed_ek, SEED_BYTES); ------------------ | | 52| 44|#define SEED_BYTES 32 ///< Define the size of the seed in bytes ------------------ 53| 44| vect_set_random(&ek_xof_ctx, h); ------------------ | | 18| 44|#define vect_set_random PQCHQC_NAMESPACE(vect_set_random) | | ------------------ | | | | 17| 44|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 44|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 44|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 54| 44| xof_ctx_release(&ek_xof_ctx); ------------------ | | 76| 44|#define xof_ctx_release PQCHQC_NAMESPACE(xof_ctx_release) | | ------------------ | | | | 17| 44|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 44|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 44|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 55| 44| vect_mul(s, y, h); ------------------ | | 12| 44|#define vect_mul PQCHQC_NAMESPACE(vect_mul) | | ------------------ | | | | 17| 44|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 44|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 44|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 56| 44| vect_add(s, x, s, VEC_N_SIZE_64); ------------------ | | 19| 44|#define vect_add PQCHQC_NAMESPACE(vect_add) | | ------------------ | | | | 17| 44|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 44|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 44|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ vect_add(s, x, s, VEC_N_SIZE_64); ------------------ | | 36| 44|#define VEC_N_SIZE_64 CEIL_DIVIDE(PARAM_N, 64) ///< Size of array to store PARAM_N bits in 64-bit words | | ------------------ | | | | 12| 44|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [Folded, False: 44] | | | | ------------------ | | ------------------ ------------------ 57| | 58| | // Parse encryption key to string 59| 44| memcpy(ek_pke, seed_ek, SEED_BYTES); ------------------ | | 52| 44|#define SEED_BYTES 32 ///< Define the size of the seed in bytes ------------------ 60| 44| memcpy(ek_pke + SEED_BYTES, s, VEC_N_SIZE_BYTES); ------------------ | | 52| 44|#define SEED_BYTES 32 ///< Define the size of the seed in bytes ------------------ memcpy(ek_pke + SEED_BYTES, s, VEC_N_SIZE_BYTES); ------------------ | | 31| 44|#define VEC_N_SIZE_BYTES CEIL_DIVIDE(PARAM_N, 8) ///< Size of array to store PARAM_N bits in bytes | | ------------------ | | | | 12| 44|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [Folded, False: 44] | | | | ------------------ | | ------------------ ------------------ 61| | 62| | // Parse decryption key to string 63| 44| memcpy(dk_pke, seed_dk, SEED_BYTES); ------------------ | | 52| 44|#define SEED_BYTES 32 ///< Define the size of the seed in bytes ------------------ 64| | 65| |#ifdef VERBOSE 66| | printf("\n\nseed_dk: "); 67| | for (int i = 0; i < SEED_BYTES; ++i) printf("%02x", seed_dk[i]); 68| | printf("\n\nseed_ek: "); 69| | for (int i = 0; i < SEED_BYTES; ++i) printf("%02x", seed_ek[i]); 70| | printf("\n\ny: "); 71| | vect_print(y, VEC_N_SIZE_BYTES); 72| | printf("\n\nx: "); 73| | vect_print(x, VEC_N_SIZE_BYTES); 74| | printf("\n\nh: "); 75| | vect_print(h, VEC_N_SIZE_BYTES); 76| | printf("\n\ns: "); 77| | vect_print(s, VEC_N_SIZE_BYTES); 78| |#endif 79| | 80| | // Zeroize sensitive data 81| 44| memset_zero(keypair_seed, sizeof keypair_seed); ------------------ | | 22| 44|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 44|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 44|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 44|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 44|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 82| 44| memset_zero(x, sizeof x); ------------------ | | 22| 44|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 44|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 44|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 44|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 44|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 83| 44| memset_zero(y, sizeof y); ------------------ | | 22| 44|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 44|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 44|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 44|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 44|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 84| 44| memset_zero(&dk_xof_ctx, sizeof dk_xof_ctx); ------------------ | | 22| 44|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 44|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 44|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 44|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 44|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 85| 44|} PQCHQC_HQC3_C_hqc_pke_encrypt: 99| 88|void hqc_pke_encrypt(ciphertext_pke_t *c_pke, const uint8_t *ek_pke, const uint64_t *m, const uint8_t *theta) { 100| 88| shake256_xof_ctx theta_xof_ctx = {0}; 101| 88| uint64_t h[VEC_N_SIZE_64] = {0}; 102| 88| uint64_t s[VEC_N_SIZE_64] = {0}; 103| 88| uint64_t r1[VEC_N_SIZE_64] = {0}; 104| 88| uint64_t r2[VEC_N_SIZE_64] = {0}; 105| 88| uint64_t e[VEC_N_SIZE_64] = {0}; 106| 88| uint64_t tmp[VEC_N_SIZE_64] = {0}; 107| | 108| | // Initialize Xof using theta 109| 88| xof_init(&theta_xof_ctx, theta, SEED_BYTES); ------------------ | | 74| 88|#define xof_init PQCHQC_NAMESPACE(xof_init) | | ------------------ | | | | 17| 88|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 88|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 88|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ xof_init(&theta_xof_ctx, theta, SEED_BYTES); ------------------ | | 52| 88|#define SEED_BYTES 32 ///< Define the size of the seed in bytes ------------------ 110| | 111| | // Retrieve h and s from public key 112| 88| hqc_ek_pke_from_string(h, s, ek_pke); ------------------ | | 15| 88|#define hqc_ek_pke_from_string PQCHQC_NAMESPACE(hqc_ek_pke_from_string) | | ------------------ | | | | 17| 88|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 88|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 88|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 113| | 114| | // Generate re, e and r1 115| 88| vect_sample_fixed_weight2(&theta_xof_ctx, r2, PARAM_OMEGA_R); ------------------ | | 17| 88|#define vect_sample_fixed_weight2 PQCHQC_NAMESPACE(vect_sample_fixed_weight2) | | ------------------ | | | | 17| 88|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 88|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 88|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ vect_sample_fixed_weight2(&theta_xof_ctx, r2, PARAM_OMEGA_R); ------------------ | | 21| 88|#define PARAM_OMEGA_R 114 ///< Define the parameter omega_r of the scheme ------------------ 116| 88| vect_sample_fixed_weight2(&theta_xof_ctx, e, PARAM_OMEGA_E); ------------------ | | 17| 88|#define vect_sample_fixed_weight2 PQCHQC_NAMESPACE(vect_sample_fixed_weight2) | | ------------------ | | | | 17| 88|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 88|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 88|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ vect_sample_fixed_weight2(&theta_xof_ctx, e, PARAM_OMEGA_E); ------------------ | | 20| 88|#define PARAM_OMEGA_E 114 ///< Define the parameter omega_e of the scheme ------------------ 117| 88| vect_sample_fixed_weight2(&theta_xof_ctx, r1, PARAM_OMEGA_R); ------------------ | | 17| 88|#define vect_sample_fixed_weight2 PQCHQC_NAMESPACE(vect_sample_fixed_weight2) | | ------------------ | | | | 17| 88|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 88|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 88|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ vect_sample_fixed_weight2(&theta_xof_ctx, r1, PARAM_OMEGA_R); ------------------ | | 21| 88|#define PARAM_OMEGA_R 114 ///< Define the parameter omega_r of the scheme ------------------ 118| 88| xof_ctx_release(&theta_xof_ctx); ------------------ | | 76| 88|#define xof_ctx_release PQCHQC_NAMESPACE(xof_ctx_release) | | ------------------ | | | | 17| 88|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 88|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 88|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 119| | 120| | // Compute u = r1 + r2.h 121| 88| vect_mul(c_pke->u, r2, h); ------------------ | | 12| 88|#define vect_mul PQCHQC_NAMESPACE(vect_mul) | | ------------------ | | | | 17| 88|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 88|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 88|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 122| 88| vect_add(c_pke->u, r1, c_pke->u, VEC_N_SIZE_64); ------------------ | | 19| 88|#define vect_add PQCHQC_NAMESPACE(vect_add) | | ------------------ | | | | 17| 88|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 88|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 88|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ vect_add(c_pke->u, r1, c_pke->u, VEC_N_SIZE_64); ------------------ | | 36| 88|#define VEC_N_SIZE_64 CEIL_DIVIDE(PARAM_N, 64) ///< Size of array to store PARAM_N bits in 64-bit words | | ------------------ | | | | 12| 88|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [Folded, False: 88] | | | | ------------------ | | ------------------ ------------------ 123| | 124| | // Compute v = C.encode(m) 125| 88| code_encode(c_pke->v, m); ------------------ | | 14| 88|#define code_encode PQCHQC_NAMESPACE(code_encode) | | ------------------ | | | | 17| 88|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 88|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 88|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 126| | 127| | // Compute v = C.encode(m) + Truncate(s.r2 + e) 128| 88| vect_mul(tmp, r2, s); ------------------ | | 12| 88|#define vect_mul PQCHQC_NAMESPACE(vect_mul) | | ------------------ | | | | 17| 88|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 88|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 88|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 129| 88| vect_add(tmp, e, tmp, VEC_N_SIZE_64); ------------------ | | 19| 88|#define vect_add PQCHQC_NAMESPACE(vect_add) | | ------------------ | | | | 17| 88|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 88|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 88|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ vect_add(tmp, e, tmp, VEC_N_SIZE_64); ------------------ | | 36| 88|#define VEC_N_SIZE_64 CEIL_DIVIDE(PARAM_N, 64) ///< Size of array to store PARAM_N bits in 64-bit words | | ------------------ | | | | 12| 88|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [Folded, False: 88] | | | | ------------------ | | ------------------ ------------------ 130| 88| vect_truncate(tmp); ------------------ | | 21| 88|#define vect_truncate PQCHQC_NAMESPACE(vect_truncate) | | ------------------ | | | | 17| 88|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 88|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 88|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 131| 88| vect_add(c_pke->v, c_pke->v, tmp, VEC_N1N2_SIZE_64); ------------------ | | 19| 88|#define vect_add PQCHQC_NAMESPACE(vect_add) | | ------------------ | | | | 17| 88|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 88|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 88|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ vect_add(c_pke->v, c_pke->v, tmp, VEC_N1N2_SIZE_64); ------------------ | | 38| 88|#define VEC_N1N2_SIZE_64 CEIL_DIVIDE(PARAM_N1N2, 64) ///< Size of array to store PARAM_N1N2 bits in 64-bit words | | ------------------ | | | | 12| 88|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [True: 88, Folded] | | | | ------------------ | | ------------------ ------------------ 132| | 133| |#ifdef VERBOSE 134| | printf("\n\nh: "); 135| | vect_print(h, VEC_N_SIZE_BYTES); 136| | printf("\n\ns: "); 137| | vect_print(s, VEC_N_SIZE_BYTES); 138| | printf("\n\nr1: "); 139| | vect_print(r1, VEC_N_SIZE_BYTES); 140| | printf("\n\nr2: "); 141| | vect_print(r2, VEC_N_SIZE_BYTES); 142| | printf("\n\ne: "); 143| | vect_print(e, VEC_N_SIZE_BYTES); 144| | printf("\n\nTruncate(s.r2 + e): "); 145| | vect_print(tmp, VEC_N1N2_SIZE_BYTES); 146| | printf("\n\nc_pke->u: "); 147| | vect_print(c_pke->u, VEC_N_SIZE_BYTES); 148| | printf("\n\nc_pke->v: "); 149| | vect_print(c_pke->v, VEC_N1N2_SIZE_BYTES); 150| |#endif 151| | 152| | // Zeroize sensitive data 153| 88| memset_zero(r1, sizeof r1); ------------------ | | 22| 88|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 88|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 88|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 88|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 88|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 154| 88| memset_zero(r2, sizeof r2); ------------------ | | 22| 88|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 88|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 88|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 88|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 88|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 155| 88| memset_zero(e, sizeof e); ------------------ | | 22| 88|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 88|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 88|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 88|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 88|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 156| 88| memset_zero(tmp, sizeof tmp); ------------------ | | 22| 88|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 88|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 88|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 88|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 88|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 157| 88| memset_zero(&theta_xof_ctx, sizeof theta_xof_ctx); ------------------ | | 22| 88|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 88|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 88|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 88|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 88|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 158| 88|} PQCHQC_HQC3_C_hqc_pke_decrypt: 173| 44|uint8_t hqc_pke_decrypt(uint64_t *m, const uint8_t *dk_pke, const ciphertext_pke_t *c_pke) { 174| 44| uint64_t y[VEC_N_SIZE_64] = {0}; 175| 44| uint64_t tmp1[VEC_N_SIZE_64] = {0}; 176| 44| uint64_t tmp2[VEC_N_SIZE_64] = {0}; 177| | 178| | // Parse decryption key dk_pke 179| 44| hqc_dk_pke_from_string(y, dk_pke); ------------------ | | 14| 44|#define hqc_dk_pke_from_string PQCHQC_NAMESPACE(hqc_dk_pke_from_string) | | ------------------ | | | | 17| 44|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 44|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 44|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 180| | 181| | // Compute u.y 182| 44| vect_mul(tmp1, y, c_pke->u); ------------------ | | 12| 44|#define vect_mul PQCHQC_NAMESPACE(vect_mul) | | ------------------ | | | | 17| 44|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 44|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 44|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 183| | // Truncate(u.y) 184| 44| vect_truncate(tmp1); ------------------ | | 21| 44|#define vect_truncate PQCHQC_NAMESPACE(vect_truncate) | | ------------------ | | | | 17| 44|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 44|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 44|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 185| | // Compute v - Truncate(u.y) 186| 44| vect_add(tmp2, c_pke->v, tmp1, VEC_N1N2_SIZE_64); ------------------ | | 19| 44|#define vect_add PQCHQC_NAMESPACE(vect_add) | | ------------------ | | | | 17| 44|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 44|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 44|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ vect_add(tmp2, c_pke->v, tmp1, VEC_N1N2_SIZE_64); ------------------ | | 38| 44|#define VEC_N1N2_SIZE_64 CEIL_DIVIDE(PARAM_N1N2, 64) ///< Size of array to store PARAM_N1N2 bits in 64-bit words | | ------------------ | | | | 12| 44|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [True: 44, Folded] | | | | ------------------ | | ------------------ ------------------ 187| | 188| |#ifdef VERBOSE 189| | printf("\n\nc_pke.u: "); 190| | vect_print(c_pke->u, VEC_N_SIZE_BYTES); 191| | printf("\n\nc_pke.v: "); 192| | vect_print(c_pke->v, VEC_N1N2_SIZE_BYTES); 193| | printf("\n\ny: "); 194| | vect_print(y, VEC_N_SIZE_BYTES); 195| | printf("\n\nTruncate(u.y): "); 196| | vect_print(tmp1, VEC_N1N2_SIZE_BYTES); 197| | printf("\n\nv - Truncate(u.y): "); 198| | vect_print(tmp2, VEC_N1N2_SIZE_BYTES); 199| |#endif 200| | 201| | // Compute plaintext m 202| 44| code_decode(m, tmp2); ------------------ | | 15| 44|#define code_decode PQCHQC_NAMESPACE(code_decode) | | ------------------ | | | | 17| 44|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 44|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 44|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 203| | 204| | // Zeroize sensitive data 205| 44| memset_zero(y, sizeof y); ------------------ | | 22| 44|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 44|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 44|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 44|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 44|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 206| 44| memset_zero(tmp1, sizeof tmp1); ------------------ | | 22| 44|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 44|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 44|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 44|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 44|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 207| 44| memset_zero(tmp2, sizeof tmp2); ------------------ | | 22| 44|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 44|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 44|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 44|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 44|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 208| | 209| 44| return 0; 210| 44|} PQCHQC_HQC3_C_crypto_kem_keypair: 39| 44|int crypto_kem_keypair(uint8_t *ek_kem, uint8_t *dk_kem) { 40| |#ifdef VERBOSE 41| | printf("\n\n\n### KEYGEN ###"); 42| |#endif 43| 44| uint8_t seed_kem[SEED_BYTES] = {0}; 44| 44| uint8_t sigma[PARAM_SECURITY_BYTES] = {0}; 45| 44| uint8_t seed_pke[SEED_BYTES] = {0}; 46| 44| shake256_xof_ctx ctx_kem; 47| | 48| 44| uint8_t ek_pke[PUBLIC_KEY_BYTES] = {0}; 49| 44| uint8_t dk_pke[SEED_BYTES] = {0}; 50| | 51| 44| prng_get_bytes(seed_kem, SEED_BYTES); ------------------ | | 73| 44|#define prng_get_bytes PQCHQC_NAMESPACE(prng_get_bytes) | | ------------------ | | | | 17| 44|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 44|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 44|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ prng_get_bytes(seed_kem, SEED_BYTES); ------------------ | | 52| 44|#define SEED_BYTES 32 ///< Define the size of the seed in bytes ------------------ 52| | 53| | // Compute seed_pke and randomness sigma 54| 44| xof_init(&ctx_kem, seed_kem, SEED_BYTES); ------------------ | | 74| 44|#define xof_init PQCHQC_NAMESPACE(xof_init) | | ------------------ | | | | 17| 44|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 44|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 44|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ xof_init(&ctx_kem, seed_kem, SEED_BYTES); ------------------ | | 52| 44|#define SEED_BYTES 32 ///< Define the size of the seed in bytes ------------------ 55| 44| xof_get_bytes(&ctx_kem, seed_pke, SEED_BYTES); ------------------ | | 75| 44|#define xof_get_bytes PQCHQC_NAMESPACE(xof_get_bytes) | | ------------------ | | | | 17| 44|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 44|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 44|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ xof_get_bytes(&ctx_kem, seed_pke, SEED_BYTES); ------------------ | | 52| 44|#define SEED_BYTES 32 ///< Define the size of the seed in bytes ------------------ 56| 44| xof_get_bytes(&ctx_kem, sigma, PARAM_SECURITY_BYTES); ------------------ | | 75| 44|#define xof_get_bytes PQCHQC_NAMESPACE(xof_get_bytes) | | ------------------ | | | | 17| 44|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 44|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 44|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ xof_get_bytes(&ctx_kem, sigma, PARAM_SECURITY_BYTES); ------------------ | | 23| 44|#define PARAM_SECURITY_BYTES 24 ///< Define the security level in bytes ------------------ 57| 44| xof_ctx_release(&ctx_kem); ------------------ | | 76| 44|#define xof_ctx_release PQCHQC_NAMESPACE(xof_ctx_release) | | ------------------ | | | | 17| 44|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 44|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 44|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 58| | 59| | // Compute HQC-PKE keypair 60| 44| hqc_pke_keygen(ek_pke, dk_pke, seed_pke); ------------------ | | 14| 44|#define hqc_pke_keygen PQCHQC_NAMESPACE(hqc_pke_keygen) | | ------------------ | | | | 17| 44|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 44|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 44|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 61| | 62| | // Compute HQC-KEM keypair 63| 44| memcpy(ek_kem, ek_pke, PUBLIC_KEY_BYTES); ------------------ | | 27| 44|#define PUBLIC_KEY_BYTES CRYPTO_PUBLICKEYBYTES ///< Define the size of the public key in bytes | | ------------------ | | | | 12| 44|#define CRYPTO_PUBLICKEYBYTES 4514 | | ------------------ ------------------ 64| 44| memcpy(dk_kem, ek_kem, PUBLIC_KEY_BYTES); ------------------ | | 27| 44|#define PUBLIC_KEY_BYTES CRYPTO_PUBLICKEYBYTES ///< Define the size of the public key in bytes | | ------------------ | | | | 12| 44|#define CRYPTO_PUBLICKEYBYTES 4514 | | ------------------ ------------------ 65| 44| memcpy(dk_kem + PUBLIC_KEY_BYTES, dk_pke, SEED_BYTES); ------------------ | | 27| 44|#define PUBLIC_KEY_BYTES CRYPTO_PUBLICKEYBYTES ///< Define the size of the public key in bytes | | ------------------ | | | | 12| 44|#define CRYPTO_PUBLICKEYBYTES 4514 | | ------------------ ------------------ memcpy(dk_kem + PUBLIC_KEY_BYTES, dk_pke, SEED_BYTES); ------------------ | | 52| 44|#define SEED_BYTES 32 ///< Define the size of the seed in bytes ------------------ 66| 44| memcpy(dk_kem + PUBLIC_KEY_BYTES + SEED_BYTES, sigma, PARAM_SECURITY_BYTES); ------------------ | | 27| 44|#define PUBLIC_KEY_BYTES CRYPTO_PUBLICKEYBYTES ///< Define the size of the public key in bytes | | ------------------ | | | | 12| 44|#define CRYPTO_PUBLICKEYBYTES 4514 | | ------------------ ------------------ memcpy(dk_kem + PUBLIC_KEY_BYTES + SEED_BYTES, sigma, PARAM_SECURITY_BYTES); ------------------ | | 52| 44|#define SEED_BYTES 32 ///< Define the size of the seed in bytes ------------------ memcpy(dk_kem + PUBLIC_KEY_BYTES + SEED_BYTES, sigma, PARAM_SECURITY_BYTES); ------------------ | | 23| 44|#define PARAM_SECURITY_BYTES 24 ///< Define the security level in bytes ------------------ 67| 44| memcpy(dk_kem + PUBLIC_KEY_BYTES + SEED_BYTES + PARAM_SECURITY_BYTES, seed_kem, SEED_BYTES); ------------------ | | 27| 44|#define PUBLIC_KEY_BYTES CRYPTO_PUBLICKEYBYTES ///< Define the size of the public key in bytes | | ------------------ | | | | 12| 44|#define CRYPTO_PUBLICKEYBYTES 4514 | | ------------------ ------------------ memcpy(dk_kem + PUBLIC_KEY_BYTES + SEED_BYTES + PARAM_SECURITY_BYTES, seed_kem, SEED_BYTES); ------------------ | | 52| 44|#define SEED_BYTES 32 ///< Define the size of the seed in bytes ------------------ memcpy(dk_kem + PUBLIC_KEY_BYTES + SEED_BYTES + PARAM_SECURITY_BYTES, seed_kem, SEED_BYTES); ------------------ | | 23| 44|#define PARAM_SECURITY_BYTES 24 ///< Define the security level in bytes ------------------ memcpy(dk_kem + PUBLIC_KEY_BYTES + SEED_BYTES + PARAM_SECURITY_BYTES, seed_kem, SEED_BYTES); ------------------ | | 52| 44|#define SEED_BYTES 32 ///< Define the size of the seed in bytes ------------------ 68| | 69| |#ifdef VERBOSE 70| | printf("\n\nseed_kem: "); 71| | for (int i = 0; i < SEED_BYTES; ++i) printf("%02x", seed_kem[i]); 72| | printf("\n\nseed_pke: "); 73| | for (int i = 0; i < SEED_BYTES; ++i) printf("%02x", seed_pke[i]); 74| | printf("\n\nsigma: "); 75| | for (int i = 0; i < PARAM_SECURITY_BYTES; ++i) printf("%02x", sigma[i]); 76| |#endif 77| | 78| | // Zeroize sensitive data 79| 44| memset_zero(seed_kem, sizeof seed_kem); ------------------ | | 22| 44|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 44|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 44|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 44|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 44|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 80| 44| memset_zero(sigma, sizeof sigma); ------------------ | | 22| 44|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 44|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 44|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 44|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 44|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 81| 44| memset_zero(seed_pke, sizeof seed_pke); ------------------ | | 22| 44|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 44|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 44|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 44|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 44|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 82| 44| memset_zero(dk_pke, sizeof dk_pke); ------------------ | | 22| 44|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 44|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 44|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 44|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 44|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 83| | 84| 44| return 0; 85| 44|} PQCHQC_HQC3_C_crypto_kem_enc: 105| 44|int crypto_kem_enc(uint8_t *c_kem, uint8_t *K, const uint8_t *ek_kem) { 106| |#ifdef VERBOSE 107| | printf("\n\n\n\n### ENCAPS ###"); 108| |#endif 109| | 110| 44| uint8_t m[PARAM_SECURITY_BYTES] = {0}; 111| 44| uint8_t K_theta[SHARED_SECRET_BYTES + SEED_BYTES] = {0}; 112| 44| uint8_t theta[SEED_BYTES] = {0}; 113| 44| uint8_t hash_ek_kem[SEED_BYTES] = {0}; 114| 44| ciphertext_kem_t c_kem_t = {0}; 115| | 116| | // Sample message m and salt 117| 44| prng_get_bytes(m, PARAM_SECURITY_BYTES); ------------------ | | 73| 44|#define prng_get_bytes PQCHQC_NAMESPACE(prng_get_bytes) | | ------------------ | | | | 17| 44|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 44|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 44|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ prng_get_bytes(m, PARAM_SECURITY_BYTES); ------------------ | | 23| 44|#define PARAM_SECURITY_BYTES 24 ///< Define the security level in bytes ------------------ 118| 44| prng_get_bytes(c_kem_t.salt, SALT_BYTES); ------------------ | | 73| 44|#define prng_get_bytes PQCHQC_NAMESPACE(prng_get_bytes) | | ------------------ | | | | 17| 44|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 44|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 44|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ prng_get_bytes(c_kem_t.salt, SALT_BYTES); ------------------ | | 53| 44|#define SALT_BYTES 16 ///< Define the size of a salt in bytes ------------------ 119| | 120| | // Compute shared key K and ciphertext c_kem 121| 44| hash_h(hash_ek_kem, ek_kem); ------------------ | | 78| 44|#define hash_h PQCHQC_NAMESPACE(hash_h) | | ------------------ | | | | 17| 44|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 44|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 44|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 122| 44| hash_g(K_theta, hash_ek_kem, m, c_kem_t.salt); ------------------ | | 77| 44|#define hash_g PQCHQC_NAMESPACE(hash_g) | | ------------------ | | | | 17| 44|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 44|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 44|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 123| 44| memcpy(theta, K_theta + SEED_BYTES, SEED_BYTES); ------------------ | | 52| 44|#define SEED_BYTES 32 ///< Define the size of the seed in bytes ------------------ memcpy(theta, K_theta + SEED_BYTES, SEED_BYTES); ------------------ | | 52| 44|#define SEED_BYTES 32 ///< Define the size of the seed in bytes ------------------ 124| 44| hqc_pke_encrypt(&c_kem_t.c_pke, ek_kem, (uint64_t *)m, theta); ------------------ | | 15| 44|#define hqc_pke_encrypt PQCHQC_NAMESPACE(hqc_pke_encrypt) | | ------------------ | | | | 17| 44|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 44|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 44|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 125| | 126| 44| hqc_c_kem_to_string(c_kem, &c_kem_t); ------------------ | | 16| 44|#define hqc_c_kem_to_string PQCHQC_NAMESPACE(hqc_c_kem_to_string) | | ------------------ | | | | 17| 44|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 44|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 44|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 127| 44| memcpy(K, K_theta, SHARED_SECRET_BYTES); ------------------ | | 28| 44|#define SHARED_SECRET_BYTES CRYPTO_BYTES ///< Define the size of the shared secret in bytes | | ------------------ | | | | 13| 44|#define CRYPTO_BYTES 32 | | ------------------ ------------------ 128| | 129| |#ifdef VERBOSE 130| | printf("\n\nek_kem: "); 131| | for (int i = 0; i < PUBLIC_KEY_BYTES; ++i) printf("%02x", ek_kem[i]); 132| | printf("\n\nm: "); 133| | vect_print((uint64_t *)m, PARAM_SECURITY_BYTES); 134| | printf("\n\nsalt: "); 135| | for (int i = 0; i < SALT_BYTES; ++i) printf("%02x", c_kem_t.salt[i]); 136| | printf("\n\nH(ek_kem): "); 137| | for (int i = 0; i < SEED_BYTES; ++i) printf("%02x", hash_ek_kem[i]); 138| | printf("\n\ntheta: "); 139| | for (int i = 0; i < SEED_BYTES; ++i) printf("%02x", theta[i]); 140| | printf("\n\nc_kem: "); 141| | for (int i = 0; i < CIPHERTEXT_BYTES; ++i) printf("%02x", c_kem[i]); 142| | printf("\n\nK: "); 143| | for (int i = 0; i < SHARED_SECRET_BYTES; ++i) printf("%02x", K[i]); 144| |#endif 145| | 146| | // Zeroize sensitive data 147| 44| memset_zero(m, sizeof m); ------------------ | | 22| 44|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 44|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 44|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 44|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 44|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 148| 44| memset_zero(K_theta, sizeof K_theta); ------------------ | | 22| 44|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 44|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 44|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 44|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 44|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 149| 44| memset_zero(theta, sizeof theta); ------------------ | | 22| 44|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 44|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 44|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 44|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 44|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 150| | 151| 44| return 0; 152| 44|} PQCHQC_HQC3_C_crypto_kem_dec: 166| 44|int crypto_kem_dec(uint8_t *K_prime, const uint8_t *c_kem, const uint8_t *dk_kem) { 167| |#ifdef VERBOSE 168| | printf("\n\n\n\n### DECAPS ###"); 169| |#endif 170| | 171| 44| uint8_t ek_pke[PUBLIC_KEY_BYTES] = {0}; 172| 44| uint8_t dk_pke[SEED_BYTES] = {0}; 173| 44| uint8_t sigma[PARAM_SECURITY_BYTES] = {0}; 174| 44| uint8_t m_prime[PARAM_SECURITY_BYTES] = {0}; 175| 44| uint8_t hash_ek_kem[SEED_BYTES] = {0}; 176| 44| uint8_t K_theta_prime[SHARED_SECRET_BYTES + SEED_BYTES] = {0}; 177| 44| uint8_t K_bar[SHARED_SECRET_BYTES] = {0}; 178| 44| uint8_t theta_prime[SEED_BYTES] = {0}; 179| 44| ciphertext_kem_t c_kem_t = {0}; 180| 44| ciphertext_kem_t c_kem_prime_t = {0}; 181| 44| uint8_t result; 182| | 183| | // Parse decapsulation key dk_kem 184| 44| memcpy(ek_pke, dk_kem, PUBLIC_KEY_BYTES); ------------------ | | 27| 44|#define PUBLIC_KEY_BYTES CRYPTO_PUBLICKEYBYTES ///< Define the size of the public key in bytes | | ------------------ | | | | 12| 44|#define CRYPTO_PUBLICKEYBYTES 4514 | | ------------------ ------------------ 185| 44| memcpy(dk_pke, dk_kem + PUBLIC_KEY_BYTES, SEED_BYTES); ------------------ | | 27| 44|#define PUBLIC_KEY_BYTES CRYPTO_PUBLICKEYBYTES ///< Define the size of the public key in bytes | | ------------------ | | | | 12| 44|#define CRYPTO_PUBLICKEYBYTES 4514 | | ------------------ ------------------ memcpy(dk_pke, dk_kem + PUBLIC_KEY_BYTES, SEED_BYTES); ------------------ | | 52| 44|#define SEED_BYTES 32 ///< Define the size of the seed in bytes ------------------ 186| 44| memcpy(sigma, dk_kem + PUBLIC_KEY_BYTES + SEED_BYTES, PARAM_SECURITY_BYTES); ------------------ | | 27| 44|#define PUBLIC_KEY_BYTES CRYPTO_PUBLICKEYBYTES ///< Define the size of the public key in bytes | | ------------------ | | | | 12| 44|#define CRYPTO_PUBLICKEYBYTES 4514 | | ------------------ ------------------ memcpy(sigma, dk_kem + PUBLIC_KEY_BYTES + SEED_BYTES, PARAM_SECURITY_BYTES); ------------------ | | 52| 44|#define SEED_BYTES 32 ///< Define the size of the seed in bytes ------------------ memcpy(sigma, dk_kem + PUBLIC_KEY_BYTES + SEED_BYTES, PARAM_SECURITY_BYTES); ------------------ | | 23| 44|#define PARAM_SECURITY_BYTES 24 ///< Define the security level in bytes ------------------ 187| | 188| | // Parse ciphertext c_kem 189| 44| hqc_c_kem_from_string(&c_kem_t.c_pke, c_kem_t.salt, c_kem); ------------------ | | 17| 44|#define hqc_c_kem_from_string PQCHQC_NAMESPACE(hqc_c_kem_from_string) | | ------------------ | | | | 17| 44|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 44|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 44|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 190| | 191| | // Compute message m_prime 192| 44| result = hqc_pke_decrypt((uint64_t *)m_prime, dk_pke, &c_kem_t.c_pke); ------------------ | | 16| 44|#define hqc_pke_decrypt PQCHQC_NAMESPACE(hqc_pke_decrypt) | | ------------------ | | | | 17| 44|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 44|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 44|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 193| | 194| | // Compute shared key K_prime and ciphertext c_kem_prime 195| 44| hash_h(hash_ek_kem, ek_pke); ------------------ | | 78| 44|#define hash_h PQCHQC_NAMESPACE(hash_h) | | ------------------ | | | | 17| 44|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 44|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 44|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 196| 44| hash_g(K_theta_prime, hash_ek_kem, m_prime, c_kem_t.salt); ------------------ | | 77| 44|#define hash_g PQCHQC_NAMESPACE(hash_g) | | ------------------ | | | | 17| 44|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 44|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 44|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 197| 44| memcpy(K_prime, K_theta_prime, SHARED_SECRET_BYTES); ------------------ | | 28| 44|#define SHARED_SECRET_BYTES CRYPTO_BYTES ///< Define the size of the shared secret in bytes | | ------------------ | | | | 13| 44|#define CRYPTO_BYTES 32 | | ------------------ ------------------ 198| 44| memcpy(theta_prime, K_theta_prime + SHARED_SECRET_BYTES, SEED_BYTES); ------------------ | | 28| 44|#define SHARED_SECRET_BYTES CRYPTO_BYTES ///< Define the size of the shared secret in bytes | | ------------------ | | | | 13| 44|#define CRYPTO_BYTES 32 | | ------------------ ------------------ memcpy(theta_prime, K_theta_prime + SHARED_SECRET_BYTES, SEED_BYTES); ------------------ | | 52| 44|#define SEED_BYTES 32 ///< Define the size of the seed in bytes ------------------ 199| | 200| 44| hqc_pke_encrypt(&c_kem_prime_t.c_pke, ek_pke, (uint64_t *)m_prime, theta_prime); ------------------ | | 15| 44|#define hqc_pke_encrypt PQCHQC_NAMESPACE(hqc_pke_encrypt) | | ------------------ | | | | 17| 44|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 44|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 44|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 201| 44| memcpy(c_kem_prime_t.salt, c_kem_t.salt, SALT_BYTES); ------------------ | | 53| 44|#define SALT_BYTES 16 ///< Define the size of a salt in bytes ------------------ 202| | 203| | // Compute rejection key K_bar 204| 44| hash_j(K_bar, hash_ek_kem, sigma, &c_kem_t); ------------------ | | 80| 44|#define hash_j PQCHQC_NAMESPACE(hash_j) | | ------------------ | | | | 17| 44|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 44|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 44|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 205| 44| result |= vect_compare((uint8_t *)c_kem_t.c_pke.u, (uint8_t *)c_kem_prime_t.c_pke.u, VEC_N_SIZE_BYTES); ------------------ | | 20| 44|#define vect_compare PQCHQC_NAMESPACE(vect_compare) | | ------------------ | | | | 17| 44|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 44|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 44|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ result |= vect_compare((uint8_t *)c_kem_t.c_pke.u, (uint8_t *)c_kem_prime_t.c_pke.u, VEC_N_SIZE_BYTES); ------------------ | | 31| 44|#define VEC_N_SIZE_BYTES CEIL_DIVIDE(PARAM_N, 8) ///< Size of array to store PARAM_N bits in bytes | | ------------------ | | | | 12| 44|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [Folded, False: 44] | | | | ------------------ | | ------------------ ------------------ 206| 44| result |= vect_compare((uint8_t *)c_kem_t.c_pke.v, (uint8_t *)c_kem_prime_t.c_pke.v, VEC_N1N2_SIZE_BYTES); ------------------ | | 20| 44|#define vect_compare PQCHQC_NAMESPACE(vect_compare) | | ------------------ | | | | 17| 44|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 44|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 44|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ result |= vect_compare((uint8_t *)c_kem_t.c_pke.v, (uint8_t *)c_kem_prime_t.c_pke.v, VEC_N1N2_SIZE_BYTES); ------------------ | | 34| 44|#define VEC_N1N2_SIZE_BYTES CEIL_DIVIDE(PARAM_N1N2, 8) ///< Size of array to store PARAM_N1N2 bits in bytes | | ------------------ | | | | 12| 44|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [True: 44, Folded] | | | | ------------------ | | ------------------ ------------------ 207| 44| result |= vect_compare(c_kem_t.salt, c_kem_prime_t.salt, SALT_BYTES); ------------------ | | 20| 44|#define vect_compare PQCHQC_NAMESPACE(vect_compare) | | ------------------ | | | | 17| 44|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 44|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 44|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ result |= vect_compare(c_kem_t.salt, c_kem_prime_t.salt, SALT_BYTES); ------------------ | | 53| 44|#define SALT_BYTES 16 ///< Define the size of a salt in bytes ------------------ 208| 44| result -= 1; 209| 1.45k| for (size_t i = 0; i < SHARED_SECRET_BYTES; ++i) { ------------------ | | 28| 1.45k|#define SHARED_SECRET_BYTES CRYPTO_BYTES ///< Define the size of the shared secret in bytes | | ------------------ | | | | 13| 1.45k|#define CRYPTO_BYTES 32 | | ------------------ ------------------ | Branch (209:24): [True: 1.40k, False: 44] ------------------ 210| 1.40k| K_prime[i] = (K_prime[i] & result) ^ (K_bar[i] & ~result); 211| 1.40k| } 212| | 213| |#ifdef VERBOSE 214| | printf("\n\nek_pke: "); 215| | for (int i = 0; i < PUBLIC_KEY_BYTES; ++i) printf("%02x", ek_pke[i]); 216| | printf("\n\ndk_pke: "); 217| | for (int i = 0; i < SEED_BYTES; ++i) printf("%02x", dk_pke[i]); 218| | printf("\n\nc_kem: "); 219| | for (int i = 0; i < CIPHERTEXT_BYTES; ++i) printf("%02x", c_kem[i]); 220| | printf("\n\nm_prime: "); 221| | vect_print((uint64_t *)m_prime, PARAM_SECURITY_BYTES); 222| | printf("\n\nH(ek_kem): "); 223| | for (int i = 0; i < SEED_BYTES; ++i) printf("%02x", hash_ek_kem[i]); 224| | printf("\n\ntheta_prime: "); 225| | for (int i = 0; i < SEED_BYTES; ++i) printf("%02x", theta_prime[i]); 226| | printf("\n\n\n# Checking Ciphertext - Begin #"); 227| | printf("\n\nc_kem_prime_t.c_pke.u: "); 228| | vect_print(c_kem_prime_t.c_pke.u, VEC_N_SIZE_BYTES); 229| | printf("\n\nc_kem_prime_t.c_pke.v: "); 230| | vect_print(c_kem_prime_t.c_pke.v, VEC_N1N2_SIZE_BYTES); 231| | printf("\n\nsalt: "); 232| | for (int i = 0; i < SALT_BYTES; ++i) printf("%02x", c_kem_prime_t.salt[i]); 233| | printf("\n\n# Checking Ciphertext - End #\n"); 234| | printf("\n\nK_prime: "); 235| | for (int i = 0; i < SHARED_SECRET_BYTES; ++i) printf("%02x", K_prime[i]); 236| |#endif 237| | 238| | // Zeroize sensitive data 239| 44| memset_zero(dk_pke, sizeof dk_pke); ------------------ | | 22| 44|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 44|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 44|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 44|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 44|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 240| 44| memset_zero(sigma, sizeof sigma); ------------------ | | 22| 44|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 44|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 44|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 44|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 44|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 241| 44| memset_zero(m_prime, sizeof m_prime); ------------------ | | 22| 44|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 44|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 44|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 44|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 44|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 242| 44| memset_zero(K_theta_prime, sizeof K_theta_prime); ------------------ | | 22| 44|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 44|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 44|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 44|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 44|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 243| 44| memset_zero(K_bar, sizeof K_bar); ------------------ | | 22| 44|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 44|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 44|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 44|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 44|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 244| 44| memset_zero(theta_prime, sizeof theta_prime); ------------------ | | 22| 44|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 44|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 44|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 44|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 44|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 245| | 246| 44| return 0; 247| 44|} PQCHQC_HQC3_C_hqc_dk_pke_from_string: 19| 44|void hqc_dk_pke_from_string(uint64_t *y, const uint8_t *dk_pke) { 20| 44| shake256_xof_ctx dk_xof_ctx = {0}; 21| 44| xof_init(&dk_xof_ctx, dk_pke, SEED_BYTES); ------------------ | | 74| 44|#define xof_init PQCHQC_NAMESPACE(xof_init) | | ------------------ | | | | 17| 44|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 44|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 44|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ xof_init(&dk_xof_ctx, dk_pke, SEED_BYTES); ------------------ | | 52| 44|#define SEED_BYTES 32 ///< Define the size of the seed in bytes ------------------ 22| 44| vect_sample_fixed_weight1(&dk_xof_ctx, y, PARAM_OMEGA); ------------------ | | 16| 44|#define vect_sample_fixed_weight1 PQCHQC_NAMESPACE(vect_sample_fixed_weight1) | | ------------------ | | | | 17| 44|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 44|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 44|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ vect_sample_fixed_weight1(&dk_xof_ctx, y, PARAM_OMEGA); ------------------ | | 19| 44|#define PARAM_OMEGA 100 ///< Define the parameter omega of the scheme ------------------ 23| 44| xof_ctx_release(&dk_xof_ctx); ------------------ | | 76| 44|#define xof_ctx_release PQCHQC_NAMESPACE(xof_ctx_release) | | ------------------ | | | | 17| 44|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 44|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 44|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 24| | 25| | // Zeroize sensitive data 26| 44| memset_zero(&dk_xof_ctx, sizeof dk_xof_ctx); ------------------ | | 22| 44|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 44|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 44|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 44|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 44|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 27| 44|} PQCHQC_HQC3_C_hqc_ek_pke_from_string: 36| 88|void hqc_ek_pke_from_string(uint64_t *h, uint64_t *s, const uint8_t *ek_pke) { 37| 88| shake256_xof_ctx ek_xof_ctx = {0}; 38| | 39| 88| xof_init(&ek_xof_ctx, ek_pke, SEED_BYTES); ------------------ | | 74| 88|#define xof_init PQCHQC_NAMESPACE(xof_init) | | ------------------ | | | | 17| 88|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 88|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 88|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ xof_init(&ek_xof_ctx, ek_pke, SEED_BYTES); ------------------ | | 52| 88|#define SEED_BYTES 32 ///< Define the size of the seed in bytes ------------------ 40| 88| vect_set_random(&ek_xof_ctx, h); ------------------ | | 18| 88|#define vect_set_random PQCHQC_NAMESPACE(vect_set_random) | | ------------------ | | | | 17| 88|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 88|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 88|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 41| 88| xof_ctx_release(&ek_xof_ctx); ------------------ | | 76| 88|#define xof_ctx_release PQCHQC_NAMESPACE(xof_ctx_release) | | ------------------ | | | | 17| 88|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 88|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 88|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 42| | 43| 88| memcpy(s, ek_pke + SEED_BYTES, VEC_N_SIZE_BYTES); ------------------ | | 52| 88|#define SEED_BYTES 32 ///< Define the size of the seed in bytes ------------------ memcpy(s, ek_pke + SEED_BYTES, VEC_N_SIZE_BYTES); ------------------ | | 31| 88|#define VEC_N_SIZE_BYTES CEIL_DIVIDE(PARAM_N, 8) ///< Size of array to store PARAM_N bits in bytes | | ------------------ | | | | 12| 88|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [Folded, False: 88] | | | | ------------------ | | ------------------ ------------------ 44| 88|} PQCHQC_HQC3_C_hqc_c_kem_to_string: 52| 44|void hqc_c_kem_to_string(uint8_t *ct, const ciphertext_kem_t *c_kem) { 53| 44| memcpy(ct, c_kem->c_pke.u, VEC_N_SIZE_BYTES); ------------------ | | 31| 44|#define VEC_N_SIZE_BYTES CEIL_DIVIDE(PARAM_N, 8) ///< Size of array to store PARAM_N bits in bytes | | ------------------ | | | | 12| 44|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [Folded, False: 44] | | | | ------------------ | | ------------------ ------------------ 54| 44| memcpy(ct + VEC_N_SIZE_BYTES, c_kem->c_pke.v, VEC_N1N2_SIZE_BYTES); ------------------ | | 31| 44|#define VEC_N_SIZE_BYTES CEIL_DIVIDE(PARAM_N, 8) ///< Size of array to store PARAM_N bits in bytes | | ------------------ | | | | 12| 44|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [Folded, False: 44] | | | | ------------------ | | ------------------ ------------------ memcpy(ct + VEC_N_SIZE_BYTES, c_kem->c_pke.v, VEC_N1N2_SIZE_BYTES); ------------------ | | 34| 44|#define VEC_N1N2_SIZE_BYTES CEIL_DIVIDE(PARAM_N1N2, 8) ///< Size of array to store PARAM_N1N2 bits in bytes | | ------------------ | | | | 12| 44|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [True: 44, Folded] | | | | ------------------ | | ------------------ ------------------ 55| 44| memcpy(ct + VEC_N_SIZE_BYTES + VEC_N1N2_SIZE_BYTES, c_kem->salt, SALT_BYTES); ------------------ | | 31| 44|#define VEC_N_SIZE_BYTES CEIL_DIVIDE(PARAM_N, 8) ///< Size of array to store PARAM_N bits in bytes | | ------------------ | | | | 12| 44|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [Folded, False: 44] | | | | ------------------ | | ------------------ ------------------ memcpy(ct + VEC_N_SIZE_BYTES + VEC_N1N2_SIZE_BYTES, c_kem->salt, SALT_BYTES); ------------------ | | 34| 44|#define VEC_N1N2_SIZE_BYTES CEIL_DIVIDE(PARAM_N1N2, 8) ///< Size of array to store PARAM_N1N2 bits in bytes | | ------------------ | | | | 12| 44|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [True: 44, Folded] | | | | ------------------ | | ------------------ ------------------ memcpy(ct + VEC_N_SIZE_BYTES + VEC_N1N2_SIZE_BYTES, c_kem->salt, SALT_BYTES); ------------------ | | 53| 44|#define SALT_BYTES 16 ///< Define the size of a salt in bytes ------------------ 56| 44|} PQCHQC_HQC3_C_hqc_c_kem_from_string: 65| 44|void hqc_c_kem_from_string(ciphertext_pke_t *c_pke, uint8_t *salt, const uint8_t *ct) { 66| 44| memcpy(c_pke->u, ct, VEC_N_SIZE_BYTES); ------------------ | | 31| 44|#define VEC_N_SIZE_BYTES CEIL_DIVIDE(PARAM_N, 8) ///< Size of array to store PARAM_N bits in bytes | | ------------------ | | | | 12| 44|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [Folded, False: 44] | | | | ------------------ | | ------------------ ------------------ 67| 44| memcpy(c_pke->v, ct + VEC_N_SIZE_BYTES, VEC_N1N2_SIZE_BYTES); ------------------ | | 31| 44|#define VEC_N_SIZE_BYTES CEIL_DIVIDE(PARAM_N, 8) ///< Size of array to store PARAM_N bits in bytes | | ------------------ | | | | 12| 44|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [Folded, False: 44] | | | | ------------------ | | ------------------ ------------------ memcpy(c_pke->v, ct + VEC_N_SIZE_BYTES, VEC_N1N2_SIZE_BYTES); ------------------ | | 34| 44|#define VEC_N1N2_SIZE_BYTES CEIL_DIVIDE(PARAM_N1N2, 8) ///< Size of array to store PARAM_N1N2 bits in bytes | | ------------------ | | | | 12| 44|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [True: 44, Folded] | | | | ------------------ | | ------------------ ------------------ 68| 44| memcpy(salt, ct + VEC_N_SIZE_BYTES + VEC_N1N2_SIZE_BYTES, SALT_BYTES); ------------------ | | 31| 44|#define VEC_N_SIZE_BYTES CEIL_DIVIDE(PARAM_N, 8) ///< Size of array to store PARAM_N bits in bytes | | ------------------ | | | | 12| 44|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [Folded, False: 44] | | | | ------------------ | | ------------------ ------------------ memcpy(salt, ct + VEC_N_SIZE_BYTES + VEC_N1N2_SIZE_BYTES, SALT_BYTES); ------------------ | | 34| 44|#define VEC_N1N2_SIZE_BYTES CEIL_DIVIDE(PARAM_N1N2, 8) ///< Size of array to store PARAM_N1N2 bits in bytes | | ------------------ | | | | 12| 44|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [True: 44, Folded] | | | | ------------------ | | ------------------ ------------------ memcpy(salt, ct + VEC_N_SIZE_BYTES + VEC_N1N2_SIZE_BYTES, SALT_BYTES); ------------------ | | 53| 44|#define SALT_BYTES 16 ///< Define the size of a salt in bytes ------------------ 69| 44|} PQCHQC_HQC3_C_reed_muller_encode: 174| 88|void reed_muller_encode(uint64_t *cdw, const uint64_t *msg) { 175| 88| uint8_t *message_array = (uint8_t *)msg; 176| 88| rm_codeword_t *codeArray = (rm_codeword_t *)cdw; 177| 5.01k| for (size_t i = 0; i < VEC_N1_SIZE_BYTES; i++) { ------------------ | | 33| 5.01k|#define VEC_N1_SIZE_BYTES PARAM_N1 ///< Size of array to store PARAM_N1 bits in bytes | | ------------------ | | | | 16| 5.01k|#define PARAM_N1 56 ///< Define the parameter n1 of the scheme (length of Reed-Solomon code) | | ------------------ ------------------ | Branch (177:24): [True: 4.92k, False: 88] ------------------ 178| | // fill entries i * MULTIPLICITY to (i+1) * MULTIPLICITY 179| 4.92k| int32_t pos = i * MULTIPLICITY; ------------------ | | 18| 4.92k|#define MULTIPLICITY CEIL_DIVIDE(PARAM_N2, 128) | | ------------------ | | | | 12| 4.92k|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [True: 4.92k, Folded] | | | | ------------------ | | ------------------ ------------------ 180| | // encode first word 181| 4.92k| encode(&codeArray[pos], message_array[i]); 182| | // copy to other identical codewords 183| 24.6k| for (size_t copy = 1; copy < MULTIPLICITY; copy++) { ------------------ | | 18| 24.6k|#define MULTIPLICITY CEIL_DIVIDE(PARAM_N2, 128) | | ------------------ | | | | 12| 24.6k|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [True: 24.6k, Folded] | | | | ------------------ | | ------------------ ------------------ | Branch (183:31): [True: 19.7k, False: 4.92k] ------------------ 184| 19.7k| memcpy(&codeArray[pos + copy], &codeArray[pos], sizeof(rm_codeword_t)); 185| 19.7k| } 186| 4.92k| } 187| 88|} PQCHQC_HQC3_C_reed_muller_decode: 198| 44|void reed_muller_decode(uint64_t *msg, const uint64_t *cdw) { 199| 44| uint8_t *message_array = (uint8_t *)msg; 200| 44| rm_codeword_t *codeArray = (rm_codeword_t *)cdw; 201| 44| rm_expanded_cdw expanded; 202| 2.50k| for (size_t i = 0; i < VEC_N1_SIZE_BYTES; i++) { ------------------ | | 33| 2.50k|#define VEC_N1_SIZE_BYTES PARAM_N1 ///< Size of array to store PARAM_N1 bits in bytes | | ------------------ | | | | 16| 2.50k|#define PARAM_N1 56 ///< Define the parameter n1 of the scheme (length of Reed-Solomon code) | | ------------------ ------------------ | Branch (202:24): [True: 2.46k, False: 44] ------------------ 203| | // collect the codewords 204| 2.46k| expand_and_sum(&expanded, &codeArray[i * MULTIPLICITY]); ------------------ | | 18| 2.46k|#define MULTIPLICITY CEIL_DIVIDE(PARAM_N2, 128) | | ------------------ | | | | 12| 2.46k|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [True: 2.46k, Folded] | | | | ------------------ | | ------------------ ------------------ 205| | // apply hadamard transform 206| 2.46k| rm_expanded_cdw transform; 207| 2.46k| hadamard(&expanded, &transform); 208| | // fix the first entry to get the half Hadamard transform 209| 2.46k| transform[0] -= 64 * MULTIPLICITY; ------------------ | | 18| 2.46k|#define MULTIPLICITY CEIL_DIVIDE(PARAM_N2, 128) | | ------------------ | | | | 12| 2.46k|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [True: 2.46k, Folded] | | | | ------------------ | | ------------------ ------------------ 210| | // finish the decoding 211| 2.46k| message_array[i] = find_peaks(&transform); 212| 2.46k| } 213| 44|} PQCHQC_HQC3_C_reed_solomon_encode: 84| 88|void reed_solomon_encode(uint64_t *cdw, const uint64_t *msg) { 85| 88| size_t i, j, k; 86| 88| uint8_t gate_value = 0; 87| | 88| 88| uint16_t tmp[PARAM_G] = {0}; 89| 88| uint16_t PARAM_RS_POLY[] = {RS_POLY_COEFS}; ------------------ | | 49| 88| 45, 216, 239, 24, 253, 104, 27, 40, 107, 50, 163, 210, 227, 134, 224, 158, 119, 13, 158, 1, 238, 164, 82, 43, 15, \ | | 50| 88| 232, 246, 142, 50, 189, 29, 232, 1 ///< Coefficients of the Reed-Solomon generator polynomial ------------------ 90| | 91| 88| uint8_t msg_bytes[PARAM_K] = {0}; 92| 88| uint8_t cdw_bytes[PARAM_N1] = {0}; 93| | 94| 88| memcpy(msg_bytes, msg, PARAM_K); ------------------ | | 44| 88|#define PARAM_K 24 ///< Define the size of the information bits of the Reed-Solomon code ------------------ 95| | 96| 2.20k| for (i = 0; i < PARAM_K; ++i) { ------------------ | | 44| 2.20k|#define PARAM_K 24 ///< Define the size of the information bits of the Reed-Solomon code ------------------ | Branch (96:17): [True: 2.11k, False: 88] ------------------ 97| 2.11k| gate_value = msg_bytes[PARAM_K - 1 - i] ^ cdw_bytes[PARAM_N1 - PARAM_K - 1]; ------------------ | | 44| 2.11k|#define PARAM_K 24 ///< Define the size of the information bits of the Reed-Solomon code ------------------ gate_value = msg_bytes[PARAM_K - 1 - i] ^ cdw_bytes[PARAM_N1 - PARAM_K - 1]; ------------------ | | 16| 2.11k|#define PARAM_N1 56 ///< Define the parameter n1 of the scheme (length of Reed-Solomon code) ------------------ gate_value = msg_bytes[PARAM_K - 1 - i] ^ cdw_bytes[PARAM_N1 - PARAM_K - 1]; ------------------ | | 44| 2.11k|#define PARAM_K 24 ///< Define the size of the information bits of the Reed-Solomon code ------------------ 98| | 99| 71.8k| for (j = 0; j < PARAM_G; ++j) { ------------------ | | 45| 71.8k|#define PARAM_G 33 ///< Define the size of the generator polynomial of the Reed-Solomon code ------------------ | Branch (99:21): [True: 69.6k, False: 2.11k] ------------------ 100| 69.6k| tmp[j] = gf_mul(gate_value, PARAM_RS_POLY[j]); ------------------ | | 51| 69.6k|#define gf_mul PQCHQC_NAMESPACE(gf_mul) | | ------------------ | | | | 17| 69.6k|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 69.6k|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 69.6k|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 101| 69.6k| } 102| | 103| 67.5k| for (k = PARAM_N1 - PARAM_K - 1; k; --k) { ------------------ | | 16| 2.11k|#define PARAM_N1 56 ///< Define the parameter n1 of the scheme (length of Reed-Solomon code) ------------------ for (k = PARAM_N1 - PARAM_K - 1; k; --k) { ------------------ | | 44| 2.11k|#define PARAM_K 24 ///< Define the size of the information bits of the Reed-Solomon code ------------------ | Branch (103:42): [True: 65.4k, False: 2.11k] ------------------ 104| 65.4k| cdw_bytes[k] = cdw_bytes[k - 1] ^ tmp[k]; 105| 65.4k| } 106| | 107| 2.11k| cdw_bytes[0] = tmp[0]; 108| 2.11k| } 109| | 110| 88| memcpy(cdw_bytes + PARAM_N1 - PARAM_K, msg_bytes, PARAM_K); ------------------ | | 16| 88|#define PARAM_N1 56 ///< Define the parameter n1 of the scheme (length of Reed-Solomon code) ------------------ memcpy(cdw_bytes + PARAM_N1 - PARAM_K, msg_bytes, PARAM_K); ------------------ | | 44| 88|#define PARAM_K 24 ///< Define the size of the information bits of the Reed-Solomon code ------------------ memcpy(cdw_bytes + PARAM_N1 - PARAM_K, msg_bytes, PARAM_K); ------------------ | | 44| 88|#define PARAM_K 24 ///< Define the size of the information bits of the Reed-Solomon code ------------------ 111| 88| memcpy(cdw, cdw_bytes, PARAM_N1); ------------------ | | 16| 88|#define PARAM_N1 56 ///< Define the parameter n1 of the scheme (length of Reed-Solomon code) ------------------ 112| 88|} PQCHQC_HQC3_C_reed_solomon_decode: 353| 44|void reed_solomon_decode(uint64_t *msg, uint64_t *cdw) { 354| 44| uint8_t cdw_bytes[PARAM_N1] = {0}; 355| 44| uint16_t syndromes[2 * PARAM_DELTA] = {0}; 356| 44| uint16_t sigma[1 << PARAM_FFT] = {0}; 357| 44| uint8_t error[1 << PARAM_M] = {0}; 358| 44| uint16_t z[PARAM_N1] = {0}; 359| 44| uint16_t error_values[PARAM_N1] = {0}; 360| 44| uint16_t deg; 361| | 362| | // Copy the vector in an array of bytes 363| 44| memcpy(cdw_bytes, cdw, PARAM_N1); ------------------ | | 16| 44|#define PARAM_N1 56 ///< Define the parameter n1 of the scheme (length of Reed-Solomon code) ------------------ 364| | 365| | // Calculate the 2*PARAM_DELTA syndromes 366| 44| compute_syndromes(syndromes, cdw_bytes); 367| | 368| | // Compute the error locator polynomial sigma 369| | // Sigma's degree is at most PARAM_DELTA but the FFT requires the extra room 370| 44| deg = compute_elp(sigma, syndromes); 371| | 372| | // Compute the error polynomial error 373| 44| compute_roots(error, sigma); 374| | 375| | // Compute the polynomial z(x) 376| 44| compute_z_poly(z, sigma, deg, syndromes); 377| | 378| | // Compute the error values 379| 44| compute_error_values(error_values, z, error); 380| | 381| | // Correct the errors 382| 44| correct_errors(cdw_bytes, error_values); 383| | 384| | // Retrieve the message from the decoded codeword 385| 44| memcpy(msg, cdw_bytes + (PARAM_G - 1), PARAM_K); ------------------ | | 45| 44|#define PARAM_G 33 ///< Define the size of the generator polynomial of the Reed-Solomon code ------------------ memcpy(msg, cdw_bytes + (PARAM_G - 1), PARAM_K); ------------------ | | 44| 44|#define PARAM_K 24 ///< Define the size of the information bits of the Reed-Solomon code ------------------ 386| | 387| |#ifdef VERBOSE 388| | printf("\n\nThe syndromes: "); 389| | for (size_t i = 0; i < 2 * PARAM_DELTA; ++i) { 390| | printf("%u ", syndromes[i]); 391| | } 392| | printf("\n\nThe error locator polynomial: sigma(x) = "); 393| | bool first_coeff = true; 394| | if (sigma[0]) { 395| | printf("%u", sigma[0]); 396| | first_coeff = false; 397| | } 398| | for (size_t i = 1; i < (1 << PARAM_FFT); ++i) { 399| | if (sigma[i] == 0) 400| | continue; 401| | if (!first_coeff) 402| | printf(" + "); 403| | first_coeff = false; 404| | if (sigma[i] != 1) 405| | printf("%u ", sigma[i]); 406| | if (i == 1) 407| | printf("x"); 408| | else 409| | printf("x^%zu", i); 410| | } 411| | if (first_coeff) 412| | printf("0"); 413| | 414| | printf("\n\nThe polynomial: z(x) = "); 415| | bool first_coeff_1 = true; 416| | if (z[0]) { 417| | printf("%u", z[0]); 418| | first_coeff_1 = false; 419| | } 420| | for (size_t i = 1; i < (PARAM_DELTA + 1); ++i) { 421| | if (z[i] == 0) 422| | continue; 423| | if (!first_coeff_1) 424| | printf(" + "); 425| | first_coeff_1 = false; 426| | if (z[i] != 1) 427| | printf("%u ", z[i]); 428| | if (i == 1) 429| | printf("x"); 430| | else 431| | printf("x^%zu", i); 432| | } 433| | if (first_coeff_1) 434| | printf("0"); 435| | 436| | printf("\n\nThe pairs of (error locator numbers, error values): "); 437| | size_t j = 0; 438| | for (size_t i = 0; i < PARAM_N1; ++i) { 439| | if (error[i]) { 440| | printf("(%zu, %d) ", i, error_values[j]); 441| | j++; 442| | } 443| | } 444| | printf("\n"); 445| |#endif 446| | 447| | // Zeroize sensitive data 448| 44| memset_zero(cdw_bytes, sizeof cdw_bytes); ------------------ | | 22| 44|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 44|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 44|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 44|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 44|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 449| 44|} PQCHQC_HQC3_C_prng_get_bytes: 20| 132|void prng_get_bytes(uint8_t *output, uint32_t outlen) { 21| 132| OQS_randombytes(output, outlen); 22| 132|} PQCHQC_HQC3_C_xof_init: 70| 352|void xof_init(shake256_xof_ctx *xof_ctx, const uint8_t *seed, uint32_t seed_size) { 71| 352| uint8_t xof_domain = HQC_XOF_DOMAIN; ------------------ | | 50| 352|#define HQC_XOF_DOMAIN 1 ------------------ 72| 352| OQS_SHA3_shake256_inc_init(xof_ctx); 73| 352| OQS_SHA3_shake256_inc_absorb(xof_ctx, seed, seed_size); 74| 352| OQS_SHA3_shake256_inc_absorb(xof_ctx, &xof_domain, 1); 75| 352| OQS_SHA3_shake256_inc_finalize(xof_ctx); 76| 352|} PQCHQC_HQC3_C_xof_get_bytes: 89| 13.7k|void xof_get_bytes(shake256_xof_ctx *xof_ctx, uint8_t *output, uint32_t output_size) { 90| 13.7k| OQS_SHA3_shake256_inc_squeeze(output, output_size, xof_ctx); 91| 13.7k|} PQCHQC_HQC3_C_xof_ctx_release: 96| 352|void xof_ctx_release(shake256_xof_ctx *xof_ctx) { 97| 352| OQS_SHA3_shake256_inc_ctx_release(xof_ctx); 98| 352|} PQCHQC_HQC3_C_hash_i: 109| 44|void hash_i(uint8_t *output, const uint8_t *seed) { 110| 44| sha3_512_ctx i_hash_ctx = {0}; 111| 44| uint8_t i_domain = HQC_I_FCT_DOMAIN; ------------------ | | 65| 44|#define HQC_I_FCT_DOMAIN 2 ------------------ 112| 44| OQS_SHA3_sha3_512_inc_init(&i_hash_ctx); 113| 44| OQS_SHA3_sha3_512_inc_absorb(&i_hash_ctx, seed, SEED_BYTES); ------------------ | | 52| 44|#define SEED_BYTES 32 ///< Define the size of the seed in bytes ------------------ 114| 44| OQS_SHA3_sha3_512_inc_absorb(&i_hash_ctx, &i_domain, 1); 115| 44| OQS_SHA3_sha3_512_inc_finalize(output, &i_hash_ctx); 116| 44| OQS_SHA3_sha3_512_inc_ctx_release(&i_hash_ctx); 117| 44|} PQCHQC_HQC3_C_hash_h: 125| 88|void hash_h(uint8_t *output, const uint8_t ek_kem[PUBLIC_KEY_BYTES]) { 126| 88| sha3_256_ctx h_hash_ctx = {0}; 127| 88| uint8_t h_domain = HQC_H_FCT_DOMAIN; ------------------ | | 60| 88|#define HQC_H_FCT_DOMAIN 1 ------------------ 128| 88| OQS_SHA3_sha3_256_inc_init(&h_hash_ctx); 129| 88| OQS_SHA3_sha3_256_inc_absorb(&h_hash_ctx, ek_kem, PUBLIC_KEY_BYTES); ------------------ | | 27| 88|#define PUBLIC_KEY_BYTES CRYPTO_PUBLICKEYBYTES ///< Define the size of the public key in bytes | | ------------------ | | | | 12| 88|#define CRYPTO_PUBLICKEYBYTES 4514 | | ------------------ ------------------ 130| 88| OQS_SHA3_sha3_256_inc_absorb(&h_hash_ctx, &h_domain, 1); 131| 88| OQS_SHA3_sha3_256_inc_finalize(output, &h_hash_ctx); 132| 88| OQS_SHA3_sha3_256_inc_ctx_release(&h_hash_ctx); 133| 88|} PQCHQC_HQC3_C_hash_g: 144| 88| const uint8_t salt[SALT_BYTES]) { 145| 88| sha3_512_ctx g_hash_ctx = {0}; 146| 88| uint8_t i_domain = HQC_G_FCT_DOMAIN; ------------------ | | 55| 88|#define HQC_G_FCT_DOMAIN 0 ------------------ 147| 88| OQS_SHA3_sha3_512_inc_init(&g_hash_ctx); 148| 88| OQS_SHA3_sha3_512_inc_absorb(&g_hash_ctx, hash_ek_kem, SEED_BYTES); ------------------ | | 52| 88|#define SEED_BYTES 32 ///< Define the size of the seed in bytes ------------------ 149| 88| OQS_SHA3_sha3_512_inc_absorb(&g_hash_ctx, m, PARAM_SECURITY_BYTES); ------------------ | | 23| 88|#define PARAM_SECURITY_BYTES 24 ///< Define the security level in bytes ------------------ 150| 88| OQS_SHA3_sha3_512_inc_absorb(&g_hash_ctx, salt, SALT_BYTES); ------------------ | | 53| 88|#define SALT_BYTES 16 ///< Define the size of a salt in bytes ------------------ 151| 88| OQS_SHA3_sha3_512_inc_absorb(&g_hash_ctx, &i_domain, 1); 152| 88| OQS_SHA3_sha3_512_inc_finalize(output, &g_hash_ctx); 153| 88| OQS_SHA3_sha3_512_inc_ctx_release(&g_hash_ctx); 154| 88|} PQCHQC_HQC3_C_hash_j: 165| 44| const ciphertext_kem_t *c_kem) { 166| 44| sha3_256_ctx k_hash_ctx = {0}; 167| 44| uint8_t k_domain = HQC_J_FCT_DOMAIN; ------------------ | | 70| 44|#define HQC_J_FCT_DOMAIN 3 ------------------ 168| 44| OQS_SHA3_sha3_256_inc_init(&k_hash_ctx); 169| 44| OQS_SHA3_sha3_256_inc_absorb(&k_hash_ctx, hash_ek_kem, SEED_BYTES); ------------------ | | 52| 44|#define SEED_BYTES 32 ///< Define the size of the seed in bytes ------------------ 170| 44| OQS_SHA3_sha3_256_inc_absorb(&k_hash_ctx, sigma, PARAM_SECURITY_BYTES); ------------------ | | 23| 44|#define PARAM_SECURITY_BYTES 24 ///< Define the security level in bytes ------------------ 171| 44| OQS_SHA3_sha3_256_inc_absorb(&k_hash_ctx, (uint8_t *)c_kem->c_pke.u, VEC_N_SIZE_BYTES); ------------------ | | 31| 44|#define VEC_N_SIZE_BYTES CEIL_DIVIDE(PARAM_N, 8) ///< Size of array to store PARAM_N bits in bytes | | ------------------ | | | | 12| 44|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [Folded, False: 44] | | | | ------------------ | | ------------------ ------------------ 172| 44| OQS_SHA3_sha3_256_inc_absorb(&k_hash_ctx, (uint8_t *)c_kem->c_pke.v, VEC_N1N2_SIZE_BYTES); ------------------ | | 34| 44|#define VEC_N1N2_SIZE_BYTES CEIL_DIVIDE(PARAM_N1N2, 8) ///< Size of array to store PARAM_N1N2 bits in bytes | | ------------------ | | | | 12| 44|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [True: 44, Folded] | | | | ------------------ | | ------------------ ------------------ 173| 44| OQS_SHA3_sha3_256_inc_absorb(&k_hash_ctx, c_kem->salt, SALT_BYTES); ------------------ | | 53| 44|#define SALT_BYTES 16 ///< Define the size of a salt in bytes ------------------ 174| 44| OQS_SHA3_sha3_256_inc_absorb(&k_hash_ctx, &k_domain, 1); 175| 44| OQS_SHA3_sha3_256_inc_finalize(output, &k_hash_ctx); 176| 44| OQS_SHA3_sha3_256_inc_ctx_release(&k_hash_ctx); 177| 44|} PQCHQC_HQC3_C_vect_generate_random_support1: 62| 132|void vect_generate_random_support1(shake256_xof_ctx *ctx, uint32_t *support, uint16_t weight) { 63| 132| uint8_t rand_bytes[3] = {0}; 64| 132| uint32_t candidate = 0; 65| | 66| 13.4k| for (size_t i = 0; i < weight;) { ------------------ | Branch (66:24): [True: 13.2k, False: 132] ------------------ 67| 13.2k| xof_get_bytes(ctx, rand_bytes, 3); ------------------ | | 75| 13.2k|#define xof_get_bytes PQCHQC_NAMESPACE(xof_get_bytes) | | ------------------ | | | | 17| 13.2k|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 13.2k|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 13.2k|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 68| 13.2k| candidate = rand_bytes[0] | (rand_bytes[1] << 8) | (rand_bytes[2] << 16); 69| | 70| 13.2k| if (candidate >= UTILS_REJECTION_THRESHOLD) { ------------------ | | 56| 13.2k|#define UTILS_REJECTION_THRESHOLD 16742417 ///< Rejection threshold for uniform sampling in [0, PARAM_N) ------------------ | Branch (70:13): [True: 34, False: 13.2k] ------------------ 71| 34| continue; 72| 34| } 73| 13.2k| candidate = barrett_reduce(candidate); 74| | 75| 13.2k| int is_position_available = 1; 76| 667k| for (size_t j = 0; j < i; j++) { ------------------ | Branch (76:28): [True: 654k, False: 13.2k] ------------------ 77| 654k| if (candidate == support[j]) { ------------------ | Branch (77:17): [True: 35, False: 654k] ------------------ 78| 35| is_position_available = 0; 79| 35| break; 80| 35| } 81| 654k| } 82| | 83| 13.2k| if (is_position_available == 1) { ------------------ | Branch (83:13): [True: 13.2k, False: 35] ------------------ 84| 13.2k| support[i] = candidate; 85| 13.2k| i++; 86| 13.2k| } 87| 13.2k| } 88| 132|} PQCHQC_HQC3_C_vect_generate_random_support2: 99| 264|void vect_generate_random_support2(shake256_xof_ctx *ctx, uint32_t *support, uint16_t weight) { 100| 264| uint32_t rand_u32[PARAM_OMEGA_R] = {0}; 101| | 102| 264| xof_get_bytes(ctx, (uint8_t *)&rand_u32, 4 * weight); ------------------ | | 75| 264|#define xof_get_bytes PQCHQC_NAMESPACE(xof_get_bytes) | | ------------------ | | | | 17| 264|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 264|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 264|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 103| | 104| 30.3k| for (size_t i = 0; i < weight; ++i) { ------------------ | Branch (104:24): [True: 30.0k, False: 264] ------------------ 105| 30.0k| uint64_t buff = rand_u32[i]; 106| 30.0k| support[i] = i + ((buff * (PARAM_N - i)) >> 32); ------------------ | | 15| 30.0k|#define PARAM_N 35851 ///< Define the parameter n of the scheme ------------------ 107| 30.0k| } 108| | 109| 30.0k| for (int32_t i = (weight - 1); i-- > 0;) { ------------------ | Branch (109:36): [True: 29.8k, False: 264] ------------------ 110| 29.8k| uint32_t found = 0; 111| | 112| 1.73M| for (size_t j = i + 1; j < weight; ++j) { ------------------ | Branch (112:32): [True: 1.70M, False: 29.8k] ------------------ 113| 1.70M| found |= compare_u32(support[j], support[i]); 114| 1.70M| } 115| | 116| 29.8k| uint32_t mask = -found; 117| 29.8k| support[i] = (mask & i) ^ (~mask & support[i]); 118| 29.8k| } 119| 264|} PQCHQC_HQC3_C_vect_write_support_to_vector: 131| 396|void vect_write_support_to_vector(uint64_t *v, uint32_t *support, uint16_t weight) { 132| 396| uint32_t index_tab[PARAM_OMEGA_R] = {0}; 133| 396| uint64_t bit_tab[PARAM_OMEGA_R] = {0}; 134| | 135| 43.6k| for (size_t i = 0; i < weight; i++) { ------------------ | Branch (135:24): [True: 43.2k, False: 396] ------------------ 136| 43.2k| index_tab[i] = support[i] >> 6; 137| 43.2k| int32_t pos = support[i] & 0x3f; 138| 43.2k| bit_tab[i] = ((uint64_t)1) << pos; 139| 43.2k| } 140| | 141| 396| uint64_t val = 0; 142| 222k| for (uint32_t i = 0; i < VEC_N_SIZE_64; i++) { ------------------ | | 36| 222k|#define VEC_N_SIZE_64 CEIL_DIVIDE(PARAM_N, 64) ///< Size of array to store PARAM_N bits in 64-bit words | | ------------------ | | | | 12| 222k|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [Folded, False: 222k] | | | | ------------------ | | ------------------ ------------------ | Branch (142:26): [True: 222k, False: 396] ------------------ 143| 222k| val = 0; 144| 24.5M| for (uint32_t j = 0; j < weight; j++) { ------------------ | Branch (144:30): [True: 24.2M, False: 222k] ------------------ 145| 24.2M| uint32_t tmp = i - index_tab[j]; 146| 24.2M| int val1 = 1 ^ ((tmp | -tmp) >> 31); 147| 24.2M| uint64_t mask = -val1; 148| 24.2M| val |= (bit_tab[j] & mask); 149| 24.2M| } 150| 222k| v[i] |= val; 151| 222k| } 152| 396|} PQCHQC_HQC3_C_vect_sample_fixed_weight1: 169| 132|void vect_sample_fixed_weight1(shake256_xof_ctx *ctx, uint64_t *v, uint16_t weight) { 170| 132| uint32_t support[PARAM_OMEGA_R] = {0}; 171| 132| vect_generate_random_support1(ctx, support, weight); ------------------ | | 13| 132|#define vect_generate_random_support1 PQCHQC_NAMESPACE(vect_generate_random_support1) | | ------------------ | | | | 17| 132|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 132|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 132|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 172| 132| vect_write_support_to_vector(v, support, weight); ------------------ | | 15| 132|#define vect_write_support_to_vector PQCHQC_NAMESPACE(vect_write_support_to_vector) | | ------------------ | | | | 17| 132|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 132|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 132|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 173| 132|} PQCHQC_HQC3_C_vect_sample_fixed_weight2: 188| 264|void vect_sample_fixed_weight2(shake256_xof_ctx *ctx, uint64_t *v, uint16_t weight) { 189| 264| uint32_t support[PARAM_OMEGA_R] = {0}; 190| 264| vect_generate_random_support2(ctx, support, weight); ------------------ | | 14| 264|#define vect_generate_random_support2 PQCHQC_NAMESPACE(vect_generate_random_support2) | | ------------------ | | | | 17| 264|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 264|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 264|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 191| 264| vect_write_support_to_vector(v, support, weight); ------------------ | | 15| 264|#define vect_write_support_to_vector PQCHQC_NAMESPACE(vect_write_support_to_vector) | | ------------------ | | | | 17| 264|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 264|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 264|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 192| 264|} PQCHQC_HQC3_C_vect_set_random: 203| 132|void vect_set_random(shake256_xof_ctx *ctx, uint64_t *v) { 204| 132| xof_get_bytes(ctx, (uint8_t *)v, VEC_N_SIZE_BYTES); ------------------ | | 75| 132|#define xof_get_bytes PQCHQC_NAMESPACE(xof_get_bytes) | | ------------------ | | | | 17| 132|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 132|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 132|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ xof_get_bytes(ctx, (uint8_t *)v, VEC_N_SIZE_BYTES); ------------------ | | 31| 132|#define VEC_N_SIZE_BYTES CEIL_DIVIDE(PARAM_N, 8) ///< Size of array to store PARAM_N bits in bytes | | ------------------ | | | | 12| 132|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [Folded, False: 132] | | | | ------------------ | | ------------------ ------------------ 205| 132| v[VEC_N_SIZE_64 - 1] &= BITMASK(PARAM_N, 64); ------------------ | | 36| 132|#define VEC_N_SIZE_64 CEIL_DIVIDE(PARAM_N, 64) ///< Size of array to store PARAM_N bits in 64-bit words | | ------------------ | | | | 12| 132|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [Folded, False: 132] | | | | ------------------ | | ------------------ ------------------ v[VEC_N_SIZE_64 - 1] &= BITMASK(PARAM_N, 64); ------------------ | | 13| 132|#define BITMASK(a, size) ((((uint64_t) 1UL) << (a % size)) - 1) /*!< Create a mask*/ ------------------ 206| 132|} PQCHQC_HQC3_C_vect_add: 216| 352|void vect_add(uint64_t *o, const uint64_t *v1, const uint64_t *v2, uint32_t size) { 217| 197k| for (uint32_t i = 0; i < size; ++i) { ------------------ | Branch (217:26): [True: 197k, False: 352] ------------------ 218| 197k| o[i] = v1[i] ^ v2[i]; 219| 197k| } 220| 352|} PQCHQC_HQC3_C_vect_compare: 233| 132|uint8_t vect_compare(const uint8_t *v1, const uint8_t *v2, uint32_t size) { 234| 132| uint16_t r = 0x0100; 235| | 236| 395k| for (size_t i = 0; i < size; i++) { ------------------ | Branch (236:24): [True: 395k, False: 132] ------------------ 237| 395k| r |= v1[i] ^ v2[i]; 238| 395k| } 239| | 240| 132| return (r - 1) >> 8; 241| 132|} PQCHQC_HQC3_C_vect_truncate: 249| 132|void vect_truncate(uint64_t *v) { 250| 132| size_t orig_words = (PARAM_N + 63) / 64; ------------------ | | 15| 132|#define PARAM_N 35851 ///< Define the parameter n of the scheme ------------------ 251| 132| size_t new_full_words = PARAM_N1N2 / 64; ------------------ | | 18| 132|#define PARAM_N1N2 35840 ///< Define the length in bits of the concatenated code ------------------ 252| 132| size_t remaining_bits = PARAM_N1N2 % 64; ------------------ | | 18| 132|#define PARAM_N1N2 35840 ///< Define the length in bits of the concatenated code ------------------ 253| | 254| | // Mask the last word if there's a partial word 255| 132| if (remaining_bits > 0) { ------------------ | Branch (255:9): [True: 0, False: 132] ------------------ 256| 0| uint64_t mask = (UINT64_C(1) << remaining_bits) - 1; 257| 0| v[new_full_words] &= mask; 258| 0| new_full_words++; // keep that partial word 259| 0| } 260| | 261| | // Zero out all subsequent words up to the original length 262| 264| for (size_t i = new_full_words; i < orig_words; i++) { ------------------ | Branch (262:37): [True: 132, False: 132] ------------------ 263| 132| v[i] = 0; 264| 132| } 265| 132|} PQCHQC_HQC5_C_code_encode: 27| 80|void code_encode(uint64_t *em, const uint64_t *m) { 28| 80| uint64_t tmp[VEC_N1_SIZE_64] = {0}; 29| | 30| 80| reed_solomon_encode(tmp, m); ------------------ | | 255| 80|#define reed_solomon_encode PQCHQC_NAMESPACE(reed_solomon_encode) | | ------------------ | | | | 17| 80|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 80|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 80|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 31| 80| reed_muller_encode(em, tmp); ------------------ | | 14| 80|#define reed_muller_encode PQCHQC_NAMESPACE(reed_muller_encode) | | ------------------ | | | | 17| 80|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 80|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 80|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 32| | 33| |#ifdef VERBOSE 34| | printf("\n\nReed-Solomon code word: "); 35| | vect_print(tmp, VEC_N1_SIZE_BYTES); 36| | printf("\n\nConcatenated code word: "); 37| | vect_print(em, VEC_N1N2_SIZE_BYTES); 38| |#endif 39| | // Zeroize sensitive data 40| 80| memset_zero(tmp, sizeof tmp); ------------------ | | 22| 80|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 80|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 80|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 80|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 80|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 41| 80|} PQCHQC_HQC5_C_code_decode: 49| 40|void code_decode(uint64_t *m, const uint64_t *em) { 50| 40| uint64_t tmp[VEC_N1_SIZE_64] = {0}; 51| | 52| 40| reed_muller_decode(tmp, em); ------------------ | | 15| 40|#define reed_muller_decode PQCHQC_NAMESPACE(reed_muller_decode) | | ------------------ | | | | 17| 40|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 40|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 40|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 53| 40| reed_solomon_decode(m, tmp); ------------------ | | 256| 40|#define reed_solomon_decode PQCHQC_NAMESPACE(reed_solomon_decode) | | ------------------ | | | | 17| 40|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 40|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 40|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 54| | 55| |#ifdef VERBOSE 56| | printf("\n\nReed-Muller decoding result (the input for the Reed-Solomon decoding algorithm): "); 57| | vect_print(tmp, VEC_N1_SIZE_BYTES); 58| |#endif 59| | 60| | // Zeroize sensitive data 61| 40| memset_zero(tmp, sizeof tmp); ------------------ | | 22| 40|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 40|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 40|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 40|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 40|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 62| 40|} PQCHQC_HQC5_C_fft: 274| 40|void fft(uint16_t *w, const uint16_t *f, size_t f_coeffs) { 275| 40| uint16_t betas[PARAM_M - 1] = {0}; 276| 40| uint16_t betas_sums[1 << (PARAM_M - 1)] = {0}; 277| 40| uint16_t f0[1 << (PARAM_FFT - 1)] = {0}; 278| 40| uint16_t f1[1 << (PARAM_FFT - 1)] = {0}; 279| 40| uint16_t deltas[PARAM_M - 1] = {0}; 280| 40| uint16_t u[1 << (PARAM_M - 1)] = {0}; 281| 40| uint16_t v[1 << (PARAM_M - 1)] = {0}; 282| | 283| 40| size_t i, k; 284| | 285| | // Follows Gao and Mateer algorithm 286| 40| compute_fft_betas(betas); 287| | 288| | // Step 1: PARAM_FFT > 1, nothing to do 289| | 290| | // Compute gammas sums 291| 40| compute_subset_sums(betas_sums, betas, PARAM_M - 1); ------------------ | | 41| 40|#define PARAM_M 8 ///< Define the degree m of the Galois field GF(2^m) ------------------ 292| | 293| | // Step 2: beta_m = 1, nothing to do 294| | 295| | // Step 3 296| 40| radix(f0, f1, f, PARAM_FFT); ------------------ | | 46| 40|#define PARAM_FFT 5 ///< Exponent for additive FFT (2^PARAM_FFT points) ------------------ 297| | 298| | // Step 4: Compute deltas 299| 320| for (i = 0; i < PARAM_M - 1; ++i) { ------------------ | | 41| 320|#define PARAM_M 8 ///< Define the degree m of the Galois field GF(2^m) ------------------ | Branch (299:17): [True: 280, False: 40] ------------------ 300| 280| deltas[i] = gf_square(betas[i]) ^ betas[i]; ------------------ | | 52| 280|#define gf_square PQCHQC_NAMESPACE(gf_square) | | ------------------ | | | | 17| 280|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 280|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 280|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 301| 280| } 302| | 303| | // Step 5 304| 40| fft_rec(u, f0, (f_coeffs + 1) / 2, PARAM_M - 1, PARAM_FFT - 1, deltas); ------------------ | | 41| 40|#define PARAM_M 8 ///< Define the degree m of the Galois field GF(2^m) ------------------ fft_rec(u, f0, (f_coeffs + 1) / 2, PARAM_M - 1, PARAM_FFT - 1, deltas); ------------------ | | 46| 40|#define PARAM_FFT 5 ///< Exponent for additive FFT (2^PARAM_FFT points) ------------------ 305| 40| fft_rec(v, f1, f_coeffs / 2, PARAM_M - 1, PARAM_FFT - 1, deltas); ------------------ | | 41| 40|#define PARAM_M 8 ///< Define the degree m of the Galois field GF(2^m) ------------------ fft_rec(v, f1, f_coeffs / 2, PARAM_M - 1, PARAM_FFT - 1, deltas); ------------------ | | 46| 40|#define PARAM_FFT 5 ///< Exponent for additive FFT (2^PARAM_FFT points) ------------------ 306| | 307| 40| k = 1 << (PARAM_M - 1); ------------------ | | 41| 40|#define PARAM_M 8 ///< Define the degree m of the Galois field GF(2^m) ------------------ 308| | // Step 6, 7 and error polynomial computation 309| 40| memcpy(w + k, v, 2 * k); 310| | 311| | // Check if 0 is root 312| 40| w[0] = u[0]; 313| | 314| | // Check if 1 is root 315| 40| w[k] ^= u[0]; 316| | 317| | // Find other roots 318| 5.12k| for (i = 1; i < k; ++i) { ------------------ | Branch (318:17): [True: 5.08k, False: 40] ------------------ 319| 5.08k| w[i] = u[i] ^ gf_mul(betas_sums[i], v[i]); ------------------ | | 51| 5.08k|#define gf_mul PQCHQC_NAMESPACE(gf_mul) | | ------------------ | | | | 17| 5.08k|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 5.08k|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 5.08k|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 320| 5.08k| w[k + i] ^= w[i]; 321| 5.08k| } 322| 40|} PQCHQC_HQC5_C_fft_retrieve_error_poly: 331| 40|void fft_retrieve_error_poly(uint8_t *error, const uint16_t *w) { 332| 40| uint16_t gammas[PARAM_M - 1] = {0}; 333| 40| uint16_t gammas_sums[1 << (PARAM_M - 1)] = {0}; 334| 40| uint16_t k; 335| 40| size_t i, index; 336| | 337| 40| compute_fft_betas(gammas); 338| 40| compute_subset_sums(gammas_sums, gammas, PARAM_M - 1); ------------------ | | 41| 40|#define PARAM_M 8 ///< Define the degree m of the Galois field GF(2^m) ------------------ 339| | 340| 40| k = 1 << (PARAM_M - 1); ------------------ | | 41| 40|#define PARAM_M 8 ///< Define the degree m of the Galois field GF(2^m) ------------------ 341| 40| error[0] ^= 1 ^ ((uint16_t)-w[0] >> 15); 342| 40| error[0] ^= 1 ^ ((uint16_t)-w[k] >> 15); 343| | 344| 5.12k| for (i = 1; i < k; ++i) { ------------------ | Branch (344:17): [True: 5.08k, False: 40] ------------------ 345| 5.08k| index = PARAM_GF_MUL_ORDER - gf_log[gammas_sums[i]]; ------------------ | | 43| 5.08k|#define PARAM_GF_MUL_ORDER 255 ///< Size of the multiplicative group of GF(2^PARAM_M) (2^PARAM_M−1) ------------------ 346| 5.08k| error[index] ^= 1 ^ ((uint16_t)-w[i] >> 15); 347| | 348| 5.08k| index = PARAM_GF_MUL_ORDER - gf_log[gammas_sums[i] ^ 1]; ------------------ | | 43| 5.08k|#define PARAM_GF_MUL_ORDER 255 ///< Size of the multiplicative group of GF(2^PARAM_M) (2^PARAM_M−1) ------------------ 349| 5.08k| error[index] ^= 1 ^ ((uint16_t)-w[k + i] >> 15); 350| 5.08k| } 351| 40|} PQCHQC_HQC5_C_gf_mul: 153| 677k|uint16_t gf_mul(uint16_t a, uint16_t b) { 154| 677k| uint8_t c[2] = {0}; 155| 677k| gf_carryless_mul(c, (uint8_t)a, (uint8_t)b); 156| 677k| uint16_t tmp = (uint16_t)(c[0] ^ (c[1] << 8)); 157| 677k| return gf_reduce(tmp); 158| 677k|} PQCHQC_HQC5_C_gf_square: 165| 46.0k|uint16_t gf_square(uint16_t a) { 166| 46.0k| uint32_t b = a; 167| 46.0k| uint32_t s = b & 1; 168| 368k| for (size_t i = 1; i < PARAM_M; ++i) { ------------------ | | 41| 368k|#define PARAM_M 8 ///< Define the degree m of the Galois field GF(2^m) ------------------ | Branch (168:24): [True: 322k, False: 46.0k] ------------------ 169| 322k| b <<= 1; 170| 322k| s ^= b & (1 << 2 * i); 171| 322k| } 172| | 173| 46.0k| return gf_reduce(s); 174| 46.0k|} PQCHQC_HQC5_C_gf_inverse: 182| 7.20k|uint16_t gf_inverse(uint16_t a) { 183| 7.20k| uint16_t inv = a; 184| 7.20k| uint16_t tmp1, tmp2; 185| | 186| 7.20k| inv = gf_square(a); /* a^2 */ ------------------ | | 52| 7.20k|#define gf_square PQCHQC_NAMESPACE(gf_square) | | ------------------ | | | | 17| 7.20k|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 7.20k|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 7.20k|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 187| 7.20k| tmp1 = gf_mul(inv, a); /* a^3 */ ------------------ | | 51| 7.20k|#define gf_mul PQCHQC_NAMESPACE(gf_mul) | | ------------------ | | | | 17| 7.20k|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 7.20k|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 7.20k|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 188| 7.20k| inv = gf_square(inv); /* a^4 */ ------------------ | | 52| 7.20k|#define gf_square PQCHQC_NAMESPACE(gf_square) | | ------------------ | | | | 17| 7.20k|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 7.20k|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 7.20k|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 189| 7.20k| tmp2 = gf_mul(inv, tmp1); /* a^7 */ ------------------ | | 51| 7.20k|#define gf_mul PQCHQC_NAMESPACE(gf_mul) | | ------------------ | | | | 17| 7.20k|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 7.20k|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 7.20k|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 190| 7.20k| tmp1 = gf_mul(inv, tmp2); /* a^11 */ ------------------ | | 51| 7.20k|#define gf_mul PQCHQC_NAMESPACE(gf_mul) | | ------------------ | | | | 17| 7.20k|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 7.20k|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 7.20k|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 191| 7.20k| inv = gf_mul(tmp1, inv); /* a^15 */ ------------------ | | 51| 7.20k|#define gf_mul PQCHQC_NAMESPACE(gf_mul) | | ------------------ | | | | 17| 7.20k|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 7.20k|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 7.20k|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 192| 7.20k| inv = gf_square(inv); /* a^30 */ ------------------ | | 52| 7.20k|#define gf_square PQCHQC_NAMESPACE(gf_square) | | ------------------ | | | | 17| 7.20k|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 7.20k|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 7.20k|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 193| 7.20k| inv = gf_square(inv); /* a^60 */ ------------------ | | 52| 7.20k|#define gf_square PQCHQC_NAMESPACE(gf_square) | | ------------------ | | | | 17| 7.20k|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 7.20k|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 7.20k|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 194| 7.20k| inv = gf_square(inv); /* a^120 */ ------------------ | | 52| 7.20k|#define gf_square PQCHQC_NAMESPACE(gf_square) | | ------------------ | | | | 17| 7.20k|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 7.20k|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 7.20k|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 195| 7.20k| inv = gf_mul(inv, tmp2); /* a^127 */ ------------------ | | 51| 7.20k|#define gf_mul PQCHQC_NAMESPACE(gf_mul) | | ------------------ | | | | 17| 7.20k|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 7.20k|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 7.20k|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 196| 7.20k| inv = gf_square(inv); /* a^254 */ ------------------ | | 52| 7.20k|#define gf_square PQCHQC_NAMESPACE(gf_square) | | ------------------ | | | | 17| 7.20k|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 7.20k|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 7.20k|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 197| 7.20k| return inv; 198| 7.20k|} PQCHQC_HQC5_C_vect_mul: 151| 240|void vect_mul(uint64_t *o, const uint64_t *a1, const uint64_t *a2) { 152| 240| uint64_t unreduced[2 * VEC_N_SIZE_64]; 153| 240| uint64_t tmp_buffer[TMP_BUFFER_WORDS]; 154| | 155| | /* multiply via Karatsuba into unreduced */ 156| 240| karatsuba_mul(unreduced, a1, a2, VEC_N_SIZE_64, tmp_buffer); ------------------ | | 36| 240|#define VEC_N_SIZE_64 CEIL_DIVIDE(PARAM_N, 64) ///< Size of array to store PARAM_N bits in 64-bit words | | ------------------ | | | | 12| 240|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [Folded, False: 240] | | | | ------------------ | | ------------------ ------------------ 157| | 158| | /* reduce modulo X^n - 1 */ 159| 240| reduce(o, unreduced); 160| 240|} PQCHQC_HQC5_C_hqc_pke_keygen: 30| 40|void hqc_pke_keygen(uint8_t *ek_pke, uint8_t *dk_pke, uint8_t *seed) { 31| 40| uint8_t keypair_seed[2 * SEED_BYTES] = {0}; 32| 40| uint8_t *seed_dk = keypair_seed; 33| 40| uint8_t *seed_ek = keypair_seed + SEED_BYTES; ------------------ | | 52| 40|#define SEED_BYTES 32 ///< Define the size of the seed in bytes ------------------ 34| 40| shake256_xof_ctx dk_xof_ctx = {0}; 35| 40| shake256_xof_ctx ek_xof_ctx = {0}; 36| | 37| 40| uint64_t x[VEC_N_SIZE_64] = {0}; 38| 40| uint64_t y[VEC_N_SIZE_64] = {0}; 39| 40| uint64_t h[VEC_N_SIZE_64] = {0}; 40| 40| uint64_t s[VEC_N_SIZE_64] = {0}; 41| | 42| | // Derive keypair seeds 43| 40| hash_i(keypair_seed, seed); ------------------ | | 79| 40|#define hash_i PQCHQC_NAMESPACE(hash_i) | | ------------------ | | | | 17| 40|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 40|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 40|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 44| | 45| | // Compute decryption key 46| 40| xof_init(&dk_xof_ctx, seed_dk, SEED_BYTES); ------------------ | | 74| 40|#define xof_init PQCHQC_NAMESPACE(xof_init) | | ------------------ | | | | 17| 40|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 40|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 40|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ xof_init(&dk_xof_ctx, seed_dk, SEED_BYTES); ------------------ | | 52| 40|#define SEED_BYTES 32 ///< Define the size of the seed in bytes ------------------ 47| 40| vect_sample_fixed_weight1(&dk_xof_ctx, y, PARAM_OMEGA); ------------------ | | 16| 40|#define vect_sample_fixed_weight1 PQCHQC_NAMESPACE(vect_sample_fixed_weight1) | | ------------------ | | | | 17| 40|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 40|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 40|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ vect_sample_fixed_weight1(&dk_xof_ctx, y, PARAM_OMEGA); ------------------ | | 19| 40|#define PARAM_OMEGA 131 ///< Define the parameter omega of the scheme ------------------ 48| 40| vect_sample_fixed_weight1(&dk_xof_ctx, x, PARAM_OMEGA); ------------------ | | 16| 40|#define vect_sample_fixed_weight1 PQCHQC_NAMESPACE(vect_sample_fixed_weight1) | | ------------------ | | | | 17| 40|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 40|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 40|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ vect_sample_fixed_weight1(&dk_xof_ctx, x, PARAM_OMEGA); ------------------ | | 19| 40|#define PARAM_OMEGA 131 ///< Define the parameter omega of the scheme ------------------ 49| 40| xof_ctx_release(&dk_xof_ctx); ------------------ | | 76| 40|#define xof_ctx_release PQCHQC_NAMESPACE(xof_ctx_release) | | ------------------ | | | | 17| 40|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 40|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 40|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 50| | 51| | // Compute encryption key 52| 40| xof_init(&ek_xof_ctx, seed_ek, SEED_BYTES); ------------------ | | 74| 40|#define xof_init PQCHQC_NAMESPACE(xof_init) | | ------------------ | | | | 17| 40|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 40|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 40|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ xof_init(&ek_xof_ctx, seed_ek, SEED_BYTES); ------------------ | | 52| 40|#define SEED_BYTES 32 ///< Define the size of the seed in bytes ------------------ 53| 40| vect_set_random(&ek_xof_ctx, h); ------------------ | | 18| 40|#define vect_set_random PQCHQC_NAMESPACE(vect_set_random) | | ------------------ | | | | 17| 40|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 40|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 40|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 54| 40| xof_ctx_release(&ek_xof_ctx); ------------------ | | 76| 40|#define xof_ctx_release PQCHQC_NAMESPACE(xof_ctx_release) | | ------------------ | | | | 17| 40|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 40|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 40|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 55| 40| vect_mul(s, y, h); ------------------ | | 12| 40|#define vect_mul PQCHQC_NAMESPACE(vect_mul) | | ------------------ | | | | 17| 40|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 40|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 40|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 56| 40| vect_add(s, x, s, VEC_N_SIZE_64); ------------------ | | 19| 40|#define vect_add PQCHQC_NAMESPACE(vect_add) | | ------------------ | | | | 17| 40|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 40|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 40|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ vect_add(s, x, s, VEC_N_SIZE_64); ------------------ | | 36| 40|#define VEC_N_SIZE_64 CEIL_DIVIDE(PARAM_N, 64) ///< Size of array to store PARAM_N bits in 64-bit words | | ------------------ | | | | 12| 40|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [Folded, False: 40] | | | | ------------------ | | ------------------ ------------------ 57| | 58| | // Parse encryption key to string 59| 40| memcpy(ek_pke, seed_ek, SEED_BYTES); ------------------ | | 52| 40|#define SEED_BYTES 32 ///< Define the size of the seed in bytes ------------------ 60| 40| memcpy(ek_pke + SEED_BYTES, s, VEC_N_SIZE_BYTES); ------------------ | | 52| 40|#define SEED_BYTES 32 ///< Define the size of the seed in bytes ------------------ memcpy(ek_pke + SEED_BYTES, s, VEC_N_SIZE_BYTES); ------------------ | | 31| 40|#define VEC_N_SIZE_BYTES CEIL_DIVIDE(PARAM_N, 8) ///< Size of array to store PARAM_N bits in bytes | | ------------------ | | | | 12| 40|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [Folded, False: 40] | | | | ------------------ | | ------------------ ------------------ 61| | 62| | // Parse decryption key to string 63| 40| memcpy(dk_pke, seed_dk, SEED_BYTES); ------------------ | | 52| 40|#define SEED_BYTES 32 ///< Define the size of the seed in bytes ------------------ 64| | 65| |#ifdef VERBOSE 66| | printf("\n\nseed_dk: "); 67| | for (int i = 0; i < SEED_BYTES; ++i) printf("%02x", seed_dk[i]); 68| | printf("\n\nseed_ek: "); 69| | for (int i = 0; i < SEED_BYTES; ++i) printf("%02x", seed_ek[i]); 70| | printf("\n\ny: "); 71| | vect_print(y, VEC_N_SIZE_BYTES); 72| | printf("\n\nx: "); 73| | vect_print(x, VEC_N_SIZE_BYTES); 74| | printf("\n\nh: "); 75| | vect_print(h, VEC_N_SIZE_BYTES); 76| | printf("\n\ns: "); 77| | vect_print(s, VEC_N_SIZE_BYTES); 78| |#endif 79| | 80| | // Zeroize sensitive data 81| 40| memset_zero(keypair_seed, sizeof keypair_seed); ------------------ | | 22| 40|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 40|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 40|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 40|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 40|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 82| 40| memset_zero(x, sizeof x); ------------------ | | 22| 40|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 40|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 40|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 40|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 40|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 83| 40| memset_zero(y, sizeof y); ------------------ | | 22| 40|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 40|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 40|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 40|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 40|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 84| 40| memset_zero(&dk_xof_ctx, sizeof dk_xof_ctx); ------------------ | | 22| 40|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 40|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 40|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 40|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 40|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 85| 40|} PQCHQC_HQC5_C_hqc_pke_encrypt: 99| 80|void hqc_pke_encrypt(ciphertext_pke_t *c_pke, const uint8_t *ek_pke, const uint64_t *m, const uint8_t *theta) { 100| 80| shake256_xof_ctx theta_xof_ctx = {0}; 101| 80| uint64_t h[VEC_N_SIZE_64] = {0}; 102| 80| uint64_t s[VEC_N_SIZE_64] = {0}; 103| 80| uint64_t r1[VEC_N_SIZE_64] = {0}; 104| 80| uint64_t r2[VEC_N_SIZE_64] = {0}; 105| 80| uint64_t e[VEC_N_SIZE_64] = {0}; 106| 80| uint64_t tmp[VEC_N_SIZE_64] = {0}; 107| | 108| | // Initialize Xof using theta 109| 80| xof_init(&theta_xof_ctx, theta, SEED_BYTES); ------------------ | | 74| 80|#define xof_init PQCHQC_NAMESPACE(xof_init) | | ------------------ | | | | 17| 80|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 80|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 80|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ xof_init(&theta_xof_ctx, theta, SEED_BYTES); ------------------ | | 52| 80|#define SEED_BYTES 32 ///< Define the size of the seed in bytes ------------------ 110| | 111| | // Retrieve h and s from public key 112| 80| hqc_ek_pke_from_string(h, s, ek_pke); ------------------ | | 15| 80|#define hqc_ek_pke_from_string PQCHQC_NAMESPACE(hqc_ek_pke_from_string) | | ------------------ | | | | 17| 80|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 80|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 80|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 113| | 114| | // Generate re, e and r1 115| 80| vect_sample_fixed_weight2(&theta_xof_ctx, r2, PARAM_OMEGA_R); ------------------ | | 17| 80|#define vect_sample_fixed_weight2 PQCHQC_NAMESPACE(vect_sample_fixed_weight2) | | ------------------ | | | | 17| 80|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 80|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 80|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ vect_sample_fixed_weight2(&theta_xof_ctx, r2, PARAM_OMEGA_R); ------------------ | | 21| 80|#define PARAM_OMEGA_R 149 ///< Define the parameter omega_r of the scheme ------------------ 116| 80| vect_sample_fixed_weight2(&theta_xof_ctx, e, PARAM_OMEGA_E); ------------------ | | 17| 80|#define vect_sample_fixed_weight2 PQCHQC_NAMESPACE(vect_sample_fixed_weight2) | | ------------------ | | | | 17| 80|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 80|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 80|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ vect_sample_fixed_weight2(&theta_xof_ctx, e, PARAM_OMEGA_E); ------------------ | | 20| 80|#define PARAM_OMEGA_E 149 ///< Define the parameter omega_e of the scheme ------------------ 117| 80| vect_sample_fixed_weight2(&theta_xof_ctx, r1, PARAM_OMEGA_R); ------------------ | | 17| 80|#define vect_sample_fixed_weight2 PQCHQC_NAMESPACE(vect_sample_fixed_weight2) | | ------------------ | | | | 17| 80|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 80|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 80|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ vect_sample_fixed_weight2(&theta_xof_ctx, r1, PARAM_OMEGA_R); ------------------ | | 21| 80|#define PARAM_OMEGA_R 149 ///< Define the parameter omega_r of the scheme ------------------ 118| 80| xof_ctx_release(&theta_xof_ctx); ------------------ | | 76| 80|#define xof_ctx_release PQCHQC_NAMESPACE(xof_ctx_release) | | ------------------ | | | | 17| 80|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 80|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 80|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 119| | 120| | // Compute u = r1 + r2.h 121| 80| vect_mul(c_pke->u, r2, h); ------------------ | | 12| 80|#define vect_mul PQCHQC_NAMESPACE(vect_mul) | | ------------------ | | | | 17| 80|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 80|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 80|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 122| 80| vect_add(c_pke->u, r1, c_pke->u, VEC_N_SIZE_64); ------------------ | | 19| 80|#define vect_add PQCHQC_NAMESPACE(vect_add) | | ------------------ | | | | 17| 80|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 80|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 80|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ vect_add(c_pke->u, r1, c_pke->u, VEC_N_SIZE_64); ------------------ | | 36| 80|#define VEC_N_SIZE_64 CEIL_DIVIDE(PARAM_N, 64) ///< Size of array to store PARAM_N bits in 64-bit words | | ------------------ | | | | 12| 80|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [Folded, False: 80] | | | | ------------------ | | ------------------ ------------------ 123| | 124| | // Compute v = C.encode(m) 125| 80| code_encode(c_pke->v, m); ------------------ | | 14| 80|#define code_encode PQCHQC_NAMESPACE(code_encode) | | ------------------ | | | | 17| 80|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 80|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 80|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 126| | 127| | // Compute v = C.encode(m) + Truncate(s.r2 + e) 128| 80| vect_mul(tmp, r2, s); ------------------ | | 12| 80|#define vect_mul PQCHQC_NAMESPACE(vect_mul) | | ------------------ | | | | 17| 80|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 80|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 80|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 129| 80| vect_add(tmp, e, tmp, VEC_N_SIZE_64); ------------------ | | 19| 80|#define vect_add PQCHQC_NAMESPACE(vect_add) | | ------------------ | | | | 17| 80|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 80|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 80|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ vect_add(tmp, e, tmp, VEC_N_SIZE_64); ------------------ | | 36| 80|#define VEC_N_SIZE_64 CEIL_DIVIDE(PARAM_N, 64) ///< Size of array to store PARAM_N bits in 64-bit words | | ------------------ | | | | 12| 80|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [Folded, False: 80] | | | | ------------------ | | ------------------ ------------------ 130| 80| vect_truncate(tmp); ------------------ | | 21| 80|#define vect_truncate PQCHQC_NAMESPACE(vect_truncate) | | ------------------ | | | | 17| 80|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 80|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 80|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 131| 80| vect_add(c_pke->v, c_pke->v, tmp, VEC_N1N2_SIZE_64); ------------------ | | 19| 80|#define vect_add PQCHQC_NAMESPACE(vect_add) | | ------------------ | | | | 17| 80|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 80|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 80|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ vect_add(c_pke->v, c_pke->v, tmp, VEC_N1N2_SIZE_64); ------------------ | | 38| 80|#define VEC_N1N2_SIZE_64 CEIL_DIVIDE(PARAM_N1N2, 64) ///< Size of array to store PARAM_N1N2 bits in 64-bit words | | ------------------ | | | | 12| 80|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [True: 80, Folded] | | | | ------------------ | | ------------------ ------------------ 132| | 133| |#ifdef VERBOSE 134| | printf("\n\nh: "); 135| | vect_print(h, VEC_N_SIZE_BYTES); 136| | printf("\n\ns: "); 137| | vect_print(s, VEC_N_SIZE_BYTES); 138| | printf("\n\nr1: "); 139| | vect_print(r1, VEC_N_SIZE_BYTES); 140| | printf("\n\nr2: "); 141| | vect_print(r2, VEC_N_SIZE_BYTES); 142| | printf("\n\ne: "); 143| | vect_print(e, VEC_N_SIZE_BYTES); 144| | printf("\n\nTruncate(s.r2 + e): "); 145| | vect_print(tmp, VEC_N1N2_SIZE_BYTES); 146| | printf("\n\nc_pke->u: "); 147| | vect_print(c_pke->u, VEC_N_SIZE_BYTES); 148| | printf("\n\nc_pke->v: "); 149| | vect_print(c_pke->v, VEC_N1N2_SIZE_BYTES); 150| |#endif 151| | 152| | // Zeroize sensitive data 153| 80| memset_zero(r1, sizeof r1); ------------------ | | 22| 80|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 80|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 80|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 80|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 80|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 154| 80| memset_zero(r2, sizeof r2); ------------------ | | 22| 80|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 80|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 80|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 80|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 80|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 155| 80| memset_zero(e, sizeof e); ------------------ | | 22| 80|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 80|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 80|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 80|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 80|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 156| 80| memset_zero(tmp, sizeof tmp); ------------------ | | 22| 80|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 80|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 80|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 80|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 80|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 157| 80| memset_zero(&theta_xof_ctx, sizeof theta_xof_ctx); ------------------ | | 22| 80|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 80|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 80|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 80|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 80|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 158| 80|} PQCHQC_HQC5_C_hqc_pke_decrypt: 173| 40|uint8_t hqc_pke_decrypt(uint64_t *m, const uint8_t *dk_pke, const ciphertext_pke_t *c_pke) { 174| 40| uint64_t y[VEC_N_SIZE_64] = {0}; 175| 40| uint64_t tmp1[VEC_N_SIZE_64] = {0}; 176| 40| uint64_t tmp2[VEC_N_SIZE_64] = {0}; 177| | 178| | // Parse decryption key dk_pke 179| 40| hqc_dk_pke_from_string(y, dk_pke); ------------------ | | 14| 40|#define hqc_dk_pke_from_string PQCHQC_NAMESPACE(hqc_dk_pke_from_string) | | ------------------ | | | | 17| 40|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 40|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 40|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 180| | 181| | // Compute u.y 182| 40| vect_mul(tmp1, y, c_pke->u); ------------------ | | 12| 40|#define vect_mul PQCHQC_NAMESPACE(vect_mul) | | ------------------ | | | | 17| 40|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 40|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 40|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 183| | // Truncate(u.y) 184| 40| vect_truncate(tmp1); ------------------ | | 21| 40|#define vect_truncate PQCHQC_NAMESPACE(vect_truncate) | | ------------------ | | | | 17| 40|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 40|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 40|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 185| | // Compute v - Truncate(u.y) 186| 40| vect_add(tmp2, c_pke->v, tmp1, VEC_N1N2_SIZE_64); ------------------ | | 19| 40|#define vect_add PQCHQC_NAMESPACE(vect_add) | | ------------------ | | | | 17| 40|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 40|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 40|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ vect_add(tmp2, c_pke->v, tmp1, VEC_N1N2_SIZE_64); ------------------ | | 38| 40|#define VEC_N1N2_SIZE_64 CEIL_DIVIDE(PARAM_N1N2, 64) ///< Size of array to store PARAM_N1N2 bits in 64-bit words | | ------------------ | | | | 12| 40|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [True: 40, Folded] | | | | ------------------ | | ------------------ ------------------ 187| | 188| |#ifdef VERBOSE 189| | printf("\n\nc_pke.u: "); 190| | vect_print(c_pke->u, VEC_N_SIZE_BYTES); 191| | printf("\n\nc_pke.v: "); 192| | vect_print(c_pke->v, VEC_N1N2_SIZE_BYTES); 193| | printf("\n\ny: "); 194| | vect_print(y, VEC_N_SIZE_BYTES); 195| | printf("\n\nTruncate(u.y): "); 196| | vect_print(tmp1, VEC_N1N2_SIZE_BYTES); 197| | printf("\n\nv - Truncate(u.y): "); 198| | vect_print(tmp2, VEC_N1N2_SIZE_BYTES); 199| |#endif 200| | 201| | // Compute plaintext m 202| 40| code_decode(m, tmp2); ------------------ | | 15| 40|#define code_decode PQCHQC_NAMESPACE(code_decode) | | ------------------ | | | | 17| 40|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 40|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 40|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 203| | 204| | // Zeroize sensitive data 205| 40| memset_zero(y, sizeof y); ------------------ | | 22| 40|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 40|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 40|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 40|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 40|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 206| 40| memset_zero(tmp1, sizeof tmp1); ------------------ | | 22| 40|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 40|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 40|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 40|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 40|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 207| 40| memset_zero(tmp2, sizeof tmp2); ------------------ | | 22| 40|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 40|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 40|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 40|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 40|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 208| | 209| 40| return 0; 210| 40|} PQCHQC_HQC5_C_crypto_kem_keypair: 39| 40|int crypto_kem_keypair(uint8_t *ek_kem, uint8_t *dk_kem) { 40| |#ifdef VERBOSE 41| | printf("\n\n\n### KEYGEN ###"); 42| |#endif 43| 40| uint8_t seed_kem[SEED_BYTES] = {0}; 44| 40| uint8_t sigma[PARAM_SECURITY_BYTES] = {0}; 45| 40| uint8_t seed_pke[SEED_BYTES] = {0}; 46| 40| shake256_xof_ctx ctx_kem; 47| | 48| 40| uint8_t ek_pke[PUBLIC_KEY_BYTES] = {0}; 49| 40| uint8_t dk_pke[SEED_BYTES] = {0}; 50| | 51| 40| prng_get_bytes(seed_kem, SEED_BYTES); ------------------ | | 73| 40|#define prng_get_bytes PQCHQC_NAMESPACE(prng_get_bytes) | | ------------------ | | | | 17| 40|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 40|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 40|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ prng_get_bytes(seed_kem, SEED_BYTES); ------------------ | | 52| 40|#define SEED_BYTES 32 ///< Define the size of the seed in bytes ------------------ 52| | 53| | // Compute seed_pke and randomness sigma 54| 40| xof_init(&ctx_kem, seed_kem, SEED_BYTES); ------------------ | | 74| 40|#define xof_init PQCHQC_NAMESPACE(xof_init) | | ------------------ | | | | 17| 40|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 40|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 40|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ xof_init(&ctx_kem, seed_kem, SEED_BYTES); ------------------ | | 52| 40|#define SEED_BYTES 32 ///< Define the size of the seed in bytes ------------------ 55| 40| xof_get_bytes(&ctx_kem, seed_pke, SEED_BYTES); ------------------ | | 75| 40|#define xof_get_bytes PQCHQC_NAMESPACE(xof_get_bytes) | | ------------------ | | | | 17| 40|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 40|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 40|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ xof_get_bytes(&ctx_kem, seed_pke, SEED_BYTES); ------------------ | | 52| 40|#define SEED_BYTES 32 ///< Define the size of the seed in bytes ------------------ 56| 40| xof_get_bytes(&ctx_kem, sigma, PARAM_SECURITY_BYTES); ------------------ | | 75| 40|#define xof_get_bytes PQCHQC_NAMESPACE(xof_get_bytes) | | ------------------ | | | | 17| 40|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 40|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 40|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ xof_get_bytes(&ctx_kem, sigma, PARAM_SECURITY_BYTES); ------------------ | | 23| 40|#define PARAM_SECURITY_BYTES 32 ///< Define the security level in bytes ------------------ 57| 40| xof_ctx_release(&ctx_kem); ------------------ | | 76| 40|#define xof_ctx_release PQCHQC_NAMESPACE(xof_ctx_release) | | ------------------ | | | | 17| 40|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 40|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 40|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 58| | 59| | // Compute HQC-PKE keypair 60| 40| hqc_pke_keygen(ek_pke, dk_pke, seed_pke); ------------------ | | 14| 40|#define hqc_pke_keygen PQCHQC_NAMESPACE(hqc_pke_keygen) | | ------------------ | | | | 17| 40|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 40|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 40|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 61| | 62| | // Compute HQC-KEM keypair 63| 40| memcpy(ek_kem, ek_pke, PUBLIC_KEY_BYTES); ------------------ | | 27| 40|#define PUBLIC_KEY_BYTES CRYPTO_PUBLICKEYBYTES ///< Define the size of the public key in bytes | | ------------------ | | | | 12| 40|#define CRYPTO_PUBLICKEYBYTES 7237 | | ------------------ ------------------ 64| 40| memcpy(dk_kem, ek_kem, PUBLIC_KEY_BYTES); ------------------ | | 27| 40|#define PUBLIC_KEY_BYTES CRYPTO_PUBLICKEYBYTES ///< Define the size of the public key in bytes | | ------------------ | | | | 12| 40|#define CRYPTO_PUBLICKEYBYTES 7237 | | ------------------ ------------------ 65| 40| memcpy(dk_kem + PUBLIC_KEY_BYTES, dk_pke, SEED_BYTES); ------------------ | | 27| 40|#define PUBLIC_KEY_BYTES CRYPTO_PUBLICKEYBYTES ///< Define the size of the public key in bytes | | ------------------ | | | | 12| 40|#define CRYPTO_PUBLICKEYBYTES 7237 | | ------------------ ------------------ memcpy(dk_kem + PUBLIC_KEY_BYTES, dk_pke, SEED_BYTES); ------------------ | | 52| 40|#define SEED_BYTES 32 ///< Define the size of the seed in bytes ------------------ 66| 40| memcpy(dk_kem + PUBLIC_KEY_BYTES + SEED_BYTES, sigma, PARAM_SECURITY_BYTES); ------------------ | | 27| 40|#define PUBLIC_KEY_BYTES CRYPTO_PUBLICKEYBYTES ///< Define the size of the public key in bytes | | ------------------ | | | | 12| 40|#define CRYPTO_PUBLICKEYBYTES 7237 | | ------------------ ------------------ memcpy(dk_kem + PUBLIC_KEY_BYTES + SEED_BYTES, sigma, PARAM_SECURITY_BYTES); ------------------ | | 52| 40|#define SEED_BYTES 32 ///< Define the size of the seed in bytes ------------------ memcpy(dk_kem + PUBLIC_KEY_BYTES + SEED_BYTES, sigma, PARAM_SECURITY_BYTES); ------------------ | | 23| 40|#define PARAM_SECURITY_BYTES 32 ///< Define the security level in bytes ------------------ 67| 40| memcpy(dk_kem + PUBLIC_KEY_BYTES + SEED_BYTES + PARAM_SECURITY_BYTES, seed_kem, SEED_BYTES); ------------------ | | 27| 40|#define PUBLIC_KEY_BYTES CRYPTO_PUBLICKEYBYTES ///< Define the size of the public key in bytes | | ------------------ | | | | 12| 40|#define CRYPTO_PUBLICKEYBYTES 7237 | | ------------------ ------------------ memcpy(dk_kem + PUBLIC_KEY_BYTES + SEED_BYTES + PARAM_SECURITY_BYTES, seed_kem, SEED_BYTES); ------------------ | | 52| 40|#define SEED_BYTES 32 ///< Define the size of the seed in bytes ------------------ memcpy(dk_kem + PUBLIC_KEY_BYTES + SEED_BYTES + PARAM_SECURITY_BYTES, seed_kem, SEED_BYTES); ------------------ | | 23| 40|#define PARAM_SECURITY_BYTES 32 ///< Define the security level in bytes ------------------ memcpy(dk_kem + PUBLIC_KEY_BYTES + SEED_BYTES + PARAM_SECURITY_BYTES, seed_kem, SEED_BYTES); ------------------ | | 52| 40|#define SEED_BYTES 32 ///< Define the size of the seed in bytes ------------------ 68| | 69| |#ifdef VERBOSE 70| | printf("\n\nseed_kem: "); 71| | for (int i = 0; i < SEED_BYTES; ++i) printf("%02x", seed_kem[i]); 72| | printf("\n\nseed_pke: "); 73| | for (int i = 0; i < SEED_BYTES; ++i) printf("%02x", seed_pke[i]); 74| | printf("\n\nsigma: "); 75| | for (int i = 0; i < PARAM_SECURITY_BYTES; ++i) printf("%02x", sigma[i]); 76| |#endif 77| | 78| | // Zeroize sensitive data 79| 40| memset_zero(seed_kem, sizeof seed_kem); ------------------ | | 22| 40|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 40|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 40|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 40|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 40|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 80| 40| memset_zero(sigma, sizeof sigma); ------------------ | | 22| 40|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 40|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 40|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 40|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 40|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 81| 40| memset_zero(seed_pke, sizeof seed_pke); ------------------ | | 22| 40|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 40|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 40|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 40|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 40|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 82| 40| memset_zero(dk_pke, sizeof dk_pke); ------------------ | | 22| 40|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 40|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 40|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 40|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 40|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 83| | 84| 40| return 0; 85| 40|} PQCHQC_HQC5_C_crypto_kem_enc: 105| 40|int crypto_kem_enc(uint8_t *c_kem, uint8_t *K, const uint8_t *ek_kem) { 106| |#ifdef VERBOSE 107| | printf("\n\n\n\n### ENCAPS ###"); 108| |#endif 109| | 110| 40| uint8_t m[PARAM_SECURITY_BYTES] = {0}; 111| 40| uint8_t K_theta[SHARED_SECRET_BYTES + SEED_BYTES] = {0}; 112| 40| uint8_t theta[SEED_BYTES] = {0}; 113| 40| uint8_t hash_ek_kem[SEED_BYTES] = {0}; 114| 40| ciphertext_kem_t c_kem_t = {0}; 115| | 116| | // Sample message m and salt 117| 40| prng_get_bytes(m, PARAM_SECURITY_BYTES); ------------------ | | 73| 40|#define prng_get_bytes PQCHQC_NAMESPACE(prng_get_bytes) | | ------------------ | | | | 17| 40|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 40|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 40|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ prng_get_bytes(m, PARAM_SECURITY_BYTES); ------------------ | | 23| 40|#define PARAM_SECURITY_BYTES 32 ///< Define the security level in bytes ------------------ 118| 40| prng_get_bytes(c_kem_t.salt, SALT_BYTES); ------------------ | | 73| 40|#define prng_get_bytes PQCHQC_NAMESPACE(prng_get_bytes) | | ------------------ | | | | 17| 40|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 40|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 40|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ prng_get_bytes(c_kem_t.salt, SALT_BYTES); ------------------ | | 53| 40|#define SALT_BYTES 16 ///< Define the size of a salt in bytes ------------------ 119| | 120| | // Compute shared key K and ciphertext c_kem 121| 40| hash_h(hash_ek_kem, ek_kem); ------------------ | | 78| 40|#define hash_h PQCHQC_NAMESPACE(hash_h) | | ------------------ | | | | 17| 40|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 40|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 40|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 122| 40| hash_g(K_theta, hash_ek_kem, m, c_kem_t.salt); ------------------ | | 77| 40|#define hash_g PQCHQC_NAMESPACE(hash_g) | | ------------------ | | | | 17| 40|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 40|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 40|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 123| 40| memcpy(theta, K_theta + SEED_BYTES, SEED_BYTES); ------------------ | | 52| 40|#define SEED_BYTES 32 ///< Define the size of the seed in bytes ------------------ memcpy(theta, K_theta + SEED_BYTES, SEED_BYTES); ------------------ | | 52| 40|#define SEED_BYTES 32 ///< Define the size of the seed in bytes ------------------ 124| 40| hqc_pke_encrypt(&c_kem_t.c_pke, ek_kem, (uint64_t *)m, theta); ------------------ | | 15| 40|#define hqc_pke_encrypt PQCHQC_NAMESPACE(hqc_pke_encrypt) | | ------------------ | | | | 17| 40|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 40|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 40|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 125| | 126| 40| hqc_c_kem_to_string(c_kem, &c_kem_t); ------------------ | | 16| 40|#define hqc_c_kem_to_string PQCHQC_NAMESPACE(hqc_c_kem_to_string) | | ------------------ | | | | 17| 40|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 40|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 40|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 127| 40| memcpy(K, K_theta, SHARED_SECRET_BYTES); ------------------ | | 28| 40|#define SHARED_SECRET_BYTES CRYPTO_BYTES ///< Define the size of the shared secret in bytes | | ------------------ | | | | 13| 40|#define CRYPTO_BYTES 32 | | ------------------ ------------------ 128| | 129| |#ifdef VERBOSE 130| | printf("\n\nek_kem: "); 131| | for (int i = 0; i < PUBLIC_KEY_BYTES; ++i) printf("%02x", ek_kem[i]); 132| | printf("\n\nm: "); 133| | vect_print((uint64_t *)m, PARAM_SECURITY_BYTES); 134| | printf("\n\nsalt: "); 135| | for (int i = 0; i < SALT_BYTES; ++i) printf("%02x", c_kem_t.salt[i]); 136| | printf("\n\nH(ek_kem): "); 137| | for (int i = 0; i < SEED_BYTES; ++i) printf("%02x", hash_ek_kem[i]); 138| | printf("\n\ntheta: "); 139| | for (int i = 0; i < SEED_BYTES; ++i) printf("%02x", theta[i]); 140| | printf("\n\nc_kem: "); 141| | for (int i = 0; i < CIPHERTEXT_BYTES; ++i) printf("%02x", c_kem[i]); 142| | printf("\n\nK: "); 143| | for (int i = 0; i < SHARED_SECRET_BYTES; ++i) printf("%02x", K[i]); 144| |#endif 145| | 146| | // Zeroize sensitive data 147| 40| memset_zero(m, sizeof m); ------------------ | | 22| 40|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 40|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 40|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 40|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 40|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 148| 40| memset_zero(K_theta, sizeof K_theta); ------------------ | | 22| 40|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 40|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 40|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 40|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 40|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 149| 40| memset_zero(theta, sizeof theta); ------------------ | | 22| 40|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 40|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 40|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 40|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 40|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 150| | 151| 40| return 0; 152| 40|} PQCHQC_HQC5_C_crypto_kem_dec: 166| 40|int crypto_kem_dec(uint8_t *K_prime, const uint8_t *c_kem, const uint8_t *dk_kem) { 167| |#ifdef VERBOSE 168| | printf("\n\n\n\n### DECAPS ###"); 169| |#endif 170| | 171| 40| uint8_t ek_pke[PUBLIC_KEY_BYTES] = {0}; 172| 40| uint8_t dk_pke[SEED_BYTES] = {0}; 173| 40| uint8_t sigma[PARAM_SECURITY_BYTES] = {0}; 174| 40| uint8_t m_prime[PARAM_SECURITY_BYTES] = {0}; 175| 40| uint8_t hash_ek_kem[SEED_BYTES] = {0}; 176| 40| uint8_t K_theta_prime[SHARED_SECRET_BYTES + SEED_BYTES] = {0}; 177| 40| uint8_t K_bar[SHARED_SECRET_BYTES] = {0}; 178| 40| uint8_t theta_prime[SEED_BYTES] = {0}; 179| 40| ciphertext_kem_t c_kem_t = {0}; 180| 40| ciphertext_kem_t c_kem_prime_t = {0}; 181| 40| uint8_t result; 182| | 183| | // Parse decapsulation key dk_kem 184| 40| memcpy(ek_pke, dk_kem, PUBLIC_KEY_BYTES); ------------------ | | 27| 40|#define PUBLIC_KEY_BYTES CRYPTO_PUBLICKEYBYTES ///< Define the size of the public key in bytes | | ------------------ | | | | 12| 40|#define CRYPTO_PUBLICKEYBYTES 7237 | | ------------------ ------------------ 185| 40| memcpy(dk_pke, dk_kem + PUBLIC_KEY_BYTES, SEED_BYTES); ------------------ | | 27| 40|#define PUBLIC_KEY_BYTES CRYPTO_PUBLICKEYBYTES ///< Define the size of the public key in bytes | | ------------------ | | | | 12| 40|#define CRYPTO_PUBLICKEYBYTES 7237 | | ------------------ ------------------ memcpy(dk_pke, dk_kem + PUBLIC_KEY_BYTES, SEED_BYTES); ------------------ | | 52| 40|#define SEED_BYTES 32 ///< Define the size of the seed in bytes ------------------ 186| 40| memcpy(sigma, dk_kem + PUBLIC_KEY_BYTES + SEED_BYTES, PARAM_SECURITY_BYTES); ------------------ | | 27| 40|#define PUBLIC_KEY_BYTES CRYPTO_PUBLICKEYBYTES ///< Define the size of the public key in bytes | | ------------------ | | | | 12| 40|#define CRYPTO_PUBLICKEYBYTES 7237 | | ------------------ ------------------ memcpy(sigma, dk_kem + PUBLIC_KEY_BYTES + SEED_BYTES, PARAM_SECURITY_BYTES); ------------------ | | 52| 40|#define SEED_BYTES 32 ///< Define the size of the seed in bytes ------------------ memcpy(sigma, dk_kem + PUBLIC_KEY_BYTES + SEED_BYTES, PARAM_SECURITY_BYTES); ------------------ | | 23| 40|#define PARAM_SECURITY_BYTES 32 ///< Define the security level in bytes ------------------ 187| | 188| | // Parse ciphertext c_kem 189| 40| hqc_c_kem_from_string(&c_kem_t.c_pke, c_kem_t.salt, c_kem); ------------------ | | 17| 40|#define hqc_c_kem_from_string PQCHQC_NAMESPACE(hqc_c_kem_from_string) | | ------------------ | | | | 17| 40|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 40|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 40|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 190| | 191| | // Compute message m_prime 192| 40| result = hqc_pke_decrypt((uint64_t *)m_prime, dk_pke, &c_kem_t.c_pke); ------------------ | | 16| 40|#define hqc_pke_decrypt PQCHQC_NAMESPACE(hqc_pke_decrypt) | | ------------------ | | | | 17| 40|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 40|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 40|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 193| | 194| | // Compute shared key K_prime and ciphertext c_kem_prime 195| 40| hash_h(hash_ek_kem, ek_pke); ------------------ | | 78| 40|#define hash_h PQCHQC_NAMESPACE(hash_h) | | ------------------ | | | | 17| 40|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 40|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 40|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 196| 40| hash_g(K_theta_prime, hash_ek_kem, m_prime, c_kem_t.salt); ------------------ | | 77| 40|#define hash_g PQCHQC_NAMESPACE(hash_g) | | ------------------ | | | | 17| 40|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 40|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 40|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 197| 40| memcpy(K_prime, K_theta_prime, SHARED_SECRET_BYTES); ------------------ | | 28| 40|#define SHARED_SECRET_BYTES CRYPTO_BYTES ///< Define the size of the shared secret in bytes | | ------------------ | | | | 13| 40|#define CRYPTO_BYTES 32 | | ------------------ ------------------ 198| 40| memcpy(theta_prime, K_theta_prime + SHARED_SECRET_BYTES, SEED_BYTES); ------------------ | | 28| 40|#define SHARED_SECRET_BYTES CRYPTO_BYTES ///< Define the size of the shared secret in bytes | | ------------------ | | | | 13| 40|#define CRYPTO_BYTES 32 | | ------------------ ------------------ memcpy(theta_prime, K_theta_prime + SHARED_SECRET_BYTES, SEED_BYTES); ------------------ | | 52| 40|#define SEED_BYTES 32 ///< Define the size of the seed in bytes ------------------ 199| | 200| 40| hqc_pke_encrypt(&c_kem_prime_t.c_pke, ek_pke, (uint64_t *)m_prime, theta_prime); ------------------ | | 15| 40|#define hqc_pke_encrypt PQCHQC_NAMESPACE(hqc_pke_encrypt) | | ------------------ | | | | 17| 40|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 40|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 40|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 201| 40| memcpy(c_kem_prime_t.salt, c_kem_t.salt, SALT_BYTES); ------------------ | | 53| 40|#define SALT_BYTES 16 ///< Define the size of a salt in bytes ------------------ 202| | 203| | // Compute rejection key K_bar 204| 40| hash_j(K_bar, hash_ek_kem, sigma, &c_kem_t); ------------------ | | 80| 40|#define hash_j PQCHQC_NAMESPACE(hash_j) | | ------------------ | | | | 17| 40|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 40|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 40|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 205| 40| result |= vect_compare((uint8_t *)c_kem_t.c_pke.u, (uint8_t *)c_kem_prime_t.c_pke.u, VEC_N_SIZE_BYTES); ------------------ | | 20| 40|#define vect_compare PQCHQC_NAMESPACE(vect_compare) | | ------------------ | | | | 17| 40|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 40|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 40|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ result |= vect_compare((uint8_t *)c_kem_t.c_pke.u, (uint8_t *)c_kem_prime_t.c_pke.u, VEC_N_SIZE_BYTES); ------------------ | | 31| 40|#define VEC_N_SIZE_BYTES CEIL_DIVIDE(PARAM_N, 8) ///< Size of array to store PARAM_N bits in bytes | | ------------------ | | | | 12| 40|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [Folded, False: 40] | | | | ------------------ | | ------------------ ------------------ 206| 40| result |= vect_compare((uint8_t *)c_kem_t.c_pke.v, (uint8_t *)c_kem_prime_t.c_pke.v, VEC_N1N2_SIZE_BYTES); ------------------ | | 20| 40|#define vect_compare PQCHQC_NAMESPACE(vect_compare) | | ------------------ | | | | 17| 40|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 40|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 40|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ result |= vect_compare((uint8_t *)c_kem_t.c_pke.v, (uint8_t *)c_kem_prime_t.c_pke.v, VEC_N1N2_SIZE_BYTES); ------------------ | | 34| 40|#define VEC_N1N2_SIZE_BYTES CEIL_DIVIDE(PARAM_N1N2, 8) ///< Size of array to store PARAM_N1N2 bits in bytes | | ------------------ | | | | 12| 40|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [True: 40, Folded] | | | | ------------------ | | ------------------ ------------------ 207| 40| result |= vect_compare(c_kem_t.salt, c_kem_prime_t.salt, SALT_BYTES); ------------------ | | 20| 40|#define vect_compare PQCHQC_NAMESPACE(vect_compare) | | ------------------ | | | | 17| 40|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 40|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 40|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ result |= vect_compare(c_kem_t.salt, c_kem_prime_t.salt, SALT_BYTES); ------------------ | | 53| 40|#define SALT_BYTES 16 ///< Define the size of a salt in bytes ------------------ 208| 40| result -= 1; 209| 1.32k| for (size_t i = 0; i < SHARED_SECRET_BYTES; ++i) { ------------------ | | 28| 1.32k|#define SHARED_SECRET_BYTES CRYPTO_BYTES ///< Define the size of the shared secret in bytes | | ------------------ | | | | 13| 1.32k|#define CRYPTO_BYTES 32 | | ------------------ ------------------ | Branch (209:24): [True: 1.28k, False: 40] ------------------ 210| 1.28k| K_prime[i] = (K_prime[i] & result) ^ (K_bar[i] & ~result); 211| 1.28k| } 212| | 213| |#ifdef VERBOSE 214| | printf("\n\nek_pke: "); 215| | for (int i = 0; i < PUBLIC_KEY_BYTES; ++i) printf("%02x", ek_pke[i]); 216| | printf("\n\ndk_pke: "); 217| | for (int i = 0; i < SEED_BYTES; ++i) printf("%02x", dk_pke[i]); 218| | printf("\n\nc_kem: "); 219| | for (int i = 0; i < CIPHERTEXT_BYTES; ++i) printf("%02x", c_kem[i]); 220| | printf("\n\nm_prime: "); 221| | vect_print((uint64_t *)m_prime, PARAM_SECURITY_BYTES); 222| | printf("\n\nH(ek_kem): "); 223| | for (int i = 0; i < SEED_BYTES; ++i) printf("%02x", hash_ek_kem[i]); 224| | printf("\n\ntheta_prime: "); 225| | for (int i = 0; i < SEED_BYTES; ++i) printf("%02x", theta_prime[i]); 226| | printf("\n\n\n# Checking Ciphertext - Begin #"); 227| | printf("\n\nc_kem_prime_t.c_pke.u: "); 228| | vect_print(c_kem_prime_t.c_pke.u, VEC_N_SIZE_BYTES); 229| | printf("\n\nc_kem_prime_t.c_pke.v: "); 230| | vect_print(c_kem_prime_t.c_pke.v, VEC_N1N2_SIZE_BYTES); 231| | printf("\n\nsalt: "); 232| | for (int i = 0; i < SALT_BYTES; ++i) printf("%02x", c_kem_prime_t.salt[i]); 233| | printf("\n\n# Checking Ciphertext - End #\n"); 234| | printf("\n\nK_prime: "); 235| | for (int i = 0; i < SHARED_SECRET_BYTES; ++i) printf("%02x", K_prime[i]); 236| |#endif 237| | 238| | // Zeroize sensitive data 239| 40| memset_zero(dk_pke, sizeof dk_pke); ------------------ | | 22| 40|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 40|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 40|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 40|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 40|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 240| 40| memset_zero(sigma, sizeof sigma); ------------------ | | 22| 40|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 40|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 40|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 40|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 40|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 241| 40| memset_zero(m_prime, sizeof m_prime); ------------------ | | 22| 40|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 40|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 40|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 40|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 40|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 242| 40| memset_zero(K_theta_prime, sizeof K_theta_prime); ------------------ | | 22| 40|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 40|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 40|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 40|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 40|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 243| 40| memset_zero(K_bar, sizeof K_bar); ------------------ | | 22| 40|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 40|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 40|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 40|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 40|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 244| 40| memset_zero(theta_prime, sizeof theta_prime); ------------------ | | 22| 40|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 40|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 40|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 40|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 40|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 245| | 246| 40| return 0; 247| 40|} PQCHQC_HQC5_C_hqc_dk_pke_from_string: 19| 40|void hqc_dk_pke_from_string(uint64_t *y, const uint8_t *dk_pke) { 20| 40| shake256_xof_ctx dk_xof_ctx = {0}; 21| 40| xof_init(&dk_xof_ctx, dk_pke, SEED_BYTES); ------------------ | | 74| 40|#define xof_init PQCHQC_NAMESPACE(xof_init) | | ------------------ | | | | 17| 40|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 40|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 40|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ xof_init(&dk_xof_ctx, dk_pke, SEED_BYTES); ------------------ | | 52| 40|#define SEED_BYTES 32 ///< Define the size of the seed in bytes ------------------ 22| 40| vect_sample_fixed_weight1(&dk_xof_ctx, y, PARAM_OMEGA); ------------------ | | 16| 40|#define vect_sample_fixed_weight1 PQCHQC_NAMESPACE(vect_sample_fixed_weight1) | | ------------------ | | | | 17| 40|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 40|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 40|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ vect_sample_fixed_weight1(&dk_xof_ctx, y, PARAM_OMEGA); ------------------ | | 19| 40|#define PARAM_OMEGA 131 ///< Define the parameter omega of the scheme ------------------ 23| 40| xof_ctx_release(&dk_xof_ctx); ------------------ | | 76| 40|#define xof_ctx_release PQCHQC_NAMESPACE(xof_ctx_release) | | ------------------ | | | | 17| 40|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 40|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 40|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 24| | 25| | // Zeroize sensitive data 26| 40| memset_zero(&dk_xof_ctx, sizeof dk_xof_ctx); ------------------ | | 22| 40|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 40|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 40|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 40|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 40|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 27| 40|} PQCHQC_HQC5_C_hqc_ek_pke_from_string: 36| 80|void hqc_ek_pke_from_string(uint64_t *h, uint64_t *s, const uint8_t *ek_pke) { 37| 80| shake256_xof_ctx ek_xof_ctx = {0}; 38| | 39| 80| xof_init(&ek_xof_ctx, ek_pke, SEED_BYTES); ------------------ | | 74| 80|#define xof_init PQCHQC_NAMESPACE(xof_init) | | ------------------ | | | | 17| 80|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 80|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 80|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ xof_init(&ek_xof_ctx, ek_pke, SEED_BYTES); ------------------ | | 52| 80|#define SEED_BYTES 32 ///< Define the size of the seed in bytes ------------------ 40| 80| vect_set_random(&ek_xof_ctx, h); ------------------ | | 18| 80|#define vect_set_random PQCHQC_NAMESPACE(vect_set_random) | | ------------------ | | | | 17| 80|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 80|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 80|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 41| 80| xof_ctx_release(&ek_xof_ctx); ------------------ | | 76| 80|#define xof_ctx_release PQCHQC_NAMESPACE(xof_ctx_release) | | ------------------ | | | | 17| 80|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 80|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 80|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 42| | 43| 80| memcpy(s, ek_pke + SEED_BYTES, VEC_N_SIZE_BYTES); ------------------ | | 52| 80|#define SEED_BYTES 32 ///< Define the size of the seed in bytes ------------------ memcpy(s, ek_pke + SEED_BYTES, VEC_N_SIZE_BYTES); ------------------ | | 31| 80|#define VEC_N_SIZE_BYTES CEIL_DIVIDE(PARAM_N, 8) ///< Size of array to store PARAM_N bits in bytes | | ------------------ | | | | 12| 80|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [Folded, False: 80] | | | | ------------------ | | ------------------ ------------------ 44| 80|} PQCHQC_HQC5_C_hqc_c_kem_to_string: 52| 40|void hqc_c_kem_to_string(uint8_t *ct, const ciphertext_kem_t *c_kem) { 53| 40| memcpy(ct, c_kem->c_pke.u, VEC_N_SIZE_BYTES); ------------------ | | 31| 40|#define VEC_N_SIZE_BYTES CEIL_DIVIDE(PARAM_N, 8) ///< Size of array to store PARAM_N bits in bytes | | ------------------ | | | | 12| 40|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [Folded, False: 40] | | | | ------------------ | | ------------------ ------------------ 54| 40| memcpy(ct + VEC_N_SIZE_BYTES, c_kem->c_pke.v, VEC_N1N2_SIZE_BYTES); ------------------ | | 31| 40|#define VEC_N_SIZE_BYTES CEIL_DIVIDE(PARAM_N, 8) ///< Size of array to store PARAM_N bits in bytes | | ------------------ | | | | 12| 40|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [Folded, False: 40] | | | | ------------------ | | ------------------ ------------------ memcpy(ct + VEC_N_SIZE_BYTES, c_kem->c_pke.v, VEC_N1N2_SIZE_BYTES); ------------------ | | 34| 40|#define VEC_N1N2_SIZE_BYTES CEIL_DIVIDE(PARAM_N1N2, 8) ///< Size of array to store PARAM_N1N2 bits in bytes | | ------------------ | | | | 12| 40|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [True: 40, Folded] | | | | ------------------ | | ------------------ ------------------ 55| 40| memcpy(ct + VEC_N_SIZE_BYTES + VEC_N1N2_SIZE_BYTES, c_kem->salt, SALT_BYTES); ------------------ | | 31| 40|#define VEC_N_SIZE_BYTES CEIL_DIVIDE(PARAM_N, 8) ///< Size of array to store PARAM_N bits in bytes | | ------------------ | | | | 12| 40|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [Folded, False: 40] | | | | ------------------ | | ------------------ ------------------ memcpy(ct + VEC_N_SIZE_BYTES + VEC_N1N2_SIZE_BYTES, c_kem->salt, SALT_BYTES); ------------------ | | 34| 40|#define VEC_N1N2_SIZE_BYTES CEIL_DIVIDE(PARAM_N1N2, 8) ///< Size of array to store PARAM_N1N2 bits in bytes | | ------------------ | | | | 12| 40|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [True: 40, Folded] | | | | ------------------ | | ------------------ ------------------ memcpy(ct + VEC_N_SIZE_BYTES + VEC_N1N2_SIZE_BYTES, c_kem->salt, SALT_BYTES); ------------------ | | 53| 40|#define SALT_BYTES 16 ///< Define the size of a salt in bytes ------------------ 56| 40|} PQCHQC_HQC5_C_hqc_c_kem_from_string: 65| 40|void hqc_c_kem_from_string(ciphertext_pke_t *c_pke, uint8_t *salt, const uint8_t *ct) { 66| 40| memcpy(c_pke->u, ct, VEC_N_SIZE_BYTES); ------------------ | | 31| 40|#define VEC_N_SIZE_BYTES CEIL_DIVIDE(PARAM_N, 8) ///< Size of array to store PARAM_N bits in bytes | | ------------------ | | | | 12| 40|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [Folded, False: 40] | | | | ------------------ | | ------------------ ------------------ 67| 40| memcpy(c_pke->v, ct + VEC_N_SIZE_BYTES, VEC_N1N2_SIZE_BYTES); ------------------ | | 31| 40|#define VEC_N_SIZE_BYTES CEIL_DIVIDE(PARAM_N, 8) ///< Size of array to store PARAM_N bits in bytes | | ------------------ | | | | 12| 40|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [Folded, False: 40] | | | | ------------------ | | ------------------ ------------------ memcpy(c_pke->v, ct + VEC_N_SIZE_BYTES, VEC_N1N2_SIZE_BYTES); ------------------ | | 34| 40|#define VEC_N1N2_SIZE_BYTES CEIL_DIVIDE(PARAM_N1N2, 8) ///< Size of array to store PARAM_N1N2 bits in bytes | | ------------------ | | | | 12| 40|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [True: 40, Folded] | | | | ------------------ | | ------------------ ------------------ 68| 40| memcpy(salt, ct + VEC_N_SIZE_BYTES + VEC_N1N2_SIZE_BYTES, SALT_BYTES); ------------------ | | 31| 40|#define VEC_N_SIZE_BYTES CEIL_DIVIDE(PARAM_N, 8) ///< Size of array to store PARAM_N bits in bytes | | ------------------ | | | | 12| 40|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [Folded, False: 40] | | | | ------------------ | | ------------------ ------------------ memcpy(salt, ct + VEC_N_SIZE_BYTES + VEC_N1N2_SIZE_BYTES, SALT_BYTES); ------------------ | | 34| 40|#define VEC_N1N2_SIZE_BYTES CEIL_DIVIDE(PARAM_N1N2, 8) ///< Size of array to store PARAM_N1N2 bits in bytes | | ------------------ | | | | 12| 40|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [True: 40, Folded] | | | | ------------------ | | ------------------ ------------------ memcpy(salt, ct + VEC_N_SIZE_BYTES + VEC_N1N2_SIZE_BYTES, SALT_BYTES); ------------------ | | 53| 40|#define SALT_BYTES 16 ///< Define the size of a salt in bytes ------------------ 69| 40|} PQCHQC_HQC5_C_reed_muller_encode: 174| 80|void reed_muller_encode(uint64_t *cdw, const uint64_t *msg) { 175| 80| uint8_t *message_array = (uint8_t *)msg; 176| 80| rm_codeword_t *codeArray = (rm_codeword_t *)cdw; 177| 7.28k| for (size_t i = 0; i < VEC_N1_SIZE_BYTES; i++) { ------------------ | | 33| 7.28k|#define VEC_N1_SIZE_BYTES PARAM_N1 ///< Size of array to store PARAM_N1 bits in bytes | | ------------------ | | | | 16| 7.28k|#define PARAM_N1 90 ///< Define the parameter n1 of the scheme (length of Reed-Solomon code) | | ------------------ ------------------ | Branch (177:24): [True: 7.20k, False: 80] ------------------ 178| | // fill entries i * MULTIPLICITY to (i+1) * MULTIPLICITY 179| 7.20k| int32_t pos = i * MULTIPLICITY; ------------------ | | 18| 7.20k|#define MULTIPLICITY CEIL_DIVIDE(PARAM_N2, 128) | | ------------------ | | | | 12| 7.20k|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [True: 7.20k, Folded] | | | | ------------------ | | ------------------ ------------------ 180| | // encode first word 181| 7.20k| encode(&codeArray[pos], message_array[i]); 182| | // copy to other identical codewords 183| 36.0k| for (size_t copy = 1; copy < MULTIPLICITY; copy++) { ------------------ | | 18| 36.0k|#define MULTIPLICITY CEIL_DIVIDE(PARAM_N2, 128) | | ------------------ | | | | 12| 36.0k|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [True: 36.0k, Folded] | | | | ------------------ | | ------------------ ------------------ | Branch (183:31): [True: 28.8k, False: 7.20k] ------------------ 184| 28.8k| memcpy(&codeArray[pos + copy], &codeArray[pos], sizeof(rm_codeword_t)); 185| 28.8k| } 186| 7.20k| } 187| 80|} PQCHQC_HQC5_C_reed_muller_decode: 198| 40|void reed_muller_decode(uint64_t *msg, const uint64_t *cdw) { 199| 40| uint8_t *message_array = (uint8_t *)msg; 200| 40| rm_codeword_t *codeArray = (rm_codeword_t *)cdw; 201| 40| rm_expanded_cdw expanded; 202| 3.64k| for (size_t i = 0; i < VEC_N1_SIZE_BYTES; i++) { ------------------ | | 33| 3.64k|#define VEC_N1_SIZE_BYTES PARAM_N1 ///< Size of array to store PARAM_N1 bits in bytes | | ------------------ | | | | 16| 3.64k|#define PARAM_N1 90 ///< Define the parameter n1 of the scheme (length of Reed-Solomon code) | | ------------------ ------------------ | Branch (202:24): [True: 3.60k, False: 40] ------------------ 203| | // collect the codewords 204| 3.60k| expand_and_sum(&expanded, &codeArray[i * MULTIPLICITY]); ------------------ | | 18| 3.60k|#define MULTIPLICITY CEIL_DIVIDE(PARAM_N2, 128) | | ------------------ | | | | 12| 3.60k|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [True: 3.60k, Folded] | | | | ------------------ | | ------------------ ------------------ 205| | // apply hadamard transform 206| 3.60k| rm_expanded_cdw transform; 207| 3.60k| hadamard(&expanded, &transform); 208| | // fix the first entry to get the half Hadamard transform 209| 3.60k| transform[0] -= 64 * MULTIPLICITY; ------------------ | | 18| 3.60k|#define MULTIPLICITY CEIL_DIVIDE(PARAM_N2, 128) | | ------------------ | | | | 12| 3.60k|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [True: 3.60k, Folded] | | | | ------------------ | | ------------------ ------------------ 210| | // finish the decoding 211| 3.60k| message_array[i] = find_peaks(&transform); 212| 3.60k| } 213| 40|} PQCHQC_HQC5_C_reed_solomon_encode: 84| 80|void reed_solomon_encode(uint64_t *cdw, const uint64_t *msg) { 85| 80| size_t i, j, k; 86| 80| uint8_t gate_value = 0; 87| | 88| 80| uint16_t tmp[PARAM_G] = {0}; 89| 80| uint16_t PARAM_RS_POLY[] = {RS_POLY_COEFS}; ------------------ | | 49| 80| 49,167,49,39,200,121,124,91,240,63,148,71,150,123,87,101,32,215,159,71,201,115,97,210,186,183,141,217,123,12,31, \ | | 50| 80| 243,180,219,152,239,99,141,4,246,191,144,8,232,47,27,141,178,130,64,124,47,39,188,216,48,199,187,1 ///< Coefficients of the Reed-Solomon generator polynomial ------------------ 90| | 91| 80| uint8_t msg_bytes[PARAM_K] = {0}; 92| 80| uint8_t cdw_bytes[PARAM_N1] = {0}; 93| | 94| 80| memcpy(msg_bytes, msg, PARAM_K); ------------------ | | 44| 80|#define PARAM_K 32 ///< Define the size of the information bits of the Reed-Solomon code ------------------ 95| | 96| 2.64k| for (i = 0; i < PARAM_K; ++i) { ------------------ | | 44| 2.64k|#define PARAM_K 32 ///< Define the size of the information bits of the Reed-Solomon code ------------------ | Branch (96:17): [True: 2.56k, False: 80] ------------------ 97| 2.56k| gate_value = msg_bytes[PARAM_K - 1 - i] ^ cdw_bytes[PARAM_N1 - PARAM_K - 1]; ------------------ | | 44| 2.56k|#define PARAM_K 32 ///< Define the size of the information bits of the Reed-Solomon code ------------------ gate_value = msg_bytes[PARAM_K - 1 - i] ^ cdw_bytes[PARAM_N1 - PARAM_K - 1]; ------------------ | | 16| 2.56k|#define PARAM_N1 90 ///< Define the parameter n1 of the scheme (length of Reed-Solomon code) ------------------ gate_value = msg_bytes[PARAM_K - 1 - i] ^ cdw_bytes[PARAM_N1 - PARAM_K - 1]; ------------------ | | 44| 2.56k|#define PARAM_K 32 ///< Define the size of the information bits of the Reed-Solomon code ------------------ 98| | 99| 153k| for (j = 0; j < PARAM_G; ++j) { ------------------ | | 45| 153k|#define PARAM_G 59 ///< Define the size of the generator polynomial of the Reed-Solomon code ------------------ | Branch (99:21): [True: 151k, False: 2.56k] ------------------ 100| 151k| tmp[j] = gf_mul(gate_value, PARAM_RS_POLY[j]); ------------------ | | 51| 151k|#define gf_mul PQCHQC_NAMESPACE(gf_mul) | | ------------------ | | | | 17| 151k|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 151k|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 151k|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 101| 151k| } 102| | 103| 148k| for (k = PARAM_N1 - PARAM_K - 1; k; --k) { ------------------ | | 16| 2.56k|#define PARAM_N1 90 ///< Define the parameter n1 of the scheme (length of Reed-Solomon code) ------------------ for (k = PARAM_N1 - PARAM_K - 1; k; --k) { ------------------ | | 44| 2.56k|#define PARAM_K 32 ///< Define the size of the information bits of the Reed-Solomon code ------------------ | Branch (103:42): [True: 145k, False: 2.56k] ------------------ 104| 145k| cdw_bytes[k] = cdw_bytes[k - 1] ^ tmp[k]; 105| 145k| } 106| | 107| 2.56k| cdw_bytes[0] = tmp[0]; 108| 2.56k| } 109| | 110| 80| memcpy(cdw_bytes + PARAM_N1 - PARAM_K, msg_bytes, PARAM_K); ------------------ | | 16| 80|#define PARAM_N1 90 ///< Define the parameter n1 of the scheme (length of Reed-Solomon code) ------------------ memcpy(cdw_bytes + PARAM_N1 - PARAM_K, msg_bytes, PARAM_K); ------------------ | | 44| 80|#define PARAM_K 32 ///< Define the size of the information bits of the Reed-Solomon code ------------------ memcpy(cdw_bytes + PARAM_N1 - PARAM_K, msg_bytes, PARAM_K); ------------------ | | 44| 80|#define PARAM_K 32 ///< Define the size of the information bits of the Reed-Solomon code ------------------ 111| 80| memcpy(cdw, cdw_bytes, PARAM_N1); ------------------ | | 16| 80|#define PARAM_N1 90 ///< Define the parameter n1 of the scheme (length of Reed-Solomon code) ------------------ 112| 80|} PQCHQC_HQC5_C_reed_solomon_decode: 353| 40|void reed_solomon_decode(uint64_t *msg, uint64_t *cdw) { 354| 40| uint8_t cdw_bytes[PARAM_N1] = {0}; 355| 40| uint16_t syndromes[2 * PARAM_DELTA] = {0}; 356| 40| uint16_t sigma[1 << PARAM_FFT] = {0}; 357| 40| uint8_t error[1 << PARAM_M] = {0}; 358| 40| uint16_t z[PARAM_N1] = {0}; 359| 40| uint16_t error_values[PARAM_N1] = {0}; 360| 40| uint16_t deg; 361| | 362| | // Copy the vector in an array of bytes 363| 40| memcpy(cdw_bytes, cdw, PARAM_N1); ------------------ | | 16| 40|#define PARAM_N1 90 ///< Define the parameter n1 of the scheme (length of Reed-Solomon code) ------------------ 364| | 365| | // Calculate the 2*PARAM_DELTA syndromes 366| 40| compute_syndromes(syndromes, cdw_bytes); 367| | 368| | // Compute the error locator polynomial sigma 369| | // Sigma's degree is at most PARAM_DELTA but the FFT requires the extra room 370| 40| deg = compute_elp(sigma, syndromes); 371| | 372| | // Compute the error polynomial error 373| 40| compute_roots(error, sigma); 374| | 375| | // Compute the polynomial z(x) 376| 40| compute_z_poly(z, sigma, deg, syndromes); 377| | 378| | // Compute the error values 379| 40| compute_error_values(error_values, z, error); 380| | 381| | // Correct the errors 382| 40| correct_errors(cdw_bytes, error_values); 383| | 384| | // Retrieve the message from the decoded codeword 385| 40| memcpy(msg, cdw_bytes + (PARAM_G - 1), PARAM_K); ------------------ | | 45| 40|#define PARAM_G 59 ///< Define the size of the generator polynomial of the Reed-Solomon code ------------------ memcpy(msg, cdw_bytes + (PARAM_G - 1), PARAM_K); ------------------ | | 44| 40|#define PARAM_K 32 ///< Define the size of the information bits of the Reed-Solomon code ------------------ 386| | 387| |#ifdef VERBOSE 388| | printf("\n\nThe syndromes: "); 389| | for (size_t i = 0; i < 2 * PARAM_DELTA; ++i) { 390| | printf("%u ", syndromes[i]); 391| | } 392| | printf("\n\nThe error locator polynomial: sigma(x) = "); 393| | bool first_coeff = true; 394| | if (sigma[0]) { 395| | printf("%u", sigma[0]); 396| | first_coeff = false; 397| | } 398| | for (size_t i = 1; i < (1 << PARAM_FFT); ++i) { 399| | if (sigma[i] == 0) 400| | continue; 401| | if (!first_coeff) 402| | printf(" + "); 403| | first_coeff = false; 404| | if (sigma[i] != 1) 405| | printf("%u ", sigma[i]); 406| | if (i == 1) 407| | printf("x"); 408| | else 409| | printf("x^%zu", i); 410| | } 411| | if (first_coeff) 412| | printf("0"); 413| | 414| | printf("\n\nThe polynomial: z(x) = "); 415| | bool first_coeff_1 = true; 416| | if (z[0]) { 417| | printf("%u", z[0]); 418| | first_coeff_1 = false; 419| | } 420| | for (size_t i = 1; i < (PARAM_DELTA + 1); ++i) { 421| | if (z[i] == 0) 422| | continue; 423| | if (!first_coeff_1) 424| | printf(" + "); 425| | first_coeff_1 = false; 426| | if (z[i] != 1) 427| | printf("%u ", z[i]); 428| | if (i == 1) 429| | printf("x"); 430| | else 431| | printf("x^%zu", i); 432| | } 433| | if (first_coeff_1) 434| | printf("0"); 435| | 436| | printf("\n\nThe pairs of (error locator numbers, error values): "); 437| | size_t j = 0; 438| | for (size_t i = 0; i < PARAM_N1; ++i) { 439| | if (error[i]) { 440| | printf("(%zu, %d) ", i, error_values[j]); 441| | j++; 442| | } 443| | } 444| | printf("\n"); 445| |#endif 446| | 447| | // Zeroize sensitive data 448| 40| memset_zero(cdw_bytes, sizeof cdw_bytes); ------------------ | | 22| 40|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 40|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 40|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 40|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 40|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 449| 40|} PQCHQC_HQC5_C_prng_get_bytes: 20| 120|void prng_get_bytes(uint8_t *output, uint32_t outlen) { 21| 120| OQS_randombytes(output, outlen); 22| 120|} PQCHQC_HQC5_C_xof_init: 70| 320|void xof_init(shake256_xof_ctx *xof_ctx, const uint8_t *seed, uint32_t seed_size) { 71| 320| uint8_t xof_domain = HQC_XOF_DOMAIN; ------------------ | | 50| 320|#define HQC_XOF_DOMAIN 1 ------------------ 72| 320| OQS_SHA3_shake256_inc_init(xof_ctx); 73| 320| OQS_SHA3_shake256_inc_absorb(xof_ctx, seed, seed_size); 74| 320| OQS_SHA3_shake256_inc_absorb(xof_ctx, &xof_domain, 1); 75| 320| OQS_SHA3_shake256_inc_finalize(xof_ctx); 76| 320|} PQCHQC_HQC5_C_xof_get_bytes: 89| 16.2k|void xof_get_bytes(shake256_xof_ctx *xof_ctx, uint8_t *output, uint32_t output_size) { 90| 16.2k| OQS_SHA3_shake256_inc_squeeze(output, output_size, xof_ctx); 91| 16.2k|} PQCHQC_HQC5_C_xof_ctx_release: 96| 320|void xof_ctx_release(shake256_xof_ctx *xof_ctx) { 97| 320| OQS_SHA3_shake256_inc_ctx_release(xof_ctx); 98| 320|} PQCHQC_HQC5_C_hash_i: 109| 40|void hash_i(uint8_t *output, const uint8_t *seed) { 110| 40| sha3_512_ctx i_hash_ctx = {0}; 111| 40| uint8_t i_domain = HQC_I_FCT_DOMAIN; ------------------ | | 65| 40|#define HQC_I_FCT_DOMAIN 2 ------------------ 112| 40| OQS_SHA3_sha3_512_inc_init(&i_hash_ctx); 113| 40| OQS_SHA3_sha3_512_inc_absorb(&i_hash_ctx, seed, SEED_BYTES); ------------------ | | 52| 40|#define SEED_BYTES 32 ///< Define the size of the seed in bytes ------------------ 114| 40| OQS_SHA3_sha3_512_inc_absorb(&i_hash_ctx, &i_domain, 1); 115| 40| OQS_SHA3_sha3_512_inc_finalize(output, &i_hash_ctx); 116| 40| OQS_SHA3_sha3_512_inc_ctx_release(&i_hash_ctx); 117| 40|} PQCHQC_HQC5_C_hash_h: 125| 80|void hash_h(uint8_t *output, const uint8_t ek_kem[PUBLIC_KEY_BYTES]) { 126| 80| sha3_256_ctx h_hash_ctx = {0}; 127| 80| uint8_t h_domain = HQC_H_FCT_DOMAIN; ------------------ | | 60| 80|#define HQC_H_FCT_DOMAIN 1 ------------------ 128| 80| OQS_SHA3_sha3_256_inc_init(&h_hash_ctx); 129| 80| OQS_SHA3_sha3_256_inc_absorb(&h_hash_ctx, ek_kem, PUBLIC_KEY_BYTES); ------------------ | | 27| 80|#define PUBLIC_KEY_BYTES CRYPTO_PUBLICKEYBYTES ///< Define the size of the public key in bytes | | ------------------ | | | | 12| 80|#define CRYPTO_PUBLICKEYBYTES 7237 | | ------------------ ------------------ 130| 80| OQS_SHA3_sha3_256_inc_absorb(&h_hash_ctx, &h_domain, 1); 131| 80| OQS_SHA3_sha3_256_inc_finalize(output, &h_hash_ctx); 132| 80| OQS_SHA3_sha3_256_inc_ctx_release(&h_hash_ctx); 133| 80|} PQCHQC_HQC5_C_hash_g: 144| 80| const uint8_t salt[SALT_BYTES]) { 145| 80| sha3_512_ctx g_hash_ctx = {0}; 146| 80| uint8_t i_domain = HQC_G_FCT_DOMAIN; ------------------ | | 55| 80|#define HQC_G_FCT_DOMAIN 0 ------------------ 147| 80| OQS_SHA3_sha3_512_inc_init(&g_hash_ctx); 148| 80| OQS_SHA3_sha3_512_inc_absorb(&g_hash_ctx, hash_ek_kem, SEED_BYTES); ------------------ | | 52| 80|#define SEED_BYTES 32 ///< Define the size of the seed in bytes ------------------ 149| 80| OQS_SHA3_sha3_512_inc_absorb(&g_hash_ctx, m, PARAM_SECURITY_BYTES); ------------------ | | 23| 80|#define PARAM_SECURITY_BYTES 32 ///< Define the security level in bytes ------------------ 150| 80| OQS_SHA3_sha3_512_inc_absorb(&g_hash_ctx, salt, SALT_BYTES); ------------------ | | 53| 80|#define SALT_BYTES 16 ///< Define the size of a salt in bytes ------------------ 151| 80| OQS_SHA3_sha3_512_inc_absorb(&g_hash_ctx, &i_domain, 1); 152| 80| OQS_SHA3_sha3_512_inc_finalize(output, &g_hash_ctx); 153| 80| OQS_SHA3_sha3_512_inc_ctx_release(&g_hash_ctx); 154| 80|} PQCHQC_HQC5_C_hash_j: 165| 40| const ciphertext_kem_t *c_kem) { 166| 40| sha3_256_ctx k_hash_ctx = {0}; 167| 40| uint8_t k_domain = HQC_J_FCT_DOMAIN; ------------------ | | 70| 40|#define HQC_J_FCT_DOMAIN 3 ------------------ 168| 40| OQS_SHA3_sha3_256_inc_init(&k_hash_ctx); 169| 40| OQS_SHA3_sha3_256_inc_absorb(&k_hash_ctx, hash_ek_kem, SEED_BYTES); ------------------ | | 52| 40|#define SEED_BYTES 32 ///< Define the size of the seed in bytes ------------------ 170| 40| OQS_SHA3_sha3_256_inc_absorb(&k_hash_ctx, sigma, PARAM_SECURITY_BYTES); ------------------ | | 23| 40|#define PARAM_SECURITY_BYTES 32 ///< Define the security level in bytes ------------------ 171| 40| OQS_SHA3_sha3_256_inc_absorb(&k_hash_ctx, (uint8_t *)c_kem->c_pke.u, VEC_N_SIZE_BYTES); ------------------ | | 31| 40|#define VEC_N_SIZE_BYTES CEIL_DIVIDE(PARAM_N, 8) ///< Size of array to store PARAM_N bits in bytes | | ------------------ | | | | 12| 40|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [Folded, False: 40] | | | | ------------------ | | ------------------ ------------------ 172| 40| OQS_SHA3_sha3_256_inc_absorb(&k_hash_ctx, (uint8_t *)c_kem->c_pke.v, VEC_N1N2_SIZE_BYTES); ------------------ | | 34| 40|#define VEC_N1N2_SIZE_BYTES CEIL_DIVIDE(PARAM_N1N2, 8) ///< Size of array to store PARAM_N1N2 bits in bytes | | ------------------ | | | | 12| 40|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [True: 40, Folded] | | | | ------------------ | | ------------------ ------------------ 173| 40| OQS_SHA3_sha3_256_inc_absorb(&k_hash_ctx, c_kem->salt, SALT_BYTES); ------------------ | | 53| 40|#define SALT_BYTES 16 ///< Define the size of a salt in bytes ------------------ 174| 40| OQS_SHA3_sha3_256_inc_absorb(&k_hash_ctx, &k_domain, 1); 175| 40| OQS_SHA3_sha3_256_inc_finalize(output, &k_hash_ctx); 176| 40| OQS_SHA3_sha3_256_inc_ctx_release(&k_hash_ctx); 177| 40|} PQCHQC_HQC5_C_vect_generate_random_support1: 62| 120|void vect_generate_random_support1(shake256_xof_ctx *ctx, uint32_t *support, uint16_t weight) { 63| 120| uint8_t rand_bytes[3] = {0}; 64| 120| uint32_t candidate = 0; 65| | 66| 15.9k| for (size_t i = 0; i < weight;) { ------------------ | Branch (66:24): [True: 15.7k, False: 120] ------------------ 67| 15.7k| xof_get_bytes(ctx, rand_bytes, 3); ------------------ | | 75| 15.7k|#define xof_get_bytes PQCHQC_NAMESPACE(xof_get_bytes) | | ------------------ | | | | 17| 15.7k|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 15.7k|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 15.7k|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 68| 15.7k| candidate = rand_bytes[0] | (rand_bytes[1] << 8) | (rand_bytes[2] << 16); 69| | 70| 15.7k| if (candidate >= UTILS_REJECTION_THRESHOLD) { ------------------ | | 56| 15.7k|#define UTILS_REJECTION_THRESHOLD 16772367 ///< Rejection threshold for uniform sampling in [0, PARAM_N) ------------------ | Branch (70:13): [True: 24, False: 15.7k] ------------------ 71| 24| continue; 72| 24| } 73| 15.7k| candidate = barrett_reduce(candidate); 74| | 75| 15.7k| int is_position_available = 1; 76| 1.04M| for (size_t j = 0; j < i; j++) { ------------------ | Branch (76:28): [True: 1.02M, False: 15.7k] ------------------ 77| 1.02M| if (candidate == support[j]) { ------------------ | Branch (77:17): [True: 50, False: 1.02M] ------------------ 78| 50| is_position_available = 0; 79| 50| break; 80| 50| } 81| 1.02M| } 82| | 83| 15.7k| if (is_position_available == 1) { ------------------ | Branch (83:13): [True: 15.7k, False: 50] ------------------ 84| 15.7k| support[i] = candidate; 85| 15.7k| i++; 86| 15.7k| } 87| 15.7k| } 88| 120|} PQCHQC_HQC5_C_vect_generate_random_support2: 99| 240|void vect_generate_random_support2(shake256_xof_ctx *ctx, uint32_t *support, uint16_t weight) { 100| 240| uint32_t rand_u32[PARAM_OMEGA_R] = {0}; 101| | 102| 240| xof_get_bytes(ctx, (uint8_t *)&rand_u32, 4 * weight); ------------------ | | 75| 240|#define xof_get_bytes PQCHQC_NAMESPACE(xof_get_bytes) | | ------------------ | | | | 17| 240|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 240|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 240|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 103| | 104| 36.0k| for (size_t i = 0; i < weight; ++i) { ------------------ | Branch (104:24): [True: 35.7k, False: 240] ------------------ 105| 35.7k| uint64_t buff = rand_u32[i]; 106| 35.7k| support[i] = i + ((buff * (PARAM_N - i)) >> 32); ------------------ | | 15| 35.7k|#define PARAM_N 57637 ///< Define the parameter n of the scheme ------------------ 107| 35.7k| } 108| | 109| 35.7k| for (int32_t i = (weight - 1); i-- > 0;) { ------------------ | Branch (109:36): [True: 35.5k, False: 240] ------------------ 110| 35.5k| uint32_t found = 0; 111| | 112| 2.68M| for (size_t j = i + 1; j < weight; ++j) { ------------------ | Branch (112:32): [True: 2.64M, False: 35.5k] ------------------ 113| 2.64M| found |= compare_u32(support[j], support[i]); 114| 2.64M| } 115| | 116| 35.5k| uint32_t mask = -found; 117| 35.5k| support[i] = (mask & i) ^ (~mask & support[i]); 118| 35.5k| } 119| 240|} PQCHQC_HQC5_C_vect_write_support_to_vector: 131| 360|void vect_write_support_to_vector(uint64_t *v, uint32_t *support, uint16_t weight) { 132| 360| uint32_t index_tab[PARAM_OMEGA_R] = {0}; 133| 360| uint64_t bit_tab[PARAM_OMEGA_R] = {0}; 134| | 135| 51.8k| for (size_t i = 0; i < weight; i++) { ------------------ | Branch (135:24): [True: 51.4k, False: 360] ------------------ 136| 51.4k| index_tab[i] = support[i] >> 6; 137| 51.4k| int32_t pos = support[i] & 0x3f; 138| 51.4k| bit_tab[i] = ((uint64_t)1) << pos; 139| 51.4k| } 140| | 141| 360| uint64_t val = 0; 142| 324k| for (uint32_t i = 0; i < VEC_N_SIZE_64; i++) { ------------------ | | 36| 324k|#define VEC_N_SIZE_64 CEIL_DIVIDE(PARAM_N, 64) ///< Size of array to store PARAM_N bits in 64-bit words | | ------------------ | | | | 12| 324k|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [Folded, False: 324k] | | | | ------------------ | | ------------------ ------------------ | Branch (142:26): [True: 324k, False: 360] ------------------ 143| 324k| val = 0; 144| 46.7M| for (uint32_t j = 0; j < weight; j++) { ------------------ | Branch (144:30): [True: 46.3M, False: 324k] ------------------ 145| 46.3M| uint32_t tmp = i - index_tab[j]; 146| 46.3M| int val1 = 1 ^ ((tmp | -tmp) >> 31); 147| 46.3M| uint64_t mask = -val1; 148| 46.3M| val |= (bit_tab[j] & mask); 149| 46.3M| } 150| 324k| v[i] |= val; 151| 324k| } 152| 360|} PQCHQC_HQC5_C_vect_sample_fixed_weight1: 169| 120|void vect_sample_fixed_weight1(shake256_xof_ctx *ctx, uint64_t *v, uint16_t weight) { 170| 120| uint32_t support[PARAM_OMEGA_R] = {0}; 171| 120| vect_generate_random_support1(ctx, support, weight); ------------------ | | 13| 120|#define vect_generate_random_support1 PQCHQC_NAMESPACE(vect_generate_random_support1) | | ------------------ | | | | 17| 120|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 120|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 120|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 172| 120| vect_write_support_to_vector(v, support, weight); ------------------ | | 15| 120|#define vect_write_support_to_vector PQCHQC_NAMESPACE(vect_write_support_to_vector) | | ------------------ | | | | 17| 120|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 120|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 120|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 173| 120|} PQCHQC_HQC5_C_vect_sample_fixed_weight2: 188| 240|void vect_sample_fixed_weight2(shake256_xof_ctx *ctx, uint64_t *v, uint16_t weight) { 189| 240| uint32_t support[PARAM_OMEGA_R] = {0}; 190| 240| vect_generate_random_support2(ctx, support, weight); ------------------ | | 14| 240|#define vect_generate_random_support2 PQCHQC_NAMESPACE(vect_generate_random_support2) | | ------------------ | | | | 17| 240|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 240|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 240|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 191| 240| vect_write_support_to_vector(v, support, weight); ------------------ | | 15| 240|#define vect_write_support_to_vector PQCHQC_NAMESPACE(vect_write_support_to_vector) | | ------------------ | | | | 17| 240|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 240|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 240|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 192| 240|} PQCHQC_HQC5_C_vect_set_random: 203| 120|void vect_set_random(shake256_xof_ctx *ctx, uint64_t *v) { 204| 120| xof_get_bytes(ctx, (uint8_t *)v, VEC_N_SIZE_BYTES); ------------------ | | 75| 120|#define xof_get_bytes PQCHQC_NAMESPACE(xof_get_bytes) | | ------------------ | | | | 17| 120|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 120|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 120|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ xof_get_bytes(ctx, (uint8_t *)v, VEC_N_SIZE_BYTES); ------------------ | | 31| 120|#define VEC_N_SIZE_BYTES CEIL_DIVIDE(PARAM_N, 8) ///< Size of array to store PARAM_N bits in bytes | | ------------------ | | | | 12| 120|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [Folded, False: 120] | | | | ------------------ | | ------------------ ------------------ 205| 120| v[VEC_N_SIZE_64 - 1] &= BITMASK(PARAM_N, 64); ------------------ | | 36| 120|#define VEC_N_SIZE_64 CEIL_DIVIDE(PARAM_N, 64) ///< Size of array to store PARAM_N bits in 64-bit words | | ------------------ | | | | 12| 120|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [Folded, False: 120] | | | | ------------------ | | ------------------ ------------------ v[VEC_N_SIZE_64 - 1] &= BITMASK(PARAM_N, 64); ------------------ | | 13| 120|#define BITMASK(a, size) ((((uint64_t) 1UL) << (a % size)) - 1) /*!< Create a mask*/ ------------------ 206| 120|} PQCHQC_HQC5_C_vect_add: 216| 320|void vect_add(uint64_t *o, const uint64_t *v1, const uint64_t *v2, uint32_t size) { 217| 288k| for (uint32_t i = 0; i < size; ++i) { ------------------ | Branch (217:26): [True: 288k, False: 320] ------------------ 218| 288k| o[i] = v1[i] ^ v2[i]; 219| 288k| } 220| 320|} PQCHQC_HQC5_C_vect_compare: 233| 120|uint8_t vect_compare(const uint8_t *v1, const uint8_t *v2, uint32_t size) { 234| 120| uint16_t r = 0x0100; 235| | 236| 576k| for (size_t i = 0; i < size; i++) { ------------------ | Branch (236:24): [True: 576k, False: 120] ------------------ 237| 576k| r |= v1[i] ^ v2[i]; 238| 576k| } 239| | 240| 120| return (r - 1) >> 8; 241| 120|} PQCHQC_HQC5_C_vect_truncate: 249| 120|void vect_truncate(uint64_t *v) { 250| 120| size_t orig_words = (PARAM_N + 63) / 64; ------------------ | | 15| 120|#define PARAM_N 57637 ///< Define the parameter n of the scheme ------------------ 251| 120| size_t new_full_words = PARAM_N1N2 / 64; ------------------ | | 18| 120|#define PARAM_N1N2 57600 ///< Define the length in bits of the concatenated code ------------------ 252| 120| size_t remaining_bits = PARAM_N1N2 % 64; ------------------ | | 18| 120|#define PARAM_N1N2 57600 ///< Define the length in bits of the concatenated code ------------------ 253| | 254| | // Mask the last word if there's a partial word 255| 120| if (remaining_bits > 0) { ------------------ | Branch (255:9): [True: 0, False: 120] ------------------ 256| 0| uint64_t mask = (UINT64_C(1) << remaining_bits) - 1; 257| 0| v[new_full_words] &= mask; 258| 0| new_full_words++; // keep that partial word 259| 0| } 260| | 261| | // Zero out all subsequent words up to the original length 262| 240| for (size_t i = new_full_words; i < orig_words; i++) { ------------------ | Branch (262:37): [True: 120, False: 120] ------------------ 263| 120| v[i] = 0; 264| 120| } 265| 120|} OQS_KEM_alg_identifier: 14| 1.87k|OQS_API const char *OQS_KEM_alg_identifier(size_t i) { 15| | // EDIT-WHEN-ADDING-KEM 16| 1.87k| const char *a[OQS_KEM_algs_length] = { 17| 1.87k| OQS_KEM_alg_bike_l1, ------------------ | | 35| 1.87k|#define OQS_KEM_alg_bike_l1 "BIKE-L1" ------------------ 18| 1.87k| OQS_KEM_alg_bike_l3, ------------------ | | 37| 1.87k|#define OQS_KEM_alg_bike_l3 "BIKE-L3" ------------------ 19| 1.87k| OQS_KEM_alg_bike_l5, ------------------ | | 39| 1.87k|#define OQS_KEM_alg_bike_l5 "BIKE-L5" ------------------ 20| | ///// OQS_COPY_FROM_UPSTREAM_FRAGMENT_ALG_IDENTIFIER_START 21| 1.87k| OQS_KEM_alg_classic_mceliece_348864, ------------------ | | 42| 1.87k|#define OQS_KEM_alg_classic_mceliece_348864 "Classic-McEliece-348864" ------------------ 22| 1.87k| OQS_KEM_alg_classic_mceliece_348864f, ------------------ | | 44| 1.87k|#define OQS_KEM_alg_classic_mceliece_348864f "Classic-McEliece-348864f" ------------------ 23| 1.87k| OQS_KEM_alg_classic_mceliece_460896, ------------------ | | 46| 1.87k|#define OQS_KEM_alg_classic_mceliece_460896 "Classic-McEliece-460896" ------------------ 24| 1.87k| OQS_KEM_alg_classic_mceliece_460896f, ------------------ | | 48| 1.87k|#define OQS_KEM_alg_classic_mceliece_460896f "Classic-McEliece-460896f" ------------------ 25| 1.87k| OQS_KEM_alg_classic_mceliece_6688128, ------------------ | | 50| 1.87k|#define OQS_KEM_alg_classic_mceliece_6688128 "Classic-McEliece-6688128" ------------------ 26| 1.87k| OQS_KEM_alg_classic_mceliece_6688128f, ------------------ | | 52| 1.87k|#define OQS_KEM_alg_classic_mceliece_6688128f "Classic-McEliece-6688128f" ------------------ 27| 1.87k| OQS_KEM_alg_classic_mceliece_6960119, ------------------ | | 54| 1.87k|#define OQS_KEM_alg_classic_mceliece_6960119 "Classic-McEliece-6960119" ------------------ 28| 1.87k| OQS_KEM_alg_classic_mceliece_6960119f, ------------------ | | 56| 1.87k|#define OQS_KEM_alg_classic_mceliece_6960119f "Classic-McEliece-6960119f" ------------------ 29| 1.87k| OQS_KEM_alg_classic_mceliece_8192128, ------------------ | | 58| 1.87k|#define OQS_KEM_alg_classic_mceliece_8192128 "Classic-McEliece-8192128" ------------------ 30| 1.87k| OQS_KEM_alg_classic_mceliece_8192128f, ------------------ | | 60| 1.87k|#define OQS_KEM_alg_classic_mceliece_8192128f "Classic-McEliece-8192128f" ------------------ 31| 1.87k| OQS_KEM_alg_hqc_1, ------------------ | | 62| 1.87k|#define OQS_KEM_alg_hqc_1 "HQC-1" ------------------ 32| 1.87k| OQS_KEM_alg_hqc_3, ------------------ | | 64| 1.87k|#define OQS_KEM_alg_hqc_3 "HQC-3" ------------------ 33| 1.87k| OQS_KEM_alg_hqc_5, ------------------ | | 66| 1.87k|#define OQS_KEM_alg_hqc_5 "HQC-5" ------------------ 34| 1.87k| OQS_KEM_alg_kyber_512, ------------------ | | 68| 1.87k|#define OQS_KEM_alg_kyber_512 "Kyber512" ------------------ 35| 1.87k| OQS_KEM_alg_kyber_768, ------------------ | | 70| 1.87k|#define OQS_KEM_alg_kyber_768 "Kyber768" ------------------ 36| 1.87k| OQS_KEM_alg_kyber_1024, ------------------ | | 72| 1.87k|#define OQS_KEM_alg_kyber_1024 "Kyber1024" ------------------ 37| 1.87k| OQS_KEM_alg_ml_kem_512, ------------------ | | 74| 1.87k|#define OQS_KEM_alg_ml_kem_512 "ML-KEM-512" ------------------ 38| 1.87k| OQS_KEM_alg_ml_kem_768, ------------------ | | 76| 1.87k|#define OQS_KEM_alg_ml_kem_768 "ML-KEM-768" ------------------ 39| 1.87k| OQS_KEM_alg_ml_kem_1024, ------------------ | | 78| 1.87k|#define OQS_KEM_alg_ml_kem_1024 "ML-KEM-1024" ------------------ 40| | ///// OQS_COPY_FROM_UPSTREAM_FRAGMENT_ALG_IDENTIFIER_END 41| 1.87k| OQS_KEM_alg_ntru_hps2048509, ------------------ | | 81| 1.87k|#define OQS_KEM_alg_ntru_hps2048509 "NTRU-HPS-2048-509" ------------------ 42| 1.87k| OQS_KEM_alg_ntru_hps2048677, ------------------ | | 83| 1.87k|#define OQS_KEM_alg_ntru_hps2048677 "NTRU-HPS-2048-677" ------------------ 43| 1.87k| OQS_KEM_alg_ntru_hps4096821, ------------------ | | 85| 1.87k|#define OQS_KEM_alg_ntru_hps4096821 "NTRU-HPS-4096-821" ------------------ 44| 1.87k| OQS_KEM_alg_ntru_hps40961229, ------------------ | | 87| 1.87k|#define OQS_KEM_alg_ntru_hps40961229 "NTRU-HPS-4096-1229" ------------------ 45| 1.87k| OQS_KEM_alg_ntru_hrss701, ------------------ | | 89| 1.87k|#define OQS_KEM_alg_ntru_hrss701 "NTRU-HRSS-701" ------------------ 46| 1.87k| OQS_KEM_alg_ntru_hrss1373, ------------------ | | 91| 1.87k|#define OQS_KEM_alg_ntru_hrss1373 "NTRU-HRSS-1373" ------------------ 47| 1.87k| OQS_KEM_alg_ntruprime_sntrup761, ------------------ | | 93| 1.87k|#define OQS_KEM_alg_ntruprime_sntrup761 "sntrup761" ------------------ 48| 1.87k| OQS_KEM_alg_frodokem_640_aes, ------------------ | | 95| 1.87k|#define OQS_KEM_alg_frodokem_640_aes "FrodoKEM-640-AES" ------------------ 49| 1.87k| OQS_KEM_alg_frodokem_640_shake, ------------------ | | 97| 1.87k|#define OQS_KEM_alg_frodokem_640_shake "FrodoKEM-640-SHAKE" ------------------ 50| 1.87k| OQS_KEM_alg_frodokem_976_aes, ------------------ | | 99| 1.87k|#define OQS_KEM_alg_frodokem_976_aes "FrodoKEM-976-AES" ------------------ 51| 1.87k| OQS_KEM_alg_frodokem_976_shake, ------------------ | | 101| 1.87k|#define OQS_KEM_alg_frodokem_976_shake "FrodoKEM-976-SHAKE" ------------------ 52| 1.87k| OQS_KEM_alg_frodokem_1344_aes, ------------------ | | 103| 1.87k|#define OQS_KEM_alg_frodokem_1344_aes "FrodoKEM-1344-AES" ------------------ 53| 1.87k| OQS_KEM_alg_frodokem_1344_shake, ------------------ | | 105| 1.87k|#define OQS_KEM_alg_frodokem_1344_shake "FrodoKEM-1344-SHAKE" ------------------ 54| 1.87k| OQS_KEM_alg_efrodokem_640_aes, ------------------ | | 107| 1.87k|#define OQS_KEM_alg_efrodokem_640_aes "eFrodoKEM-640-AES" ------------------ 55| 1.87k| OQS_KEM_alg_efrodokem_640_shake, ------------------ | | 109| 1.87k|#define OQS_KEM_alg_efrodokem_640_shake "eFrodoKEM-640-SHAKE" ------------------ 56| 1.87k| OQS_KEM_alg_efrodokem_976_aes, ------------------ | | 111| 1.87k|#define OQS_KEM_alg_efrodokem_976_aes "eFrodoKEM-976-AES" ------------------ 57| 1.87k| OQS_KEM_alg_efrodokem_976_shake, ------------------ | | 113| 1.87k|#define OQS_KEM_alg_efrodokem_976_shake "eFrodoKEM-976-SHAKE" ------------------ 58| 1.87k| OQS_KEM_alg_efrodokem_1344_aes, ------------------ | | 115| 1.87k|#define OQS_KEM_alg_efrodokem_1344_aes "eFrodoKEM-1344-AES" ------------------ 59| 1.87k| OQS_KEM_alg_efrodokem_1344_shake, ------------------ | | 117| 1.87k|#define OQS_KEM_alg_efrodokem_1344_shake "eFrodoKEM-1344-SHAKE" ------------------ 60| 1.87k| }; 61| 1.87k| if (i >= OQS_KEM_algs_length) { ------------------ | | 122| 1.87k|#define OQS_KEM_algs_length 41 ------------------ | Branch (61:6): [True: 0, False: 1.87k] ------------------ 62| 0| return NULL; 63| 1.87k| } else { 64| 1.87k| return a[i]; 65| 1.87k| } 66| 1.87k|} OQS_KEM_new: 348| 1.87k|OQS_API OQS_KEM *OQS_KEM_new(const char *method_name) { 349| 1.87k| if (method_name == NULL) { ------------------ | Branch (349:6): [True: 0, False: 1.87k] ------------------ 350| 0| return NULL; 351| 0| } 352| 1.87k| if (0 == strcasecmp(method_name, OQS_KEM_alg_bike_l1)) { ------------------ | | 35| 1.87k|#define OQS_KEM_alg_bike_l1 "BIKE-L1" ------------------ | Branch (352:6): [True: 5, False: 1.87k] ------------------ 353| 5|#ifdef OQS_ENABLE_KEM_bike_l1 354| 5| return OQS_KEM_bike_l1_new(); 355| |#else 356| | return NULL; 357| |#endif 358| 1.87k| } else if (0 == strcasecmp(method_name, OQS_KEM_alg_bike_l3)) { ------------------ | | 37| 1.87k|#define OQS_KEM_alg_bike_l3 "BIKE-L3" ------------------ | Branch (358:13): [True: 1, False: 1.87k] ------------------ 359| 1|#ifdef OQS_ENABLE_KEM_bike_l3 360| 1| return OQS_KEM_bike_l3_new(); 361| |#else 362| | return NULL; 363| |#endif 364| 1.87k| } else if (0 == strcasecmp(method_name, OQS_KEM_alg_bike_l5)) { ------------------ | | 39| 1.87k|#define OQS_KEM_alg_bike_l5 "BIKE-L5" ------------------ | Branch (364:13): [True: 1, False: 1.87k] ------------------ 365| 1|#ifdef OQS_ENABLE_KEM_bike_l5 366| 1| return OQS_KEM_bike_l5_new(); 367| |#else 368| | return NULL; 369| |#endif 370| | ///// OQS_COPY_FROM_UPSTREAM_FRAGMENT_NEW_CASE_START 371| 1.87k| } else if (0 == strcasecmp(method_name, OQS_KEM_alg_classic_mceliece_348864)) { ------------------ | | 42| 1.87k|#define OQS_KEM_alg_classic_mceliece_348864 "Classic-McEliece-348864" ------------------ | Branch (371:13): [True: 98, False: 1.77k] ------------------ 372| 98|#ifdef OQS_ENABLE_KEM_classic_mceliece_348864 373| 98| return OQS_KEM_classic_mceliece_348864_new(); 374| |#else 375| | return NULL; 376| |#endif 377| | 378| 1.77k| } else if (0 == strcasecmp(method_name, OQS_KEM_alg_classic_mceliece_348864f)) { ------------------ | | 44| 1.77k|#define OQS_KEM_alg_classic_mceliece_348864f "Classic-McEliece-348864f" ------------------ | Branch (378:13): [True: 83, False: 1.69k] ------------------ 379| 83|#ifdef OQS_ENABLE_KEM_classic_mceliece_348864f 380| 83| return OQS_KEM_classic_mceliece_348864f_new(); 381| |#else 382| | return NULL; 383| |#endif 384| | 385| 1.69k| } else if (0 == strcasecmp(method_name, OQS_KEM_alg_classic_mceliece_460896)) { ------------------ | | 46| 1.69k|#define OQS_KEM_alg_classic_mceliece_460896 "Classic-McEliece-460896" ------------------ | Branch (385:13): [True: 111, False: 1.58k] ------------------ 386| 111|#ifdef OQS_ENABLE_KEM_classic_mceliece_460896 387| 111| return OQS_KEM_classic_mceliece_460896_new(); 388| |#else 389| | return NULL; 390| |#endif 391| | 392| 1.58k| } else if (0 == strcasecmp(method_name, OQS_KEM_alg_classic_mceliece_460896f)) { ------------------ | | 48| 1.58k|#define OQS_KEM_alg_classic_mceliece_460896f "Classic-McEliece-460896f" ------------------ | Branch (392:13): [True: 88, False: 1.49k] ------------------ 393| 88|#ifdef OQS_ENABLE_KEM_classic_mceliece_460896f 394| 88| return OQS_KEM_classic_mceliece_460896f_new(); 395| |#else 396| | return NULL; 397| |#endif 398| | 399| 1.49k| } else if (0 == strcasecmp(method_name, OQS_KEM_alg_classic_mceliece_6688128)) { ------------------ | | 50| 1.49k|#define OQS_KEM_alg_classic_mceliece_6688128 "Classic-McEliece-6688128" ------------------ | Branch (399:13): [True: 111, False: 1.38k] ------------------ 400| 111|#ifdef OQS_ENABLE_KEM_classic_mceliece_6688128 401| 111| return OQS_KEM_classic_mceliece_6688128_new(); 402| |#else 403| | return NULL; 404| |#endif 405| | 406| 1.38k| } else if (0 == strcasecmp(method_name, OQS_KEM_alg_classic_mceliece_6688128f)) { ------------------ | | 52| 1.38k|#define OQS_KEM_alg_classic_mceliece_6688128f "Classic-McEliece-6688128f" ------------------ | Branch (406:13): [True: 92, False: 1.28k] ------------------ 407| 92|#ifdef OQS_ENABLE_KEM_classic_mceliece_6688128f 408| 92| return OQS_KEM_classic_mceliece_6688128f_new(); 409| |#else 410| | return NULL; 411| |#endif 412| | 413| 1.28k| } else if (0 == strcasecmp(method_name, OQS_KEM_alg_classic_mceliece_6960119)) { ------------------ | | 54| 1.28k|#define OQS_KEM_alg_classic_mceliece_6960119 "Classic-McEliece-6960119" ------------------ | Branch (413:13): [True: 109, False: 1.18k] ------------------ 414| 109|#ifdef OQS_ENABLE_KEM_classic_mceliece_6960119 415| 109| return OQS_KEM_classic_mceliece_6960119_new(); 416| |#else 417| | return NULL; 418| |#endif 419| | 420| 1.18k| } else if (0 == strcasecmp(method_name, OQS_KEM_alg_classic_mceliece_6960119f)) { ------------------ | | 56| 1.18k|#define OQS_KEM_alg_classic_mceliece_6960119f "Classic-McEliece-6960119f" ------------------ | Branch (420:13): [True: 99, False: 1.08k] ------------------ 421| 99|#ifdef OQS_ENABLE_KEM_classic_mceliece_6960119f 422| 99| return OQS_KEM_classic_mceliece_6960119f_new(); 423| |#else 424| | return NULL; 425| |#endif 426| | 427| 1.08k| } else if (0 == strcasecmp(method_name, OQS_KEM_alg_classic_mceliece_8192128)) { ------------------ | | 58| 1.08k|#define OQS_KEM_alg_classic_mceliece_8192128 "Classic-McEliece-8192128" ------------------ | Branch (427:13): [True: 91, False: 990] ------------------ 428| 91|#ifdef OQS_ENABLE_KEM_classic_mceliece_8192128 429| 91| return OQS_KEM_classic_mceliece_8192128_new(); 430| |#else 431| | return NULL; 432| |#endif 433| | 434| 990| } else if (0 == strcasecmp(method_name, OQS_KEM_alg_classic_mceliece_8192128f)) { ------------------ | | 60| 990|#define OQS_KEM_alg_classic_mceliece_8192128f "Classic-McEliece-8192128f" ------------------ | Branch (434:13): [True: 69, False: 921] ------------------ 435| 69|#ifdef OQS_ENABLE_KEM_classic_mceliece_8192128f 436| 69| return OQS_KEM_classic_mceliece_8192128f_new(); 437| |#else 438| | return NULL; 439| |#endif 440| | 441| 921| } else if (0 == strcasecmp(method_name, OQS_KEM_alg_hqc_1)) { ------------------ | | 62| 921|#define OQS_KEM_alg_hqc_1 "HQC-1" ------------------ | Branch (441:13): [True: 38, False: 883] ------------------ 442| 38|#ifdef OQS_ENABLE_KEM_hqc_1 443| 38| return OQS_KEM_hqc_1_new(); 444| |#else 445| | return NULL; 446| |#endif 447| | 448| 883| } else if (0 == strcasecmp(method_name, OQS_KEM_alg_hqc_3)) { ------------------ | | 64| 883|#define OQS_KEM_alg_hqc_3 "HQC-3" ------------------ | Branch (448:13): [True: 44, False: 839] ------------------ 449| 44|#ifdef OQS_ENABLE_KEM_hqc_3 450| 44| return OQS_KEM_hqc_3_new(); 451| |#else 452| | return NULL; 453| |#endif 454| | 455| 839| } else if (0 == strcasecmp(method_name, OQS_KEM_alg_hqc_5)) { ------------------ | | 66| 839|#define OQS_KEM_alg_hqc_5 "HQC-5" ------------------ | Branch (455:13): [True: 40, False: 799] ------------------ 456| 40|#ifdef OQS_ENABLE_KEM_hqc_5 457| 40| return OQS_KEM_hqc_5_new(); 458| |#else 459| | return NULL; 460| |#endif 461| | 462| 799| } else if (0 == strcasecmp(method_name, OQS_KEM_alg_kyber_512)) { ------------------ | | 68| 799|#define OQS_KEM_alg_kyber_512 "Kyber512" ------------------ | Branch (462:13): [True: 59, False: 740] ------------------ 463| 59|#ifdef OQS_ENABLE_KEM_kyber_512 464| 59| return OQS_KEM_kyber_512_new(); 465| |#else 466| | return NULL; 467| |#endif 468| | 469| 740| } else if (0 == strcasecmp(method_name, OQS_KEM_alg_kyber_768)) { ------------------ | | 70| 740|#define OQS_KEM_alg_kyber_768 "Kyber768" ------------------ | Branch (469:13): [True: 128, False: 612] ------------------ 470| 128|#ifdef OQS_ENABLE_KEM_kyber_768 471| 128| return OQS_KEM_kyber_768_new(); 472| |#else 473| | return NULL; 474| |#endif 475| | 476| 612| } else if (0 == strcasecmp(method_name, OQS_KEM_alg_kyber_1024)) { ------------------ | | 72| 612|#define OQS_KEM_alg_kyber_1024 "Kyber1024" ------------------ | Branch (476:13): [True: 87, False: 525] ------------------ 477| 87|#ifdef OQS_ENABLE_KEM_kyber_1024 478| 87| return OQS_KEM_kyber_1024_new(); 479| |#else 480| | return NULL; 481| |#endif 482| | 483| 525| } else if (0 == strcasecmp(method_name, OQS_KEM_alg_ml_kem_512)) { ------------------ | | 74| 525|#define OQS_KEM_alg_ml_kem_512 "ML-KEM-512" ------------------ | Branch (483:13): [True: 30, False: 495] ------------------ 484| 30|#ifdef OQS_ENABLE_KEM_ml_kem_512 485| 30| return OQS_KEM_ml_kem_512_new(); 486| |#else 487| | return NULL; 488| |#endif 489| | 490| 495| } else if (0 == strcasecmp(method_name, OQS_KEM_alg_ml_kem_768)) { ------------------ | | 76| 495|#define OQS_KEM_alg_ml_kem_768 "ML-KEM-768" ------------------ | Branch (490:13): [True: 34, False: 461] ------------------ 491| 34|#ifdef OQS_ENABLE_KEM_ml_kem_768 492| 34| return OQS_KEM_ml_kem_768_new(); 493| |#else 494| | return NULL; 495| |#endif 496| | 497| 461| } else if (0 == strcasecmp(method_name, OQS_KEM_alg_ml_kem_1024)) { ------------------ | | 78| 461|#define OQS_KEM_alg_ml_kem_1024 "ML-KEM-1024" ------------------ | Branch (497:13): [True: 24, False: 437] ------------------ 498| 24|#ifdef OQS_ENABLE_KEM_ml_kem_1024 499| 24| return OQS_KEM_ml_kem_1024_new(); 500| |#else 501| | return NULL; 502| |#endif 503| | 504| | ///// OQS_COPY_FROM_UPSTREAM_FRAGMENT_NEW_CASE_END 505| 437| } else if (0 == strcasecmp(method_name, OQS_KEM_alg_ntru_hps2048509)) { ------------------ | | 81| 437|#define OQS_KEM_alg_ntru_hps2048509 "NTRU-HPS-2048-509" ------------------ | Branch (505:13): [True: 182, False: 255] ------------------ 506| 182|#ifdef OQS_ENABLE_KEM_ntru_hps2048509 507| 182| return OQS_KEM_ntru_hps2048509_new(); 508| |#else 509| | return NULL; 510| |#endif 511| 255| } else if (0 == strcasecmp(method_name, OQS_KEM_alg_ntru_hps2048677)) { ------------------ | | 83| 255|#define OQS_KEM_alg_ntru_hps2048677 "NTRU-HPS-2048-677" ------------------ | Branch (511:13): [True: 14, False: 241] ------------------ 512| 14|#ifdef OQS_ENABLE_KEM_ntru_hps2048677 513| 14| return OQS_KEM_ntru_hps2048677_new(); 514| |#else 515| | return NULL; 516| |#endif 517| 241| } else if (0 == strcasecmp(method_name, OQS_KEM_alg_ntru_hps4096821)) { ------------------ | | 85| 241|#define OQS_KEM_alg_ntru_hps4096821 "NTRU-HPS-4096-821" ------------------ | Branch (517:13): [True: 89, False: 152] ------------------ 518| 89|#ifdef OQS_ENABLE_KEM_ntru_hps4096821 519| 89| return OQS_KEM_ntru_hps4096821_new(); 520| |#else 521| | return NULL; 522| |#endif 523| 152| } else if (0 == strcasecmp(method_name, OQS_KEM_alg_ntru_hps40961229)) { ------------------ | | 87| 152|#define OQS_KEM_alg_ntru_hps40961229 "NTRU-HPS-4096-1229" ------------------ | Branch (523:13): [True: 42, False: 110] ------------------ 524| 42|#ifdef OQS_ENABLE_KEM_ntru_hps40961229 525| 42| return OQS_KEM_ntru_hps40961229_new(); 526| |#else 527| | return NULL; 528| |#endif 529| 110| } else if (0 == strcasecmp(method_name, OQS_KEM_alg_ntru_hrss701)) { ------------------ | | 89| 110|#define OQS_KEM_alg_ntru_hrss701 "NTRU-HRSS-701" ------------------ | Branch (529:13): [True: 6, False: 104] ------------------ 530| 6|#ifdef OQS_ENABLE_KEM_ntru_hrss701 531| 6| return OQS_KEM_ntru_hrss701_new(); 532| |#else 533| | return NULL; 534| |#endif 535| 104| } else if (0 == strcasecmp(method_name, OQS_KEM_alg_ntru_hrss1373)) { ------------------ | | 91| 104|#define OQS_KEM_alg_ntru_hrss1373 "NTRU-HRSS-1373" ------------------ | Branch (535:13): [True: 3, False: 101] ------------------ 536| 3|#ifdef OQS_ENABLE_KEM_ntru_hrss1373 537| 3| return OQS_KEM_ntru_hrss1373_new(); 538| |#else 539| | return NULL; 540| |#endif 541| 101| } else if (0 == strcasecmp(method_name, OQS_KEM_alg_ntruprime_sntrup761)) { ------------------ | | 93| 101|#define OQS_KEM_alg_ntruprime_sntrup761 "sntrup761" ------------------ | Branch (541:13): [True: 10, False: 91] ------------------ 542| 10|#ifdef OQS_ENABLE_KEM_ntruprime_sntrup761 543| 10| return OQS_KEM_ntruprime_sntrup761_new(); 544| |#else 545| | return NULL; 546| |#endif 547| 91| } else if (0 == strcasecmp(method_name, OQS_KEM_alg_frodokem_640_aes)) { ------------------ | | 95| 91|#define OQS_KEM_alg_frodokem_640_aes "FrodoKEM-640-AES" ------------------ | Branch (547:13): [True: 2, False: 89] ------------------ 548| 2|#ifdef OQS_ENABLE_KEM_frodokem_640_aes 549| 2| return OQS_KEM_frodokem_640_aes_new(); 550| |#else 551| | return NULL; 552| |#endif 553| 89| } else if (0 == strcasecmp(method_name, OQS_KEM_alg_frodokem_640_shake)) { ------------------ | | 97| 89|#define OQS_KEM_alg_frodokem_640_shake "FrodoKEM-640-SHAKE" ------------------ | Branch (553:13): [True: 3, False: 86] ------------------ 554| 3|#ifdef OQS_ENABLE_KEM_frodokem_640_shake 555| 3| return OQS_KEM_frodokem_640_shake_new(); 556| |#else 557| | return NULL; 558| |#endif 559| 86| } else if (0 == strcasecmp(method_name, OQS_KEM_alg_frodokem_976_aes)) { ------------------ | | 99| 86|#define OQS_KEM_alg_frodokem_976_aes "FrodoKEM-976-AES" ------------------ | Branch (559:13): [True: 15, False: 71] ------------------ 560| 15|#ifdef OQS_ENABLE_KEM_frodokem_976_aes 561| 15| return OQS_KEM_frodokem_976_aes_new(); 562| |#else 563| | return NULL; 564| |#endif 565| 71| } else if (0 == strcasecmp(method_name, OQS_KEM_alg_frodokem_976_shake)) { ------------------ | | 101| 71|#define OQS_KEM_alg_frodokem_976_shake "FrodoKEM-976-SHAKE" ------------------ | Branch (565:13): [True: 11, False: 60] ------------------ 566| 11|#ifdef OQS_ENABLE_KEM_frodokem_976_shake 567| 11| return OQS_KEM_frodokem_976_shake_new(); 568| |#else 569| | return NULL; 570| |#endif 571| 60| } else if (0 == strcasecmp(method_name, OQS_KEM_alg_frodokem_1344_aes)) { ------------------ | | 103| 60|#define OQS_KEM_alg_frodokem_1344_aes "FrodoKEM-1344-AES" ------------------ | Branch (571:13): [True: 8, False: 52] ------------------ 572| 8|#ifdef OQS_ENABLE_KEM_frodokem_1344_aes 573| 8| return OQS_KEM_frodokem_1344_aes_new(); 574| |#else 575| | return NULL; 576| |#endif 577| 52| } else if (0 == strcasecmp(method_name, OQS_KEM_alg_frodokem_1344_shake)) { ------------------ | | 105| 52|#define OQS_KEM_alg_frodokem_1344_shake "FrodoKEM-1344-SHAKE" ------------------ | Branch (577:13): [True: 9, False: 43] ------------------ 578| 9|#ifdef OQS_ENABLE_KEM_frodokem_1344_shake 579| 9| return OQS_KEM_frodokem_1344_shake_new(); 580| |#else 581| | return NULL; 582| |#endif 583| 43| } else if (0 == strcasecmp(method_name, OQS_KEM_alg_efrodokem_640_aes)) { ------------------ | | 107| 43|#define OQS_KEM_alg_efrodokem_640_aes "eFrodoKEM-640-AES" ------------------ | Branch (583:13): [True: 4, False: 39] ------------------ 584| 4|#ifdef OQS_ENABLE_KEM_efrodokem_640_aes 585| 4| return OQS_KEM_efrodokem_640_aes_new(); 586| |#else 587| | return NULL; 588| |#endif 589| 39| } else if (0 == strcasecmp(method_name, OQS_KEM_alg_efrodokem_640_shake)) { ------------------ | | 109| 39|#define OQS_KEM_alg_efrodokem_640_shake "eFrodoKEM-640-SHAKE" ------------------ | Branch (589:13): [True: 2, False: 37] ------------------ 590| 2|#ifdef OQS_ENABLE_KEM_efrodokem_640_shake 591| 2| return OQS_KEM_efrodokem_640_shake_new(); 592| |#else 593| | return NULL; 594| |#endif 595| 37| } else if (0 == strcasecmp(method_name, OQS_KEM_alg_efrodokem_976_aes)) { ------------------ | | 111| 37|#define OQS_KEM_alg_efrodokem_976_aes "eFrodoKEM-976-AES" ------------------ | Branch (595:13): [True: 12, False: 25] ------------------ 596| 12|#ifdef OQS_ENABLE_KEM_efrodokem_976_aes 597| 12| return OQS_KEM_efrodokem_976_aes_new(); 598| |#else 599| | return NULL; 600| |#endif 601| 25| } else if (0 == strcasecmp(method_name, OQS_KEM_alg_efrodokem_976_shake)) { ------------------ | | 113| 25|#define OQS_KEM_alg_efrodokem_976_shake "eFrodoKEM-976-SHAKE" ------------------ | Branch (601:13): [True: 12, False: 13] ------------------ 602| 12|#ifdef OQS_ENABLE_KEM_efrodokem_976_shake 603| 12| return OQS_KEM_efrodokem_976_shake_new(); 604| |#else 605| | return NULL; 606| |#endif 607| 13| } else if (0 == strcasecmp(method_name, OQS_KEM_alg_efrodokem_1344_aes)) { ------------------ | | 115| 13|#define OQS_KEM_alg_efrodokem_1344_aes "eFrodoKEM-1344-AES" ------------------ | Branch (607:13): [True: 8, False: 5] ------------------ 608| 8|#ifdef OQS_ENABLE_KEM_efrodokem_1344_aes 609| 8| return OQS_KEM_efrodokem_1344_aes_new(); 610| |#else 611| | return NULL; 612| |#endif 613| 8| } else if (0 == strcasecmp(method_name, OQS_KEM_alg_efrodokem_1344_shake)) { ------------------ | | 117| 5|#define OQS_KEM_alg_efrodokem_1344_shake "eFrodoKEM-1344-SHAKE" ------------------ | Branch (613:13): [True: 5, False: 0] ------------------ 614| 5|#ifdef OQS_ENABLE_KEM_efrodokem_1344_shake 615| 5| return OQS_KEM_efrodokem_1344_shake_new(); 616| |#else 617| | return NULL; 618| |#endif 619| | // EDIT-WHEN-ADDING-KEM 620| 5| } else { 621| | return NULL; 622| 0| } 623| 1.87k|} OQS_KEM_keypair: 633| 1.87k|OQS_API OQS_STATUS OQS_KEM_keypair(const OQS_KEM *kem, uint8_t *public_key, uint8_t *secret_key) { 634| 1.87k| if (kem == NULL || kem->keypair == NULL) { ------------------ | Branch (634:6): [True: 0, False: 1.87k] | Branch (634:21): [True: 0, False: 1.87k] ------------------ 635| 0| return OQS_ERROR; 636| 1.87k| } else { 637| 1.87k| return kem->keypair(public_key, secret_key); 638| 1.87k| } 639| 1.87k|} OQS_KEM_encaps: 649| 1.87k|OQS_API OQS_STATUS OQS_KEM_encaps(const OQS_KEM *kem, uint8_t *ciphertext, uint8_t *shared_secret, const uint8_t *public_key) { 650| 1.87k| if (kem == NULL || kem->encaps == NULL) { ------------------ | Branch (650:6): [True: 0, False: 1.87k] | Branch (650:21): [True: 0, False: 1.87k] ------------------ 651| 0| return OQS_ERROR; 652| 1.87k| } else { 653| 1.87k| return kem->encaps(ciphertext, shared_secret, public_key); 654| 1.87k| } 655| 1.87k|} OQS_KEM_decaps: 657| 1.87k|OQS_API OQS_STATUS OQS_KEM_decaps(const OQS_KEM *kem, uint8_t *shared_secret, const uint8_t *ciphertext, const uint8_t *secret_key) { 658| 1.87k| if (kem == NULL || kem->decaps == NULL) { ------------------ | Branch (658:6): [True: 0, False: 1.87k] | Branch (658:21): [True: 0, False: 1.87k] ------------------ 659| 0| return OQS_ERROR; 660| 1.87k| } else { 661| 1.87k| return kem->decaps(shared_secret, ciphertext, secret_key); 662| 1.87k| } 663| 1.87k|} OQS_KEM_free: 665| 1.87k|OQS_API void OQS_KEM_free(OQS_KEM *kem) { 666| 1.87k| OQS_MEM_insecure_free(kem); 667| 1.87k|} OQS_KEM_kyber_1024_new: 9| 87|OQS_KEM *OQS_KEM_kyber_1024_new(void) { 10| | 11| 87| OQS_KEM *kem = OQS_MEM_calloc(1, sizeof(OQS_KEM)); 12| 87| if (kem == NULL) { ------------------ | Branch (12:6): [True: 0, False: 87] ------------------ 13| 0| return NULL; 14| 0| } 15| 87| kem->method_name = OQS_KEM_alg_kyber_1024; ------------------ | | 72| 87|#define OQS_KEM_alg_kyber_1024 "Kyber1024" ------------------ 16| 87| kem->alg_version = "https://github.com/pq-crystals/kyber/commit/28413dfbf523fdde181246451c2bd77199c0f7ff"; 17| | 18| 87| kem->claimed_nist_level = 5; 19| 87| kem->ind_cca = true; 20| | 21| 87| kem->length_public_key = OQS_KEM_kyber_1024_length_public_key; ------------------ | | 39| 87|#define OQS_KEM_kyber_1024_length_public_key 1568 ------------------ 22| 87| kem->length_secret_key = OQS_KEM_kyber_1024_length_secret_key; ------------------ | | 40| 87|#define OQS_KEM_kyber_1024_length_secret_key 3168 ------------------ 23| 87| kem->length_ciphertext = OQS_KEM_kyber_1024_length_ciphertext; ------------------ | | 41| 87|#define OQS_KEM_kyber_1024_length_ciphertext 1568 ------------------ 24| 87| kem->length_shared_secret = OQS_KEM_kyber_1024_length_shared_secret; ------------------ | | 42| 87|#define OQS_KEM_kyber_1024_length_shared_secret 32 ------------------ 25| 87| kem->length_keypair_seed = OQS_KEM_kyber_1024_length_keypair_seed; ------------------ | | 43| 87|#define OQS_KEM_kyber_1024_length_keypair_seed 0 ------------------ 26| 87| kem->length_encaps_seed = OQS_KEM_kyber_1024_length_encaps_seed; ------------------ | | 44| 87|#define OQS_KEM_kyber_1024_length_encaps_seed 0 ------------------ 27| | 28| 87| kem->keypair = OQS_KEM_kyber_1024_keypair; 29| 87| kem->keypair_derand = OQS_KEM_kyber_1024_keypair_derand; 30| 87| kem->encaps = OQS_KEM_kyber_1024_encaps; 31| 87| kem->encaps_derand = OQS_KEM_kyber_1024_encaps_derand; 32| 87| kem->decaps = OQS_KEM_kyber_1024_decaps; 33| | 34| 87| return kem; 35| 87|} OQS_KEM_kyber_1024_keypair: 60| 87|OQS_API OQS_STATUS OQS_KEM_kyber_1024_keypair(uint8_t *public_key, uint8_t *secret_key) { 61| 87|#if defined(OQS_ENABLE_KEM_kyber_1024_avx2) 62| 87|#if defined(OQS_DIST_BUILD) 63| 87| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2) && OQS_CPU_has_extension(OQS_CPU_EXT_BMI2) && OQS_CPU_has_extension(OQS_CPU_EXT_POPCNT)) { ------------------ | Branch (63:6): [True: 87, False: 0] | Branch (63:49): [True: 87, False: 0] | Branch (63:92): [True: 87, False: 0] ------------------ 64| 87|#endif /* OQS_DIST_BUILD */ 65| 87| return (OQS_STATUS) pqcrystals_kyber1024_avx2_keypair(public_key, secret_key); 66| 87|#if defined(OQS_DIST_BUILD) 67| 87| } else { 68| 0| return (OQS_STATUS) pqcrystals_kyber1024_ref_keypair(public_key, secret_key); 69| 0| } 70| 87|#endif /* OQS_DIST_BUILD */ 71| |#elif defined(OQS_ENABLE_KEM_kyber_1024_aarch64) 72| |#if defined(OQS_DIST_BUILD) 73| | if (OQS_CPU_has_extension(OQS_CPU_EXT_ARM_NEON)) { 74| |#endif /* OQS_DIST_BUILD */ 75| | return (OQS_STATUS) PQCLEAN_KYBER1024_AARCH64_crypto_kem_keypair(public_key, secret_key); 76| |#if defined(OQS_DIST_BUILD) 77| | } else { 78| | return (OQS_STATUS) pqcrystals_kyber1024_ref_keypair(public_key, secret_key); 79| | } 80| |#endif /* OQS_DIST_BUILD */ 81| |#else 82| | return (OQS_STATUS) pqcrystals_kyber1024_ref_keypair(public_key, secret_key); 83| |#endif 84| 87|} OQS_KEM_kyber_1024_encaps: 94| 87|OQS_API OQS_STATUS OQS_KEM_kyber_1024_encaps(uint8_t *ciphertext, uint8_t *shared_secret, const uint8_t *public_key) { 95| 87|#if defined(OQS_ENABLE_KEM_kyber_1024_avx2) 96| 87|#if defined(OQS_DIST_BUILD) 97| 87| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2) && OQS_CPU_has_extension(OQS_CPU_EXT_BMI2) && OQS_CPU_has_extension(OQS_CPU_EXT_POPCNT)) { ------------------ | Branch (97:6): [True: 87, False: 0] | Branch (97:49): [True: 87, False: 0] | Branch (97:92): [True: 87, False: 0] ------------------ 98| 87|#endif /* OQS_DIST_BUILD */ 99| 87| return (OQS_STATUS) pqcrystals_kyber1024_avx2_enc(ciphertext, shared_secret, public_key); 100| 87|#if defined(OQS_DIST_BUILD) 101| 87| } else { 102| 0| return (OQS_STATUS) pqcrystals_kyber1024_ref_enc(ciphertext, shared_secret, public_key); 103| 0| } 104| 87|#endif /* OQS_DIST_BUILD */ 105| |#elif defined(OQS_ENABLE_KEM_kyber_1024_aarch64) 106| |#if defined(OQS_DIST_BUILD) 107| | if (OQS_CPU_has_extension(OQS_CPU_EXT_ARM_NEON)) { 108| |#endif /* OQS_DIST_BUILD */ 109| | return (OQS_STATUS) PQCLEAN_KYBER1024_AARCH64_crypto_kem_enc(ciphertext, shared_secret, public_key); 110| |#if defined(OQS_DIST_BUILD) 111| | } else { 112| | return (OQS_STATUS) pqcrystals_kyber1024_ref_enc(ciphertext, shared_secret, public_key); 113| | } 114| |#endif /* OQS_DIST_BUILD */ 115| |#else 116| | return (OQS_STATUS) pqcrystals_kyber1024_ref_enc(ciphertext, shared_secret, public_key); 117| |#endif 118| 87|} OQS_KEM_kyber_1024_decaps: 120| 87|OQS_API OQS_STATUS OQS_KEM_kyber_1024_decaps(uint8_t *shared_secret, const uint8_t *ciphertext, const uint8_t *secret_key) { 121| 87|#if defined(OQS_ENABLE_KEM_kyber_1024_avx2) 122| 87|#if defined(OQS_DIST_BUILD) 123| 87| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2) && OQS_CPU_has_extension(OQS_CPU_EXT_BMI2) && OQS_CPU_has_extension(OQS_CPU_EXT_POPCNT)) { ------------------ | Branch (123:6): [True: 87, False: 0] | Branch (123:49): [True: 87, False: 0] | Branch (123:92): [True: 87, False: 0] ------------------ 124| 87|#endif /* OQS_DIST_BUILD */ 125| 87| return (OQS_STATUS) pqcrystals_kyber1024_avx2_dec(shared_secret, ciphertext, secret_key); 126| 87|#if defined(OQS_DIST_BUILD) 127| 87| } else { 128| 0| return (OQS_STATUS) pqcrystals_kyber1024_ref_dec(shared_secret, ciphertext, secret_key); 129| 0| } 130| 87|#endif /* OQS_DIST_BUILD */ 131| |#elif defined(OQS_ENABLE_KEM_kyber_1024_aarch64) 132| |#if defined(OQS_DIST_BUILD) 133| | if (OQS_CPU_has_extension(OQS_CPU_EXT_ARM_NEON)) { 134| |#endif /* OQS_DIST_BUILD */ 135| | return (OQS_STATUS) PQCLEAN_KYBER1024_AARCH64_crypto_kem_dec(shared_secret, ciphertext, secret_key); 136| |#if defined(OQS_DIST_BUILD) 137| | } else { 138| | return (OQS_STATUS) pqcrystals_kyber1024_ref_dec(shared_secret, ciphertext, secret_key); 139| | } 140| |#endif /* OQS_DIST_BUILD */ 141| |#else 142| | return (OQS_STATUS) pqcrystals_kyber1024_ref_dec(shared_secret, ciphertext, secret_key); 143| |#endif 144| 87|} OQS_KEM_kyber_512_new: 9| 59|OQS_KEM *OQS_KEM_kyber_512_new(void) { 10| | 11| 59| OQS_KEM *kem = OQS_MEM_calloc(1, sizeof(OQS_KEM)); 12| 59| if (kem == NULL) { ------------------ | Branch (12:6): [True: 0, False: 59] ------------------ 13| 0| return NULL; 14| 0| } 15| 59| kem->method_name = OQS_KEM_alg_kyber_512; ------------------ | | 68| 59|#define OQS_KEM_alg_kyber_512 "Kyber512" ------------------ 16| 59| kem->alg_version = "https://github.com/pq-crystals/kyber/commit/74cad307858b61e434490c75f812cb9b9ef7279b"; 17| | 18| 59| kem->claimed_nist_level = 1; 19| 59| kem->ind_cca = true; 20| | 21| 59| kem->length_public_key = OQS_KEM_kyber_512_length_public_key; ------------------ | | 9| 59|#define OQS_KEM_kyber_512_length_public_key 800 ------------------ 22| 59| kem->length_secret_key = OQS_KEM_kyber_512_length_secret_key; ------------------ | | 10| 59|#define OQS_KEM_kyber_512_length_secret_key 1632 ------------------ 23| 59| kem->length_ciphertext = OQS_KEM_kyber_512_length_ciphertext; ------------------ | | 11| 59|#define OQS_KEM_kyber_512_length_ciphertext 768 ------------------ 24| 59| kem->length_shared_secret = OQS_KEM_kyber_512_length_shared_secret; ------------------ | | 12| 59|#define OQS_KEM_kyber_512_length_shared_secret 32 ------------------ 25| 59| kem->length_keypair_seed = OQS_KEM_kyber_512_length_keypair_seed; ------------------ | | 13| 59|#define OQS_KEM_kyber_512_length_keypair_seed 0 ------------------ 26| 59| kem->length_encaps_seed = OQS_KEM_kyber_512_length_encaps_seed; ------------------ | | 14| 59|#define OQS_KEM_kyber_512_length_encaps_seed 0 ------------------ 27| | 28| 59| kem->keypair = OQS_KEM_kyber_512_keypair; 29| 59| kem->keypair_derand = OQS_KEM_kyber_512_keypair_derand; 30| 59| kem->encaps = OQS_KEM_kyber_512_encaps; 31| 59| kem->encaps_derand = OQS_KEM_kyber_512_encaps_derand; 32| 59| kem->decaps = OQS_KEM_kyber_512_decaps; 33| | 34| 59| return kem; 35| 59|} OQS_KEM_kyber_512_keypair: 73| 59|OQS_API OQS_STATUS OQS_KEM_kyber_512_keypair(uint8_t *public_key, uint8_t *secret_key) { 74| |#if defined(OQS_LIBJADE_BUILD) && (defined(OQS_ENABLE_LIBJADE_KEM_kyber_512)) 75| |#if defined(OQS_ENABLE_LIBJADE_KEM_kyber_512_avx2) 76| |#if defined(OQS_DIST_BUILD) 77| | if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2) && OQS_CPU_has_extension(OQS_CPU_EXT_BMI2) && OQS_CPU_has_extension(OQS_CPU_EXT_POPCNT)) { 78| |#endif /* OQS_DIST_BUILD */ 79| | return (OQS_STATUS) libjade_kyber512_avx2_keypair(public_key, secret_key); 80| |#if defined(OQS_DIST_BUILD) 81| | } else { 82| | return (OQS_STATUS) libjade_kyber512_ref_keypair(public_key, secret_key); 83| | } 84| |#endif /* OQS_DIST_BUILD */ 85| |#else 86| | return (OQS_STATUS) libjade_kyber512_ref_keypair(public_key, secret_key); 87| |#endif 88| |#else /*OQS_LIBJADE_BUILD && (OQS_ENABLE_LIBJADE_KEM_kyber_512)*/ 89| 59|#if defined(OQS_ENABLE_KEM_kyber_512_avx2) 90| 59|#if defined(OQS_DIST_BUILD) 91| 59| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2) && OQS_CPU_has_extension(OQS_CPU_EXT_BMI2) && OQS_CPU_has_extension(OQS_CPU_EXT_POPCNT)) { ------------------ | Branch (91:6): [True: 59, False: 0] | Branch (91:49): [True: 59, False: 0] | Branch (91:92): [True: 59, False: 0] ------------------ 92| 59|#endif /* OQS_DIST_BUILD */ 93| 59| return (OQS_STATUS) pqcrystals_kyber512_avx2_keypair(public_key, secret_key); 94| 59|#if defined(OQS_DIST_BUILD) 95| 59| } else { 96| 0| return (OQS_STATUS) pqcrystals_kyber512_ref_keypair(public_key, secret_key); 97| 0| } 98| 59|#endif /* OQS_DIST_BUILD */ 99| |#elif defined(OQS_ENABLE_KEM_kyber_512_aarch64) 100| |#if defined(OQS_DIST_BUILD) 101| | if (OQS_CPU_has_extension(OQS_CPU_EXT_ARM_NEON)) { 102| |#endif /* OQS_DIST_BUILD */ 103| | return (OQS_STATUS) PQCLEAN_KYBER512_AARCH64_crypto_kem_keypair(public_key, secret_key); 104| |#if defined(OQS_DIST_BUILD) 105| | } else { 106| | return (OQS_STATUS) pqcrystals_kyber512_ref_keypair(public_key, secret_key); 107| | } 108| |#endif /* OQS_DIST_BUILD */ 109| |#else 110| | return (OQS_STATUS) pqcrystals_kyber512_ref_keypair(public_key, secret_key); 111| |#endif 112| 59|#endif /* OQS_LIBJADE_BUILD */ 113| 59|} OQS_KEM_kyber_512_encaps: 123| 59|OQS_API OQS_STATUS OQS_KEM_kyber_512_encaps(uint8_t *ciphertext, uint8_t *shared_secret, const uint8_t *public_key) { 124| |#if defined(OQS_LIBJADE_BUILD) && (defined(OQS_ENABLE_LIBJADE_KEM_kyber_512)) 125| |#if defined(OQS_ENABLE_LIBJADE_KEM_kyber_512_avx2) 126| |#if defined(OQS_DIST_BUILD) 127| | if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2) && OQS_CPU_has_extension(OQS_CPU_EXT_BMI2) && OQS_CPU_has_extension(OQS_CPU_EXT_POPCNT)) { 128| |#endif /* OQS_DIST_BUILD */ 129| | return (OQS_STATUS) libjade_kyber512_avx2_enc(ciphertext, shared_secret, public_key); 130| |#if defined(OQS_DIST_BUILD) 131| | } else { 132| | return (OQS_STATUS) libjade_kyber512_ref_enc(ciphertext, shared_secret, public_key); 133| | } 134| |#endif /* OQS_DIST_BUILD */ 135| |#else 136| | return (OQS_STATUS) libjade_kyber512_ref_enc(ciphertext, shared_secret, public_key); 137| |#endif 138| |#else /*OQS_LIBJADE_BUILD && (OQS_ENABLE_LIBJADE_KEM_kyber_512)*/ 139| 59|#if defined(OQS_ENABLE_KEM_kyber_512_avx2) 140| 59|#if defined(OQS_DIST_BUILD) 141| 59| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2) && OQS_CPU_has_extension(OQS_CPU_EXT_BMI2) && OQS_CPU_has_extension(OQS_CPU_EXT_POPCNT)) { ------------------ | Branch (141:6): [True: 59, False: 0] | Branch (141:49): [True: 59, False: 0] | Branch (141:92): [True: 59, False: 0] ------------------ 142| 59|#endif /* OQS_DIST_BUILD */ 143| 59| return (OQS_STATUS) pqcrystals_kyber512_avx2_enc(ciphertext, shared_secret, public_key); 144| 59|#if defined(OQS_DIST_BUILD) 145| 59| } else { 146| 0| return (OQS_STATUS) pqcrystals_kyber512_ref_enc(ciphertext, shared_secret, public_key); 147| 0| } 148| 59|#endif /* OQS_DIST_BUILD */ 149| |#elif defined(OQS_ENABLE_KEM_kyber_512_aarch64) 150| |#if defined(OQS_DIST_BUILD) 151| | if (OQS_CPU_has_extension(OQS_CPU_EXT_ARM_NEON)) { 152| |#endif /* OQS_DIST_BUILD */ 153| | return (OQS_STATUS) PQCLEAN_KYBER512_AARCH64_crypto_kem_enc(ciphertext, shared_secret, public_key); 154| |#if defined(OQS_DIST_BUILD) 155| | } else { 156| | return (OQS_STATUS) pqcrystals_kyber512_ref_enc(ciphertext, shared_secret, public_key); 157| | } 158| |#endif /* OQS_DIST_BUILD */ 159| |#else 160| | return (OQS_STATUS) pqcrystals_kyber512_ref_enc(ciphertext, shared_secret, public_key); 161| |#endif 162| 59|#endif /* OQS_LIBJADE_BUILD */ 163| 59|} OQS_KEM_kyber_512_decaps: 165| 59|OQS_API OQS_STATUS OQS_KEM_kyber_512_decaps(uint8_t *shared_secret, const uint8_t *ciphertext, const uint8_t *secret_key) { 166| |#if defined(OQS_LIBJADE_BUILD) && (defined(OQS_ENABLE_LIBJADE_KEM_kyber_512)) 167| |#if defined(OQS_ENABLE_LIBJADE_KEM_kyber_512_avx2) 168| |#if defined(OQS_DIST_BUILD) 169| | if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2) && OQS_CPU_has_extension(OQS_CPU_EXT_BMI2) && OQS_CPU_has_extension(OQS_CPU_EXT_POPCNT)) { 170| |#endif /* OQS_DIST_BUILD */ 171| | return (OQS_STATUS) libjade_kyber512_avx2_dec(shared_secret, ciphertext, secret_key); 172| |#if defined(OQS_DIST_BUILD) 173| | } else { 174| | return (OQS_STATUS) libjade_kyber512_ref_dec(shared_secret, ciphertext, secret_key); 175| | } 176| |#endif /* OQS_DIST_BUILD */ 177| |#else 178| | return (OQS_STATUS) libjade_kyber512_ref_dec(shared_secret, ciphertext, secret_key); 179| |#endif 180| |#else /*OQS_LIBJADE_BUILD && (OQS_ENABLE_LIBJADE_KEM_kyber_512)*/ 181| 59|#if defined(OQS_ENABLE_KEM_kyber_512_avx2) 182| 59|#if defined(OQS_DIST_BUILD) 183| 59| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2) && OQS_CPU_has_extension(OQS_CPU_EXT_BMI2) && OQS_CPU_has_extension(OQS_CPU_EXT_POPCNT)) { ------------------ | Branch (183:6): [True: 59, False: 0] | Branch (183:49): [True: 59, False: 0] | Branch (183:92): [True: 59, False: 0] ------------------ 184| 59|#endif /* OQS_DIST_BUILD */ 185| 59| return (OQS_STATUS) pqcrystals_kyber512_avx2_dec(shared_secret, ciphertext, secret_key); 186| 59|#if defined(OQS_DIST_BUILD) 187| 59| } else { 188| 0| return (OQS_STATUS) pqcrystals_kyber512_ref_dec(shared_secret, ciphertext, secret_key); 189| 0| } 190| 59|#endif /* OQS_DIST_BUILD */ 191| |#elif defined(OQS_ENABLE_KEM_kyber_512_aarch64) 192| |#if defined(OQS_DIST_BUILD) 193| | if (OQS_CPU_has_extension(OQS_CPU_EXT_ARM_NEON)) { 194| |#endif /* OQS_DIST_BUILD */ 195| | return (OQS_STATUS) PQCLEAN_KYBER512_AARCH64_crypto_kem_dec(shared_secret, ciphertext, secret_key); 196| |#if defined(OQS_DIST_BUILD) 197| | } else { 198| | return (OQS_STATUS) pqcrystals_kyber512_ref_dec(shared_secret, ciphertext, secret_key); 199| | } 200| |#endif /* OQS_DIST_BUILD */ 201| |#else 202| | return (OQS_STATUS) pqcrystals_kyber512_ref_dec(shared_secret, ciphertext, secret_key); 203| |#endif 204| 59|#endif /* OQS_LIBJADE_BUILD */ 205| 59|} OQS_KEM_kyber_768_new: 9| 128|OQS_KEM *OQS_KEM_kyber_768_new(void) { 10| | 11| 128| OQS_KEM *kem = OQS_MEM_calloc(1, sizeof(OQS_KEM)); 12| 128| if (kem == NULL) { ------------------ | Branch (12:6): [True: 0, False: 128] ------------------ 13| 0| return NULL; 14| 0| } 15| 128| kem->method_name = OQS_KEM_alg_kyber_768; ------------------ | | 70| 128|#define OQS_KEM_alg_kyber_768 "Kyber768" ------------------ 16| 128| kem->alg_version = "https://github.com/pq-crystals/kyber/commit/28413dfbf523fdde181246451c2bd77199c0f7ff"; 17| | 18| 128| kem->claimed_nist_level = 3; 19| 128| kem->ind_cca = true; 20| | 21| 128| kem->length_public_key = OQS_KEM_kyber_768_length_public_key; ------------------ | | 24| 128|#define OQS_KEM_kyber_768_length_public_key 1184 ------------------ 22| 128| kem->length_secret_key = OQS_KEM_kyber_768_length_secret_key; ------------------ | | 25| 128|#define OQS_KEM_kyber_768_length_secret_key 2400 ------------------ 23| 128| kem->length_ciphertext = OQS_KEM_kyber_768_length_ciphertext; ------------------ | | 26| 128|#define OQS_KEM_kyber_768_length_ciphertext 1088 ------------------ 24| 128| kem->length_shared_secret = OQS_KEM_kyber_768_length_shared_secret; ------------------ | | 27| 128|#define OQS_KEM_kyber_768_length_shared_secret 32 ------------------ 25| 128| kem->length_keypair_seed = OQS_KEM_kyber_768_length_keypair_seed; ------------------ | | 28| 128|#define OQS_KEM_kyber_768_length_keypair_seed 0 ------------------ 26| 128| kem->length_encaps_seed = OQS_KEM_kyber_768_length_encaps_seed; ------------------ | | 29| 128|#define OQS_KEM_kyber_768_length_encaps_seed 0 ------------------ 27| | 28| 128| kem->keypair = OQS_KEM_kyber_768_keypair; 29| 128| kem->keypair_derand = OQS_KEM_kyber_768_keypair_derand; 30| 128| kem->encaps = OQS_KEM_kyber_768_encaps; 31| 128| kem->encaps_derand = OQS_KEM_kyber_768_encaps_derand; 32| 128| kem->decaps = OQS_KEM_kyber_768_decaps; 33| | 34| 128| return kem; 35| 128|} OQS_KEM_kyber_768_keypair: 73| 128|OQS_API OQS_STATUS OQS_KEM_kyber_768_keypair(uint8_t *public_key, uint8_t *secret_key) { 74| |#if defined(OQS_LIBJADE_BUILD) && (defined(OQS_ENABLE_LIBJADE_KEM_kyber_768)) 75| |#if defined(OQS_ENABLE_LIBJADE_KEM_kyber_768_avx2) 76| |#if defined(OQS_DIST_BUILD) 77| | if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2) && OQS_CPU_has_extension(OQS_CPU_EXT_BMI2) && OQS_CPU_has_extension(OQS_CPU_EXT_POPCNT)) { 78| |#endif /* OQS_DIST_BUILD */ 79| | return (OQS_STATUS) libjade_kyber768_avx2_keypair(public_key, secret_key); 80| |#if defined(OQS_DIST_BUILD) 81| | } else { 82| | return (OQS_STATUS) libjade_kyber768_ref_keypair(public_key, secret_key); 83| | } 84| |#endif /* OQS_DIST_BUILD */ 85| |#else 86| | return (OQS_STATUS) libjade_kyber768_ref_keypair(public_key, secret_key); 87| |#endif 88| |#else /*OQS_LIBJADE_BUILD && (OQS_ENABLE_LIBJADE_KEM_kyber_768)*/ 89| 128|#if defined(OQS_ENABLE_KEM_kyber_768_avx2) 90| 128|#if defined(OQS_DIST_BUILD) 91| 128| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2) && OQS_CPU_has_extension(OQS_CPU_EXT_BMI2) && OQS_CPU_has_extension(OQS_CPU_EXT_POPCNT)) { ------------------ | Branch (91:6): [True: 128, False: 0] | Branch (91:49): [True: 128, False: 0] | Branch (91:92): [True: 128, False: 0] ------------------ 92| 128|#endif /* OQS_DIST_BUILD */ 93| 128| return (OQS_STATUS) pqcrystals_kyber768_avx2_keypair(public_key, secret_key); 94| 128|#if defined(OQS_DIST_BUILD) 95| 128| } else { 96| 0| return (OQS_STATUS) pqcrystals_kyber768_ref_keypair(public_key, secret_key); 97| 0| } 98| 128|#endif /* OQS_DIST_BUILD */ 99| |#elif defined(OQS_ENABLE_KEM_kyber_768_aarch64) 100| |#if defined(OQS_DIST_BUILD) 101| | if (OQS_CPU_has_extension(OQS_CPU_EXT_ARM_NEON)) { 102| |#endif /* OQS_DIST_BUILD */ 103| | return (OQS_STATUS) PQCLEAN_KYBER768_AARCH64_crypto_kem_keypair(public_key, secret_key); 104| |#if defined(OQS_DIST_BUILD) 105| | } else { 106| | return (OQS_STATUS) pqcrystals_kyber768_ref_keypair(public_key, secret_key); 107| | } 108| |#endif /* OQS_DIST_BUILD */ 109| |#else 110| | return (OQS_STATUS) pqcrystals_kyber768_ref_keypair(public_key, secret_key); 111| |#endif 112| 128|#endif /* OQS_LIBJADE_BUILD */ 113| 128|} OQS_KEM_kyber_768_encaps: 123| 128|OQS_API OQS_STATUS OQS_KEM_kyber_768_encaps(uint8_t *ciphertext, uint8_t *shared_secret, const uint8_t *public_key) { 124| |#if defined(OQS_LIBJADE_BUILD) && (defined(OQS_ENABLE_LIBJADE_KEM_kyber_768)) 125| |#if defined(OQS_ENABLE_LIBJADE_KEM_kyber_768_avx2) 126| |#if defined(OQS_DIST_BUILD) 127| | if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2) && OQS_CPU_has_extension(OQS_CPU_EXT_BMI2) && OQS_CPU_has_extension(OQS_CPU_EXT_POPCNT)) { 128| |#endif /* OQS_DIST_BUILD */ 129| | return (OQS_STATUS) libjade_kyber768_avx2_enc(ciphertext, shared_secret, public_key); 130| |#if defined(OQS_DIST_BUILD) 131| | } else { 132| | return (OQS_STATUS) libjade_kyber768_ref_enc(ciphertext, shared_secret, public_key); 133| | } 134| |#endif /* OQS_DIST_BUILD */ 135| |#else 136| | return (OQS_STATUS) libjade_kyber768_ref_enc(ciphertext, shared_secret, public_key); 137| |#endif 138| |#else /*OQS_LIBJADE_BUILD && (OQS_ENABLE_LIBJADE_KEM_kyber_768)*/ 139| 128|#if defined(OQS_ENABLE_KEM_kyber_768_avx2) 140| 128|#if defined(OQS_DIST_BUILD) 141| 128| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2) && OQS_CPU_has_extension(OQS_CPU_EXT_BMI2) && OQS_CPU_has_extension(OQS_CPU_EXT_POPCNT)) { ------------------ | Branch (141:6): [True: 128, False: 0] | Branch (141:49): [True: 128, False: 0] | Branch (141:92): [True: 128, False: 0] ------------------ 142| 128|#endif /* OQS_DIST_BUILD */ 143| 128| return (OQS_STATUS) pqcrystals_kyber768_avx2_enc(ciphertext, shared_secret, public_key); 144| 128|#if defined(OQS_DIST_BUILD) 145| 128| } else { 146| 0| return (OQS_STATUS) pqcrystals_kyber768_ref_enc(ciphertext, shared_secret, public_key); 147| 0| } 148| 128|#endif /* OQS_DIST_BUILD */ 149| |#elif defined(OQS_ENABLE_KEM_kyber_768_aarch64) 150| |#if defined(OQS_DIST_BUILD) 151| | if (OQS_CPU_has_extension(OQS_CPU_EXT_ARM_NEON)) { 152| |#endif /* OQS_DIST_BUILD */ 153| | return (OQS_STATUS) PQCLEAN_KYBER768_AARCH64_crypto_kem_enc(ciphertext, shared_secret, public_key); 154| |#if defined(OQS_DIST_BUILD) 155| | } else { 156| | return (OQS_STATUS) pqcrystals_kyber768_ref_enc(ciphertext, shared_secret, public_key); 157| | } 158| |#endif /* OQS_DIST_BUILD */ 159| |#else 160| | return (OQS_STATUS) pqcrystals_kyber768_ref_enc(ciphertext, shared_secret, public_key); 161| |#endif 162| 128|#endif /* OQS_LIBJADE_BUILD */ 163| 128|} OQS_KEM_kyber_768_decaps: 165| 128|OQS_API OQS_STATUS OQS_KEM_kyber_768_decaps(uint8_t *shared_secret, const uint8_t *ciphertext, const uint8_t *secret_key) { 166| |#if defined(OQS_LIBJADE_BUILD) && (defined(OQS_ENABLE_LIBJADE_KEM_kyber_768)) 167| |#if defined(OQS_ENABLE_LIBJADE_KEM_kyber_768_avx2) 168| |#if defined(OQS_DIST_BUILD) 169| | if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2) && OQS_CPU_has_extension(OQS_CPU_EXT_BMI2) && OQS_CPU_has_extension(OQS_CPU_EXT_POPCNT)) { 170| |#endif /* OQS_DIST_BUILD */ 171| | return (OQS_STATUS) libjade_kyber768_avx2_dec(shared_secret, ciphertext, secret_key); 172| |#if defined(OQS_DIST_BUILD) 173| | } else { 174| | return (OQS_STATUS) libjade_kyber768_ref_dec(shared_secret, ciphertext, secret_key); 175| | } 176| |#endif /* OQS_DIST_BUILD */ 177| |#else 178| | return (OQS_STATUS) libjade_kyber768_ref_dec(shared_secret, ciphertext, secret_key); 179| |#endif 180| |#else /*OQS_LIBJADE_BUILD && (OQS_ENABLE_LIBJADE_KEM_kyber_768)*/ 181| 128|#if defined(OQS_ENABLE_KEM_kyber_768_avx2) 182| 128|#if defined(OQS_DIST_BUILD) 183| 128| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2) && OQS_CPU_has_extension(OQS_CPU_EXT_BMI2) && OQS_CPU_has_extension(OQS_CPU_EXT_POPCNT)) { ------------------ | Branch (183:6): [True: 128, False: 0] | Branch (183:49): [True: 128, False: 0] | Branch (183:92): [True: 128, False: 0] ------------------ 184| 128|#endif /* OQS_DIST_BUILD */ 185| 128| return (OQS_STATUS) pqcrystals_kyber768_avx2_dec(shared_secret, ciphertext, secret_key); 186| 128|#if defined(OQS_DIST_BUILD) 187| 128| } else { 188| 0| return (OQS_STATUS) pqcrystals_kyber768_ref_dec(shared_secret, ciphertext, secret_key); 189| 0| } 190| 128|#endif /* OQS_DIST_BUILD */ 191| |#elif defined(OQS_ENABLE_KEM_kyber_768_aarch64) 192| |#if defined(OQS_DIST_BUILD) 193| | if (OQS_CPU_has_extension(OQS_CPU_EXT_ARM_NEON)) { 194| |#endif /* OQS_DIST_BUILD */ 195| | return (OQS_STATUS) PQCLEAN_KYBER768_AARCH64_crypto_kem_dec(shared_secret, ciphertext, secret_key); 196| |#if defined(OQS_DIST_BUILD) 197| | } else { 198| | return (OQS_STATUS) pqcrystals_kyber768_ref_dec(shared_secret, ciphertext, secret_key); 199| | } 200| |#endif /* OQS_DIST_BUILD */ 201| |#else 202| | return (OQS_STATUS) pqcrystals_kyber768_ref_dec(shared_secret, ciphertext, secret_key); 203| |#endif 204| 128|#endif /* OQS_LIBJADE_BUILD */ 205| 128|} pqcrystals_kyber1024_avx2_poly_cbd_eta1: 127| 2.08k|{ 128| 2.08k|#if KYBER_ETA1 == 2 129| 2.08k| cbd2(r, buf); 130| |#elif KYBER_ETA1 == 3 131| | cbd3(r, (uint8_t *)buf); 132| |#else 133| |#error "This implementation requires eta1 in {2,3}" 134| |#endif 135| 2.08k|} pqcrystals_kyber1024_avx2_poly_cbd_eta2: 138| 174|{ 139| 174|#if KYBER_ETA2 == 2 140| 174| cbd2(r, buf); 141| |#else 142| |#error "This implementation requires eta2 = 2" 143| |#endif 144| 174|} pqcrystals_kyber1024_avx2_gen_matrix: 397| 261|{ 398| 261| unsigned int i, ctr0, ctr1, ctr2, ctr3; 399| 261| ALIGNED_UINT8(REJ_UNIFORM_AVX_NBLOCKS*SHAKE128_RATE) buf[4]; ------------------ | | 8| 261| union { \ | | 9| 261| uint8_t coeffs[N]; \ | | 10| 261| __m256i vec[(N+31)/32]; \ | | 11| 261| } ------------------ 400| 261| __m256i f; 401| 261| shake128x4incctx state; ------------------ | | 18| 261|#define shake128x4incctx OQS_SHA3_shake128_x4_inc_ctx ------------------ 402| 261| shake128x4_inc_init(&state); ------------------ | | 19| 261|#define shake128x4_inc_init OQS_SHA3_shake128_x4_inc_init ------------------ 403| | 404| 1.30k| for(i=0;i<4;i++) { ------------------ | Branch (404:11): [True: 1.04k, False: 261] ------------------ 405| 1.04k| f = _mm256_loadu_si256((__m256i *)seed); 406| 1.04k| _mm256_store_si256(buf[0].vec, f); 407| 1.04k| _mm256_store_si256(buf[1].vec, f); 408| 1.04k| _mm256_store_si256(buf[2].vec, f); 409| 1.04k| _mm256_store_si256(buf[3].vec, f); 410| | 411| 1.04k| if(transposed) { ------------------ | Branch (411:8): [True: 696, False: 348] ------------------ 412| 696| buf[0].coeffs[32] = i; 413| 696| buf[0].coeffs[33] = 0; 414| 696| buf[1].coeffs[32] = i; 415| 696| buf[1].coeffs[33] = 1; 416| 696| buf[2].coeffs[32] = i; 417| 696| buf[2].coeffs[33] = 2; 418| 696| buf[3].coeffs[32] = i; 419| 696| buf[3].coeffs[33] = 3; 420| 696| } 421| 348| else { 422| 348| buf[0].coeffs[32] = 0; 423| 348| buf[0].coeffs[33] = i; 424| 348| buf[1].coeffs[32] = 1; 425| 348| buf[1].coeffs[33] = i; 426| 348| buf[2].coeffs[32] = 2; 427| 348| buf[2].coeffs[33] = i; 428| 348| buf[3].coeffs[32] = 3; 429| 348| buf[3].coeffs[33] = i; 430| 348| } 431| | 432| 1.04k| shake128x4_absorb_once(&state, buf[0].coeffs, buf[1].coeffs, buf[2].coeffs, buf[3].coeffs, 34); ------------------ | | 39| 1.04k|#define shake128x4_absorb_once OQS_SHA3_shake128_x4_absorb_once ------------------ 433| 1.04k| shake128x4_squeezeblocks(buf[0].coeffs, buf[1].coeffs, buf[2].coeffs, buf[3].coeffs, REJ_UNIFORM_AVX_NBLOCKS, &state); ------------------ | | 46| 1.04k| OQS_SHA3_shake128_x4_inc_squeeze(OUT0, OUT1, OUT2, OUT3, (NBLOCKS)*OQS_SHA3_SHAKE128_RATE, STATE) | | ------------------ | | | | 239| 1.04k|#define OQS_SHA3_SHAKE128_RATE 168 | | ------------------ ------------------ 434| | 435| 1.04k| ctr0 = rej_uniform_avx(a[i].vec[0].coeffs, buf[0].coeffs); ------------------ | | 11| 1.04k|#define rej_uniform_avx KYBER_NAMESPACE(rej_uniform_avx) | | ------------------ | | | | 27| 1.04k|#define KYBER_NAMESPACE(s) pqcrystals_kyber1024_avx2_##s | | ------------------ ------------------ 436| 1.04k| ctr1 = rej_uniform_avx(a[i].vec[1].coeffs, buf[1].coeffs); ------------------ | | 11| 1.04k|#define rej_uniform_avx KYBER_NAMESPACE(rej_uniform_avx) | | ------------------ | | | | 27| 1.04k|#define KYBER_NAMESPACE(s) pqcrystals_kyber1024_avx2_##s | | ------------------ ------------------ 437| 1.04k| ctr2 = rej_uniform_avx(a[i].vec[2].coeffs, buf[2].coeffs); ------------------ | | 11| 1.04k|#define rej_uniform_avx KYBER_NAMESPACE(rej_uniform_avx) | | ------------------ | | | | 27| 1.04k|#define KYBER_NAMESPACE(s) pqcrystals_kyber1024_avx2_##s | | ------------------ ------------------ 438| 1.04k| ctr3 = rej_uniform_avx(a[i].vec[3].coeffs, buf[3].coeffs); ------------------ | | 11| 1.04k|#define rej_uniform_avx KYBER_NAMESPACE(rej_uniform_avx) | | ------------------ | | | | 27| 1.04k|#define KYBER_NAMESPACE(s) pqcrystals_kyber1024_avx2_##s | | ------------------ ------------------ 439| | 440| 1.34k| while(ctr0 < KYBER_N || ctr1 < KYBER_N || ctr2 < KYBER_N || ctr3 < KYBER_N) { ------------------ | | 33| 2.68k|#define KYBER_N 256 ------------------ while(ctr0 < KYBER_N || ctr1 < KYBER_N || ctr2 < KYBER_N || ctr3 < KYBER_N) { ------------------ | | 33| 2.60k|#define KYBER_N 256 ------------------ while(ctr0 < KYBER_N || ctr1 < KYBER_N || ctr2 < KYBER_N || ctr3 < KYBER_N) { ------------------ | | 33| 2.53k|#define KYBER_N 256 ------------------ while(ctr0 < KYBER_N || ctr1 < KYBER_N || ctr2 < KYBER_N || ctr3 < KYBER_N) { ------------------ | | 33| 1.11k|#define KYBER_N 256 ------------------ | Branch (440:11): [True: 76, False: 1.26k] | Branch (440:29): [True: 73, False: 1.19k] | Branch (440:47): [True: 83, False: 1.11k] | Branch (440:65): [True: 66, False: 1.04k] ------------------ 441| 298| shake128x4_squeezeblocks(buf[0].coeffs, buf[1].coeffs, buf[2].coeffs, buf[3].coeffs, 1, &state); ------------------ | | 46| 298| OQS_SHA3_shake128_x4_inc_squeeze(OUT0, OUT1, OUT2, OUT3, (NBLOCKS)*OQS_SHA3_SHAKE128_RATE, STATE) | | ------------------ | | | | 239| 298|#define OQS_SHA3_SHAKE128_RATE 168 | | ------------------ ------------------ 442| | 443| 298| ctr0 += rej_uniform(a[i].vec[0].coeffs + ctr0, KYBER_N - ctr0, buf[0].coeffs, SHAKE128_RATE); ------------------ | | 33| 298|#define KYBER_N 256 ------------------ ctr0 += rej_uniform(a[i].vec[0].coeffs + ctr0, KYBER_N - ctr0, buf[0].coeffs, SHAKE128_RATE); ------------------ | | 8| 298|#define SHAKE128_RATE OQS_SHA3_SHAKE128_RATE | | ------------------ | | | | 239| 298|#define OQS_SHA3_SHAKE128_RATE 168 | | ------------------ ------------------ 444| 298| ctr1 += rej_uniform(a[i].vec[1].coeffs + ctr1, KYBER_N - ctr1, buf[1].coeffs, SHAKE128_RATE); ------------------ | | 33| 298|#define KYBER_N 256 ------------------ ctr1 += rej_uniform(a[i].vec[1].coeffs + ctr1, KYBER_N - ctr1, buf[1].coeffs, SHAKE128_RATE); ------------------ | | 8| 298|#define SHAKE128_RATE OQS_SHA3_SHAKE128_RATE | | ------------------ | | | | 239| 298|#define OQS_SHA3_SHAKE128_RATE 168 | | ------------------ ------------------ 445| 298| ctr2 += rej_uniform(a[i].vec[2].coeffs + ctr2, KYBER_N - ctr2, buf[2].coeffs, SHAKE128_RATE); ------------------ | | 33| 298|#define KYBER_N 256 ------------------ ctr2 += rej_uniform(a[i].vec[2].coeffs + ctr2, KYBER_N - ctr2, buf[2].coeffs, SHAKE128_RATE); ------------------ | | 8| 298|#define SHAKE128_RATE OQS_SHA3_SHAKE128_RATE | | ------------------ | | | | 239| 298|#define OQS_SHA3_SHAKE128_RATE 168 | | ------------------ ------------------ 446| 298| ctr3 += rej_uniform(a[i].vec[3].coeffs + ctr3, KYBER_N - ctr3, buf[3].coeffs, SHAKE128_RATE); ------------------ | | 33| 298|#define KYBER_N 256 ------------------ ctr3 += rej_uniform(a[i].vec[3].coeffs + ctr3, KYBER_N - ctr3, buf[3].coeffs, SHAKE128_RATE); ------------------ | | 8| 298|#define SHAKE128_RATE OQS_SHA3_SHAKE128_RATE | | ------------------ | | | | 239| 298|#define OQS_SHA3_SHAKE128_RATE 168 | | ------------------ ------------------ 447| 298| } 448| | 449| 1.04k| poly_nttunpack(&a[i].vec[0]); ------------------ | | 62| 1.04k|#define poly_nttunpack KYBER_NAMESPACE(poly_nttunpack) | | ------------------ | | | | 27| 1.04k|#define KYBER_NAMESPACE(s) pqcrystals_kyber1024_avx2_##s | | ------------------ ------------------ 450| 1.04k| poly_nttunpack(&a[i].vec[1]); ------------------ | | 62| 1.04k|#define poly_nttunpack KYBER_NAMESPACE(poly_nttunpack) | | ------------------ | | | | 27| 1.04k|#define KYBER_NAMESPACE(s) pqcrystals_kyber1024_avx2_##s | | ------------------ ------------------ 451| 1.04k| poly_nttunpack(&a[i].vec[2]); ------------------ | | 62| 1.04k|#define poly_nttunpack KYBER_NAMESPACE(poly_nttunpack) | | ------------------ | | | | 27| 1.04k|#define KYBER_NAMESPACE(s) pqcrystals_kyber1024_avx2_##s | | ------------------ ------------------ 452| 1.04k| poly_nttunpack(&a[i].vec[3]); ------------------ | | 62| 1.04k|#define poly_nttunpack KYBER_NAMESPACE(poly_nttunpack) | | ------------------ | | | | 27| 1.04k|#define KYBER_NAMESPACE(s) pqcrystals_kyber1024_avx2_##s | | ------------------ ------------------ 453| 1.04k| } 454| 261| shake128x4_inc_ctx_release(&state); ------------------ | | 23| 261|#define shake128x4_inc_ctx_release OQS_SHA3_shake128_x4_inc_ctx_release ------------------ 455| 261|} pqcrystals_kyber1024_avx2_indcpa_keypair: 472| 87|{ 473| 87| unsigned int i; 474| 87| uint8_t buf[2*KYBER_SYMBYTES]; 475| 87| const uint8_t *publicseed = buf; 476| 87| const uint8_t *noiseseed = buf + KYBER_SYMBYTES; ------------------ | | 36| 87|#define KYBER_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 477| 87| polyvec a[KYBER_K], e, pkpv, skpv; 478| | 479| 87| randombytes(buf, KYBER_SYMBYTES); ------------------ | | 8| 87|#define randombytes OQS_randombytes ------------------ randombytes(buf, KYBER_SYMBYTES); ------------------ | | 36| 87|#define KYBER_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 480| 87| hash_g(buf, buf, KYBER_SYMBYTES); ------------------ | | 53| 87|#define hash_g(OUT, IN, INBYTES) sha3_512(OUT, IN, INBYTES) | | ------------------ | | | | 31| 87|#define sha3_512 OQS_SHA3_sha3_512 | | ------------------ ------------------ 481| | 482| 87| gen_a(a, publicseed); ------------------ | | 157| 87|#define gen_a(A,B) gen_matrix(A,B,0) | | ------------------ | | | | 8| 87|#define gen_matrix KYBER_NAMESPACE(gen_matrix) | | | | ------------------ | | | | | | 27| 87|#define KYBER_NAMESPACE(s) pqcrystals_kyber1024_avx2_##s | | | | ------------------ | | ------------------ ------------------ 483| | 484| |#ifdef KYBER_90S 485| |#define NOISE_NBLOCKS ((KYBER_ETA1*KYBER_N/4)/AES256CTR_BLOCKBYTES) /* Assumes divisibility */ 486| | uint64_t nonce = 0; 487| | ALIGNED_UINT8(NOISE_NBLOCKS*AES256CTR_BLOCKBYTES+32) coins; // +32 bytes as required by poly_cbd_eta1 488| | aes256ctr_ctx state; 489| | aes256ctr_init_u64(&state, noiseseed, nonce++); 490| | for(i=0;ivec[2*i+0]); 190| 1.39k| f1 = _mm256_load_si256(&a->vec[2*i+1]); 191| 1.39k| f0 = _mm256_mulhi_epi16(f0,v); 192| 1.39k| f1 = _mm256_mulhi_epi16(f1,v); 193| 1.39k| f0 = _mm256_mulhrs_epi16(f0,shift1); 194| 1.39k| f1 = _mm256_mulhrs_epi16(f1,shift1); 195| 1.39k| f0 = _mm256_and_si256(f0,mask); 196| 1.39k| f1 = _mm256_and_si256(f1,mask); 197| 1.39k| f0 = _mm256_packus_epi16(f0,f1); 198| 1.39k| f0 = _mm256_maddubs_epi16(f0,shift2); // a0 a1 a2 a3 b0 b1 b2 b3 a4 a5 a6 a7 b4 b5 b6 b7 199| 1.39k| f0 = _mm256_madd_epi16(f0,shift3); // a0 a1 b0 b1 a2 a3 b2 b3 200| 1.39k| f0 = _mm256_sllv_epi32(f0,sllvdidx); 201| 1.39k| f0 = _mm256_srlv_epi64(f0,sllvdidx); 202| 1.39k| f0 = _mm256_shuffle_epi8(f0,shufbidx); 203| 1.39k| t0 = _mm256_castsi256_si128(f0); 204| | t1 = _mm256_extracti128_si256(f0,1); 205| 1.39k| t0 = _mm_blendv_epi8(t0,t1,_mm256_castsi256_si128(shufbidx)); 206| 1.39k| _mm_storeu_si128((__m128i *)&r[20*i+ 0],t0); 207| 1.39k| memcpy(&r[20*i+16],&t1,4); 208| 1.39k| } 209| 174|} pqcrystals_kyber1024_avx2_poly_decompress: 212| 87|{ 213| 87| unsigned int i; 214| 87| __m128i t; 215| 87| __m256i f; 216| 87| int16_t ti; 217| 87| const __m256i q = _mm256_load_si256(&qdata.vec[_16XQ/16]); ------------------ | | 39| 87|#define qdata KYBER_NAMESPACE(qdata) | | ------------------ | | | | 27| 87|#define KYBER_NAMESPACE(s) pqcrystals_kyber1024_avx2_##s | | ------------------ ------------------ const __m256i q = _mm256_load_si256(&qdata.vec[_16XQ/16]); ------------------ | | 6| 87|#define _16XQ 0 ------------------ 218| 87| const __m256i shufbidx = _mm256_set_epi8(9,9,9,8,8,8,8,7,7,6,6,6,6,5,5,5, 219| 87| 4,4,4,3,3,3,3,2,2,1,1,1,1,0,0,0); 220| 87| const __m256i mask = _mm256_set_epi16(248,1984,62,496,3968,124,992,31, 221| 87| 248,1984,62,496,3968,124,992,31); 222| 87| const __m256i shift = _mm256_set_epi16(128,16,512,64,8,256,32,1024, 223| 87| 128,16,512,64,8,256,32,1024); 224| | 225| 1.47k| for(i=0;ivec[i],f); 235| 1.39k| } 236| 87|} pqcrystals_kyber1024_avx2_poly_tobytes: 255| 696|{ 256| 696| ntttobytes_avx(r, a->vec, qdata.vec); ------------------ | | 23| 696|#define ntttobytes_avx KYBER_NAMESPACE(ntttobytes_avx) | | ------------------ | | | | 27| 696|#define KYBER_NAMESPACE(s) pqcrystals_kyber1024_avx2_##s | | ------------------ ------------------ ntttobytes_avx(r, a->vec, qdata.vec); ------------------ | | 39| 696|#define qdata KYBER_NAMESPACE(qdata) | | ------------------ | | | | 27| 696|#define KYBER_NAMESPACE(s) pqcrystals_kyber1024_avx2_##s | | ------------------ ------------------ 257| 696|} pqcrystals_kyber1024_avx2_poly_frombytes: 270| 1.04k|{ 271| 1.04k| nttfrombytes_avx(r->vec, a, qdata.vec); ------------------ | | 25| 1.04k|#define nttfrombytes_avx KYBER_NAMESPACE(nttfrombytes_avx) | | ------------------ | | | | 27| 1.04k|#define KYBER_NAMESPACE(s) pqcrystals_kyber1024_avx2_##s | | ------------------ ------------------ nttfrombytes_avx(r->vec, a, qdata.vec); ------------------ | | 39| 1.04k|#define qdata KYBER_NAMESPACE(qdata) | | ------------------ | | | | 27| 1.04k|#define KYBER_NAMESPACE(s) pqcrystals_kyber1024_avx2_##s | | ------------------ ------------------ 272| 1.04k|} pqcrystals_kyber1024_avx2_poly_frommsg: 283| 174|{ 284| |#if (KYBER_INDCPA_MSGBYTES != 32) 285| |#error "KYBER_INDCPA_MSGBYTES must be equal to 32!" 286| |#endif 287| 174| __m256i f, g0, g1, g2, g3, h0, h1, h2, h3; 288| 174| const __m256i shift = _mm256_broadcastsi128_si256(_mm_set_epi32(0,1,2,3)); 289| 174| const __m256i idx = _mm256_broadcastsi128_si256(_mm_set_epi8(15,14,11,10,7,6,3,2,13,12,9,8,5,4,1,0)); 290| 174| const __m256i hqs = _mm256_set1_epi16((KYBER_Q+1)/2); ------------------ | | 34| 174|#define KYBER_Q 3329 ------------------ 291| | 292| 174|#define FROMMSG64(i) \ 293| 174| g3 = _mm256_shuffle_epi32(f,0x55*i); \ 294| 174| g3 = _mm256_sllv_epi32(g3,shift); \ 295| 174| g3 = _mm256_shuffle_epi8(g3,idx); \ 296| 174| g0 = _mm256_slli_epi16(g3,12); \ 297| 174| g1 = _mm256_slli_epi16(g3,8); \ 298| 174| g2 = _mm256_slli_epi16(g3,4); \ 299| 174| g0 = _mm256_srai_epi16(g0,15); \ 300| 174| g1 = _mm256_srai_epi16(g1,15); \ 301| 174| g2 = _mm256_srai_epi16(g2,15); \ 302| 174| g3 = _mm256_srai_epi16(g3,15); \ 303| 174| g0 = _mm256_and_si256(g0,hqs); /* 19 18 17 16 3 2 1 0 */ \ 304| 174| g1 = _mm256_and_si256(g1,hqs); /* 23 22 21 20 7 6 5 4 */ \ 305| 174| g2 = _mm256_and_si256(g2,hqs); /* 27 26 25 24 11 10 9 8 */ \ 306| 174| g3 = _mm256_and_si256(g3,hqs); /* 31 30 29 28 15 14 13 12 */ \ 307| 174| h0 = _mm256_unpacklo_epi64(g0,g1); \ 308| 174| h2 = _mm256_unpackhi_epi64(g0,g1); \ 309| 174| h1 = _mm256_unpacklo_epi64(g2,g3); \ 310| 174| h3 = _mm256_unpackhi_epi64(g2,g3); \ 311| 174| g0 = _mm256_permute2x128_si256(h0,h1,0x20); \ 312| 174| g2 = _mm256_permute2x128_si256(h0,h1,0x31); \ 313| 174| g1 = _mm256_permute2x128_si256(h2,h3,0x20); \ 314| 174| g3 = _mm256_permute2x128_si256(h2,h3,0x31); \ 315| 174| _mm256_store_si256(&r->vec[0+2*i+0],g0); \ 316| 174| _mm256_store_si256(&r->vec[0+2*i+1],g1); \ 317| 174| _mm256_store_si256(&r->vec[8+2*i+0],g2); \ 318| 174| _mm256_store_si256(&r->vec[8+2*i+1],g3) 319| | 320| 174| f = _mm256_loadu_si256((__m256i *)msg); 321| 174| FROMMSG64(0); ------------------ | | 293| 174| g3 = _mm256_shuffle_epi32(f,0x55*i); \ | | 294| 174| g3 = _mm256_sllv_epi32(g3,shift); \ | | 295| 174| g3 = _mm256_shuffle_epi8(g3,idx); \ | | 296| 174| g0 = _mm256_slli_epi16(g3,12); \ | | 297| 174| g1 = _mm256_slli_epi16(g3,8); \ | | 298| 174| g2 = _mm256_slli_epi16(g3,4); \ | | 299| 174| g0 = _mm256_srai_epi16(g0,15); \ | | 300| 174| g1 = _mm256_srai_epi16(g1,15); \ | | 301| 174| g2 = _mm256_srai_epi16(g2,15); \ | | 302| 174| g3 = _mm256_srai_epi16(g3,15); \ | | 303| 174| g0 = _mm256_and_si256(g0,hqs); /* 19 18 17 16 3 2 1 0 */ \ | | 304| 174| g1 = _mm256_and_si256(g1,hqs); /* 23 22 21 20 7 6 5 4 */ \ | | 305| 174| g2 = _mm256_and_si256(g2,hqs); /* 27 26 25 24 11 10 9 8 */ \ | | 306| 174| g3 = _mm256_and_si256(g3,hqs); /* 31 30 29 28 15 14 13 12 */ \ | | 307| 174| h0 = _mm256_unpacklo_epi64(g0,g1); \ | | 308| 174| h2 = _mm256_unpackhi_epi64(g0,g1); \ | | 309| 174| h1 = _mm256_unpacklo_epi64(g2,g3); \ | | 310| 174| h3 = _mm256_unpackhi_epi64(g2,g3); \ | | 311| 174| g0 = _mm256_permute2x128_si256(h0,h1,0x20); \ | | 312| 174| g2 = _mm256_permute2x128_si256(h0,h1,0x31); \ | | 313| 174| g1 = _mm256_permute2x128_si256(h2,h3,0x20); \ | | 314| 174| g3 = _mm256_permute2x128_si256(h2,h3,0x31); \ | | 315| 174| _mm256_store_si256(&r->vec[0+2*i+0],g0); \ | | 316| 174| _mm256_store_si256(&r->vec[0+2*i+1],g1); \ | | 317| 174| _mm256_store_si256(&r->vec[8+2*i+0],g2); \ | | 318| 174| _mm256_store_si256(&r->vec[8+2*i+1],g3) ------------------ 322| 174| FROMMSG64(1); ------------------ | | 293| 174| g3 = _mm256_shuffle_epi32(f,0x55*i); \ | | 294| 174| g3 = _mm256_sllv_epi32(g3,shift); \ | | 295| 174| g3 = _mm256_shuffle_epi8(g3,idx); \ | | 296| 174| g0 = _mm256_slli_epi16(g3,12); \ | | 297| 174| g1 = _mm256_slli_epi16(g3,8); \ | | 298| 174| g2 = _mm256_slli_epi16(g3,4); \ | | 299| 174| g0 = _mm256_srai_epi16(g0,15); \ | | 300| 174| g1 = _mm256_srai_epi16(g1,15); \ | | 301| 174| g2 = _mm256_srai_epi16(g2,15); \ | | 302| 174| g3 = _mm256_srai_epi16(g3,15); \ | | 303| 174| g0 = _mm256_and_si256(g0,hqs); /* 19 18 17 16 3 2 1 0 */ \ | | 304| 174| g1 = _mm256_and_si256(g1,hqs); /* 23 22 21 20 7 6 5 4 */ \ | | 305| 174| g2 = _mm256_and_si256(g2,hqs); /* 27 26 25 24 11 10 9 8 */ \ | | 306| 174| g3 = _mm256_and_si256(g3,hqs); /* 31 30 29 28 15 14 13 12 */ \ | | 307| 174| h0 = _mm256_unpacklo_epi64(g0,g1); \ | | 308| 174| h2 = _mm256_unpackhi_epi64(g0,g1); \ | | 309| 174| h1 = _mm256_unpacklo_epi64(g2,g3); \ | | 310| 174| h3 = _mm256_unpackhi_epi64(g2,g3); \ | | 311| 174| g0 = _mm256_permute2x128_si256(h0,h1,0x20); \ | | 312| 174| g2 = _mm256_permute2x128_si256(h0,h1,0x31); \ | | 313| 174| g1 = _mm256_permute2x128_si256(h2,h3,0x20); \ | | 314| 174| g3 = _mm256_permute2x128_si256(h2,h3,0x31); \ | | 315| 174| _mm256_store_si256(&r->vec[0+2*i+0],g0); \ | | 316| 174| _mm256_store_si256(&r->vec[0+2*i+1],g1); \ | | 317| 174| _mm256_store_si256(&r->vec[8+2*i+0],g2); \ | | 318| 174| _mm256_store_si256(&r->vec[8+2*i+1],g3) ------------------ 323| 174| FROMMSG64(2); ------------------ | | 293| 174| g3 = _mm256_shuffle_epi32(f,0x55*i); \ | | 294| 174| g3 = _mm256_sllv_epi32(g3,shift); \ | | 295| 174| g3 = _mm256_shuffle_epi8(g3,idx); \ | | 296| 174| g0 = _mm256_slli_epi16(g3,12); \ | | 297| 174| g1 = _mm256_slli_epi16(g3,8); \ | | 298| 174| g2 = _mm256_slli_epi16(g3,4); \ | | 299| 174| g0 = _mm256_srai_epi16(g0,15); \ | | 300| 174| g1 = _mm256_srai_epi16(g1,15); \ | | 301| 174| g2 = _mm256_srai_epi16(g2,15); \ | | 302| 174| g3 = _mm256_srai_epi16(g3,15); \ | | 303| 174| g0 = _mm256_and_si256(g0,hqs); /* 19 18 17 16 3 2 1 0 */ \ | | 304| 174| g1 = _mm256_and_si256(g1,hqs); /* 23 22 21 20 7 6 5 4 */ \ | | 305| 174| g2 = _mm256_and_si256(g2,hqs); /* 27 26 25 24 11 10 9 8 */ \ | | 306| 174| g3 = _mm256_and_si256(g3,hqs); /* 31 30 29 28 15 14 13 12 */ \ | | 307| 174| h0 = _mm256_unpacklo_epi64(g0,g1); \ | | 308| 174| h2 = _mm256_unpackhi_epi64(g0,g1); \ | | 309| 174| h1 = _mm256_unpacklo_epi64(g2,g3); \ | | 310| 174| h3 = _mm256_unpackhi_epi64(g2,g3); \ | | 311| 174| g0 = _mm256_permute2x128_si256(h0,h1,0x20); \ | | 312| 174| g2 = _mm256_permute2x128_si256(h0,h1,0x31); \ | | 313| 174| g1 = _mm256_permute2x128_si256(h2,h3,0x20); \ | | 314| 174| g3 = _mm256_permute2x128_si256(h2,h3,0x31); \ | | 315| 174| _mm256_store_si256(&r->vec[0+2*i+0],g0); \ | | 316| 174| _mm256_store_si256(&r->vec[0+2*i+1],g1); \ | | 317| 174| _mm256_store_si256(&r->vec[8+2*i+0],g2); \ | | 318| 174| _mm256_store_si256(&r->vec[8+2*i+1],g3) ------------------ 324| | FROMMSG64(3); ------------------ | | 293| 174| g3 = _mm256_shuffle_epi32(f,0x55*i); \ | | 294| 174| g3 = _mm256_sllv_epi32(g3,shift); \ | | 295| 174| g3 = _mm256_shuffle_epi8(g3,idx); \ | | 296| 174| g0 = _mm256_slli_epi16(g3,12); \ | | 297| 174| g1 = _mm256_slli_epi16(g3,8); \ | | 298| 174| g2 = _mm256_slli_epi16(g3,4); \ | | 299| 174| g0 = _mm256_srai_epi16(g0,15); \ | | 300| 174| g1 = _mm256_srai_epi16(g1,15); \ | | 301| 174| g2 = _mm256_srai_epi16(g2,15); \ | | 302| 174| g3 = _mm256_srai_epi16(g3,15); \ | | 303| 174| g0 = _mm256_and_si256(g0,hqs); /* 19 18 17 16 3 2 1 0 */ \ | | 304| 174| g1 = _mm256_and_si256(g1,hqs); /* 23 22 21 20 7 6 5 4 */ \ | | 305| 174| g2 = _mm256_and_si256(g2,hqs); /* 27 26 25 24 11 10 9 8 */ \ | | 306| 174| g3 = _mm256_and_si256(g3,hqs); /* 31 30 29 28 15 14 13 12 */ \ | | 307| 174| h0 = _mm256_unpacklo_epi64(g0,g1); \ | | 308| 174| h2 = _mm256_unpackhi_epi64(g0,g1); \ | | 309| 174| h1 = _mm256_unpacklo_epi64(g2,g3); \ | | 310| 174| h3 = _mm256_unpackhi_epi64(g2,g3); \ | | 311| 174| g0 = _mm256_permute2x128_si256(h0,h1,0x20); \ | | 312| 174| g2 = _mm256_permute2x128_si256(h0,h1,0x31); \ | | 313| 174| g1 = _mm256_permute2x128_si256(h2,h3,0x20); \ | | 314| 174| g3 = _mm256_permute2x128_si256(h2,h3,0x31); \ | | 315| 174| _mm256_store_si256(&r->vec[0+2*i+0],g0); \ | | 316| 174| _mm256_store_si256(&r->vec[0+2*i+1],g1); \ | | 317| 174| _mm256_store_si256(&r->vec[8+2*i+0],g2); \ | | 318| 174| _mm256_store_si256(&r->vec[8+2*i+1],g3) ------------------ 325| 174|} pqcrystals_kyber1024_avx2_poly_tomsg: 339| 87|{ 340| 87| unsigned int i; 341| 87| uint32_t small; 342| 87| __m256i f0, f1, g0, g1; 343| 87| const __m256i hq = _mm256_set1_epi16((KYBER_Q - 1)/2); ------------------ | | 34| 87|#define KYBER_Q 3329 ------------------ 344| 87| const __m256i hhq = _mm256_set1_epi16((KYBER_Q - 1)/4); ------------------ | | 34| 87|#define KYBER_Q 3329 ------------------ 345| | 346| 783| for(i=0;ivec[2*i+0]); 348| 696| f1 = _mm256_load_si256(&a->vec[2*i+1]); 349| 696| f0 = _mm256_sub_epi16(hq, f0); 350| 696| f1 = _mm256_sub_epi16(hq, f1); 351| 696| g0 = _mm256_srai_epi16(f0, 15); 352| 696| g1 = _mm256_srai_epi16(f1, 15); 353| 696| f0 = _mm256_xor_si256(f0, g0); 354| 696| f1 = _mm256_xor_si256(f1, g1); 355| 696| f0 = _mm256_sub_epi16(f0, hhq); 356| 696| f1 = _mm256_sub_epi16(f1, hhq); 357| 696| f0 = _mm256_packs_epi16(f0, f1); 358| | f0 = _mm256_permute4x64_epi64(f0, 0xD8); 359| 696| small = _mm256_movemask_epi8(f0); 360| 696| memcpy(&msg[4*i], &small, 4); 361| 696| } 362| 87|} pqcrystals_kyber1024_avx2_poly_getnoise_eta2: 397| 174|{ 398| 174| ALIGNED_UINT8(KYBER_ETA2*KYBER_N/4) buf; ------------------ | | 8| 174| union { \ | | 9| 174| uint8_t coeffs[N]; \ | | 10| 174| __m256i vec[(N+31)/32]; \ | | 11| 174| } ------------------ 399| 174| prf(buf.coeffs, KYBER_ETA2*KYBER_N/4, seed, nonce); ------------------ | | 58| 174| kyber_shake256_prf(OUT, OUTBYTES, KEY, NONCE) | | ------------------ | | | | 44| 174|#define kyber_shake256_prf KYBER_NAMESPACE(kyber_shake256_prf) | | | | ------------------ | | | | | | 27| 174|#define KYBER_NAMESPACE(s) pqcrystals_kyber1024_avx2_##s | | | | ------------------ | | ------------------ ------------------ 400| 174| poly_cbd_eta2(r, buf.vec); ------------------ | | 12| 174|#define poly_cbd_eta2 KYBER_NAMESPACE(poly_cbd_eta2) | | ------------------ | | | | 27| 174|#define KYBER_NAMESPACE(s) pqcrystals_kyber1024_avx2_##s | | ------------------ ------------------ 401| 174|} pqcrystals_kyber1024_avx2_poly_getnoise_eta2_4x: 415| 522|{ 416| 522| ALIGNED_UINT8(NOISE_NBLOCKS*SHAKE256_RATE) buf[4]; ------------------ | | 8| 522| union { \ | | 9| 522| uint8_t coeffs[N]; \ | | 10| 522| __m256i vec[(N+31)/32]; \ | | 11| 522| } ------------------ 417| 522| __m256i f; 418| 522| shake256x4incctx state; ------------------ | | 27| 522|#define shake256x4incctx OQS_SHA3_shake256_x4_inc_ctx ------------------ 419| | 420| 522| f = _mm256_loadu_si256((__m256i *)seed); 421| 522| _mm256_store_si256(buf[0].vec, f); 422| 522| _mm256_store_si256(buf[1].vec, f); 423| 522| _mm256_store_si256(buf[2].vec, f); 424| 522| _mm256_store_si256(buf[3].vec, f); 425| | 426| 522| buf[0].coeffs[32] = nonce0; 427| 522| buf[1].coeffs[32] = nonce1; 428| 522| buf[2].coeffs[32] = nonce2; 429| 522| buf[3].coeffs[32] = nonce3; 430| | 431| 522| shake256x4_inc_init(&state); ------------------ | | 28| 522|#define shake256x4_inc_init OQS_SHA3_shake256_x4_inc_init ------------------ 432| 522| shake256x4_absorb_once(&state, buf[0].coeffs, buf[1].coeffs, buf[2].coeffs, buf[3].coeffs, 33); ------------------ | | 42| 522|#define shake256x4_absorb_once OQS_SHA3_shake256_x4_absorb_once ------------------ 433| 522| shake256x4_squeezeblocks(buf[0].coeffs, buf[1].coeffs, buf[2].coeffs, buf[3].coeffs, NOISE_NBLOCKS, &state); ------------------ | | 49| 522| OQS_SHA3_shake256_x4_inc_squeeze(OUT0, OUT1, OUT2, OUT3, (NBLOCKS)*OQS_SHA3_SHAKE256_RATE, STATE) | | ------------------ | | | | 320| 522|#define OQS_SHA3_SHAKE256_RATE 136 | | ------------------ ------------------ 434| 522| shake256x4_inc_ctx_release(&state); ------------------ | | 32| 522|#define shake256x4_inc_ctx_release OQS_SHA3_shake256_x4_inc_ctx_release ------------------ 435| | 436| 522| poly_cbd_eta1(r0, buf[0].vec); ------------------ | | 9| 522|#define poly_cbd_eta1 KYBER_NAMESPACE(poly_cbd_eta1) | | ------------------ | | | | 27| 522|#define KYBER_NAMESPACE(s) pqcrystals_kyber1024_avx2_##s | | ------------------ ------------------ 437| 522| poly_cbd_eta1(r1, buf[1].vec); ------------------ | | 9| 522|#define poly_cbd_eta1 KYBER_NAMESPACE(poly_cbd_eta1) | | ------------------ | | | | 27| 522|#define KYBER_NAMESPACE(s) pqcrystals_kyber1024_avx2_##s | | ------------------ ------------------ 438| 522| poly_cbd_eta1(r2, buf[2].vec); ------------------ | | 9| 522|#define poly_cbd_eta1 KYBER_NAMESPACE(poly_cbd_eta1) | | ------------------ | | | | 27| 522|#define KYBER_NAMESPACE(s) pqcrystals_kyber1024_avx2_##s | | ------------------ ------------------ 439| 522| poly_cbd_eta1(r3, buf[3].vec); ------------------ | | 9| 522|#define poly_cbd_eta1 KYBER_NAMESPACE(poly_cbd_eta1) | | ------------------ | | | | 27| 522|#define KYBER_NAMESPACE(s) pqcrystals_kyber1024_avx2_##s | | ------------------ ------------------ 440| 522|} pqcrystals_kyber1024_avx2_poly_ntt: 495| 1.74k|{ 496| 1.74k| ntt_avx(r->vec, qdata.vec); ------------------ | | 7| 1.74k|#define ntt_avx KYBER_NAMESPACE(ntt_avx) | | ------------------ | | | | 27| 1.74k|#define KYBER_NAMESPACE(s) pqcrystals_kyber1024_avx2_##s | | ------------------ ------------------ ntt_avx(r->vec, qdata.vec); ------------------ | | 39| 1.74k|#define qdata KYBER_NAMESPACE(qdata) | | ------------------ | | | | 27| 1.74k|#define KYBER_NAMESPACE(s) pqcrystals_kyber1024_avx2_##s | | ------------------ ------------------ 497| 1.74k|} pqcrystals_kyber1024_avx2_poly_invntt_tomont: 512| 957|{ 513| 957| invntt_avx(r->vec, qdata.vec); ------------------ | | 9| 957|#define invntt_avx KYBER_NAMESPACE(invntt_avx) | | ------------------ | | | | 27| 957|#define KYBER_NAMESPACE(s) pqcrystals_kyber1024_avx2_##s | | ------------------ ------------------ invntt_avx(r->vec, qdata.vec); ------------------ | | 39| 957|#define qdata KYBER_NAMESPACE(qdata) | | ------------------ | | | | 27| 957|#define KYBER_NAMESPACE(s) pqcrystals_kyber1024_avx2_##s | | ------------------ ------------------ 514| 957|} pqcrystals_kyber1024_avx2_poly_nttunpack: 517| 4.17k|{ 518| 4.17k| nttunpack_avx(r->vec, qdata.vec); ------------------ | | 14| 4.17k|#define nttunpack_avx KYBER_NAMESPACE(nttunpack_avx) | | ------------------ | | | | 27| 4.17k|#define KYBER_NAMESPACE(s) pqcrystals_kyber1024_avx2_##s | | ------------------ ------------------ nttunpack_avx(r->vec, qdata.vec); ------------------ | | 39| 4.17k|#define qdata KYBER_NAMESPACE(qdata) | | ------------------ | | | | 27| 4.17k|#define KYBER_NAMESPACE(s) pqcrystals_kyber1024_avx2_##s | | ------------------ ------------------ 519| 4.17k|} pqcrystals_kyber1024_avx2_poly_basemul_montgomery: 534| 5.22k|{ 535| 5.22k| basemul_avx(r->vec, a->vec, b->vec, qdata.vec); ------------------ | | 17| 5.22k|#define basemul_avx KYBER_NAMESPACE(basemul_avx) | | ------------------ | | | | 27| 5.22k|#define KYBER_NAMESPACE(s) pqcrystals_kyber1024_avx2_##s | | ------------------ ------------------ basemul_avx(r->vec, a->vec, b->vec, qdata.vec); ------------------ | | 39| 5.22k|#define qdata KYBER_NAMESPACE(qdata) | | ------------------ | | | | 27| 5.22k|#define KYBER_NAMESPACE(s) pqcrystals_kyber1024_avx2_##s | | ------------------ ------------------ 536| 5.22k|} pqcrystals_kyber1024_avx2_poly_tomont: 547| 348|{ 548| 348| tomont_avx(r->vec, qdata.vec); ------------------ | | 9| 348|#define tomont_avx KYBER_NAMESPACE(tomont_avx) | | ------------------ | | | | 27| 348|#define KYBER_NAMESPACE(s) pqcrystals_kyber1024_avx2_##s | | ------------------ ------------------ tomont_avx(r->vec, qdata.vec); ------------------ | | 39| 348|#define qdata KYBER_NAMESPACE(qdata) | | ------------------ | | | | 27| 348|#define KYBER_NAMESPACE(s) pqcrystals_kyber1024_avx2_##s | | ------------------ ------------------ 549| 348|} pqcrystals_kyber1024_avx2_poly_reduce: 560| 1.65k|{ 561| 1.65k| reduce_avx(r->vec, qdata.vec); ------------------ | | 7| 1.65k|#define reduce_avx KYBER_NAMESPACE(reduce_avx) | | ------------------ | | | | 27| 1.65k|#define KYBER_NAMESPACE(s) pqcrystals_kyber1024_avx2_##s | | ------------------ ------------------ reduce_avx(r->vec, qdata.vec); ------------------ | | 39| 1.65k|#define qdata KYBER_NAMESPACE(qdata) | | ------------------ | | | | 27| 1.65k|#define KYBER_NAMESPACE(s) pqcrystals_kyber1024_avx2_##s | | ------------------ ------------------ 562| 1.65k|} pqcrystals_kyber1024_avx2_poly_add: 575| 5.30k|{ 576| 5.30k| unsigned int i; 577| 5.30k| __m256i f0, f1; 578| | 579| 90.2k| for(i=0;ivec[i]); 581| 84.9k| f1 = _mm256_load_si256(&b->vec[i]); 582| 84.9k| f0 = _mm256_add_epi16(f0, f1); 583| 84.9k| _mm256_store_si256(&r->vec[i], f0); 584| 84.9k| } 585| 5.30k|} pqcrystals_kyber1024_avx2_poly_sub: 598| 87|{ 599| 87| unsigned int i; 600| 87| __m256i f0, f1; 601| | 602| 1.47k| for(i=0;ivec[i]); 604| 1.39k| f1 = _mm256_load_si256(&b->vec[i]); 605| 1.39k| f0 = _mm256_sub_epi16(f0, f1); 606| 1.39k| _mm256_store_si256(&r->vec[i], f0); 607| 1.39k| } 608| 87|} pqcrystals_kyber1024_avx2_polyvec_compress: 158| 174|{ 159| 174| unsigned int i; 160| | 161| |#if (KYBER_POLYVECCOMPRESSEDBYTES == (KYBER_K * 320)) 162| | for(i=0;ivec[i]); 164| |#elif (KYBER_POLYVECCOMPRESSEDBYTES == (KYBER_K * 352)) 165| 870| for(i=0;ivec[i]); 167| 174|#endif 168| 174|} pqcrystals_kyber1024_avx2_polyvec_decompress: 181| 87|{ 182| 87| unsigned int i; 183| | 184| |#if (KYBER_POLYVECCOMPRESSEDBYTES == (KYBER_K * 320)) 185| | for(i=0;ivec[i],&a[320*i]); 187| |#elif (KYBER_POLYVECCOMPRESSEDBYTES == (KYBER_K * 352)) 188| 435| for(i=0;ivec[i],&a[352*i]); 190| 87|#endif 191| 87|} pqcrystals_kyber1024_avx2_polyvec_tobytes: 203| 174|{ 204| 174| unsigned int i; 205| 870| for(i=0;ivec[i]); ------------------ | | 15| 696|#define poly_tobytes KYBER_NAMESPACE(poly_tobytes) | | ------------------ | | | | 27| 696|#define KYBER_NAMESPACE(s) pqcrystals_kyber1024_avx2_##s | | ------------------ ------------------ poly_tobytes(r+i*KYBER_POLYBYTES, &a->vec[i]); ------------------ | | 39| 696|#define KYBER_POLYBYTES 384 ------------------ 207| 174|} pqcrystals_kyber1024_avx2_polyvec_frombytes: 220| 261|{ 221| 261| unsigned int i; 222| 1.30k| for(i=0;ivec[i], a+i*KYBER_POLYBYTES); ------------------ | | 17| 1.04k|#define poly_frombytes KYBER_NAMESPACE(poly_frombytes) | | ------------------ | | | | 27| 1.04k|#define KYBER_NAMESPACE(s) pqcrystals_kyber1024_avx2_##s | | ------------------ ------------------ poly_frombytes(&r->vec[i], a+i*KYBER_POLYBYTES); ------------------ | | 39| 1.04k|#define KYBER_POLYBYTES 384 ------------------ 224| 261|} pqcrystals_kyber1024_avx2_polyvec_ntt: 234| 435|{ 235| 435| unsigned int i; 236| 2.17k| for(i=0;ivec[i]); ------------------ | | 58| 1.74k|#define poly_ntt KYBER_NAMESPACE(poly_ntt) | | ------------------ | | | | 27| 1.74k|#define KYBER_NAMESPACE(s) pqcrystals_kyber1024_avx2_##s | | ------------------ ------------------ 238| 435|} pqcrystals_kyber1024_avx2_polyvec_invntt_tomont: 249| 174|{ 250| 174| unsigned int i; 251| 870| for(i=0;ivec[i]); ------------------ | | 60| 696|#define poly_invntt_tomont KYBER_NAMESPACE(poly_invntt_tomont) | | ------------------ | | | | 27| 696|#define KYBER_NAMESPACE(s) pqcrystals_kyber1024_avx2_##s | | ------------------ ------------------ 253| 174|} pqcrystals_kyber1024_avx2_polyvec_basemul_acc_montgomery: 266| 1.30k|{ 267| 1.30k| unsigned int i; 268| 1.30k| poly tmp; 269| | 270| 1.30k| poly_basemul_montgomery(r,&a->vec[0],&b->vec[0]); ------------------ | | 64| 1.30k|#define poly_basemul_montgomery KYBER_NAMESPACE(poly_basemul_montgomery) | | ------------------ | | | | 27| 1.30k|#define KYBER_NAMESPACE(s) pqcrystals_kyber1024_avx2_##s | | ------------------ ------------------ 271| 5.22k| for(i=1;ivec[i],&b->vec[i]); ------------------ | | 64| 3.91k|#define poly_basemul_montgomery KYBER_NAMESPACE(poly_basemul_montgomery) | | ------------------ | | | | 27| 3.91k|#define KYBER_NAMESPACE(s) pqcrystals_kyber1024_avx2_##s | | ------------------ ------------------ 273| 3.91k| poly_add(r,r,&tmp); ------------------ | | 72| 3.91k|#define poly_add KYBER_NAMESPACE(poly_add) | | ------------------ | | | | 27| 3.91k|#define KYBER_NAMESPACE(s) pqcrystals_kyber1024_avx2_##s | | ------------------ ------------------ 274| 3.91k| } 275| 1.30k|} pqcrystals_kyber1024_avx2_polyvec_reduce: 287| 348|{ 288| 348| unsigned int i; 289| 1.74k| for(i=0;ivec[i]); ------------------ | | 69| 1.39k|#define poly_reduce KYBER_NAMESPACE(poly_reduce) | | ------------------ | | | | 27| 1.39k|#define KYBER_NAMESPACE(s) pqcrystals_kyber1024_avx2_##s | | ------------------ ------------------ 291| 348|} pqcrystals_kyber1024_avx2_polyvec_add: 303| 261|{ 304| 261| unsigned int i; 305| 1.30k| for(i=0;ivec[i], &a->vec[i], &b->vec[i]); ------------------ | | 72| 1.04k|#define poly_add KYBER_NAMESPACE(poly_add) | | ------------------ | | | | 27| 1.04k|#define KYBER_NAMESPACE(s) pqcrystals_kyber1024_avx2_##s | | ------------------ ------------------ 307| 261|} polyvec.c:poly_compress11: 76| 696|{ 77| 696| unsigned int i; 78| 696| __m256i f0, f1, f2; 79| 696| __m128i t0, t1; 80| 696| const __m256i v = _mm256_load_si256(&qdata.vec[_16XV/16]); ------------------ | | 39| 696|#define qdata KYBER_NAMESPACE(qdata) | | ------------------ | | | | 27| 696|#define KYBER_NAMESPACE(s) pqcrystals_kyber1024_avx2_##s | | ------------------ ------------------ const __m256i v = _mm256_load_si256(&qdata.vec[_16XV/16]); ------------------ | | 8| 696|#define _16XV 32 ------------------ 81| 696| const __m256i v8 = _mm256_slli_epi16(v,3); 82| 696| const __m256i off = _mm256_set1_epi16(36); 83| 696| const __m256i shift1 = _mm256_set1_epi16(1 << 13); 84| 696| const __m256i mask = _mm256_set1_epi16(2047); 85| 696| const __m256i shift2 = _mm256_set1_epi64x((2048LL << 48) + (1LL << 32) + (2048 << 16) + 1); 86| 696| const __m256i sllvdidx = _mm256_set1_epi64x(10); 87| 696| const __m256i srlvqidx = _mm256_set_epi64x(30,10,30,10); 88| 696| const __m256i shufbidx = _mm256_set_epi8( 4, 3, 2, 1, 0, 0,-1,-1,-1,-1,10, 9, 8, 7, 6, 5, 89| 696| -1,-1,-1,-1,-1,10, 9, 8, 7, 6, 5, 4, 3, 2, 1, 0); 90| | 91| 11.8k| for(i=0;ivec[i]); 93| 11.1k| f1 = _mm256_mullo_epi16(f0,v8); 94| 11.1k| f2 = _mm256_add_epi16(f0,off); 95| 11.1k| f0 = _mm256_slli_epi16(f0,3); 96| 11.1k| f0 = _mm256_mulhi_epi16(f0,v); 97| 11.1k| f2 = _mm256_sub_epi16(f1,f2); 98| 11.1k| f1 = _mm256_andnot_si256(f1,f2); 99| 11.1k| f1 = _mm256_srli_epi16(f1,15); 100| 11.1k| f0 = _mm256_sub_epi16(f0,f1); 101| 11.1k| f0 = _mm256_mulhrs_epi16(f0,shift1); 102| 11.1k| f0 = _mm256_and_si256(f0,mask); 103| 11.1k| f0 = _mm256_madd_epi16(f0,shift2); 104| 11.1k| f0 = _mm256_sllv_epi32(f0,sllvdidx); 105| 11.1k| f1 = _mm256_bsrli_epi128(f0,8); 106| 11.1k| f0 = _mm256_srlv_epi64(f0,srlvqidx); 107| 11.1k| f1 = _mm256_slli_epi64(f1,34); 108| 11.1k| f0 = _mm256_add_epi64(f0,f1); 109| 11.1k| f0 = _mm256_shuffle_epi8(f0,shufbidx); 110| 11.1k| t0 = _mm256_castsi256_si128(f0); 111| | t1 = _mm256_extracti128_si256(f0,1); 112| 11.1k| t0 = _mm_blendv_epi8(t0,t1,_mm256_castsi256_si128(shufbidx)); 113| 11.1k| _mm_storeu_si128((__m128i *)&r[22*i+ 0],t0); 114| 11.1k| _mm_storel_epi64((__m128i *)&r[22*i+16],t1); 115| 11.1k| } 116| 696|} polyvec.c:poly_decompress11: 119| 348|{ 120| 348| unsigned int i; 121| 348| __m256i f; 122| 348| const __m256i q = _mm256_load_si256(&qdata.vec[_16XQ/16]); ------------------ | | 39| 348|#define qdata KYBER_NAMESPACE(qdata) | | ------------------ | | | | 27| 348|#define KYBER_NAMESPACE(s) pqcrystals_kyber1024_avx2_##s | | ------------------ ------------------ const __m256i q = _mm256_load_si256(&qdata.vec[_16XQ/16]); ------------------ | | 6| 348|#define _16XQ 0 ------------------ 123| 348| const __m256i shufbidx = _mm256_set_epi8(13,12,12,11,10, 9, 9, 8, 124| 348| 8, 7, 6, 5, 5, 4, 4, 3, 125| 348| 10, 9, 9, 8, 7, 6, 6, 5, 126| 348| 5, 4, 3, 2, 2, 1, 1, 0); 127| 348| const __m256i srlvdidx = _mm256_set_epi32(0,0,1,0,0,0,1,0); 128| 348| const __m256i srlvqidx = _mm256_set_epi64x(2,0,2,0); 129| 348| const __m256i shift = _mm256_set_epi16(4,32,1,8,32,1,4,32,4,32,1,8,32,1,4,32); 130| 348| const __m256i mask = _mm256_set1_epi16(32752); 131| | 132| 5.91k| for(i=0;ivec[i],f); 143| 5.56k| } 144| 348|} pqcrystals_kyber1024_avx2_rej_uniform_avx: 275| 4.17k|{ 276| 4.17k| unsigned int ctr, pos; 277| 4.17k| uint16_t val0, val1; 278| 4.17k| uint32_t good; 279| |#ifdef BMI 280| | uint64_t idx0, idx1, idx2, idx3; 281| |#endif 282| 4.17k| const __m256i bound = _mm256_load_si256(&qdata.vec[_16XQ/16]); ------------------ | | 39| 4.17k|#define qdata KYBER_NAMESPACE(qdata) | | ------------------ | | | | 27| 4.17k|#define KYBER_NAMESPACE(s) pqcrystals_kyber1024_avx2_##s | | ------------------ ------------------ const __m256i bound = _mm256_load_si256(&qdata.vec[_16XQ/16]); ------------------ | | 6| 4.17k|#define _16XQ 0 ------------------ 283| 4.17k| const __m256i ones = _mm256_set1_epi8(1); 284| 4.17k| const __m256i mask = _mm256_set1_epi16(0xFFF); 285| 4.17k| const __m256i idx8 = _mm256_set_epi8(15,14,14,13,12,11,11,10, 286| 4.17k| 9, 8, 8, 7, 6, 5, 5, 4, 287| 4.17k| 11,10,10, 9, 8, 7, 7, 6, 288| 4.17k| 5, 4, 4, 3, 2, 1, 1, 0); 289| 4.17k| __m256i f0, f1, g0, g1, g2, g3; 290| 4.17k| __m128i f, t, pilo, pihi; 291| | 292| 4.17k| ctr = pos = 0; 293| 42.3k| while(ctr <= KYBER_N - 32 && pos <= REJ_UNIFORM_AVX_BUFLEN - 48) { ------------------ | | 33| 42.3k|#define KYBER_N 256 ------------------ while(ctr <= KYBER_N - 32 && pos <= REJ_UNIFORM_AVX_BUFLEN - 48) { ------------------ | | 9| 38.1k|#define REJ_UNIFORM_AVX_BUFLEN (REJ_UNIFORM_AVX_NBLOCKS*XOF_BLOCKBYTES) | | ------------------ | | | | 8| 38.1k|#define REJ_UNIFORM_AVX_NBLOCKS ((12*KYBER_N/8*(1 << 12)/KYBER_Q + XOF_BLOCKBYTES)/XOF_BLOCKBYTES) | | | | ------------------ | | | | | | 33| 38.1k|#define KYBER_N 256 | | | | ------------------ | | | | #define REJ_UNIFORM_AVX_NBLOCKS ((12*KYBER_N/8*(1 << 12)/KYBER_Q + XOF_BLOCKBYTES)/XOF_BLOCKBYTES) | | | | ------------------ | | | | | | 34| 38.1k|#define KYBER_Q 3329 | | | | ------------------ | | | | #define REJ_UNIFORM_AVX_NBLOCKS ((12*KYBER_N/8*(1 << 12)/KYBER_Q + XOF_BLOCKBYTES)/XOF_BLOCKBYTES) | | | | ------------------ | | | | | | 50| 38.1k|#define XOF_BLOCKBYTES SHAKE128_RATE | | | | | | ------------------ | | | | | | | | 8| 38.1k|#define SHAKE128_RATE OQS_SHA3_SHAKE128_RATE | | | | | | | | ------------------ | | | | | | | | | | 239| 38.1k|#define OQS_SHA3_SHAKE128_RATE 168 | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | | | #define REJ_UNIFORM_AVX_NBLOCKS ((12*KYBER_N/8*(1 << 12)/KYBER_Q + XOF_BLOCKBYTES)/XOF_BLOCKBYTES) | | | | ------------------ | | | | | | 50| 38.1k|#define XOF_BLOCKBYTES SHAKE128_RATE | | | | | | ------------------ | | | | | | | | 8| 38.1k|#define SHAKE128_RATE OQS_SHA3_SHAKE128_RATE | | | | | | | | ------------------ | | | | | | | | | | 239| 38.1k|#define OQS_SHA3_SHAKE128_RATE 168 | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ | | #define REJ_UNIFORM_AVX_BUFLEN (REJ_UNIFORM_AVX_NBLOCKS*XOF_BLOCKBYTES) | | ------------------ | | | | 50| 38.1k|#define XOF_BLOCKBYTES SHAKE128_RATE | | | | ------------------ | | | | | | 8| 38.1k|#define SHAKE128_RATE OQS_SHA3_SHAKE128_RATE | | | | | | ------------------ | | | | | | | | 239| 38.1k|#define OQS_SHA3_SHAKE128_RATE 168 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ | Branch (293:9): [True: 38.1k, False: 4.16k] | Branch (293:32): [True: 38.1k, False: 9] ------------------ 294| 38.1k| f0 = _mm256_loadu_si256((__m256i *)&buf[pos]); 295| 38.1k| f1 = _mm256_loadu_si256((__m256i *)&buf[pos+24]); 296| 38.1k| f0 = _mm256_permute4x64_epi64(f0, 0x94); 297| 38.1k| f1 = _mm256_permute4x64_epi64(f1, 0x94); 298| 38.1k| f0 = _mm256_shuffle_epi8(f0, idx8); 299| 38.1k| f1 = _mm256_shuffle_epi8(f1, idx8); 300| 38.1k| g0 = _mm256_srli_epi16(f0, 4); 301| 38.1k| g1 = _mm256_srli_epi16(f1, 4); 302| 38.1k| f0 = _mm256_blend_epi16(f0, g0, 0xAA); 303| 38.1k| f1 = _mm256_blend_epi16(f1, g1, 0xAA); 304| 38.1k| f0 = _mm256_and_si256(f0, mask); 305| 38.1k| f1 = _mm256_and_si256(f1, mask); 306| 38.1k| pos += 48; 307| | 308| 38.1k| g0 = _mm256_cmpgt_epi16(bound, f0); 309| 38.1k| g1 = _mm256_cmpgt_epi16(bound, f1); 310| | 311| 38.1k| g0 = _mm256_packs_epi16(g0, g1); 312| 38.1k| good = _mm256_movemask_epi8(g0); 313| | 314| |#ifdef BMI 315| | idx0 = _pdep_u64(good >> 0, 0x0101010101010101); 316| | idx1 = _pdep_u64(good >> 8, 0x0101010101010101); 317| | idx2 = _pdep_u64(good >> 16, 0x0101010101010101); 318| | idx3 = _pdep_u64(good >> 24, 0x0101010101010101); 319| | idx0 = (idx0 << 8) - idx0; 320| | idx0 = _pext_u64(0x0E0C0A0806040200, idx0); 321| | idx1 = (idx1 << 8) - idx1; 322| | idx1 = _pext_u64(0x0E0C0A0806040200, idx1); 323| | idx2 = (idx2 << 8) - idx2; 324| | idx2 = _pext_u64(0x0E0C0A0806040200, idx2); 325| | idx3 = (idx3 << 8) - idx3; 326| | idx3 = _pext_u64(0x0E0C0A0806040200, idx3); 327| | 328| | g0 = _mm256_castsi128_si256(_mm_cvtsi64_si128(idx0)); 329| | g1 = _mm256_castsi128_si256(_mm_cvtsi64_si128(idx1)); 330| | g0 = _mm256_inserti128_si256(g0, _mm_cvtsi64_si128(idx2), 1); 331| | g1 = _mm256_inserti128_si256(g1, _mm_cvtsi64_si128(idx3), 1); 332| |#else 333| 38.1k| g0 = _mm256_castsi128_si256(_mm_loadl_epi64((__m128i *)&idx[(good >> 0) & 0xFF])); 334| 38.1k| g1 = _mm256_castsi128_si256(_mm_loadl_epi64((__m128i *)&idx[(good >> 8) & 0xFF])); 335| 38.1k| g0 = _mm256_inserti128_si256(g0, _mm_loadl_epi64((__m128i *)&idx[(good >> 16) & 0xFF]), 1); 336| 38.1k| g1 = _mm256_inserti128_si256(g1, _mm_loadl_epi64((__m128i *)&idx[(good >> 24) & 0xFF]), 1); 337| 38.1k|#endif 338| | 339| 38.1k| g2 = _mm256_add_epi8(g0, ones); 340| 38.1k| g3 = _mm256_add_epi8(g1, ones); 341| 38.1k| g0 = _mm256_unpacklo_epi8(g0, g2); 342| 38.1k| g1 = _mm256_unpacklo_epi8(g1, g3); 343| | 344| 38.1k| f0 = _mm256_shuffle_epi8(f0, g0); 345| 38.1k| f1 = _mm256_shuffle_epi8(f1, g1); 346| | 347| 38.1k| _mm_storeu_si128((__m128i *)&r[ctr], _mm256_castsi256_si128(f0)); 348| 38.1k| ctr += _mm_popcnt_u32((good >> 0) & 0xFF); 349| 38.1k| _mm_storeu_si128((__m128i *)&r[ctr], _mm256_extracti128_si256(f0, 1)); 350| 38.1k| ctr += _mm_popcnt_u32((good >> 16) & 0xFF); 351| 38.1k| _mm_storeu_si128((__m128i *)&r[ctr], _mm256_castsi256_si128(f1)); 352| 38.1k| ctr += _mm_popcnt_u32((good >> 8) & 0xFF); 353| 38.1k| _mm_storeu_si128((__m128i *)&r[ctr], _mm256_extracti128_si256(f1, 1)); 354| 38.1k| ctr += _mm_popcnt_u32((good >> 24) & 0xFF); 355| 38.1k| } 356| | 357| 13.9k| while(ctr <= KYBER_N - 8 && pos <= REJ_UNIFORM_AVX_BUFLEN - 12) { ------------------ | | 33| 13.9k|#define KYBER_N 256 ------------------ while(ctr <= KYBER_N - 8 && pos <= REJ_UNIFORM_AVX_BUFLEN - 12) { ------------------ | | 9| 9.89k|#define REJ_UNIFORM_AVX_BUFLEN (REJ_UNIFORM_AVX_NBLOCKS*XOF_BLOCKBYTES) | | ------------------ | | | | 8| 9.89k|#define REJ_UNIFORM_AVX_NBLOCKS ((12*KYBER_N/8*(1 << 12)/KYBER_Q + XOF_BLOCKBYTES)/XOF_BLOCKBYTES) | | | | ------------------ | | | | | | 33| 9.89k|#define KYBER_N 256 | | | | ------------------ | | | | #define REJ_UNIFORM_AVX_NBLOCKS ((12*KYBER_N/8*(1 << 12)/KYBER_Q + XOF_BLOCKBYTES)/XOF_BLOCKBYTES) | | | | ------------------ | | | | | | 34| 9.89k|#define KYBER_Q 3329 | | | | ------------------ | | | | #define REJ_UNIFORM_AVX_NBLOCKS ((12*KYBER_N/8*(1 << 12)/KYBER_Q + XOF_BLOCKBYTES)/XOF_BLOCKBYTES) | | | | ------------------ | | | | | | 50| 9.89k|#define XOF_BLOCKBYTES SHAKE128_RATE | | | | | | ------------------ | | | | | | | | 8| 9.89k|#define SHAKE128_RATE OQS_SHA3_SHAKE128_RATE | | | | | | | | ------------------ | | | | | | | | | | 239| 9.89k|#define OQS_SHA3_SHAKE128_RATE 168 | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | | | #define REJ_UNIFORM_AVX_NBLOCKS ((12*KYBER_N/8*(1 << 12)/KYBER_Q + XOF_BLOCKBYTES)/XOF_BLOCKBYTES) | | | | ------------------ | | | | | | 50| 9.89k|#define XOF_BLOCKBYTES SHAKE128_RATE | | | | | | ------------------ | | | | | | | | 8| 9.89k|#define SHAKE128_RATE OQS_SHA3_SHAKE128_RATE | | | | | | | | ------------------ | | | | | | | | | | 239| 9.89k|#define OQS_SHA3_SHAKE128_RATE 168 | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ | | #define REJ_UNIFORM_AVX_BUFLEN (REJ_UNIFORM_AVX_NBLOCKS*XOF_BLOCKBYTES) | | ------------------ | | | | 50| 9.89k|#define XOF_BLOCKBYTES SHAKE128_RATE | | | | ------------------ | | | | | | 8| 9.89k|#define SHAKE128_RATE OQS_SHA3_SHAKE128_RATE | | | | | | ------------------ | | | | | | | | 239| 9.89k|#define OQS_SHA3_SHAKE128_RATE 168 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ | Branch (357:9): [True: 9.89k, False: 4.09k] | Branch (357:31): [True: 9.81k, False: 81] ------------------ 358| 9.81k| f = _mm_loadu_si128((__m128i *)&buf[pos]); 359| 9.81k| f = _mm_shuffle_epi8(f, _mm256_castsi256_si128(idx8)); 360| 9.81k| t = _mm_srli_epi16(f, 4); 361| 9.81k| f = _mm_blend_epi16(f, t, 0xAA); 362| 9.81k| f = _mm_and_si128(f, _mm256_castsi256_si128(mask)); 363| 9.81k| pos += 12; 364| | 365| 9.81k| t = _mm_cmpgt_epi16(_mm256_castsi256_si128(bound), f); 366| 9.81k| good = _mm_movemask_epi8(t); 367| | 368| |#ifdef BMI 369| | good &= 0x5555; 370| | idx0 = _pdep_u64(good, 0x1111111111111111); 371| | idx0 = (idx0 << 8) - idx0; 372| | idx0 = _pext_u64(0x0E0C0A0806040200, idx0); 373| | pilo = _mm_cvtsi64_si128(idx0); 374| |#else 375| 9.81k| good = _pext_u32(good, 0x5555); 376| 9.81k| pilo = _mm_loadl_epi64((__m128i *)&idx[good]); 377| 9.81k|#endif 378| | 379| 9.81k| pihi = _mm_add_epi8(pilo, _mm256_castsi256_si128(ones)); 380| 9.81k| pilo = _mm_unpacklo_epi8(pilo, pihi); 381| 9.81k| f = _mm_shuffle_epi8(f, pilo); 382| 9.81k| _mm_storeu_si128((__m128i *)&r[ctr], f); 383| 9.81k| ctr += _mm_popcnt_u32(good); 384| 9.81k| } 385| | 386| 15.0k| while(ctr < KYBER_N && pos <= REJ_UNIFORM_AVX_BUFLEN - 3) { ------------------ | | 33| 30.0k|#define KYBER_N 256 ------------------ while(ctr < KYBER_N && pos <= REJ_UNIFORM_AVX_BUFLEN - 3) { ------------------ | | 9| 11.1k|#define REJ_UNIFORM_AVX_BUFLEN (REJ_UNIFORM_AVX_NBLOCKS*XOF_BLOCKBYTES) | | ------------------ | | | | 8| 11.1k|#define REJ_UNIFORM_AVX_NBLOCKS ((12*KYBER_N/8*(1 << 12)/KYBER_Q + XOF_BLOCKBYTES)/XOF_BLOCKBYTES) | | | | ------------------ | | | | | | 33| 11.1k|#define KYBER_N 256 | | | | ------------------ | | | | #define REJ_UNIFORM_AVX_NBLOCKS ((12*KYBER_N/8*(1 << 12)/KYBER_Q + XOF_BLOCKBYTES)/XOF_BLOCKBYTES) | | | | ------------------ | | | | | | 34| 11.1k|#define KYBER_Q 3329 | | | | ------------------ | | | | #define REJ_UNIFORM_AVX_NBLOCKS ((12*KYBER_N/8*(1 << 12)/KYBER_Q + XOF_BLOCKBYTES)/XOF_BLOCKBYTES) | | | | ------------------ | | | | | | 50| 11.1k|#define XOF_BLOCKBYTES SHAKE128_RATE | | | | | | ------------------ | | | | | | | | 8| 11.1k|#define SHAKE128_RATE OQS_SHA3_SHAKE128_RATE | | | | | | | | ------------------ | | | | | | | | | | 239| 11.1k|#define OQS_SHA3_SHAKE128_RATE 168 | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | | | #define REJ_UNIFORM_AVX_NBLOCKS ((12*KYBER_N/8*(1 << 12)/KYBER_Q + XOF_BLOCKBYTES)/XOF_BLOCKBYTES) | | | | ------------------ | | | | | | 50| 11.1k|#define XOF_BLOCKBYTES SHAKE128_RATE | | | | | | ------------------ | | | | | | | | 8| 11.1k|#define SHAKE128_RATE OQS_SHA3_SHAKE128_RATE | | | | | | | | ------------------ | | | | | | | | | | 239| 11.1k|#define OQS_SHA3_SHAKE128_RATE 168 | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ | | #define REJ_UNIFORM_AVX_BUFLEN (REJ_UNIFORM_AVX_NBLOCKS*XOF_BLOCKBYTES) | | ------------------ | | | | 50| 11.1k|#define XOF_BLOCKBYTES SHAKE128_RATE | | | | ------------------ | | | | | | 8| 11.1k|#define SHAKE128_RATE OQS_SHA3_SHAKE128_RATE | | | | | | ------------------ | | | | | | | | 239| 11.1k|#define OQS_SHA3_SHAKE128_RATE 168 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ | Branch (386:9): [True: 11.1k, False: 3.84k] | Branch (386:26): [True: 10.8k, False: 327] ------------------ 387| 10.8k| val0 = ((buf[pos+0] >> 0) | ((uint16_t)buf[pos+1] << 8)) & 0xFFF; 388| 10.8k| val1 = ((buf[pos+1] >> 4) | ((uint16_t)buf[pos+2] << 4)); 389| 10.8k| pos += 3; 390| | 391| 10.8k| if(val0 < KYBER_Q) ------------------ | | 34| 10.8k|#define KYBER_Q 3329 ------------------ | Branch (391:8): [True: 8.81k, False: 2.04k] ------------------ 392| 8.81k| r[ctr++] = val0; 393| 10.8k| if(val1 < KYBER_Q && ctr < KYBER_N) ------------------ | | 34| 21.7k|#define KYBER_Q 3329 ------------------ if(val1 < KYBER_Q && ctr < KYBER_N) ------------------ | | 33| 8.70k|#define KYBER_N 256 ------------------ | Branch (393:8): [True: 8.70k, False: 2.15k] | Branch (393:26): [True: 7.11k, False: 1.59k] ------------------ 394| 7.11k| r[ctr++] = val1; 395| 10.8k| } 396| | 397| 4.17k| return ctr; 398| 4.17k|} pqcrystals_kyber1024_avx2_kyber_shake256_prf: 44| 174|{ 45| 174| uint8_t extkey[KYBER_SYMBYTES+1]; 46| | 47| 174| memcpy(extkey, key, KYBER_SYMBYTES); ------------------ | | 36| 174|#define KYBER_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 48| 174| extkey[KYBER_SYMBYTES] = nonce; ------------------ | | 36| 174|#define KYBER_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 49| | 50| 174| shake256(out, outlen, extkey, sizeof(extkey)); ------------------ | | 12| 174|#define shake256 OQS_SHA3_shake256 ------------------ 51| 174|} pqcrystals_kyber1024_avx2_verify: 18| 87|{ 19| 87| size_t i; 20| 87| uint64_t r; 21| 87| __m256i f, g, h; 22| | 23| 87| h = _mm256_setzero_si256(); 24| 4.35k| for(i=0;i> 63; 39| 87| return r; 40| 87|} pqcrystals_kyber1024_avx2_cmov: 56| 87|{ 57| 87| size_t i; 58| 87| __m256i xvec, rvec, bvec; 59| | 60| 87|#if defined(__GNUC__) || defined(__clang__) 61| | // Prevent the compiler from 62| | // 1) inferring that b is 0/1-valued, and 63| | // 2) handling the two cases with a branch. 64| | // This is not necessary when verify.c and kem.c are separate translation 65| | // units, but we expect that downstream consumers will copy this code and/or 66| | // change how it is built. 67| 87| __asm__("" : "+r"(b) : /* no inputs */); 68| 87|#endif 69| | 70| 87| bvec = _mm256_set1_epi64x(-(uint64_t)b); 71| 174| for(i=0;ivec[4*i+0]); 126| 472| f1 = _mm256_load_si256(&a->vec[4*i+1]); 127| 472| f2 = _mm256_load_si256(&a->vec[4*i+2]); 128| 472| f3 = _mm256_load_si256(&a->vec[4*i+3]); 129| 472| f0 = _mm256_mulhi_epi16(f0,v); 130| 472| f1 = _mm256_mulhi_epi16(f1,v); 131| 472| f2 = _mm256_mulhi_epi16(f2,v); 132| 472| f3 = _mm256_mulhi_epi16(f3,v); 133| 472| f0 = _mm256_mulhrs_epi16(f0,shift1); 134| 472| f1 = _mm256_mulhrs_epi16(f1,shift1); 135| 472| f2 = _mm256_mulhrs_epi16(f2,shift1); 136| 472| f3 = _mm256_mulhrs_epi16(f3,shift1); 137| 472| f0 = _mm256_and_si256(f0,mask); 138| 472| f1 = _mm256_and_si256(f1,mask); 139| 472| f2 = _mm256_and_si256(f2,mask); 140| 472| f3 = _mm256_and_si256(f3,mask); 141| 472| f0 = _mm256_packus_epi16(f0,f1); 142| 472| f2 = _mm256_packus_epi16(f2,f3); 143| 472| f0 = _mm256_maddubs_epi16(f0,shift2); 144| 472| f2 = _mm256_maddubs_epi16(f2,shift2); 145| 472| f0 = _mm256_packus_epi16(f0,f2); 146| 472| f0 = _mm256_permutevar8x32_epi32(f0,permdidx); 147| 472| _mm256_storeu_si256((__m256i *)&r[32*i],f0); 148| 472| } 149| 118|} pqcrystals_kyber512_avx2_poly_decompress: 152| 59|{ 153| 59| unsigned int i; 154| 59| __m128i t; 155| 59| __m256i f; 156| 59| const __m256i q = _mm256_load_si256(&qdata.vec[_16XQ/16]); ------------------ | | 39| 59|#define qdata KYBER_NAMESPACE(qdata) | | ------------------ | | | | 15| 59|#define KYBER_NAMESPACE(s) pqcrystals_kyber512_avx2_##s | | ------------------ ------------------ const __m256i q = _mm256_load_si256(&qdata.vec[_16XQ/16]); ------------------ | | 6| 59|#define _16XQ 0 ------------------ 157| 59| const __m256i shufbidx = _mm256_set_epi8(7,7,7,7,6,6,6,6,5,5,5,5,4,4,4,4, 158| 59| 3,3,3,3,2,2,2,2,1,1,1,1,0,0,0,0); 159| 59| const __m256i mask = _mm256_set1_epi32(0x00F0000F); 160| 59| const __m256i shift = _mm256_set1_epi32((128 << 16) + 2048); 161| | 162| 1.00k| for(i=0;ivec[i],f); 170| 944| } 171| 59|} pqcrystals_kyber512_avx2_poly_tobytes: 255| 236|{ 256| 236| ntttobytes_avx(r, a->vec, qdata.vec); ------------------ | | 23| 236|#define ntttobytes_avx KYBER_NAMESPACE(ntttobytes_avx) | | ------------------ | | | | 15| 236|#define KYBER_NAMESPACE(s) pqcrystals_kyber512_avx2_##s | | ------------------ ------------------ ntttobytes_avx(r, a->vec, qdata.vec); ------------------ | | 39| 236|#define qdata KYBER_NAMESPACE(qdata) | | ------------------ | | | | 15| 236|#define KYBER_NAMESPACE(s) pqcrystals_kyber512_avx2_##s | | ------------------ ------------------ 257| 236|} pqcrystals_kyber512_avx2_poly_frombytes: 270| 354|{ 271| 354| nttfrombytes_avx(r->vec, a, qdata.vec); ------------------ | | 25| 354|#define nttfrombytes_avx KYBER_NAMESPACE(nttfrombytes_avx) | | ------------------ | | | | 15| 354|#define KYBER_NAMESPACE(s) pqcrystals_kyber512_avx2_##s | | ------------------ ------------------ nttfrombytes_avx(r->vec, a, qdata.vec); ------------------ | | 39| 354|#define qdata KYBER_NAMESPACE(qdata) | | ------------------ | | | | 15| 354|#define KYBER_NAMESPACE(s) pqcrystals_kyber512_avx2_##s | | ------------------ ------------------ 272| 354|} pqcrystals_kyber512_avx2_poly_frommsg: 283| 118|{ 284| |#if (KYBER_INDCPA_MSGBYTES != 32) 285| |#error "KYBER_INDCPA_MSGBYTES must be equal to 32!" 286| |#endif 287| 118| __m256i f, g0, g1, g2, g3, h0, h1, h2, h3; 288| 118| const __m256i shift = _mm256_broadcastsi128_si256(_mm_set_epi32(0,1,2,3)); 289| 118| const __m256i idx = _mm256_broadcastsi128_si256(_mm_set_epi8(15,14,11,10,7,6,3,2,13,12,9,8,5,4,1,0)); 290| 118| const __m256i hqs = _mm256_set1_epi16((KYBER_Q+1)/2); ------------------ | | 34| 118|#define KYBER_Q 3329 ------------------ 291| | 292| 118|#define FROMMSG64(i) \ 293| 118| g3 = _mm256_shuffle_epi32(f,0x55*i); \ 294| 118| g3 = _mm256_sllv_epi32(g3,shift); \ 295| 118| g3 = _mm256_shuffle_epi8(g3,idx); \ 296| 118| g0 = _mm256_slli_epi16(g3,12); \ 297| 118| g1 = _mm256_slli_epi16(g3,8); \ 298| 118| g2 = _mm256_slli_epi16(g3,4); \ 299| 118| g0 = _mm256_srai_epi16(g0,15); \ 300| 118| g1 = _mm256_srai_epi16(g1,15); \ 301| 118| g2 = _mm256_srai_epi16(g2,15); \ 302| 118| g3 = _mm256_srai_epi16(g3,15); \ 303| 118| g0 = _mm256_and_si256(g0,hqs); /* 19 18 17 16 3 2 1 0 */ \ 304| 118| g1 = _mm256_and_si256(g1,hqs); /* 23 22 21 20 7 6 5 4 */ \ 305| 118| g2 = _mm256_and_si256(g2,hqs); /* 27 26 25 24 11 10 9 8 */ \ 306| 118| g3 = _mm256_and_si256(g3,hqs); /* 31 30 29 28 15 14 13 12 */ \ 307| 118| h0 = _mm256_unpacklo_epi64(g0,g1); \ 308| 118| h2 = _mm256_unpackhi_epi64(g0,g1); \ 309| 118| h1 = _mm256_unpacklo_epi64(g2,g3); \ 310| 118| h3 = _mm256_unpackhi_epi64(g2,g3); \ 311| 118| g0 = _mm256_permute2x128_si256(h0,h1,0x20); \ 312| 118| g2 = _mm256_permute2x128_si256(h0,h1,0x31); \ 313| 118| g1 = _mm256_permute2x128_si256(h2,h3,0x20); \ 314| 118| g3 = _mm256_permute2x128_si256(h2,h3,0x31); \ 315| 118| _mm256_store_si256(&r->vec[0+2*i+0],g0); \ 316| 118| _mm256_store_si256(&r->vec[0+2*i+1],g1); \ 317| 118| _mm256_store_si256(&r->vec[8+2*i+0],g2); \ 318| 118| _mm256_store_si256(&r->vec[8+2*i+1],g3) 319| | 320| 118| f = _mm256_loadu_si256((__m256i *)msg); 321| 118| FROMMSG64(0); ------------------ | | 293| 118| g3 = _mm256_shuffle_epi32(f,0x55*i); \ | | 294| 118| g3 = _mm256_sllv_epi32(g3,shift); \ | | 295| 118| g3 = _mm256_shuffle_epi8(g3,idx); \ | | 296| 118| g0 = _mm256_slli_epi16(g3,12); \ | | 297| 118| g1 = _mm256_slli_epi16(g3,8); \ | | 298| 118| g2 = _mm256_slli_epi16(g3,4); \ | | 299| 118| g0 = _mm256_srai_epi16(g0,15); \ | | 300| 118| g1 = _mm256_srai_epi16(g1,15); \ | | 301| 118| g2 = _mm256_srai_epi16(g2,15); \ | | 302| 118| g3 = _mm256_srai_epi16(g3,15); \ | | 303| 118| g0 = _mm256_and_si256(g0,hqs); /* 19 18 17 16 3 2 1 0 */ \ | | 304| 118| g1 = _mm256_and_si256(g1,hqs); /* 23 22 21 20 7 6 5 4 */ \ | | 305| 118| g2 = _mm256_and_si256(g2,hqs); /* 27 26 25 24 11 10 9 8 */ \ | | 306| 118| g3 = _mm256_and_si256(g3,hqs); /* 31 30 29 28 15 14 13 12 */ \ | | 307| 118| h0 = _mm256_unpacklo_epi64(g0,g1); \ | | 308| 118| h2 = _mm256_unpackhi_epi64(g0,g1); \ | | 309| 118| h1 = _mm256_unpacklo_epi64(g2,g3); \ | | 310| 118| h3 = _mm256_unpackhi_epi64(g2,g3); \ | | 311| 118| g0 = _mm256_permute2x128_si256(h0,h1,0x20); \ | | 312| 118| g2 = _mm256_permute2x128_si256(h0,h1,0x31); \ | | 313| 118| g1 = _mm256_permute2x128_si256(h2,h3,0x20); \ | | 314| 118| g3 = _mm256_permute2x128_si256(h2,h3,0x31); \ | | 315| 118| _mm256_store_si256(&r->vec[0+2*i+0],g0); \ | | 316| 118| _mm256_store_si256(&r->vec[0+2*i+1],g1); \ | | 317| 118| _mm256_store_si256(&r->vec[8+2*i+0],g2); \ | | 318| 118| _mm256_store_si256(&r->vec[8+2*i+1],g3) ------------------ 322| 118| FROMMSG64(1); ------------------ | | 293| 118| g3 = _mm256_shuffle_epi32(f,0x55*i); \ | | 294| 118| g3 = _mm256_sllv_epi32(g3,shift); \ | | 295| 118| g3 = _mm256_shuffle_epi8(g3,idx); \ | | 296| 118| g0 = _mm256_slli_epi16(g3,12); \ | | 297| 118| g1 = _mm256_slli_epi16(g3,8); \ | | 298| 118| g2 = _mm256_slli_epi16(g3,4); \ | | 299| 118| g0 = _mm256_srai_epi16(g0,15); \ | | 300| 118| g1 = _mm256_srai_epi16(g1,15); \ | | 301| 118| g2 = _mm256_srai_epi16(g2,15); \ | | 302| 118| g3 = _mm256_srai_epi16(g3,15); \ | | 303| 118| g0 = _mm256_and_si256(g0,hqs); /* 19 18 17 16 3 2 1 0 */ \ | | 304| 118| g1 = _mm256_and_si256(g1,hqs); /* 23 22 21 20 7 6 5 4 */ \ | | 305| 118| g2 = _mm256_and_si256(g2,hqs); /* 27 26 25 24 11 10 9 8 */ \ | | 306| 118| g3 = _mm256_and_si256(g3,hqs); /* 31 30 29 28 15 14 13 12 */ \ | | 307| 118| h0 = _mm256_unpacklo_epi64(g0,g1); \ | | 308| 118| h2 = _mm256_unpackhi_epi64(g0,g1); \ | | 309| 118| h1 = _mm256_unpacklo_epi64(g2,g3); \ | | 310| 118| h3 = _mm256_unpackhi_epi64(g2,g3); \ | | 311| 118| g0 = _mm256_permute2x128_si256(h0,h1,0x20); \ | | 312| 118| g2 = _mm256_permute2x128_si256(h0,h1,0x31); \ | | 313| 118| g1 = _mm256_permute2x128_si256(h2,h3,0x20); \ | | 314| 118| g3 = _mm256_permute2x128_si256(h2,h3,0x31); \ | | 315| 118| _mm256_store_si256(&r->vec[0+2*i+0],g0); \ | | 316| 118| _mm256_store_si256(&r->vec[0+2*i+1],g1); \ | | 317| 118| _mm256_store_si256(&r->vec[8+2*i+0],g2); \ | | 318| 118| _mm256_store_si256(&r->vec[8+2*i+1],g3) ------------------ 323| 118| FROMMSG64(2); ------------------ | | 293| 118| g3 = _mm256_shuffle_epi32(f,0x55*i); \ | | 294| 118| g3 = _mm256_sllv_epi32(g3,shift); \ | | 295| 118| g3 = _mm256_shuffle_epi8(g3,idx); \ | | 296| 118| g0 = _mm256_slli_epi16(g3,12); \ | | 297| 118| g1 = _mm256_slli_epi16(g3,8); \ | | 298| 118| g2 = _mm256_slli_epi16(g3,4); \ | | 299| 118| g0 = _mm256_srai_epi16(g0,15); \ | | 300| 118| g1 = _mm256_srai_epi16(g1,15); \ | | 301| 118| g2 = _mm256_srai_epi16(g2,15); \ | | 302| 118| g3 = _mm256_srai_epi16(g3,15); \ | | 303| 118| g0 = _mm256_and_si256(g0,hqs); /* 19 18 17 16 3 2 1 0 */ \ | | 304| 118| g1 = _mm256_and_si256(g1,hqs); /* 23 22 21 20 7 6 5 4 */ \ | | 305| 118| g2 = _mm256_and_si256(g2,hqs); /* 27 26 25 24 11 10 9 8 */ \ | | 306| 118| g3 = _mm256_and_si256(g3,hqs); /* 31 30 29 28 15 14 13 12 */ \ | | 307| 118| h0 = _mm256_unpacklo_epi64(g0,g1); \ | | 308| 118| h2 = _mm256_unpackhi_epi64(g0,g1); \ | | 309| 118| h1 = _mm256_unpacklo_epi64(g2,g3); \ | | 310| 118| h3 = _mm256_unpackhi_epi64(g2,g3); \ | | 311| 118| g0 = _mm256_permute2x128_si256(h0,h1,0x20); \ | | 312| 118| g2 = _mm256_permute2x128_si256(h0,h1,0x31); \ | | 313| 118| g1 = _mm256_permute2x128_si256(h2,h3,0x20); \ | | 314| 118| g3 = _mm256_permute2x128_si256(h2,h3,0x31); \ | | 315| 118| _mm256_store_si256(&r->vec[0+2*i+0],g0); \ | | 316| 118| _mm256_store_si256(&r->vec[0+2*i+1],g1); \ | | 317| 118| _mm256_store_si256(&r->vec[8+2*i+0],g2); \ | | 318| 118| _mm256_store_si256(&r->vec[8+2*i+1],g3) ------------------ 324| | FROMMSG64(3); ------------------ | | 293| 118| g3 = _mm256_shuffle_epi32(f,0x55*i); \ | | 294| 118| g3 = _mm256_sllv_epi32(g3,shift); \ | | 295| 118| g3 = _mm256_shuffle_epi8(g3,idx); \ | | 296| 118| g0 = _mm256_slli_epi16(g3,12); \ | | 297| 118| g1 = _mm256_slli_epi16(g3,8); \ | | 298| 118| g2 = _mm256_slli_epi16(g3,4); \ | | 299| 118| g0 = _mm256_srai_epi16(g0,15); \ | | 300| 118| g1 = _mm256_srai_epi16(g1,15); \ | | 301| 118| g2 = _mm256_srai_epi16(g2,15); \ | | 302| 118| g3 = _mm256_srai_epi16(g3,15); \ | | 303| 118| g0 = _mm256_and_si256(g0,hqs); /* 19 18 17 16 3 2 1 0 */ \ | | 304| 118| g1 = _mm256_and_si256(g1,hqs); /* 23 22 21 20 7 6 5 4 */ \ | | 305| 118| g2 = _mm256_and_si256(g2,hqs); /* 27 26 25 24 11 10 9 8 */ \ | | 306| 118| g3 = _mm256_and_si256(g3,hqs); /* 31 30 29 28 15 14 13 12 */ \ | | 307| 118| h0 = _mm256_unpacklo_epi64(g0,g1); \ | | 308| 118| h2 = _mm256_unpackhi_epi64(g0,g1); \ | | 309| 118| h1 = _mm256_unpacklo_epi64(g2,g3); \ | | 310| 118| h3 = _mm256_unpackhi_epi64(g2,g3); \ | | 311| 118| g0 = _mm256_permute2x128_si256(h0,h1,0x20); \ | | 312| 118| g2 = _mm256_permute2x128_si256(h0,h1,0x31); \ | | 313| 118| g1 = _mm256_permute2x128_si256(h2,h3,0x20); \ | | 314| 118| g3 = _mm256_permute2x128_si256(h2,h3,0x31); \ | | 315| 118| _mm256_store_si256(&r->vec[0+2*i+0],g0); \ | | 316| 118| _mm256_store_si256(&r->vec[0+2*i+1],g1); \ | | 317| 118| _mm256_store_si256(&r->vec[8+2*i+0],g2); \ | | 318| 118| _mm256_store_si256(&r->vec[8+2*i+1],g3) ------------------ 325| 118|} pqcrystals_kyber512_avx2_poly_tomsg: 339| 59|{ 340| 59| unsigned int i; 341| 59| uint32_t small; 342| 59| __m256i f0, f1, g0, g1; 343| 59| const __m256i hq = _mm256_set1_epi16((KYBER_Q - 1)/2); ------------------ | | 34| 59|#define KYBER_Q 3329 ------------------ 344| 59| const __m256i hhq = _mm256_set1_epi16((KYBER_Q - 1)/4); ------------------ | | 34| 59|#define KYBER_Q 3329 ------------------ 345| | 346| 531| for(i=0;ivec[2*i+0]); 348| 472| f1 = _mm256_load_si256(&a->vec[2*i+1]); 349| 472| f0 = _mm256_sub_epi16(hq, f0); 350| 472| f1 = _mm256_sub_epi16(hq, f1); 351| 472| g0 = _mm256_srai_epi16(f0, 15); 352| 472| g1 = _mm256_srai_epi16(f1, 15); 353| 472| f0 = _mm256_xor_si256(f0, g0); 354| 472| f1 = _mm256_xor_si256(f1, g1); 355| 472| f0 = _mm256_sub_epi16(f0, hhq); 356| 472| f1 = _mm256_sub_epi16(f1, hhq); 357| 472| f0 = _mm256_packs_epi16(f0, f1); 358| | f0 = _mm256_permute4x64_epi64(f0, 0xD8); 359| 472| small = _mm256_movemask_epi8(f0); 360| 472| memcpy(&msg[4*i], &small, 4); 361| 472| } 362| 59|} pqcrystals_kyber512_avx2_poly_getnoise_eta2: 397| 118|{ 398| 118| ALIGNED_UINT8(KYBER_ETA2*KYBER_N/4) buf; ------------------ | | 8| 118| union { \ | | 9| 118| uint8_t coeffs[N]; \ | | 10| 118| __m256i vec[(N+31)/32]; \ | | 11| 118| } ------------------ 399| 118| prf(buf.coeffs, KYBER_ETA2*KYBER_N/4, seed, nonce); ------------------ | | 58| 118| kyber_shake256_prf(OUT, OUTBYTES, KEY, NONCE) | | ------------------ | | | | 44| 118|#define kyber_shake256_prf KYBER_NAMESPACE(kyber_shake256_prf) | | | | ------------------ | | | | | | 15| 118|#define KYBER_NAMESPACE(s) pqcrystals_kyber512_avx2_##s | | | | ------------------ | | ------------------ ------------------ 400| 118| poly_cbd_eta2(r, buf.vec); ------------------ | | 12| 118|#define poly_cbd_eta2 KYBER_NAMESPACE(poly_cbd_eta2) | | ------------------ | | | | 15| 118|#define KYBER_NAMESPACE(s) pqcrystals_kyber512_avx2_##s | | ------------------ ------------------ 401| 118|} pqcrystals_kyber512_avx2_poly_getnoise_eta2_4x: 415| 59|{ 416| 59| ALIGNED_UINT8(NOISE_NBLOCKS*SHAKE256_RATE) buf[4]; ------------------ | | 8| 59| union { \ | | 9| 59| uint8_t coeffs[N]; \ | | 10| 59| __m256i vec[(N+31)/32]; \ | | 11| 59| } ------------------ 417| 59| __m256i f; 418| 59| shake256x4incctx state; ------------------ | | 27| 59|#define shake256x4incctx OQS_SHA3_shake256_x4_inc_ctx ------------------ 419| | 420| 59| f = _mm256_loadu_si256((__m256i *)seed); 421| 59| _mm256_store_si256(buf[0].vec, f); 422| 59| _mm256_store_si256(buf[1].vec, f); 423| 59| _mm256_store_si256(buf[2].vec, f); 424| 59| _mm256_store_si256(buf[3].vec, f); 425| | 426| 59| buf[0].coeffs[32] = nonce0; 427| 59| buf[1].coeffs[32] = nonce1; 428| 59| buf[2].coeffs[32] = nonce2; 429| 59| buf[3].coeffs[32] = nonce3; 430| | 431| 59| shake256x4_inc_init(&state); ------------------ | | 28| 59|#define shake256x4_inc_init OQS_SHA3_shake256_x4_inc_init ------------------ 432| 59| shake256x4_absorb_once(&state, buf[0].coeffs, buf[1].coeffs, buf[2].coeffs, buf[3].coeffs, 33); ------------------ | | 42| 59|#define shake256x4_absorb_once OQS_SHA3_shake256_x4_absorb_once ------------------ 433| 59| shake256x4_squeezeblocks(buf[0].coeffs, buf[1].coeffs, buf[2].coeffs, buf[3].coeffs, NOISE_NBLOCKS, &state); ------------------ | | 49| 59| OQS_SHA3_shake256_x4_inc_squeeze(OUT0, OUT1, OUT2, OUT3, (NBLOCKS)*OQS_SHA3_SHAKE256_RATE, STATE) | | ------------------ | | | | 320| 59|#define OQS_SHA3_SHAKE256_RATE 136 | | ------------------ ------------------ 434| 59| shake256x4_inc_ctx_release(&state); ------------------ | | 32| 59|#define shake256x4_inc_ctx_release OQS_SHA3_shake256_x4_inc_ctx_release ------------------ 435| | 436| 59| poly_cbd_eta1(r0, buf[0].vec); ------------------ | | 9| 59|#define poly_cbd_eta1 KYBER_NAMESPACE(poly_cbd_eta1) | | ------------------ | | | | 15| 59|#define KYBER_NAMESPACE(s) pqcrystals_kyber512_avx2_##s | | ------------------ ------------------ 437| 59| poly_cbd_eta1(r1, buf[1].vec); ------------------ | | 9| 59|#define poly_cbd_eta1 KYBER_NAMESPACE(poly_cbd_eta1) | | ------------------ | | | | 15| 59|#define KYBER_NAMESPACE(s) pqcrystals_kyber512_avx2_##s | | ------------------ ------------------ 438| 59| poly_cbd_eta1(r2, buf[2].vec); ------------------ | | 9| 59|#define poly_cbd_eta1 KYBER_NAMESPACE(poly_cbd_eta1) | | ------------------ | | | | 15| 59|#define KYBER_NAMESPACE(s) pqcrystals_kyber512_avx2_##s | | ------------------ ------------------ 439| 59| poly_cbd_eta1(r3, buf[3].vec); ------------------ | | 9| 59|#define poly_cbd_eta1 KYBER_NAMESPACE(poly_cbd_eta1) | | ------------------ | | | | 15| 59|#define KYBER_NAMESPACE(s) pqcrystals_kyber512_avx2_##s | | ------------------ ------------------ 440| 59|} pqcrystals_kyber512_avx2_poly_getnoise_eta1122_4x: 452| 118|{ 453| 118| ALIGNED_UINT8(NOISE_NBLOCKS*SHAKE256_RATE) buf[4]; ------------------ | | 8| 118| union { \ | | 9| 118| uint8_t coeffs[N]; \ | | 10| 118| __m256i vec[(N+31)/32]; \ | | 11| 118| } ------------------ 454| 118| __m256i f; 455| 118| shake256x4incctx state; ------------------ | | 27| 118|#define shake256x4incctx OQS_SHA3_shake256_x4_inc_ctx ------------------ 456| | 457| 118| f = _mm256_loadu_si256((__m256i *)seed); 458| 118| _mm256_store_si256(buf[0].vec, f); 459| 118| _mm256_store_si256(buf[1].vec, f); 460| 118| _mm256_store_si256(buf[2].vec, f); 461| 118| _mm256_store_si256(buf[3].vec, f); 462| | 463| 118| buf[0].coeffs[32] = nonce0; 464| 118| buf[1].coeffs[32] = nonce1; 465| 118| buf[2].coeffs[32] = nonce2; 466| 118| buf[3].coeffs[32] = nonce3; 467| | 468| 118| shake256x4_inc_init(&state); ------------------ | | 28| 118|#define shake256x4_inc_init OQS_SHA3_shake256_x4_inc_init ------------------ 469| 118| shake256x4_absorb_once(&state, buf[0].coeffs, buf[1].coeffs, buf[2].coeffs, buf[3].coeffs, 33); ------------------ | | 42| 118|#define shake256x4_absorb_once OQS_SHA3_shake256_x4_absorb_once ------------------ 470| 118| shake256x4_squeezeblocks(buf[0].coeffs, buf[1].coeffs, buf[2].coeffs, buf[3].coeffs, NOISE_NBLOCKS, &state); ------------------ | | 49| 118| OQS_SHA3_shake256_x4_inc_squeeze(OUT0, OUT1, OUT2, OUT3, (NBLOCKS)*OQS_SHA3_SHAKE256_RATE, STATE) | | ------------------ | | | | 320| 118|#define OQS_SHA3_SHAKE256_RATE 136 | | ------------------ ------------------ 471| 118| shake256x4_inc_ctx_release(&state); ------------------ | | 32| 118|#define shake256x4_inc_ctx_release OQS_SHA3_shake256_x4_inc_ctx_release ------------------ 472| | 473| 118| poly_cbd_eta1(r0, buf[0].vec); ------------------ | | 9| 118|#define poly_cbd_eta1 KYBER_NAMESPACE(poly_cbd_eta1) | | ------------------ | | | | 15| 118|#define KYBER_NAMESPACE(s) pqcrystals_kyber512_avx2_##s | | ------------------ ------------------ 474| 118| poly_cbd_eta1(r1, buf[1].vec); ------------------ | | 9| 118|#define poly_cbd_eta1 KYBER_NAMESPACE(poly_cbd_eta1) | | ------------------ | | | | 15| 118|#define KYBER_NAMESPACE(s) pqcrystals_kyber512_avx2_##s | | ------------------ ------------------ 475| 118| poly_cbd_eta2(r2, buf[2].vec); ------------------ | | 12| 118|#define poly_cbd_eta2 KYBER_NAMESPACE(poly_cbd_eta2) | | ------------------ | | | | 15| 118|#define KYBER_NAMESPACE(s) pqcrystals_kyber512_avx2_##s | | ------------------ ------------------ 476| 118| poly_cbd_eta2(r3, buf[3].vec); ------------------ | | 12| 118|#define poly_cbd_eta2 KYBER_NAMESPACE(poly_cbd_eta2) | | ------------------ | | | | 15| 118|#define KYBER_NAMESPACE(s) pqcrystals_kyber512_avx2_##s | | ------------------ ------------------ 477| 118|} pqcrystals_kyber512_avx2_poly_ntt: 495| 590|{ 496| 590| ntt_avx(r->vec, qdata.vec); ------------------ | | 7| 590|#define ntt_avx KYBER_NAMESPACE(ntt_avx) | | ------------------ | | | | 15| 590|#define KYBER_NAMESPACE(s) pqcrystals_kyber512_avx2_##s | | ------------------ ------------------ ntt_avx(r->vec, qdata.vec); ------------------ | | 39| 590|#define qdata KYBER_NAMESPACE(qdata) | | ------------------ | | | | 15| 590|#define KYBER_NAMESPACE(s) pqcrystals_kyber512_avx2_##s | | ------------------ ------------------ 497| 590|} pqcrystals_kyber512_avx2_poly_invntt_tomont: 512| 413|{ 513| 413| invntt_avx(r->vec, qdata.vec); ------------------ | | 9| 413|#define invntt_avx KYBER_NAMESPACE(invntt_avx) | | ------------------ | | | | 15| 413|#define KYBER_NAMESPACE(s) pqcrystals_kyber512_avx2_##s | | ------------------ ------------------ invntt_avx(r->vec, qdata.vec); ------------------ | | 39| 413|#define qdata KYBER_NAMESPACE(qdata) | | ------------------ | | | | 15| 413|#define KYBER_NAMESPACE(s) pqcrystals_kyber512_avx2_##s | | ------------------ ------------------ 514| 413|} pqcrystals_kyber512_avx2_poly_nttunpack: 517| 708|{ 518| 708| nttunpack_avx(r->vec, qdata.vec); ------------------ | | 14| 708|#define nttunpack_avx KYBER_NAMESPACE(nttunpack_avx) | | ------------------ | | | | 15| 708|#define KYBER_NAMESPACE(s) pqcrystals_kyber512_avx2_##s | | ------------------ ------------------ nttunpack_avx(r->vec, qdata.vec); ------------------ | | 39| 708|#define qdata KYBER_NAMESPACE(qdata) | | ------------------ | | | | 15| 708|#define KYBER_NAMESPACE(s) pqcrystals_kyber512_avx2_##s | | ------------------ ------------------ 519| 708|} pqcrystals_kyber512_avx2_poly_basemul_montgomery: 534| 1.06k|{ 535| 1.06k| basemul_avx(r->vec, a->vec, b->vec, qdata.vec); ------------------ | | 17| 1.06k|#define basemul_avx KYBER_NAMESPACE(basemul_avx) | | ------------------ | | | | 15| 1.06k|#define KYBER_NAMESPACE(s) pqcrystals_kyber512_avx2_##s | | ------------------ ------------------ basemul_avx(r->vec, a->vec, b->vec, qdata.vec); ------------------ | | 39| 1.06k|#define qdata KYBER_NAMESPACE(qdata) | | ------------------ | | | | 15| 1.06k|#define KYBER_NAMESPACE(s) pqcrystals_kyber512_avx2_##s | | ------------------ ------------------ 536| 1.06k|} pqcrystals_kyber512_avx2_poly_tomont: 547| 118|{ 548| 118| tomont_avx(r->vec, qdata.vec); ------------------ | | 9| 118|#define tomont_avx KYBER_NAMESPACE(tomont_avx) | | ------------------ | | | | 15| 118|#define KYBER_NAMESPACE(s) pqcrystals_kyber512_avx2_##s | | ------------------ ------------------ tomont_avx(r->vec, qdata.vec); ------------------ | | 39| 118|#define qdata KYBER_NAMESPACE(qdata) | | ------------------ | | | | 15| 118|#define KYBER_NAMESPACE(s) pqcrystals_kyber512_avx2_##s | | ------------------ ------------------ 549| 118|} pqcrystals_kyber512_avx2_poly_reduce: 560| 649|{ 561| 649| reduce_avx(r->vec, qdata.vec); ------------------ | | 7| 649|#define reduce_avx KYBER_NAMESPACE(reduce_avx) | | ------------------ | | | | 15| 649|#define KYBER_NAMESPACE(s) pqcrystals_kyber512_avx2_##s | | ------------------ ------------------ reduce_avx(r->vec, qdata.vec); ------------------ | | 39| 649|#define qdata KYBER_NAMESPACE(qdata) | | ------------------ | | | | 15| 649|#define KYBER_NAMESPACE(s) pqcrystals_kyber512_avx2_##s | | ------------------ ------------------ 562| 649|} pqcrystals_kyber512_avx2_poly_add: 575| 1.12k|{ 576| 1.12k| unsigned int i; 577| 1.12k| __m256i f0, f1; 578| | 579| 19.0k| for(i=0;ivec[i]); 581| 17.9k| f1 = _mm256_load_si256(&b->vec[i]); 582| 17.9k| f0 = _mm256_add_epi16(f0, f1); 583| 17.9k| _mm256_store_si256(&r->vec[i], f0); 584| 17.9k| } 585| 1.12k|} pqcrystals_kyber512_avx2_poly_sub: 598| 59|{ 599| 59| unsigned int i; 600| 59| __m256i f0, f1; 601| | 602| 1.00k| for(i=0;ivec[i]); 604| 944| f1 = _mm256_load_si256(&b->vec[i]); 605| 944| f0 = _mm256_sub_epi16(f0, f1); 606| 944| _mm256_store_si256(&r->vec[i], f0); 607| 944| } 608| 59|} pqcrystals_kyber512_avx2_polyvec_compress: 158| 118|{ 159| 118| unsigned int i; 160| | 161| 118|#if (KYBER_POLYVECCOMPRESSEDBYTES == (KYBER_K * 320)) 162| 354| for(i=0;ivec[i]); 164| |#elif (KYBER_POLYVECCOMPRESSEDBYTES == (KYBER_K * 352)) 165| | for(i=0;ivec[i]); 167| |#endif 168| 118|} pqcrystals_kyber512_avx2_polyvec_decompress: 181| 59|{ 182| 59| unsigned int i; 183| | 184| 59|#if (KYBER_POLYVECCOMPRESSEDBYTES == (KYBER_K * 320)) 185| 177| for(i=0;ivec[i],&a[320*i]); 187| |#elif (KYBER_POLYVECCOMPRESSEDBYTES == (KYBER_K * 352)) 188| | for(i=0;ivec[i],&a[352*i]); 190| |#endif 191| 59|} pqcrystals_kyber512_avx2_polyvec_tobytes: 203| 118|{ 204| 118| unsigned int i; 205| 354| for(i=0;ivec[i]); ------------------ | | 15| 236|#define poly_tobytes KYBER_NAMESPACE(poly_tobytes) | | ------------------ | | | | 15| 236|#define KYBER_NAMESPACE(s) pqcrystals_kyber512_avx2_##s | | ------------------ ------------------ poly_tobytes(r+i*KYBER_POLYBYTES, &a->vec[i]); ------------------ | | 39| 236|#define KYBER_POLYBYTES 384 ------------------ 207| 118|} pqcrystals_kyber512_avx2_polyvec_frombytes: 220| 177|{ 221| 177| unsigned int i; 222| 531| for(i=0;ivec[i], a+i*KYBER_POLYBYTES); ------------------ | | 17| 354|#define poly_frombytes KYBER_NAMESPACE(poly_frombytes) | | ------------------ | | | | 15| 354|#define KYBER_NAMESPACE(s) pqcrystals_kyber512_avx2_##s | | ------------------ ------------------ poly_frombytes(&r->vec[i], a+i*KYBER_POLYBYTES); ------------------ | | 39| 354|#define KYBER_POLYBYTES 384 ------------------ 224| 177|} pqcrystals_kyber512_avx2_polyvec_ntt: 234| 295|{ 235| 295| unsigned int i; 236| 885| for(i=0;ivec[i]); ------------------ | | 58| 590|#define poly_ntt KYBER_NAMESPACE(poly_ntt) | | ------------------ | | | | 15| 590|#define KYBER_NAMESPACE(s) pqcrystals_kyber512_avx2_##s | | ------------------ ------------------ 238| 295|} pqcrystals_kyber512_avx2_polyvec_invntt_tomont: 249| 118|{ 250| 118| unsigned int i; 251| 354| for(i=0;ivec[i]); ------------------ | | 60| 236|#define poly_invntt_tomont KYBER_NAMESPACE(poly_invntt_tomont) | | ------------------ | | | | 15| 236|#define KYBER_NAMESPACE(s) pqcrystals_kyber512_avx2_##s | | ------------------ ------------------ 253| 118|} pqcrystals_kyber512_avx2_polyvec_basemul_acc_montgomery: 266| 531|{ 267| 531| unsigned int i; 268| 531| poly tmp; 269| | 270| 531| poly_basemul_montgomery(r,&a->vec[0],&b->vec[0]); ------------------ | | 64| 531|#define poly_basemul_montgomery KYBER_NAMESPACE(poly_basemul_montgomery) | | ------------------ | | | | 15| 531|#define KYBER_NAMESPACE(s) pqcrystals_kyber512_avx2_##s | | ------------------ ------------------ 271| 1.06k| for(i=1;ivec[i],&b->vec[i]); ------------------ | | 64| 531|#define poly_basemul_montgomery KYBER_NAMESPACE(poly_basemul_montgomery) | | ------------------ | | | | 15| 531|#define KYBER_NAMESPACE(s) pqcrystals_kyber512_avx2_##s | | ------------------ ------------------ 273| 531| poly_add(r,r,&tmp); ------------------ | | 72| 531|#define poly_add KYBER_NAMESPACE(poly_add) | | ------------------ | | | | 15| 531|#define KYBER_NAMESPACE(s) pqcrystals_kyber512_avx2_##s | | ------------------ ------------------ 274| 531| } 275| 531|} pqcrystals_kyber512_avx2_polyvec_reduce: 287| 236|{ 288| 236| unsigned int i; 289| 708| for(i=0;ivec[i]); ------------------ | | 69| 472|#define poly_reduce KYBER_NAMESPACE(poly_reduce) | | ------------------ | | | | 15| 472|#define KYBER_NAMESPACE(s) pqcrystals_kyber512_avx2_##s | | ------------------ ------------------ 291| 236|} pqcrystals_kyber512_avx2_polyvec_add: 303| 177|{ 304| 177| unsigned int i; 305| 531| for(i=0;ivec[i], &a->vec[i], &b->vec[i]); ------------------ | | 72| 354|#define poly_add KYBER_NAMESPACE(poly_add) | | ------------------ | | | | 15| 354|#define KYBER_NAMESPACE(s) pqcrystals_kyber512_avx2_##s | | ------------------ ------------------ 307| 177|} polyvec.c:poly_compress10: 12| 1.00k|{ 13| 1.00k| unsigned int i; 14| 1.00k| __m256i f0, f1, f2; 15| 1.00k| __m128i t0, t1; 16| 1.00k| const __m256i v = _mm256_load_si256(&qdata.vec[_16XV/16]); ------------------ | | 39| 1.00k|#define qdata KYBER_NAMESPACE(qdata) | | ------------------ | | | | 15| 1.00k|#define KYBER_NAMESPACE(s) pqcrystals_kyber512_avx2_##s | | ------------------ ------------------ const __m256i v = _mm256_load_si256(&qdata.vec[_16XV/16]); ------------------ | | 8| 1.00k|#define _16XV 32 ------------------ 17| 1.00k| const __m256i v8 = _mm256_slli_epi16(v,3); 18| 1.00k| const __m256i off = _mm256_set1_epi16(15); 19| 1.00k| const __m256i shift1 = _mm256_set1_epi16(1 << 12); 20| 1.00k| const __m256i mask = _mm256_set1_epi16(1023); 21| 1.00k| const __m256i shift2 = _mm256_set1_epi64x((1024LL << 48) + (1LL << 32) + (1024 << 16) + 1); 22| 1.00k| const __m256i sllvdidx = _mm256_set1_epi64x(12); 23| 1.00k| const __m256i shufbidx = _mm256_set_epi8( 8, 4, 3, 2, 1, 0,-1,-1,-1,-1,-1,-1,12,11,10, 9, 24| 1.00k| -1,-1,-1,-1,-1,-1,12,11,10, 9, 8, 4, 3, 2, 1, 0); 25| | 26| 17.0k| for(i=0;ivec[i]); 28| 16.0k| f1 = _mm256_mullo_epi16(f0,v8); 29| 16.0k| f2 = _mm256_add_epi16(f0,off); 30| 16.0k| f0 = _mm256_slli_epi16(f0,3); 31| 16.0k| f0 = _mm256_mulhi_epi16(f0,v); 32| 16.0k| f2 = _mm256_sub_epi16(f1,f2); 33| 16.0k| f1 = _mm256_andnot_si256(f1,f2); 34| 16.0k| f1 = _mm256_srli_epi16(f1,15); 35| 16.0k| f0 = _mm256_sub_epi16(f0,f1); 36| 16.0k| f0 = _mm256_mulhrs_epi16(f0,shift1); 37| 16.0k| f0 = _mm256_and_si256(f0,mask); 38| 16.0k| f0 = _mm256_madd_epi16(f0,shift2); 39| 16.0k| f0 = _mm256_sllv_epi32(f0,sllvdidx); 40| 16.0k| f0 = _mm256_srli_epi64(f0,12); 41| 16.0k| f0 = _mm256_shuffle_epi8(f0,shufbidx); 42| 16.0k| t0 = _mm256_castsi256_si128(f0); 43| 16.0k| t1 = _mm256_extracti128_si256(f0,1); 44| | t0 = _mm_blend_epi16(t0,t1,0xE0); 45| 16.0k| _mm_storeu_si128((__m128i *)&r[20*i+ 0],t0); 46| 16.0k| memcpy(&r[20*i+16],&t1,4); 47| 16.0k| } 48| 1.00k|} polyvec.c:poly_decompress10: 51| 502|{ 52| 502| unsigned int i; 53| 502| __m256i f; 54| 502| const __m256i q = _mm256_set1_epi32((KYBER_Q << 16) + 4*KYBER_Q); ------------------ | | 34| 502|#define KYBER_Q 3329 ------------------ const __m256i q = _mm256_set1_epi32((KYBER_Q << 16) + 4*KYBER_Q); ------------------ | | 34| 502|#define KYBER_Q 3329 ------------------ 55| 502| const __m256i shufbidx = _mm256_set_epi8(11,10,10, 9, 9, 8, 8, 7, 56| 502| 6, 5, 5, 4, 4, 3, 3, 2, 57| 502| 9, 8, 8, 7, 7, 6, 6, 5, 58| 502| 4, 3, 3, 2, 2, 1, 1, 0); 59| 502| const __m256i sllvdidx = _mm256_set1_epi64x(4); 60| 502| const __m256i mask = _mm256_set1_epi32((32736 << 16) + 8184); 61| | 62| 8.53k| for(i=0;ivec[i],f); 71| 8.03k| } 72| 502|} pqcrystals_kyber512_avx2_rej_uniform_avx: 275| 708|{ 276| 708| unsigned int ctr, pos; 277| 708| uint16_t val0, val1; 278| 708| uint32_t good; 279| |#ifdef BMI 280| | uint64_t idx0, idx1, idx2, idx3; 281| |#endif 282| 708| const __m256i bound = _mm256_load_si256(&qdata.vec[_16XQ/16]); ------------------ | | 39| 708|#define qdata KYBER_NAMESPACE(qdata) | | ------------------ | | | | 15| 708|#define KYBER_NAMESPACE(s) pqcrystals_kyber512_avx2_##s | | ------------------ ------------------ const __m256i bound = _mm256_load_si256(&qdata.vec[_16XQ/16]); ------------------ | | 6| 708|#define _16XQ 0 ------------------ 283| 708| const __m256i ones = _mm256_set1_epi8(1); 284| 708| const __m256i mask = _mm256_set1_epi16(0xFFF); 285| 708| const __m256i idx8 = _mm256_set_epi8(15,14,14,13,12,11,11,10, 286| 708| 9, 8, 8, 7, 6, 5, 5, 4, 287| 708| 11,10,10, 9, 8, 7, 7, 6, 288| 708| 5, 4, 4, 3, 2, 1, 1, 0); 289| 708| __m256i f0, f1, g0, g1, g2, g3; 290| 708| __m128i f, t, pilo, pihi; 291| | 292| 708| ctr = pos = 0; 293| 7.29k| while(ctr <= KYBER_N - 32 && pos <= REJ_UNIFORM_AVX_BUFLEN - 48) { ------------------ | | 33| 7.29k|#define KYBER_N 256 ------------------ while(ctr <= KYBER_N - 32 && pos <= REJ_UNIFORM_AVX_BUFLEN - 48) { ------------------ | | 9| 6.58k|#define REJ_UNIFORM_AVX_BUFLEN (REJ_UNIFORM_AVX_NBLOCKS*XOF_BLOCKBYTES) | | ------------------ | | | | 8| 6.58k|#define REJ_UNIFORM_AVX_NBLOCKS ((12*KYBER_N/8*(1 << 12)/KYBER_Q + XOF_BLOCKBYTES)/XOF_BLOCKBYTES) | | | | ------------------ | | | | | | 33| 6.58k|#define KYBER_N 256 | | | | ------------------ | | | | #define REJ_UNIFORM_AVX_NBLOCKS ((12*KYBER_N/8*(1 << 12)/KYBER_Q + XOF_BLOCKBYTES)/XOF_BLOCKBYTES) | | | | ------------------ | | | | | | 34| 6.58k|#define KYBER_Q 3329 | | | | ------------------ | | | | #define REJ_UNIFORM_AVX_NBLOCKS ((12*KYBER_N/8*(1 << 12)/KYBER_Q + XOF_BLOCKBYTES)/XOF_BLOCKBYTES) | | | | ------------------ | | | | | | 50| 6.58k|#define XOF_BLOCKBYTES SHAKE128_RATE | | | | | | ------------------ | | | | | | | | 8| 6.58k|#define SHAKE128_RATE OQS_SHA3_SHAKE128_RATE | | | | | | | | ------------------ | | | | | | | | | | 239| 6.58k|#define OQS_SHA3_SHAKE128_RATE 168 | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | | | #define REJ_UNIFORM_AVX_NBLOCKS ((12*KYBER_N/8*(1 << 12)/KYBER_Q + XOF_BLOCKBYTES)/XOF_BLOCKBYTES) | | | | ------------------ | | | | | | 50| 6.58k|#define XOF_BLOCKBYTES SHAKE128_RATE | | | | | | ------------------ | | | | | | | | 8| 6.58k|#define SHAKE128_RATE OQS_SHA3_SHAKE128_RATE | | | | | | | | ------------------ | | | | | | | | | | 239| 6.58k|#define OQS_SHA3_SHAKE128_RATE 168 | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ | | #define REJ_UNIFORM_AVX_BUFLEN (REJ_UNIFORM_AVX_NBLOCKS*XOF_BLOCKBYTES) | | ------------------ | | | | 50| 6.58k|#define XOF_BLOCKBYTES SHAKE128_RATE | | | | ------------------ | | | | | | 8| 6.58k|#define SHAKE128_RATE OQS_SHA3_SHAKE128_RATE | | | | | | ------------------ | | | | | | | | 239| 6.58k|#define OQS_SHA3_SHAKE128_RATE 168 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ | Branch (293:9): [True: 6.58k, False: 702] | Branch (293:32): [True: 6.58k, False: 6] ------------------ 294| 6.58k| f0 = _mm256_loadu_si256((__m256i *)&buf[pos]); 295| 6.58k| f1 = _mm256_loadu_si256((__m256i *)&buf[pos+24]); 296| 6.58k| f0 = _mm256_permute4x64_epi64(f0, 0x94); 297| 6.58k| f1 = _mm256_permute4x64_epi64(f1, 0x94); 298| 6.58k| f0 = _mm256_shuffle_epi8(f0, idx8); 299| 6.58k| f1 = _mm256_shuffle_epi8(f1, idx8); 300| 6.58k| g0 = _mm256_srli_epi16(f0, 4); 301| 6.58k| g1 = _mm256_srli_epi16(f1, 4); 302| 6.58k| f0 = _mm256_blend_epi16(f0, g0, 0xAA); 303| 6.58k| f1 = _mm256_blend_epi16(f1, g1, 0xAA); 304| 6.58k| f0 = _mm256_and_si256(f0, mask); 305| 6.58k| f1 = _mm256_and_si256(f1, mask); 306| 6.58k| pos += 48; 307| | 308| 6.58k| g0 = _mm256_cmpgt_epi16(bound, f0); 309| 6.58k| g1 = _mm256_cmpgt_epi16(bound, f1); 310| | 311| 6.58k| g0 = _mm256_packs_epi16(g0, g1); 312| 6.58k| good = _mm256_movemask_epi8(g0); 313| | 314| |#ifdef BMI 315| | idx0 = _pdep_u64(good >> 0, 0x0101010101010101); 316| | idx1 = _pdep_u64(good >> 8, 0x0101010101010101); 317| | idx2 = _pdep_u64(good >> 16, 0x0101010101010101); 318| | idx3 = _pdep_u64(good >> 24, 0x0101010101010101); 319| | idx0 = (idx0 << 8) - idx0; 320| | idx0 = _pext_u64(0x0E0C0A0806040200, idx0); 321| | idx1 = (idx1 << 8) - idx1; 322| | idx1 = _pext_u64(0x0E0C0A0806040200, idx1); 323| | idx2 = (idx2 << 8) - idx2; 324| | idx2 = _pext_u64(0x0E0C0A0806040200, idx2); 325| | idx3 = (idx3 << 8) - idx3; 326| | idx3 = _pext_u64(0x0E0C0A0806040200, idx3); 327| | 328| | g0 = _mm256_castsi128_si256(_mm_cvtsi64_si128(idx0)); 329| | g1 = _mm256_castsi128_si256(_mm_cvtsi64_si128(idx1)); 330| | g0 = _mm256_inserti128_si256(g0, _mm_cvtsi64_si128(idx2), 1); 331| | g1 = _mm256_inserti128_si256(g1, _mm_cvtsi64_si128(idx3), 1); 332| |#else 333| 6.58k| g0 = _mm256_castsi128_si256(_mm_loadl_epi64((__m128i *)&idx[(good >> 0) & 0xFF])); 334| 6.58k| g1 = _mm256_castsi128_si256(_mm_loadl_epi64((__m128i *)&idx[(good >> 8) & 0xFF])); 335| 6.58k| g0 = _mm256_inserti128_si256(g0, _mm_loadl_epi64((__m128i *)&idx[(good >> 16) & 0xFF]), 1); 336| 6.58k| g1 = _mm256_inserti128_si256(g1, _mm_loadl_epi64((__m128i *)&idx[(good >> 24) & 0xFF]), 1); 337| 6.58k|#endif 338| | 339| 6.58k| g2 = _mm256_add_epi8(g0, ones); 340| 6.58k| g3 = _mm256_add_epi8(g1, ones); 341| 6.58k| g0 = _mm256_unpacklo_epi8(g0, g2); 342| 6.58k| g1 = _mm256_unpacklo_epi8(g1, g3); 343| | 344| 6.58k| f0 = _mm256_shuffle_epi8(f0, g0); 345| 6.58k| f1 = _mm256_shuffle_epi8(f1, g1); 346| | 347| 6.58k| _mm_storeu_si128((__m128i *)&r[ctr], _mm256_castsi256_si128(f0)); 348| 6.58k| ctr += _mm_popcnt_u32((good >> 0) & 0xFF); 349| 6.58k| _mm_storeu_si128((__m128i *)&r[ctr], _mm256_extracti128_si256(f0, 1)); 350| 6.58k| ctr += _mm_popcnt_u32((good >> 16) & 0xFF); 351| 6.58k| _mm_storeu_si128((__m128i *)&r[ctr], _mm256_castsi256_si128(f1)); 352| 6.58k| ctr += _mm_popcnt_u32((good >> 8) & 0xFF); 353| 6.58k| _mm_storeu_si128((__m128i *)&r[ctr], _mm256_extracti128_si256(f1, 1)); 354| 6.58k| ctr += _mm_popcnt_u32((good >> 24) & 0xFF); 355| 6.58k| } 356| | 357| 2.34k| while(ctr <= KYBER_N - 8 && pos <= REJ_UNIFORM_AVX_BUFLEN - 12) { ------------------ | | 33| 2.34k|#define KYBER_N 256 ------------------ while(ctr <= KYBER_N - 8 && pos <= REJ_UNIFORM_AVX_BUFLEN - 12) { ------------------ | | 9| 1.68k|#define REJ_UNIFORM_AVX_BUFLEN (REJ_UNIFORM_AVX_NBLOCKS*XOF_BLOCKBYTES) | | ------------------ | | | | 8| 1.68k|#define REJ_UNIFORM_AVX_NBLOCKS ((12*KYBER_N/8*(1 << 12)/KYBER_Q + XOF_BLOCKBYTES)/XOF_BLOCKBYTES) | | | | ------------------ | | | | | | 33| 1.68k|#define KYBER_N 256 | | | | ------------------ | | | | #define REJ_UNIFORM_AVX_NBLOCKS ((12*KYBER_N/8*(1 << 12)/KYBER_Q + XOF_BLOCKBYTES)/XOF_BLOCKBYTES) | | | | ------------------ | | | | | | 34| 1.68k|#define KYBER_Q 3329 | | | | ------------------ | | | | #define REJ_UNIFORM_AVX_NBLOCKS ((12*KYBER_N/8*(1 << 12)/KYBER_Q + XOF_BLOCKBYTES)/XOF_BLOCKBYTES) | | | | ------------------ | | | | | | 50| 1.68k|#define XOF_BLOCKBYTES SHAKE128_RATE | | | | | | ------------------ | | | | | | | | 8| 1.68k|#define SHAKE128_RATE OQS_SHA3_SHAKE128_RATE | | | | | | | | ------------------ | | | | | | | | | | 239| 1.68k|#define OQS_SHA3_SHAKE128_RATE 168 | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | | | #define REJ_UNIFORM_AVX_NBLOCKS ((12*KYBER_N/8*(1 << 12)/KYBER_Q + XOF_BLOCKBYTES)/XOF_BLOCKBYTES) | | | | ------------------ | | | | | | 50| 1.68k|#define XOF_BLOCKBYTES SHAKE128_RATE | | | | | | ------------------ | | | | | | | | 8| 1.68k|#define SHAKE128_RATE OQS_SHA3_SHAKE128_RATE | | | | | | | | ------------------ | | | | | | | | | | 239| 1.68k|#define OQS_SHA3_SHAKE128_RATE 168 | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ | | #define REJ_UNIFORM_AVX_BUFLEN (REJ_UNIFORM_AVX_NBLOCKS*XOF_BLOCKBYTES) | | ------------------ | | | | 50| 1.68k|#define XOF_BLOCKBYTES SHAKE128_RATE | | | | ------------------ | | | | | | 8| 1.68k|#define SHAKE128_RATE OQS_SHA3_SHAKE128_RATE | | | | | | ------------------ | | | | | | | | 239| 1.68k|#define OQS_SHA3_SHAKE128_RATE 168 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ | Branch (357:9): [True: 1.68k, False: 657] | Branch (357:31): [True: 1.63k, False: 51] ------------------ 358| 1.63k| f = _mm_loadu_si128((__m128i *)&buf[pos]); 359| 1.63k| f = _mm_shuffle_epi8(f, _mm256_castsi256_si128(idx8)); 360| 1.63k| t = _mm_srli_epi16(f, 4); 361| 1.63k| f = _mm_blend_epi16(f, t, 0xAA); 362| 1.63k| f = _mm_and_si128(f, _mm256_castsi256_si128(mask)); 363| 1.63k| pos += 12; 364| | 365| 1.63k| t = _mm_cmpgt_epi16(_mm256_castsi256_si128(bound), f); 366| 1.63k| good = _mm_movemask_epi8(t); 367| | 368| |#ifdef BMI 369| | good &= 0x5555; 370| | idx0 = _pdep_u64(good, 0x1111111111111111); 371| | idx0 = (idx0 << 8) - idx0; 372| | idx0 = _pext_u64(0x0E0C0A0806040200, idx0); 373| | pilo = _mm_cvtsi64_si128(idx0); 374| |#else 375| 1.63k| good = _pext_u32(good, 0x5555); 376| 1.63k| pilo = _mm_loadl_epi64((__m128i *)&idx[good]); 377| 1.63k|#endif 378| | 379| 1.63k| pihi = _mm_add_epi8(pilo, _mm256_castsi256_si128(ones)); 380| 1.63k| pilo = _mm_unpacklo_epi8(pilo, pihi); 381| 1.63k| f = _mm_shuffle_epi8(f, pilo); 382| 1.63k| _mm_storeu_si128((__m128i *)&r[ctr], f); 383| 1.63k| ctr += _mm_popcnt_u32(good); 384| 1.63k| } 385| | 386| 2.40k| while(ctr < KYBER_N && pos <= REJ_UNIFORM_AVX_BUFLEN - 3) { ------------------ | | 33| 4.81k|#define KYBER_N 256 ------------------ while(ctr < KYBER_N && pos <= REJ_UNIFORM_AVX_BUFLEN - 3) { ------------------ | | 9| 1.85k|#define REJ_UNIFORM_AVX_BUFLEN (REJ_UNIFORM_AVX_NBLOCKS*XOF_BLOCKBYTES) | | ------------------ | | | | 8| 1.85k|#define REJ_UNIFORM_AVX_NBLOCKS ((12*KYBER_N/8*(1 << 12)/KYBER_Q + XOF_BLOCKBYTES)/XOF_BLOCKBYTES) | | | | ------------------ | | | | | | 33| 1.85k|#define KYBER_N 256 | | | | ------------------ | | | | #define REJ_UNIFORM_AVX_NBLOCKS ((12*KYBER_N/8*(1 << 12)/KYBER_Q + XOF_BLOCKBYTES)/XOF_BLOCKBYTES) | | | | ------------------ | | | | | | 34| 1.85k|#define KYBER_Q 3329 | | | | ------------------ | | | | #define REJ_UNIFORM_AVX_NBLOCKS ((12*KYBER_N/8*(1 << 12)/KYBER_Q + XOF_BLOCKBYTES)/XOF_BLOCKBYTES) | | | | ------------------ | | | | | | 50| 1.85k|#define XOF_BLOCKBYTES SHAKE128_RATE | | | | | | ------------------ | | | | | | | | 8| 1.85k|#define SHAKE128_RATE OQS_SHA3_SHAKE128_RATE | | | | | | | | ------------------ | | | | | | | | | | 239| 1.85k|#define OQS_SHA3_SHAKE128_RATE 168 | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | | | #define REJ_UNIFORM_AVX_NBLOCKS ((12*KYBER_N/8*(1 << 12)/KYBER_Q + XOF_BLOCKBYTES)/XOF_BLOCKBYTES) | | | | ------------------ | | | | | | 50| 1.85k|#define XOF_BLOCKBYTES SHAKE128_RATE | | | | | | ------------------ | | | | | | | | 8| 1.85k|#define SHAKE128_RATE OQS_SHA3_SHAKE128_RATE | | | | | | | | ------------------ | | | | | | | | | | 239| 1.85k|#define OQS_SHA3_SHAKE128_RATE 168 | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ | | #define REJ_UNIFORM_AVX_BUFLEN (REJ_UNIFORM_AVX_NBLOCKS*XOF_BLOCKBYTES) | | ------------------ | | | | 50| 1.85k|#define XOF_BLOCKBYTES SHAKE128_RATE | | | | ------------------ | | | | | | 8| 1.85k|#define SHAKE128_RATE OQS_SHA3_SHAKE128_RATE | | | | | | ------------------ | | | | | | | | 239| 1.85k|#define OQS_SHA3_SHAKE128_RATE 168 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ | Branch (386:9): [True: 1.85k, False: 552] | Branch (386:26): [True: 1.70k, False: 156] ------------------ 387| 1.70k| val0 = ((buf[pos+0] >> 0) | ((uint16_t)buf[pos+1] << 8)) & 0xFFF; 388| 1.70k| val1 = ((buf[pos+1] >> 4) | ((uint16_t)buf[pos+2] << 4)); 389| 1.70k| pos += 3; 390| | 391| 1.70k| if(val0 < KYBER_Q) ------------------ | | 34| 1.70k|#define KYBER_Q 3329 ------------------ | Branch (391:8): [True: 1.29k, False: 405] ------------------ 392| 1.29k| r[ctr++] = val0; 393| 1.70k| if(val1 < KYBER_Q && ctr < KYBER_N) ------------------ | | 34| 3.40k|#define KYBER_Q 3329 ------------------ if(val1 < KYBER_Q && ctr < KYBER_N) ------------------ | | 33| 1.35k|#define KYBER_N 256 ------------------ | Branch (393:8): [True: 1.35k, False: 348] | Branch (393:26): [True: 1.13k, False: 222] ------------------ 394| 1.13k| r[ctr++] = val1; 395| 1.70k| } 396| | 397| 708| return ctr; 398| 708|} pqcrystals_kyber512_avx2_kyber_shake256_prf: 44| 118|{ 45| 118| uint8_t extkey[KYBER_SYMBYTES+1]; 46| | 47| 118| memcpy(extkey, key, KYBER_SYMBYTES); ------------------ | | 36| 118|#define KYBER_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 48| 118| extkey[KYBER_SYMBYTES] = nonce; ------------------ | | 36| 118|#define KYBER_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 49| | 50| 118| shake256(out, outlen, extkey, sizeof(extkey)); ------------------ | | 12| 118|#define shake256 OQS_SHA3_shake256 ------------------ 51| 118|} pqcrystals_kyber512_avx2_verify: 18| 59|{ 19| 59| size_t i; 20| 59| uint64_t r; 21| 59| __m256i f, g, h; 22| | 23| 59| h = _mm256_setzero_si256(); 24| 1.47k| for(i=0;i> 63; 39| 59| return r; 40| 59|} pqcrystals_kyber512_avx2_cmov: 56| 59|{ 57| 59| size_t i; 58| 59| __m256i xvec, rvec, bvec; 59| | 60| 59|#if defined(__GNUC__) || defined(__clang__) 61| | // Prevent the compiler from 62| | // 1) inferring that b is 0/1-valued, and 63| | // 2) handling the two cases with a branch. 64| | // This is not necessary when verify.c and kem.c are separate translation 65| | // units, but we expect that downstream consumers will copy this code and/or 66| | // change how it is built. 67| 59| __asm__("" : "+r"(b) : /* no inputs */); 68| 59|#endif 69| | 70| 59| bvec = _mm256_set1_epi64x(-(uint64_t)b); 71| 118| for(i=0;i> 0) | ((uint16_t)buf[pos+1] << 8)) & 0xFFF; 135| 4.04k| val1 = ((buf[pos+1] >> 4) | ((uint16_t)buf[pos+2] << 4)) & 0xFFF; 136| 4.04k| pos += 3; 137| | 138| 4.04k| if(val0 < KYBER_Q) ------------------ | | 34| 4.04k|#define KYBER_Q 3329 ------------------ | Branch (138:8): [True: 2.94k, False: 1.10k] ------------------ 139| 2.94k| r[ctr++] = val0; 140| 4.04k| if(ctr < len && val1 < KYBER_Q) ------------------ | | 34| 3.51k|#define KYBER_Q 3329 ------------------ | Branch (140:8): [True: 3.51k, False: 534] | Branch (140:21): [True: 2.57k, False: 939] ------------------ 141| 2.57k| r[ctr++] = val1; 142| 4.04k| } 143| | 144| 3.13k| return ctr; 145| 3.13k|} indcpa.c:pack_sk: 61| 274|{ 62| 274| polyvec_tobytes(r, sk); ------------------ | | 17| 274|#define polyvec_tobytes KYBER_NAMESPACE(polyvec_tobytes) | | ------------------ | | | | 15| 274|#define KYBER_NAMESPACE(s) pqcrystals_kyber512_ref_##s | | ------------------ ------------------ 63| 274|} indcpa.c:pack_ciphertext: 90| 548|{ 91| 548| polyvec_compress(r, b); ------------------ | | 12| 548|#define polyvec_compress KYBER_NAMESPACE(polyvec_compress) | | ------------------ | | | | 15| 548|#define KYBER_NAMESPACE(s) pqcrystals_kyber512_ref_##s | | ------------------ ------------------ 92| 548| poly_compress(r+KYBER_POLYVECCOMPRESSEDBYTES, v); ------------------ | | 15| 548|#define poly_compress KYBER_NAMESPACE(poly_compress) | | ------------------ | | | | 15| 548|#define KYBER_NAMESPACE(s) pqcrystals_kyber512_ref_##s | | ------------------ ------------------ poly_compress(r+KYBER_POLYVECCOMPRESSEDBYTES, v); ------------------ | | 45| 548|#define KYBER_POLYVECCOMPRESSEDBYTES (KYBER_K * 320) ------------------ 93| 548|} indcpa.c:unpack_ciphertext: 106| 274|{ 107| 274| polyvec_decompress(b, c); ------------------ | | 14| 274|#define polyvec_decompress KYBER_NAMESPACE(polyvec_decompress) | | ------------------ | | | | 15| 274|#define KYBER_NAMESPACE(s) pqcrystals_kyber512_ref_##s | | ------------------ ------------------ 108| 274| poly_decompress(v, c+KYBER_POLYVECCOMPRESSEDBYTES); ------------------ | | 17| 274|#define poly_decompress KYBER_NAMESPACE(poly_decompress) | | ------------------ | | | | 15| 274|#define KYBER_NAMESPACE(s) pqcrystals_kyber512_ref_##s | | ------------------ ------------------ poly_decompress(v, c+KYBER_POLYVECCOMPRESSEDBYTES); ------------------ | | 45| 274|#define KYBER_POLYVECCOMPRESSEDBYTES (KYBER_K * 320) ------------------ 109| 274|} indcpa.c:unpack_sk: 74| 274|{ 75| 274| polyvec_frombytes(sk, packedsk); ------------------ | | 19| 274|#define polyvec_frombytes KYBER_NAMESPACE(polyvec_frombytes) | | ------------------ | | | | 15| 274|#define KYBER_NAMESPACE(s) pqcrystals_kyber512_ref_##s | | ------------------ ------------------ 76| 274|} pqcrystals_kyber768_avx2_poly_cbd_eta1: 127| 3.07k|{ 128| 3.07k|#if KYBER_ETA1 == 2 129| 3.07k| cbd2(r, buf); 130| |#elif KYBER_ETA1 == 3 131| | cbd3(r, (uint8_t *)buf); 132| |#else 133| |#error "This implementation requires eta1 in {2,3}" 134| |#endif 135| 3.07k|} pqcrystals_kyber768_avx2_gen_matrix: 271| 384|{ 272| 384| unsigned int ctr0, ctr1, ctr2, ctr3; 273| 384| ALIGNED_UINT8(REJ_UNIFORM_AVX_NBLOCKS*SHAKE128_RATE) buf[4]; ------------------ | | 8| 384| union { \ | | 9| 384| uint8_t coeffs[N]; \ | | 10| 384| __m256i vec[(N+31)/32]; \ | | 11| 384| } ------------------ 274| 384| __m256i f; 275| 384| shake128x4incctx state; ------------------ | | 18| 384|#define shake128x4incctx OQS_SHA3_shake128_x4_inc_ctx ------------------ 276| 384| shake128incctx state1x; ------------------ | | 38| 384|#define shake128incctx OQS_SHA3_shake128_inc_ctx ------------------ 277| | 278| 384| f = _mm256_loadu_si256((__m256i *)seed); 279| 384| _mm256_store_si256(buf[0].vec, f); 280| 384| _mm256_store_si256(buf[1].vec, f); 281| 384| _mm256_store_si256(buf[2].vec, f); 282| 384| _mm256_store_si256(buf[3].vec, f); 283| | 284| 384| if(transposed) { ------------------ | Branch (284:6): [True: 256, False: 128] ------------------ 285| 256| buf[0].coeffs[32] = 0; 286| 256| buf[0].coeffs[33] = 0; 287| 256| buf[1].coeffs[32] = 0; 288| 256| buf[1].coeffs[33] = 1; 289| 256| buf[2].coeffs[32] = 0; 290| 256| buf[2].coeffs[33] = 2; 291| 256| buf[3].coeffs[32] = 1; 292| 256| buf[3].coeffs[33] = 0; 293| 256| } 294| 128| else { 295| 128| buf[0].coeffs[32] = 0; 296| 128| buf[0].coeffs[33] = 0; 297| 128| buf[1].coeffs[32] = 1; 298| 128| buf[1].coeffs[33] = 0; 299| 128| buf[2].coeffs[32] = 2; 300| 128| buf[2].coeffs[33] = 0; 301| 128| buf[3].coeffs[32] = 0; 302| 128| buf[3].coeffs[33] = 1; 303| 128| } 304| | 305| 384| shake128x4_inc_init(&state); ------------------ | | 19| 384|#define shake128x4_inc_init OQS_SHA3_shake128_x4_inc_init ------------------ 306| 384| shake128x4_absorb_once(&state, buf[0].coeffs, buf[1].coeffs, buf[2].coeffs, buf[3].coeffs, 34); ------------------ | | 39| 384|#define shake128x4_absorb_once OQS_SHA3_shake128_x4_absorb_once ------------------ 307| 384| shake128x4_squeezeblocks(buf[0].coeffs, buf[1].coeffs, buf[2].coeffs, buf[3].coeffs, REJ_UNIFORM_AVX_NBLOCKS, &state); ------------------ | | 46| 384| OQS_SHA3_shake128_x4_inc_squeeze(OUT0, OUT1, OUT2, OUT3, (NBLOCKS)*OQS_SHA3_SHAKE128_RATE, STATE) | | ------------------ | | | | 239| 384|#define OQS_SHA3_SHAKE128_RATE 168 | | ------------------ ------------------ 308| | 309| 384| ctr0 = rej_uniform_avx(a[0].vec[0].coeffs, buf[0].coeffs); ------------------ | | 11| 384|#define rej_uniform_avx KYBER_NAMESPACE(rej_uniform_avx) | | ------------------ | | | | 21| 384|#define KYBER_NAMESPACE(s) pqcrystals_kyber768_avx2_##s | | ------------------ ------------------ 310| 384| ctr1 = rej_uniform_avx(a[0].vec[1].coeffs, buf[1].coeffs); ------------------ | | 11| 384|#define rej_uniform_avx KYBER_NAMESPACE(rej_uniform_avx) | | ------------------ | | | | 21| 384|#define KYBER_NAMESPACE(s) pqcrystals_kyber768_avx2_##s | | ------------------ ------------------ 311| 384| ctr2 = rej_uniform_avx(a[0].vec[2].coeffs, buf[2].coeffs); ------------------ | | 11| 384|#define rej_uniform_avx KYBER_NAMESPACE(rej_uniform_avx) | | ------------------ | | | | 21| 384|#define KYBER_NAMESPACE(s) pqcrystals_kyber768_avx2_##s | | ------------------ ------------------ 312| 384| ctr3 = rej_uniform_avx(a[1].vec[0].coeffs, buf[3].coeffs); ------------------ | | 11| 384|#define rej_uniform_avx KYBER_NAMESPACE(rej_uniform_avx) | | ------------------ | | | | 21| 384|#define KYBER_NAMESPACE(s) pqcrystals_kyber768_avx2_##s | | ------------------ ------------------ 313| | 314| 529| while(ctr0 < KYBER_N || ctr1 < KYBER_N || ctr2 < KYBER_N || ctr3 < KYBER_N) { ------------------ | | 33| 1.05k|#define KYBER_N 256 ------------------ while(ctr0 < KYBER_N || ctr1 < KYBER_N || ctr2 < KYBER_N || ctr3 < KYBER_N) { ------------------ | | 33| 1.01k|#define KYBER_N 256 ------------------ while(ctr0 < KYBER_N || ctr1 < KYBER_N || ctr2 < KYBER_N || ctr3 < KYBER_N) { ------------------ | | 33| 980|#define KYBER_N 256 ------------------ while(ctr0 < KYBER_N || ctr1 < KYBER_N || ctr2 < KYBER_N || ctr3 < KYBER_N) { ------------------ | | 33| 413|#define KYBER_N 256 ------------------ | Branch (314:9): [True: 45, False: 484] | Branch (314:27): [True: 33, False: 451] | Branch (314:45): [True: 38, False: 413] | Branch (314:63): [True: 29, False: 384] ------------------ 315| 145| shake128x4_squeezeblocks(buf[0].coeffs, buf[1].coeffs, buf[2].coeffs, buf[3].coeffs, 1, &state); ------------------ | | 46| 145| OQS_SHA3_shake128_x4_inc_squeeze(OUT0, OUT1, OUT2, OUT3, (NBLOCKS)*OQS_SHA3_SHAKE128_RATE, STATE) | | ------------------ | | | | 239| 145|#define OQS_SHA3_SHAKE128_RATE 168 | | ------------------ ------------------ 316| | 317| 145| ctr0 += rej_uniform(a[0].vec[0].coeffs + ctr0, KYBER_N - ctr0, buf[0].coeffs, SHAKE128_RATE); ------------------ | | 33| 145|#define KYBER_N 256 ------------------ ctr0 += rej_uniform(a[0].vec[0].coeffs + ctr0, KYBER_N - ctr0, buf[0].coeffs, SHAKE128_RATE); ------------------ | | 8| 145|#define SHAKE128_RATE OQS_SHA3_SHAKE128_RATE | | ------------------ | | | | 239| 145|#define OQS_SHA3_SHAKE128_RATE 168 | | ------------------ ------------------ 318| 145| ctr1 += rej_uniform(a[0].vec[1].coeffs + ctr1, KYBER_N - ctr1, buf[1].coeffs, SHAKE128_RATE); ------------------ | | 33| 145|#define KYBER_N 256 ------------------ ctr1 += rej_uniform(a[0].vec[1].coeffs + ctr1, KYBER_N - ctr1, buf[1].coeffs, SHAKE128_RATE); ------------------ | | 8| 145|#define SHAKE128_RATE OQS_SHA3_SHAKE128_RATE | | ------------------ | | | | 239| 145|#define OQS_SHA3_SHAKE128_RATE 168 | | ------------------ ------------------ 319| 145| ctr2 += rej_uniform(a[0].vec[2].coeffs + ctr2, KYBER_N - ctr2, buf[2].coeffs, SHAKE128_RATE); ------------------ | | 33| 145|#define KYBER_N 256 ------------------ ctr2 += rej_uniform(a[0].vec[2].coeffs + ctr2, KYBER_N - ctr2, buf[2].coeffs, SHAKE128_RATE); ------------------ | | 8| 145|#define SHAKE128_RATE OQS_SHA3_SHAKE128_RATE | | ------------------ | | | | 239| 145|#define OQS_SHA3_SHAKE128_RATE 168 | | ------------------ ------------------ 320| 145| ctr3 += rej_uniform(a[1].vec[0].coeffs + ctr3, KYBER_N - ctr3, buf[3].coeffs, SHAKE128_RATE); ------------------ | | 33| 145|#define KYBER_N 256 ------------------ ctr3 += rej_uniform(a[1].vec[0].coeffs + ctr3, KYBER_N - ctr3, buf[3].coeffs, SHAKE128_RATE); ------------------ | | 8| 145|#define SHAKE128_RATE OQS_SHA3_SHAKE128_RATE | | ------------------ | | | | 239| 145|#define OQS_SHA3_SHAKE128_RATE 168 | | ------------------ ------------------ 321| 145| } 322| | 323| 384| poly_nttunpack(&a[0].vec[0]); ------------------ | | 62| 384|#define poly_nttunpack KYBER_NAMESPACE(poly_nttunpack) | | ------------------ | | | | 21| 384|#define KYBER_NAMESPACE(s) pqcrystals_kyber768_avx2_##s | | ------------------ ------------------ 324| 384| poly_nttunpack(&a[0].vec[1]); ------------------ | | 62| 384|#define poly_nttunpack KYBER_NAMESPACE(poly_nttunpack) | | ------------------ | | | | 21| 384|#define KYBER_NAMESPACE(s) pqcrystals_kyber768_avx2_##s | | ------------------ ------------------ 325| 384| poly_nttunpack(&a[0].vec[2]); ------------------ | | 62| 384|#define poly_nttunpack KYBER_NAMESPACE(poly_nttunpack) | | ------------------ | | | | 21| 384|#define KYBER_NAMESPACE(s) pqcrystals_kyber768_avx2_##s | | ------------------ ------------------ 326| 384| poly_nttunpack(&a[1].vec[0]); ------------------ | | 62| 384|#define poly_nttunpack KYBER_NAMESPACE(poly_nttunpack) | | ------------------ | | | | 21| 384|#define KYBER_NAMESPACE(s) pqcrystals_kyber768_avx2_##s | | ------------------ ------------------ 327| | 328| 384| f = _mm256_loadu_si256((__m256i *)seed); 329| 384| _mm256_store_si256(buf[0].vec, f); 330| 384| _mm256_store_si256(buf[1].vec, f); 331| 384| _mm256_store_si256(buf[2].vec, f); 332| 384| _mm256_store_si256(buf[3].vec, f); 333| | 334| 384| if(transposed) { ------------------ | Branch (334:6): [True: 256, False: 128] ------------------ 335| 256| buf[0].coeffs[32] = 1; 336| 256| buf[0].coeffs[33] = 1; 337| 256| buf[1].coeffs[32] = 1; 338| 256| buf[1].coeffs[33] = 2; 339| 256| buf[2].coeffs[32] = 2; 340| 256| buf[2].coeffs[33] = 0; 341| 256| buf[3].coeffs[32] = 2; 342| 256| buf[3].coeffs[33] = 1; 343| 256| } 344| 128| else { 345| 128| buf[0].coeffs[32] = 1; 346| 128| buf[0].coeffs[33] = 1; 347| 128| buf[1].coeffs[32] = 2; 348| 128| buf[1].coeffs[33] = 1; 349| 128| buf[2].coeffs[32] = 0; 350| 128| buf[2].coeffs[33] = 2; 351| 128| buf[3].coeffs[32] = 1; 352| 128| buf[3].coeffs[33] = 2; 353| 128| } 354| | 355| 384| shake128x4_absorb_once(&state, buf[0].coeffs, buf[1].coeffs, buf[2].coeffs, buf[3].coeffs, 34); ------------------ | | 39| 384|#define shake128x4_absorb_once OQS_SHA3_shake128_x4_absorb_once ------------------ 356| 384| shake128x4_squeezeblocks(buf[0].coeffs, buf[1].coeffs, buf[2].coeffs, buf[3].coeffs, REJ_UNIFORM_AVX_NBLOCKS, &state); ------------------ | | 46| 384| OQS_SHA3_shake128_x4_inc_squeeze(OUT0, OUT1, OUT2, OUT3, (NBLOCKS)*OQS_SHA3_SHAKE128_RATE, STATE) | | ------------------ | | | | 239| 384|#define OQS_SHA3_SHAKE128_RATE 168 | | ------------------ ------------------ 357| | 358| 384| ctr0 = rej_uniform_avx(a[1].vec[1].coeffs, buf[0].coeffs); ------------------ | | 11| 384|#define rej_uniform_avx KYBER_NAMESPACE(rej_uniform_avx) | | ------------------ | | | | 21| 384|#define KYBER_NAMESPACE(s) pqcrystals_kyber768_avx2_##s | | ------------------ ------------------ 359| 384| ctr1 = rej_uniform_avx(a[1].vec[2].coeffs, buf[1].coeffs); ------------------ | | 11| 384|#define rej_uniform_avx KYBER_NAMESPACE(rej_uniform_avx) | | ------------------ | | | | 21| 384|#define KYBER_NAMESPACE(s) pqcrystals_kyber768_avx2_##s | | ------------------ ------------------ 360| 384| ctr2 = rej_uniform_avx(a[2].vec[0].coeffs, buf[2].coeffs); ------------------ | | 11| 384|#define rej_uniform_avx KYBER_NAMESPACE(rej_uniform_avx) | | ------------------ | | | | 21| 384|#define KYBER_NAMESPACE(s) pqcrystals_kyber768_avx2_##s | | ------------------ ------------------ 361| 384| ctr3 = rej_uniform_avx(a[2].vec[1].coeffs, buf[3].coeffs); ------------------ | | 11| 384|#define rej_uniform_avx KYBER_NAMESPACE(rej_uniform_avx) | | ------------------ | | | | 21| 384|#define KYBER_NAMESPACE(s) pqcrystals_kyber768_avx2_##s | | ------------------ ------------------ 362| | 363| 569| while(ctr0 < KYBER_N || ctr1 < KYBER_N || ctr2 < KYBER_N || ctr3 < KYBER_N) { ------------------ | | 33| 1.13k|#define KYBER_N 256 ------------------ while(ctr0 < KYBER_N || ctr1 < KYBER_N || ctr2 < KYBER_N || ctr3 < KYBER_N) { ------------------ | | 33| 1.09k|#define KYBER_N 256 ------------------ while(ctr0 < KYBER_N || ctr1 < KYBER_N || ctr2 < KYBER_N || ctr3 < KYBER_N) { ------------------ | | 33| 1.04k|#define KYBER_N 256 ------------------ while(ctr0 < KYBER_N || ctr1 < KYBER_N || ctr2 < KYBER_N || ctr3 < KYBER_N) { ------------------ | | 33| 429|#define KYBER_N 256 ------------------ | Branch (363:9): [True: 48, False: 521] | Branch (363:27): [True: 48, False: 473] | Branch (363:45): [True: 44, False: 429] | Branch (363:63): [True: 45, False: 384] ------------------ 364| 185| shake128x4_squeezeblocks(buf[0].coeffs, buf[1].coeffs, buf[2].coeffs, buf[3].coeffs, 1, &state); ------------------ | | 46| 185| OQS_SHA3_shake128_x4_inc_squeeze(OUT0, OUT1, OUT2, OUT3, (NBLOCKS)*OQS_SHA3_SHAKE128_RATE, STATE) | | ------------------ | | | | 239| 185|#define OQS_SHA3_SHAKE128_RATE 168 | | ------------------ ------------------ 365| | 366| 185| ctr0 += rej_uniform(a[1].vec[1].coeffs + ctr0, KYBER_N - ctr0, buf[0].coeffs, SHAKE128_RATE); ------------------ | | 33| 185|#define KYBER_N 256 ------------------ ctr0 += rej_uniform(a[1].vec[1].coeffs + ctr0, KYBER_N - ctr0, buf[0].coeffs, SHAKE128_RATE); ------------------ | | 8| 185|#define SHAKE128_RATE OQS_SHA3_SHAKE128_RATE | | ------------------ | | | | 239| 185|#define OQS_SHA3_SHAKE128_RATE 168 | | ------------------ ------------------ 367| 185| ctr1 += rej_uniform(a[1].vec[2].coeffs + ctr1, KYBER_N - ctr1, buf[1].coeffs, SHAKE128_RATE); ------------------ | | 33| 185|#define KYBER_N 256 ------------------ ctr1 += rej_uniform(a[1].vec[2].coeffs + ctr1, KYBER_N - ctr1, buf[1].coeffs, SHAKE128_RATE); ------------------ | | 8| 185|#define SHAKE128_RATE OQS_SHA3_SHAKE128_RATE | | ------------------ | | | | 239| 185|#define OQS_SHA3_SHAKE128_RATE 168 | | ------------------ ------------------ 368| 185| ctr2 += rej_uniform(a[2].vec[0].coeffs + ctr2, KYBER_N - ctr2, buf[2].coeffs, SHAKE128_RATE); ------------------ | | 33| 185|#define KYBER_N 256 ------------------ ctr2 += rej_uniform(a[2].vec[0].coeffs + ctr2, KYBER_N - ctr2, buf[2].coeffs, SHAKE128_RATE); ------------------ | | 8| 185|#define SHAKE128_RATE OQS_SHA3_SHAKE128_RATE | | ------------------ | | | | 239| 185|#define OQS_SHA3_SHAKE128_RATE 168 | | ------------------ ------------------ 369| 185| ctr3 += rej_uniform(a[2].vec[1].coeffs + ctr3, KYBER_N - ctr3, buf[3].coeffs, SHAKE128_RATE); ------------------ | | 33| 185|#define KYBER_N 256 ------------------ ctr3 += rej_uniform(a[2].vec[1].coeffs + ctr3, KYBER_N - ctr3, buf[3].coeffs, SHAKE128_RATE); ------------------ | | 8| 185|#define SHAKE128_RATE OQS_SHA3_SHAKE128_RATE | | ------------------ | | | | 239| 185|#define OQS_SHA3_SHAKE128_RATE 168 | | ------------------ ------------------ 370| 185| } 371| 384| shake128x4_inc_ctx_release(&state); ------------------ | | 23| 384|#define shake128x4_inc_ctx_release OQS_SHA3_shake128_x4_inc_ctx_release ------------------ 372| | 373| 384| poly_nttunpack(&a[1].vec[1]); ------------------ | | 62| 384|#define poly_nttunpack KYBER_NAMESPACE(poly_nttunpack) | | ------------------ | | | | 21| 384|#define KYBER_NAMESPACE(s) pqcrystals_kyber768_avx2_##s | | ------------------ ------------------ 374| 384| poly_nttunpack(&a[1].vec[2]); ------------------ | | 62| 384|#define poly_nttunpack KYBER_NAMESPACE(poly_nttunpack) | | ------------------ | | | | 21| 384|#define KYBER_NAMESPACE(s) pqcrystals_kyber768_avx2_##s | | ------------------ ------------------ 375| 384| poly_nttunpack(&a[2].vec[0]); ------------------ | | 62| 384|#define poly_nttunpack KYBER_NAMESPACE(poly_nttunpack) | | ------------------ | | | | 21| 384|#define KYBER_NAMESPACE(s) pqcrystals_kyber768_avx2_##s | | ------------------ ------------------ 376| 384| poly_nttunpack(&a[2].vec[1]); ------------------ | | 62| 384|#define poly_nttunpack KYBER_NAMESPACE(poly_nttunpack) | | ------------------ | | | | 21| 384|#define KYBER_NAMESPACE(s) pqcrystals_kyber768_avx2_##s | | ------------------ ------------------ 377| | 378| 384| f = _mm256_loadu_si256((__m256i *)seed); 379| 384| _mm256_store_si256(buf[0].vec, f); 380| 384| buf[0].coeffs[32] = 2; 381| 384| buf[0].coeffs[33] = 2; 382| | 383| 384| shake128_inc_init(&state1x); ------------------ | | 39| 384|#define shake128_inc_init OQS_SHA3_shake128_inc_init ------------------ 384| 384| shake128_absorb_once(&state1x, buf[0].coeffs, 34); ------------------ | | 57| 384|#define shake128_absorb_once OQS_SHA3_shake128_absorb_once ------------------ 385| 384| shake128_squeezeblocks(buf[0].coeffs, REJ_UNIFORM_AVX_NBLOCKS, &state1x); ------------------ | | 64| 384| OQS_SHA3_shake128_inc_squeeze(OUT, (NBLOCKS)*OQS_SHA3_SHAKE128_RATE, STATE) | | ------------------ | | | | 239| 384|#define OQS_SHA3_SHAKE128_RATE 168 | | ------------------ ------------------ 386| 384| ctr0 = rej_uniform_avx(a[2].vec[2].coeffs, buf[0].coeffs); ------------------ | | 11| 384|#define rej_uniform_avx KYBER_NAMESPACE(rej_uniform_avx) | | ------------------ | | | | 21| 384|#define KYBER_NAMESPACE(s) pqcrystals_kyber768_avx2_##s | | ------------------ ------------------ 387| 441| while(ctr0 < KYBER_N) { ------------------ | | 33| 441|#define KYBER_N 256 ------------------ | Branch (387:9): [True: 57, False: 384] ------------------ 388| 57| shake128_squeezeblocks(buf[0].coeffs, 1, &state1x); ------------------ | | 64| 57| OQS_SHA3_shake128_inc_squeeze(OUT, (NBLOCKS)*OQS_SHA3_SHAKE128_RATE, STATE) | | ------------------ | | | | 239| 57|#define OQS_SHA3_SHAKE128_RATE 168 | | ------------------ ------------------ 389| 57| ctr0 += rej_uniform(a[2].vec[2].coeffs + ctr0, KYBER_N - ctr0, buf[0].coeffs, SHAKE128_RATE); ------------------ | | 33| 57|#define KYBER_N 256 ------------------ ctr0 += rej_uniform(a[2].vec[2].coeffs + ctr0, KYBER_N - ctr0, buf[0].coeffs, SHAKE128_RATE); ------------------ | | 8| 57|#define SHAKE128_RATE OQS_SHA3_SHAKE128_RATE | | ------------------ | | | | 239| 57|#define OQS_SHA3_SHAKE128_RATE 168 | | ------------------ ------------------ 390| 57| } 391| 384| shake128_inc_ctx_release(&state1x); ------------------ | | 43| 384|#define shake128_inc_ctx_release OQS_SHA3_shake128_inc_ctx_release ------------------ 392| | 393| 384| poly_nttunpack(&a[2].vec[2]); ------------------ | | 62| 384|#define poly_nttunpack KYBER_NAMESPACE(poly_nttunpack) | | ------------------ | | | | 21| 384|#define KYBER_NAMESPACE(s) pqcrystals_kyber768_avx2_##s | | ------------------ ------------------ 394| 384|} pqcrystals_kyber768_avx2_indcpa_keypair: 472| 128|{ 473| 128| unsigned int i; 474| 128| uint8_t buf[2*KYBER_SYMBYTES]; 475| 128| const uint8_t *publicseed = buf; 476| 128| const uint8_t *noiseseed = buf + KYBER_SYMBYTES; ------------------ | | 36| 128|#define KYBER_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 477| 128| polyvec a[KYBER_K], e, pkpv, skpv; 478| | 479| 128| randombytes(buf, KYBER_SYMBYTES); ------------------ | | 8| 128|#define randombytes OQS_randombytes ------------------ randombytes(buf, KYBER_SYMBYTES); ------------------ | | 36| 128|#define KYBER_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 480| 128| hash_g(buf, buf, KYBER_SYMBYTES); ------------------ | | 53| 128|#define hash_g(OUT, IN, INBYTES) sha3_512(OUT, IN, INBYTES) | | ------------------ | | | | 31| 128|#define sha3_512 OQS_SHA3_sha3_512 | | ------------------ ------------------ 481| | 482| 128| gen_a(a, publicseed); ------------------ | | 157| 128|#define gen_a(A,B) gen_matrix(A,B,0) | | ------------------ | | | | 8| 128|#define gen_matrix KYBER_NAMESPACE(gen_matrix) | | | | ------------------ | | | | | | 21| 128|#define KYBER_NAMESPACE(s) pqcrystals_kyber768_avx2_##s | | | | ------------------ | | ------------------ ------------------ 483| | 484| |#ifdef KYBER_90S 485| |#define NOISE_NBLOCKS ((KYBER_ETA1*KYBER_N/4)/AES256CTR_BLOCKBYTES) /* Assumes divisibility */ 486| | uint64_t nonce = 0; 487| | ALIGNED_UINT8(NOISE_NBLOCKS*AES256CTR_BLOCKBYTES+32) coins; // +32 bytes as required by poly_cbd_eta1 488| | aes256ctr_ctx state; 489| | aes256ctr_init_u64(&state, noiseseed, nonce++); 490| | for(i=0;ivec[4*i+0]); 126| 1.02k| f1 = _mm256_load_si256(&a->vec[4*i+1]); 127| 1.02k| f2 = _mm256_load_si256(&a->vec[4*i+2]); 128| 1.02k| f3 = _mm256_load_si256(&a->vec[4*i+3]); 129| 1.02k| f0 = _mm256_mulhi_epi16(f0,v); 130| 1.02k| f1 = _mm256_mulhi_epi16(f1,v); 131| 1.02k| f2 = _mm256_mulhi_epi16(f2,v); 132| 1.02k| f3 = _mm256_mulhi_epi16(f3,v); 133| 1.02k| f0 = _mm256_mulhrs_epi16(f0,shift1); 134| 1.02k| f1 = _mm256_mulhrs_epi16(f1,shift1); 135| 1.02k| f2 = _mm256_mulhrs_epi16(f2,shift1); 136| 1.02k| f3 = _mm256_mulhrs_epi16(f3,shift1); 137| 1.02k| f0 = _mm256_and_si256(f0,mask); 138| 1.02k| f1 = _mm256_and_si256(f1,mask); 139| 1.02k| f2 = _mm256_and_si256(f2,mask); 140| 1.02k| f3 = _mm256_and_si256(f3,mask); 141| 1.02k| f0 = _mm256_packus_epi16(f0,f1); 142| 1.02k| f2 = _mm256_packus_epi16(f2,f3); 143| 1.02k| f0 = _mm256_maddubs_epi16(f0,shift2); 144| 1.02k| f2 = _mm256_maddubs_epi16(f2,shift2); 145| 1.02k| f0 = _mm256_packus_epi16(f0,f2); 146| 1.02k| f0 = _mm256_permutevar8x32_epi32(f0,permdidx); 147| 1.02k| _mm256_storeu_si256((__m256i *)&r[32*i],f0); 148| 1.02k| } 149| 256|} pqcrystals_kyber768_avx2_poly_decompress: 152| 128|{ 153| 128| unsigned int i; 154| 128| __m128i t; 155| 128| __m256i f; 156| 128| const __m256i q = _mm256_load_si256(&qdata.vec[_16XQ/16]); ------------------ | | 39| 128|#define qdata KYBER_NAMESPACE(qdata) | | ------------------ | | | | 21| 128|#define KYBER_NAMESPACE(s) pqcrystals_kyber768_avx2_##s | | ------------------ ------------------ const __m256i q = _mm256_load_si256(&qdata.vec[_16XQ/16]); ------------------ | | 6| 128|#define _16XQ 0 ------------------ 157| 128| const __m256i shufbidx = _mm256_set_epi8(7,7,7,7,6,6,6,6,5,5,5,5,4,4,4,4, 158| 128| 3,3,3,3,2,2,2,2,1,1,1,1,0,0,0,0); 159| 128| const __m256i mask = _mm256_set1_epi32(0x00F0000F); 160| 128| const __m256i shift = _mm256_set1_epi32((128 << 16) + 2048); 161| | 162| 2.17k| for(i=0;ivec[i],f); 170| 2.04k| } 171| 128|} pqcrystals_kyber768_avx2_poly_tobytes: 255| 768|{ 256| 768| ntttobytes_avx(r, a->vec, qdata.vec); ------------------ | | 23| 768|#define ntttobytes_avx KYBER_NAMESPACE(ntttobytes_avx) | | ------------------ | | | | 21| 768|#define KYBER_NAMESPACE(s) pqcrystals_kyber768_avx2_##s | | ------------------ ------------------ ntttobytes_avx(r, a->vec, qdata.vec); ------------------ | | 39| 768|#define qdata KYBER_NAMESPACE(qdata) | | ------------------ | | | | 21| 768|#define KYBER_NAMESPACE(s) pqcrystals_kyber768_avx2_##s | | ------------------ ------------------ 257| 768|} pqcrystals_kyber768_avx2_poly_frombytes: 270| 1.15k|{ 271| 1.15k| nttfrombytes_avx(r->vec, a, qdata.vec); ------------------ | | 25| 1.15k|#define nttfrombytes_avx KYBER_NAMESPACE(nttfrombytes_avx) | | ------------------ | | | | 21| 1.15k|#define KYBER_NAMESPACE(s) pqcrystals_kyber768_avx2_##s | | ------------------ ------------------ nttfrombytes_avx(r->vec, a, qdata.vec); ------------------ | | 39| 1.15k|#define qdata KYBER_NAMESPACE(qdata) | | ------------------ | | | | 21| 1.15k|#define KYBER_NAMESPACE(s) pqcrystals_kyber768_avx2_##s | | ------------------ ------------------ 272| 1.15k|} pqcrystals_kyber768_avx2_poly_frommsg: 283| 256|{ 284| |#if (KYBER_INDCPA_MSGBYTES != 32) 285| |#error "KYBER_INDCPA_MSGBYTES must be equal to 32!" 286| |#endif 287| 256| __m256i f, g0, g1, g2, g3, h0, h1, h2, h3; 288| 256| const __m256i shift = _mm256_broadcastsi128_si256(_mm_set_epi32(0,1,2,3)); 289| 256| const __m256i idx = _mm256_broadcastsi128_si256(_mm_set_epi8(15,14,11,10,7,6,3,2,13,12,9,8,5,4,1,0)); 290| 256| const __m256i hqs = _mm256_set1_epi16((KYBER_Q+1)/2); ------------------ | | 34| 256|#define KYBER_Q 3329 ------------------ 291| | 292| 256|#define FROMMSG64(i) \ 293| 256| g3 = _mm256_shuffle_epi32(f,0x55*i); \ 294| 256| g3 = _mm256_sllv_epi32(g3,shift); \ 295| 256| g3 = _mm256_shuffle_epi8(g3,idx); \ 296| 256| g0 = _mm256_slli_epi16(g3,12); \ 297| 256| g1 = _mm256_slli_epi16(g3,8); \ 298| 256| g2 = _mm256_slli_epi16(g3,4); \ 299| 256| g0 = _mm256_srai_epi16(g0,15); \ 300| 256| g1 = _mm256_srai_epi16(g1,15); \ 301| 256| g2 = _mm256_srai_epi16(g2,15); \ 302| 256| g3 = _mm256_srai_epi16(g3,15); \ 303| 256| g0 = _mm256_and_si256(g0,hqs); /* 19 18 17 16 3 2 1 0 */ \ 304| 256| g1 = _mm256_and_si256(g1,hqs); /* 23 22 21 20 7 6 5 4 */ \ 305| 256| g2 = _mm256_and_si256(g2,hqs); /* 27 26 25 24 11 10 9 8 */ \ 306| 256| g3 = _mm256_and_si256(g3,hqs); /* 31 30 29 28 15 14 13 12 */ \ 307| 256| h0 = _mm256_unpacklo_epi64(g0,g1); \ 308| 256| h2 = _mm256_unpackhi_epi64(g0,g1); \ 309| 256| h1 = _mm256_unpacklo_epi64(g2,g3); \ 310| 256| h3 = _mm256_unpackhi_epi64(g2,g3); \ 311| 256| g0 = _mm256_permute2x128_si256(h0,h1,0x20); \ 312| 256| g2 = _mm256_permute2x128_si256(h0,h1,0x31); \ 313| 256| g1 = _mm256_permute2x128_si256(h2,h3,0x20); \ 314| 256| g3 = _mm256_permute2x128_si256(h2,h3,0x31); \ 315| 256| _mm256_store_si256(&r->vec[0+2*i+0],g0); \ 316| 256| _mm256_store_si256(&r->vec[0+2*i+1],g1); \ 317| 256| _mm256_store_si256(&r->vec[8+2*i+0],g2); \ 318| 256| _mm256_store_si256(&r->vec[8+2*i+1],g3) 319| | 320| 256| f = _mm256_loadu_si256((__m256i *)msg); 321| 256| FROMMSG64(0); ------------------ | | 293| 256| g3 = _mm256_shuffle_epi32(f,0x55*i); \ | | 294| 256| g3 = _mm256_sllv_epi32(g3,shift); \ | | 295| 256| g3 = _mm256_shuffle_epi8(g3,idx); \ | | 296| 256| g0 = _mm256_slli_epi16(g3,12); \ | | 297| 256| g1 = _mm256_slli_epi16(g3,8); \ | | 298| 256| g2 = _mm256_slli_epi16(g3,4); \ | | 299| 256| g0 = _mm256_srai_epi16(g0,15); \ | | 300| 256| g1 = _mm256_srai_epi16(g1,15); \ | | 301| 256| g2 = _mm256_srai_epi16(g2,15); \ | | 302| 256| g3 = _mm256_srai_epi16(g3,15); \ | | 303| 256| g0 = _mm256_and_si256(g0,hqs); /* 19 18 17 16 3 2 1 0 */ \ | | 304| 256| g1 = _mm256_and_si256(g1,hqs); /* 23 22 21 20 7 6 5 4 */ \ | | 305| 256| g2 = _mm256_and_si256(g2,hqs); /* 27 26 25 24 11 10 9 8 */ \ | | 306| 256| g3 = _mm256_and_si256(g3,hqs); /* 31 30 29 28 15 14 13 12 */ \ | | 307| 256| h0 = _mm256_unpacklo_epi64(g0,g1); \ | | 308| 256| h2 = _mm256_unpackhi_epi64(g0,g1); \ | | 309| 256| h1 = _mm256_unpacklo_epi64(g2,g3); \ | | 310| 256| h3 = _mm256_unpackhi_epi64(g2,g3); \ | | 311| 256| g0 = _mm256_permute2x128_si256(h0,h1,0x20); \ | | 312| 256| g2 = _mm256_permute2x128_si256(h0,h1,0x31); \ | | 313| 256| g1 = _mm256_permute2x128_si256(h2,h3,0x20); \ | | 314| 256| g3 = _mm256_permute2x128_si256(h2,h3,0x31); \ | | 315| 256| _mm256_store_si256(&r->vec[0+2*i+0],g0); \ | | 316| 256| _mm256_store_si256(&r->vec[0+2*i+1],g1); \ | | 317| 256| _mm256_store_si256(&r->vec[8+2*i+0],g2); \ | | 318| 256| _mm256_store_si256(&r->vec[8+2*i+1],g3) ------------------ 322| 256| FROMMSG64(1); ------------------ | | 293| 256| g3 = _mm256_shuffle_epi32(f,0x55*i); \ | | 294| 256| g3 = _mm256_sllv_epi32(g3,shift); \ | | 295| 256| g3 = _mm256_shuffle_epi8(g3,idx); \ | | 296| 256| g0 = _mm256_slli_epi16(g3,12); \ | | 297| 256| g1 = _mm256_slli_epi16(g3,8); \ | | 298| 256| g2 = _mm256_slli_epi16(g3,4); \ | | 299| 256| g0 = _mm256_srai_epi16(g0,15); \ | | 300| 256| g1 = _mm256_srai_epi16(g1,15); \ | | 301| 256| g2 = _mm256_srai_epi16(g2,15); \ | | 302| 256| g3 = _mm256_srai_epi16(g3,15); \ | | 303| 256| g0 = _mm256_and_si256(g0,hqs); /* 19 18 17 16 3 2 1 0 */ \ | | 304| 256| g1 = _mm256_and_si256(g1,hqs); /* 23 22 21 20 7 6 5 4 */ \ | | 305| 256| g2 = _mm256_and_si256(g2,hqs); /* 27 26 25 24 11 10 9 8 */ \ | | 306| 256| g3 = _mm256_and_si256(g3,hqs); /* 31 30 29 28 15 14 13 12 */ \ | | 307| 256| h0 = _mm256_unpacklo_epi64(g0,g1); \ | | 308| 256| h2 = _mm256_unpackhi_epi64(g0,g1); \ | | 309| 256| h1 = _mm256_unpacklo_epi64(g2,g3); \ | | 310| 256| h3 = _mm256_unpackhi_epi64(g2,g3); \ | | 311| 256| g0 = _mm256_permute2x128_si256(h0,h1,0x20); \ | | 312| 256| g2 = _mm256_permute2x128_si256(h0,h1,0x31); \ | | 313| 256| g1 = _mm256_permute2x128_si256(h2,h3,0x20); \ | | 314| 256| g3 = _mm256_permute2x128_si256(h2,h3,0x31); \ | | 315| 256| _mm256_store_si256(&r->vec[0+2*i+0],g0); \ | | 316| 256| _mm256_store_si256(&r->vec[0+2*i+1],g1); \ | | 317| 256| _mm256_store_si256(&r->vec[8+2*i+0],g2); \ | | 318| 256| _mm256_store_si256(&r->vec[8+2*i+1],g3) ------------------ 323| 256| FROMMSG64(2); ------------------ | | 293| 256| g3 = _mm256_shuffle_epi32(f,0x55*i); \ | | 294| 256| g3 = _mm256_sllv_epi32(g3,shift); \ | | 295| 256| g3 = _mm256_shuffle_epi8(g3,idx); \ | | 296| 256| g0 = _mm256_slli_epi16(g3,12); \ | | 297| 256| g1 = _mm256_slli_epi16(g3,8); \ | | 298| 256| g2 = _mm256_slli_epi16(g3,4); \ | | 299| 256| g0 = _mm256_srai_epi16(g0,15); \ | | 300| 256| g1 = _mm256_srai_epi16(g1,15); \ | | 301| 256| g2 = _mm256_srai_epi16(g2,15); \ | | 302| 256| g3 = _mm256_srai_epi16(g3,15); \ | | 303| 256| g0 = _mm256_and_si256(g0,hqs); /* 19 18 17 16 3 2 1 0 */ \ | | 304| 256| g1 = _mm256_and_si256(g1,hqs); /* 23 22 21 20 7 6 5 4 */ \ | | 305| 256| g2 = _mm256_and_si256(g2,hqs); /* 27 26 25 24 11 10 9 8 */ \ | | 306| 256| g3 = _mm256_and_si256(g3,hqs); /* 31 30 29 28 15 14 13 12 */ \ | | 307| 256| h0 = _mm256_unpacklo_epi64(g0,g1); \ | | 308| 256| h2 = _mm256_unpackhi_epi64(g0,g1); \ | | 309| 256| h1 = _mm256_unpacklo_epi64(g2,g3); \ | | 310| 256| h3 = _mm256_unpackhi_epi64(g2,g3); \ | | 311| 256| g0 = _mm256_permute2x128_si256(h0,h1,0x20); \ | | 312| 256| g2 = _mm256_permute2x128_si256(h0,h1,0x31); \ | | 313| 256| g1 = _mm256_permute2x128_si256(h2,h3,0x20); \ | | 314| 256| g3 = _mm256_permute2x128_si256(h2,h3,0x31); \ | | 315| 256| _mm256_store_si256(&r->vec[0+2*i+0],g0); \ | | 316| 256| _mm256_store_si256(&r->vec[0+2*i+1],g1); \ | | 317| 256| _mm256_store_si256(&r->vec[8+2*i+0],g2); \ | | 318| 256| _mm256_store_si256(&r->vec[8+2*i+1],g3) ------------------ 324| | FROMMSG64(3); ------------------ | | 293| 256| g3 = _mm256_shuffle_epi32(f,0x55*i); \ | | 294| 256| g3 = _mm256_sllv_epi32(g3,shift); \ | | 295| 256| g3 = _mm256_shuffle_epi8(g3,idx); \ | | 296| 256| g0 = _mm256_slli_epi16(g3,12); \ | | 297| 256| g1 = _mm256_slli_epi16(g3,8); \ | | 298| 256| g2 = _mm256_slli_epi16(g3,4); \ | | 299| 256| g0 = _mm256_srai_epi16(g0,15); \ | | 300| 256| g1 = _mm256_srai_epi16(g1,15); \ | | 301| 256| g2 = _mm256_srai_epi16(g2,15); \ | | 302| 256| g3 = _mm256_srai_epi16(g3,15); \ | | 303| 256| g0 = _mm256_and_si256(g0,hqs); /* 19 18 17 16 3 2 1 0 */ \ | | 304| 256| g1 = _mm256_and_si256(g1,hqs); /* 23 22 21 20 7 6 5 4 */ \ | | 305| 256| g2 = _mm256_and_si256(g2,hqs); /* 27 26 25 24 11 10 9 8 */ \ | | 306| 256| g3 = _mm256_and_si256(g3,hqs); /* 31 30 29 28 15 14 13 12 */ \ | | 307| 256| h0 = _mm256_unpacklo_epi64(g0,g1); \ | | 308| 256| h2 = _mm256_unpackhi_epi64(g0,g1); \ | | 309| 256| h1 = _mm256_unpacklo_epi64(g2,g3); \ | | 310| 256| h3 = _mm256_unpackhi_epi64(g2,g3); \ | | 311| 256| g0 = _mm256_permute2x128_si256(h0,h1,0x20); \ | | 312| 256| g2 = _mm256_permute2x128_si256(h0,h1,0x31); \ | | 313| 256| g1 = _mm256_permute2x128_si256(h2,h3,0x20); \ | | 314| 256| g3 = _mm256_permute2x128_si256(h2,h3,0x31); \ | | 315| 256| _mm256_store_si256(&r->vec[0+2*i+0],g0); \ | | 316| 256| _mm256_store_si256(&r->vec[0+2*i+1],g1); \ | | 317| 256| _mm256_store_si256(&r->vec[8+2*i+0],g2); \ | | 318| 256| _mm256_store_si256(&r->vec[8+2*i+1],g3) ------------------ 325| 256|} pqcrystals_kyber768_avx2_poly_tomsg: 339| 128|{ 340| 128| unsigned int i; 341| 128| uint32_t small; 342| 128| __m256i f0, f1, g0, g1; 343| 128| const __m256i hq = _mm256_set1_epi16((KYBER_Q - 1)/2); ------------------ | | 34| 128|#define KYBER_Q 3329 ------------------ 344| 128| const __m256i hhq = _mm256_set1_epi16((KYBER_Q - 1)/4); ------------------ | | 34| 128|#define KYBER_Q 3329 ------------------ 345| | 346| 1.15k| for(i=0;ivec[2*i+0]); 348| 1.02k| f1 = _mm256_load_si256(&a->vec[2*i+1]); 349| 1.02k| f0 = _mm256_sub_epi16(hq, f0); 350| 1.02k| f1 = _mm256_sub_epi16(hq, f1); 351| 1.02k| g0 = _mm256_srai_epi16(f0, 15); 352| 1.02k| g1 = _mm256_srai_epi16(f1, 15); 353| 1.02k| f0 = _mm256_xor_si256(f0, g0); 354| 1.02k| f1 = _mm256_xor_si256(f1, g1); 355| 1.02k| f0 = _mm256_sub_epi16(f0, hhq); 356| 1.02k| f1 = _mm256_sub_epi16(f1, hhq); 357| 1.02k| f0 = _mm256_packs_epi16(f0, f1); 358| | f0 = _mm256_permute4x64_epi64(f0, 0xD8); 359| 1.02k| small = _mm256_movemask_epi8(f0); 360| 1.02k| memcpy(&msg[4*i], &small, 4); 361| 1.02k| } 362| 128|} pqcrystals_kyber768_avx2_poly_getnoise_eta2_4x: 415| 768|{ 416| 768| ALIGNED_UINT8(NOISE_NBLOCKS*SHAKE256_RATE) buf[4]; ------------------ | | 8| 768| union { \ | | 9| 768| uint8_t coeffs[N]; \ | | 10| 768| __m256i vec[(N+31)/32]; \ | | 11| 768| } ------------------ 417| 768| __m256i f; 418| 768| shake256x4incctx state; ------------------ | | 27| 768|#define shake256x4incctx OQS_SHA3_shake256_x4_inc_ctx ------------------ 419| | 420| 768| f = _mm256_loadu_si256((__m256i *)seed); 421| 768| _mm256_store_si256(buf[0].vec, f); 422| 768| _mm256_store_si256(buf[1].vec, f); 423| 768| _mm256_store_si256(buf[2].vec, f); 424| 768| _mm256_store_si256(buf[3].vec, f); 425| | 426| 768| buf[0].coeffs[32] = nonce0; 427| 768| buf[1].coeffs[32] = nonce1; 428| 768| buf[2].coeffs[32] = nonce2; 429| 768| buf[3].coeffs[32] = nonce3; 430| | 431| 768| shake256x4_inc_init(&state); ------------------ | | 28| 768|#define shake256x4_inc_init OQS_SHA3_shake256_x4_inc_init ------------------ 432| 768| shake256x4_absorb_once(&state, buf[0].coeffs, buf[1].coeffs, buf[2].coeffs, buf[3].coeffs, 33); ------------------ | | 42| 768|#define shake256x4_absorb_once OQS_SHA3_shake256_x4_absorb_once ------------------ 433| 768| shake256x4_squeezeblocks(buf[0].coeffs, buf[1].coeffs, buf[2].coeffs, buf[3].coeffs, NOISE_NBLOCKS, &state); ------------------ | | 49| 768| OQS_SHA3_shake256_x4_inc_squeeze(OUT0, OUT1, OUT2, OUT3, (NBLOCKS)*OQS_SHA3_SHAKE256_RATE, STATE) | | ------------------ | | | | 320| 768|#define OQS_SHA3_SHAKE256_RATE 136 | | ------------------ ------------------ 434| 768| shake256x4_inc_ctx_release(&state); ------------------ | | 32| 768|#define shake256x4_inc_ctx_release OQS_SHA3_shake256_x4_inc_ctx_release ------------------ 435| | 436| 768| poly_cbd_eta1(r0, buf[0].vec); ------------------ | | 9| 768|#define poly_cbd_eta1 KYBER_NAMESPACE(poly_cbd_eta1) | | ------------------ | | | | 21| 768|#define KYBER_NAMESPACE(s) pqcrystals_kyber768_avx2_##s | | ------------------ ------------------ 437| 768| poly_cbd_eta1(r1, buf[1].vec); ------------------ | | 9| 768|#define poly_cbd_eta1 KYBER_NAMESPACE(poly_cbd_eta1) | | ------------------ | | | | 21| 768|#define KYBER_NAMESPACE(s) pqcrystals_kyber768_avx2_##s | | ------------------ ------------------ 438| 768| poly_cbd_eta1(r2, buf[2].vec); ------------------ | | 9| 768|#define poly_cbd_eta1 KYBER_NAMESPACE(poly_cbd_eta1) | | ------------------ | | | | 21| 768|#define KYBER_NAMESPACE(s) pqcrystals_kyber768_avx2_##s | | ------------------ ------------------ 439| 768| poly_cbd_eta1(r3, buf[3].vec); ------------------ | | 9| 768|#define poly_cbd_eta1 KYBER_NAMESPACE(poly_cbd_eta1) | | ------------------ | | | | 21| 768|#define KYBER_NAMESPACE(s) pqcrystals_kyber768_avx2_##s | | ------------------ ------------------ 440| 768|} pqcrystals_kyber768_avx2_poly_ntt: 495| 1.92k|{ 496| 1.92k| ntt_avx(r->vec, qdata.vec); ------------------ | | 7| 1.92k|#define ntt_avx KYBER_NAMESPACE(ntt_avx) | | ------------------ | | | | 21| 1.92k|#define KYBER_NAMESPACE(s) pqcrystals_kyber768_avx2_##s | | ------------------ ------------------ ntt_avx(r->vec, qdata.vec); ------------------ | | 39| 1.92k|#define qdata KYBER_NAMESPACE(qdata) | | ------------------ | | | | 21| 1.92k|#define KYBER_NAMESPACE(s) pqcrystals_kyber768_avx2_##s | | ------------------ ------------------ 497| 1.92k|} pqcrystals_kyber768_avx2_poly_invntt_tomont: 512| 1.15k|{ 513| 1.15k| invntt_avx(r->vec, qdata.vec); ------------------ | | 9| 1.15k|#define invntt_avx KYBER_NAMESPACE(invntt_avx) | | ------------------ | | | | 21| 1.15k|#define KYBER_NAMESPACE(s) pqcrystals_kyber768_avx2_##s | | ------------------ ------------------ invntt_avx(r->vec, qdata.vec); ------------------ | | 39| 1.15k|#define qdata KYBER_NAMESPACE(qdata) | | ------------------ | | | | 21| 1.15k|#define KYBER_NAMESPACE(s) pqcrystals_kyber768_avx2_##s | | ------------------ ------------------ 514| 1.15k|} pqcrystals_kyber768_avx2_poly_nttunpack: 517| 3.45k|{ 518| 3.45k| nttunpack_avx(r->vec, qdata.vec); ------------------ | | 14| 3.45k|#define nttunpack_avx KYBER_NAMESPACE(nttunpack_avx) | | ------------------ | | | | 21| 3.45k|#define KYBER_NAMESPACE(s) pqcrystals_kyber768_avx2_##s | | ------------------ ------------------ nttunpack_avx(r->vec, qdata.vec); ------------------ | | 39| 3.45k|#define qdata KYBER_NAMESPACE(qdata) | | ------------------ | | | | 21| 3.45k|#define KYBER_NAMESPACE(s) pqcrystals_kyber768_avx2_##s | | ------------------ ------------------ 519| 3.45k|} pqcrystals_kyber768_avx2_poly_basemul_montgomery: 534| 4.60k|{ 535| 4.60k| basemul_avx(r->vec, a->vec, b->vec, qdata.vec); ------------------ | | 17| 4.60k|#define basemul_avx KYBER_NAMESPACE(basemul_avx) | | ------------------ | | | | 21| 4.60k|#define KYBER_NAMESPACE(s) pqcrystals_kyber768_avx2_##s | | ------------------ ------------------ basemul_avx(r->vec, a->vec, b->vec, qdata.vec); ------------------ | | 39| 4.60k|#define qdata KYBER_NAMESPACE(qdata) | | ------------------ | | | | 21| 4.60k|#define KYBER_NAMESPACE(s) pqcrystals_kyber768_avx2_##s | | ------------------ ------------------ 536| 4.60k|} pqcrystals_kyber768_avx2_poly_tomont: 547| 384|{ 548| 384| tomont_avx(r->vec, qdata.vec); ------------------ | | 9| 384|#define tomont_avx KYBER_NAMESPACE(tomont_avx) | | ------------------ | | | | 21| 384|#define KYBER_NAMESPACE(s) pqcrystals_kyber768_avx2_##s | | ------------------ ------------------ tomont_avx(r->vec, qdata.vec); ------------------ | | 39| 384|#define qdata KYBER_NAMESPACE(qdata) | | ------------------ | | | | 21| 384|#define KYBER_NAMESPACE(s) pqcrystals_kyber768_avx2_##s | | ------------------ ------------------ 549| 384|} pqcrystals_kyber768_avx2_poly_reduce: 560| 1.92k|{ 561| 1.92k| reduce_avx(r->vec, qdata.vec); ------------------ | | 7| 1.92k|#define reduce_avx KYBER_NAMESPACE(reduce_avx) | | ------------------ | | | | 21| 1.92k|#define KYBER_NAMESPACE(s) pqcrystals_kyber768_avx2_##s | | ------------------ ------------------ reduce_avx(r->vec, qdata.vec); ------------------ | | 39| 1.92k|#define qdata KYBER_NAMESPACE(qdata) | | ------------------ | | | | 21| 1.92k|#define KYBER_NAMESPACE(s) pqcrystals_kyber768_avx2_##s | | ------------------ ------------------ 562| 1.92k|} pqcrystals_kyber768_avx2_poly_add: 575| 4.73k|{ 576| 4.73k| unsigned int i; 577| 4.73k| __m256i f0, f1; 578| | 579| 80.5k| for(i=0;ivec[i]); 581| 75.7k| f1 = _mm256_load_si256(&b->vec[i]); 582| 75.7k| f0 = _mm256_add_epi16(f0, f1); 583| 75.7k| _mm256_store_si256(&r->vec[i], f0); 584| 75.7k| } 585| 4.73k|} pqcrystals_kyber768_avx2_poly_sub: 598| 128|{ 599| 128| unsigned int i; 600| 128| __m256i f0, f1; 601| | 602| 2.17k| for(i=0;ivec[i]); 604| 2.04k| f1 = _mm256_load_si256(&b->vec[i]); 605| 2.04k| f0 = _mm256_sub_epi16(f0, f1); 606| 2.04k| _mm256_store_si256(&r->vec[i], f0); 607| 2.04k| } 608| 128|} pqcrystals_kyber768_avx2_polyvec_compress: 158| 256|{ 159| 256| unsigned int i; 160| | 161| 256|#if (KYBER_POLYVECCOMPRESSEDBYTES == (KYBER_K * 320)) 162| 1.02k| for(i=0;ivec[i]); 164| |#elif (KYBER_POLYVECCOMPRESSEDBYTES == (KYBER_K * 352)) 165| | for(i=0;ivec[i]); 167| |#endif 168| 256|} pqcrystals_kyber768_avx2_polyvec_decompress: 181| 128|{ 182| 128| unsigned int i; 183| | 184| 128|#if (KYBER_POLYVECCOMPRESSEDBYTES == (KYBER_K * 320)) 185| 512| for(i=0;ivec[i],&a[320*i]); 187| |#elif (KYBER_POLYVECCOMPRESSEDBYTES == (KYBER_K * 352)) 188| | for(i=0;ivec[i],&a[352*i]); 190| |#endif 191| 128|} pqcrystals_kyber768_avx2_polyvec_tobytes: 203| 256|{ 204| 256| unsigned int i; 205| 1.02k| for(i=0;ivec[i]); ------------------ | | 15| 768|#define poly_tobytes KYBER_NAMESPACE(poly_tobytes) | | ------------------ | | | | 21| 768|#define KYBER_NAMESPACE(s) pqcrystals_kyber768_avx2_##s | | ------------------ ------------------ poly_tobytes(r+i*KYBER_POLYBYTES, &a->vec[i]); ------------------ | | 39| 768|#define KYBER_POLYBYTES 384 ------------------ 207| 256|} pqcrystals_kyber768_avx2_polyvec_frombytes: 220| 384|{ 221| 384| unsigned int i; 222| 1.53k| for(i=0;ivec[i], a+i*KYBER_POLYBYTES); ------------------ | | 17| 1.15k|#define poly_frombytes KYBER_NAMESPACE(poly_frombytes) | | ------------------ | | | | 21| 1.15k|#define KYBER_NAMESPACE(s) pqcrystals_kyber768_avx2_##s | | ------------------ ------------------ poly_frombytes(&r->vec[i], a+i*KYBER_POLYBYTES); ------------------ | | 39| 1.15k|#define KYBER_POLYBYTES 384 ------------------ 224| 384|} pqcrystals_kyber768_avx2_polyvec_ntt: 234| 640|{ 235| 640| unsigned int i; 236| 2.56k| for(i=0;ivec[i]); ------------------ | | 58| 1.92k|#define poly_ntt KYBER_NAMESPACE(poly_ntt) | | ------------------ | | | | 21| 1.92k|#define KYBER_NAMESPACE(s) pqcrystals_kyber768_avx2_##s | | ------------------ ------------------ 238| 640|} pqcrystals_kyber768_avx2_polyvec_invntt_tomont: 249| 256|{ 250| 256| unsigned int i; 251| 1.02k| for(i=0;ivec[i]); ------------------ | | 60| 768|#define poly_invntt_tomont KYBER_NAMESPACE(poly_invntt_tomont) | | ------------------ | | | | 21| 768|#define KYBER_NAMESPACE(s) pqcrystals_kyber768_avx2_##s | | ------------------ ------------------ 253| 256|} pqcrystals_kyber768_avx2_polyvec_basemul_acc_montgomery: 266| 1.53k|{ 267| 1.53k| unsigned int i; 268| 1.53k| poly tmp; 269| | 270| 1.53k| poly_basemul_montgomery(r,&a->vec[0],&b->vec[0]); ------------------ | | 64| 1.53k|#define poly_basemul_montgomery KYBER_NAMESPACE(poly_basemul_montgomery) | | ------------------ | | | | 21| 1.53k|#define KYBER_NAMESPACE(s) pqcrystals_kyber768_avx2_##s | | ------------------ ------------------ 271| 4.60k| for(i=1;ivec[i],&b->vec[i]); ------------------ | | 64| 3.07k|#define poly_basemul_montgomery KYBER_NAMESPACE(poly_basemul_montgomery) | | ------------------ | | | | 21| 3.07k|#define KYBER_NAMESPACE(s) pqcrystals_kyber768_avx2_##s | | ------------------ ------------------ 273| 3.07k| poly_add(r,r,&tmp); ------------------ | | 72| 3.07k|#define poly_add KYBER_NAMESPACE(poly_add) | | ------------------ | | | | 21| 3.07k|#define KYBER_NAMESPACE(s) pqcrystals_kyber768_avx2_##s | | ------------------ ------------------ 274| 3.07k| } 275| 1.53k|} pqcrystals_kyber768_avx2_polyvec_reduce: 287| 512|{ 288| 512| unsigned int i; 289| 2.04k| for(i=0;ivec[i]); ------------------ | | 69| 1.53k|#define poly_reduce KYBER_NAMESPACE(poly_reduce) | | ------------------ | | | | 21| 1.53k|#define KYBER_NAMESPACE(s) pqcrystals_kyber768_avx2_##s | | ------------------ ------------------ 291| 512|} pqcrystals_kyber768_avx2_polyvec_add: 303| 384|{ 304| 384| unsigned int i; 305| 1.53k| for(i=0;ivec[i], &a->vec[i], &b->vec[i]); ------------------ | | 72| 1.15k|#define poly_add KYBER_NAMESPACE(poly_add) | | ------------------ | | | | 21| 1.15k|#define KYBER_NAMESPACE(s) pqcrystals_kyber768_avx2_##s | | ------------------ ------------------ 307| 384|} pqcrystals_kyber768_avx2_rej_uniform_avx: 275| 3.45k|{ 276| 3.45k| unsigned int ctr, pos; 277| 3.45k| uint16_t val0, val1; 278| 3.45k| uint32_t good; 279| |#ifdef BMI 280| | uint64_t idx0, idx1, idx2, idx3; 281| |#endif 282| 3.45k| const __m256i bound = _mm256_load_si256(&qdata.vec[_16XQ/16]); ------------------ | | 39| 3.45k|#define qdata KYBER_NAMESPACE(qdata) | | ------------------ | | | | 21| 3.45k|#define KYBER_NAMESPACE(s) pqcrystals_kyber768_avx2_##s | | ------------------ ------------------ const __m256i bound = _mm256_load_si256(&qdata.vec[_16XQ/16]); ------------------ | | 6| 3.45k|#define _16XQ 0 ------------------ 283| 3.45k| const __m256i ones = _mm256_set1_epi8(1); 284| 3.45k| const __m256i mask = _mm256_set1_epi16(0xFFF); 285| 3.45k| const __m256i idx8 = _mm256_set_epi8(15,14,14,13,12,11,11,10, 286| 3.45k| 9, 8, 8, 7, 6, 5, 5, 4, 287| 3.45k| 11,10,10, 9, 8, 7, 7, 6, 288| 3.45k| 5, 4, 4, 3, 2, 1, 1, 0); 289| 3.45k| __m256i f0, f1, g0, g1, g2, g3; 290| 3.45k| __m128i f, t, pilo, pihi; 291| | 292| 3.45k| ctr = pos = 0; 293| 35.2k| while(ctr <= KYBER_N - 32 && pos <= REJ_UNIFORM_AVX_BUFLEN - 48) { ------------------ | | 33| 35.2k|#define KYBER_N 256 ------------------ while(ctr <= KYBER_N - 32 && pos <= REJ_UNIFORM_AVX_BUFLEN - 48) { ------------------ | | 9| 31.7k|#define REJ_UNIFORM_AVX_BUFLEN (REJ_UNIFORM_AVX_NBLOCKS*XOF_BLOCKBYTES) | | ------------------ | | | | 8| 31.7k|#define REJ_UNIFORM_AVX_NBLOCKS ((12*KYBER_N/8*(1 << 12)/KYBER_Q + XOF_BLOCKBYTES)/XOF_BLOCKBYTES) | | | | ------------------ | | | | | | 33| 31.7k|#define KYBER_N 256 | | | | ------------------ | | | | #define REJ_UNIFORM_AVX_NBLOCKS ((12*KYBER_N/8*(1 << 12)/KYBER_Q + XOF_BLOCKBYTES)/XOF_BLOCKBYTES) | | | | ------------------ | | | | | | 34| 31.7k|#define KYBER_Q 3329 | | | | ------------------ | | | | #define REJ_UNIFORM_AVX_NBLOCKS ((12*KYBER_N/8*(1 << 12)/KYBER_Q + XOF_BLOCKBYTES)/XOF_BLOCKBYTES) | | | | ------------------ | | | | | | 50| 31.7k|#define XOF_BLOCKBYTES SHAKE128_RATE | | | | | | ------------------ | | | | | | | | 8| 31.7k|#define SHAKE128_RATE OQS_SHA3_SHAKE128_RATE | | | | | | | | ------------------ | | | | | | | | | | 239| 31.7k|#define OQS_SHA3_SHAKE128_RATE 168 | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | | | #define REJ_UNIFORM_AVX_NBLOCKS ((12*KYBER_N/8*(1 << 12)/KYBER_Q + XOF_BLOCKBYTES)/XOF_BLOCKBYTES) | | | | ------------------ | | | | | | 50| 31.7k|#define XOF_BLOCKBYTES SHAKE128_RATE | | | | | | ------------------ | | | | | | | | 8| 31.7k|#define SHAKE128_RATE OQS_SHA3_SHAKE128_RATE | | | | | | | | ------------------ | | | | | | | | | | 239| 31.7k|#define OQS_SHA3_SHAKE128_RATE 168 | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ | | #define REJ_UNIFORM_AVX_BUFLEN (REJ_UNIFORM_AVX_NBLOCKS*XOF_BLOCKBYTES) | | ------------------ | | | | 50| 31.7k|#define XOF_BLOCKBYTES SHAKE128_RATE | | | | ------------------ | | | | | | 8| 31.7k|#define SHAKE128_RATE OQS_SHA3_SHAKE128_RATE | | | | | | ------------------ | | | | | | | | 239| 31.7k|#define OQS_SHA3_SHAKE128_RATE 168 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ | Branch (293:9): [True: 31.7k, False: 3.44k] | Branch (293:32): [True: 31.7k, False: 9] ------------------ 294| 31.7k| f0 = _mm256_loadu_si256((__m256i *)&buf[pos]); 295| 31.7k| f1 = _mm256_loadu_si256((__m256i *)&buf[pos+24]); 296| 31.7k| f0 = _mm256_permute4x64_epi64(f0, 0x94); 297| 31.7k| f1 = _mm256_permute4x64_epi64(f1, 0x94); 298| 31.7k| f0 = _mm256_shuffle_epi8(f0, idx8); 299| 31.7k| f1 = _mm256_shuffle_epi8(f1, idx8); 300| 31.7k| g0 = _mm256_srli_epi16(f0, 4); 301| 31.7k| g1 = _mm256_srli_epi16(f1, 4); 302| 31.7k| f0 = _mm256_blend_epi16(f0, g0, 0xAA); 303| 31.7k| f1 = _mm256_blend_epi16(f1, g1, 0xAA); 304| 31.7k| f0 = _mm256_and_si256(f0, mask); 305| 31.7k| f1 = _mm256_and_si256(f1, mask); 306| 31.7k| pos += 48; 307| | 308| 31.7k| g0 = _mm256_cmpgt_epi16(bound, f0); 309| 31.7k| g1 = _mm256_cmpgt_epi16(bound, f1); 310| | 311| 31.7k| g0 = _mm256_packs_epi16(g0, g1); 312| 31.7k| good = _mm256_movemask_epi8(g0); 313| | 314| |#ifdef BMI 315| | idx0 = _pdep_u64(good >> 0, 0x0101010101010101); 316| | idx1 = _pdep_u64(good >> 8, 0x0101010101010101); 317| | idx2 = _pdep_u64(good >> 16, 0x0101010101010101); 318| | idx3 = _pdep_u64(good >> 24, 0x0101010101010101); 319| | idx0 = (idx0 << 8) - idx0; 320| | idx0 = _pext_u64(0x0E0C0A0806040200, idx0); 321| | idx1 = (idx1 << 8) - idx1; 322| | idx1 = _pext_u64(0x0E0C0A0806040200, idx1); 323| | idx2 = (idx2 << 8) - idx2; 324| | idx2 = _pext_u64(0x0E0C0A0806040200, idx2); 325| | idx3 = (idx3 << 8) - idx3; 326| | idx3 = _pext_u64(0x0E0C0A0806040200, idx3); 327| | 328| | g0 = _mm256_castsi128_si256(_mm_cvtsi64_si128(idx0)); 329| | g1 = _mm256_castsi128_si256(_mm_cvtsi64_si128(idx1)); 330| | g0 = _mm256_inserti128_si256(g0, _mm_cvtsi64_si128(idx2), 1); 331| | g1 = _mm256_inserti128_si256(g1, _mm_cvtsi64_si128(idx3), 1); 332| |#else 333| 31.7k| g0 = _mm256_castsi128_si256(_mm_loadl_epi64((__m128i *)&idx[(good >> 0) & 0xFF])); 334| 31.7k| g1 = _mm256_castsi128_si256(_mm_loadl_epi64((__m128i *)&idx[(good >> 8) & 0xFF])); 335| 31.7k| g0 = _mm256_inserti128_si256(g0, _mm_loadl_epi64((__m128i *)&idx[(good >> 16) & 0xFF]), 1); 336| 31.7k| g1 = _mm256_inserti128_si256(g1, _mm_loadl_epi64((__m128i *)&idx[(good >> 24) & 0xFF]), 1); 337| 31.7k|#endif 338| | 339| 31.7k| g2 = _mm256_add_epi8(g0, ones); 340| 31.7k| g3 = _mm256_add_epi8(g1, ones); 341| 31.7k| g0 = _mm256_unpacklo_epi8(g0, g2); 342| 31.7k| g1 = _mm256_unpacklo_epi8(g1, g3); 343| | 344| 31.7k| f0 = _mm256_shuffle_epi8(f0, g0); 345| 31.7k| f1 = _mm256_shuffle_epi8(f1, g1); 346| | 347| 31.7k| _mm_storeu_si128((__m128i *)&r[ctr], _mm256_castsi256_si128(f0)); 348| 31.7k| ctr += _mm_popcnt_u32((good >> 0) & 0xFF); 349| 31.7k| _mm_storeu_si128((__m128i *)&r[ctr], _mm256_extracti128_si256(f0, 1)); 350| 31.7k| ctr += _mm_popcnt_u32((good >> 16) & 0xFF); 351| 31.7k| _mm_storeu_si128((__m128i *)&r[ctr], _mm256_castsi256_si128(f1)); 352| 31.7k| ctr += _mm_popcnt_u32((good >> 8) & 0xFF); 353| 31.7k| _mm_storeu_si128((__m128i *)&r[ctr], _mm256_extracti128_si256(f1, 1)); 354| 31.7k| ctr += _mm_popcnt_u32((good >> 24) & 0xFF); 355| 31.7k| } 356| | 357| 11.6k| while(ctr <= KYBER_N - 8 && pos <= REJ_UNIFORM_AVX_BUFLEN - 12) { ------------------ | | 33| 11.6k|#define KYBER_N 256 ------------------ while(ctr <= KYBER_N - 8 && pos <= REJ_UNIFORM_AVX_BUFLEN - 12) { ------------------ | | 9| 8.26k|#define REJ_UNIFORM_AVX_BUFLEN (REJ_UNIFORM_AVX_NBLOCKS*XOF_BLOCKBYTES) | | ------------------ | | | | 8| 8.26k|#define REJ_UNIFORM_AVX_NBLOCKS ((12*KYBER_N/8*(1 << 12)/KYBER_Q + XOF_BLOCKBYTES)/XOF_BLOCKBYTES) | | | | ------------------ | | | | | | 33| 8.26k|#define KYBER_N 256 | | | | ------------------ | | | | #define REJ_UNIFORM_AVX_NBLOCKS ((12*KYBER_N/8*(1 << 12)/KYBER_Q + XOF_BLOCKBYTES)/XOF_BLOCKBYTES) | | | | ------------------ | | | | | | 34| 8.26k|#define KYBER_Q 3329 | | | | ------------------ | | | | #define REJ_UNIFORM_AVX_NBLOCKS ((12*KYBER_N/8*(1 << 12)/KYBER_Q + XOF_BLOCKBYTES)/XOF_BLOCKBYTES) | | | | ------------------ | | | | | | 50| 8.26k|#define XOF_BLOCKBYTES SHAKE128_RATE | | | | | | ------------------ | | | | | | | | 8| 8.26k|#define SHAKE128_RATE OQS_SHA3_SHAKE128_RATE | | | | | | | | ------------------ | | | | | | | | | | 239| 8.26k|#define OQS_SHA3_SHAKE128_RATE 168 | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | | | #define REJ_UNIFORM_AVX_NBLOCKS ((12*KYBER_N/8*(1 << 12)/KYBER_Q + XOF_BLOCKBYTES)/XOF_BLOCKBYTES) | | | | ------------------ | | | | | | 50| 8.26k|#define XOF_BLOCKBYTES SHAKE128_RATE | | | | | | ------------------ | | | | | | | | 8| 8.26k|#define SHAKE128_RATE OQS_SHA3_SHAKE128_RATE | | | | | | | | ------------------ | | | | | | | | | | 239| 8.26k|#define OQS_SHA3_SHAKE128_RATE 168 | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ | | #define REJ_UNIFORM_AVX_BUFLEN (REJ_UNIFORM_AVX_NBLOCKS*XOF_BLOCKBYTES) | | ------------------ | | | | 50| 8.26k|#define XOF_BLOCKBYTES SHAKE128_RATE | | | | ------------------ | | | | | | 8| 8.26k|#define SHAKE128_RATE OQS_SHA3_SHAKE128_RATE | | | | | | ------------------ | | | | | | | | 239| 8.26k|#define OQS_SHA3_SHAKE128_RATE 168 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ | Branch (357:9): [True: 8.26k, False: 3.34k] | Branch (357:31): [True: 8.15k, False: 108] ------------------ 358| 8.15k| f = _mm_loadu_si128((__m128i *)&buf[pos]); 359| 8.15k| f = _mm_shuffle_epi8(f, _mm256_castsi256_si128(idx8)); 360| 8.15k| t = _mm_srli_epi16(f, 4); 361| 8.15k| f = _mm_blend_epi16(f, t, 0xAA); 362| 8.15k| f = _mm_and_si128(f, _mm256_castsi256_si128(mask)); 363| 8.15k| pos += 12; 364| | 365| 8.15k| t = _mm_cmpgt_epi16(_mm256_castsi256_si128(bound), f); 366| 8.15k| good = _mm_movemask_epi8(t); 367| | 368| |#ifdef BMI 369| | good &= 0x5555; 370| | idx0 = _pdep_u64(good, 0x1111111111111111); 371| | idx0 = (idx0 << 8) - idx0; 372| | idx0 = _pext_u64(0x0E0C0A0806040200, idx0); 373| | pilo = _mm_cvtsi64_si128(idx0); 374| |#else 375| 8.15k| good = _pext_u32(good, 0x5555); 376| 8.15k| pilo = _mm_loadl_epi64((__m128i *)&idx[good]); 377| 8.15k|#endif 378| | 379| 8.15k| pihi = _mm_add_epi8(pilo, _mm256_castsi256_si128(ones)); 380| 8.15k| pilo = _mm_unpacklo_epi8(pilo, pihi); 381| 8.15k| f = _mm_shuffle_epi8(f, pilo); 382| 8.15k| _mm_storeu_si128((__m128i *)&r[ctr], f); 383| 8.15k| ctr += _mm_popcnt_u32(good); 384| 8.15k| } 385| | 386| 11.7k| while(ctr < KYBER_N && pos <= REJ_UNIFORM_AVX_BUFLEN - 3) { ------------------ | | 33| 23.5k|#define KYBER_N 256 ------------------ while(ctr < KYBER_N && pos <= REJ_UNIFORM_AVX_BUFLEN - 3) { ------------------ | | 9| 8.75k|#define REJ_UNIFORM_AVX_BUFLEN (REJ_UNIFORM_AVX_NBLOCKS*XOF_BLOCKBYTES) | | ------------------ | | | | 8| 8.75k|#define REJ_UNIFORM_AVX_NBLOCKS ((12*KYBER_N/8*(1 << 12)/KYBER_Q + XOF_BLOCKBYTES)/XOF_BLOCKBYTES) | | | | ------------------ | | | | | | 33| 8.75k|#define KYBER_N 256 | | | | ------------------ | | | | #define REJ_UNIFORM_AVX_NBLOCKS ((12*KYBER_N/8*(1 << 12)/KYBER_Q + XOF_BLOCKBYTES)/XOF_BLOCKBYTES) | | | | ------------------ | | | | | | 34| 8.75k|#define KYBER_Q 3329 | | | | ------------------ | | | | #define REJ_UNIFORM_AVX_NBLOCKS ((12*KYBER_N/8*(1 << 12)/KYBER_Q + XOF_BLOCKBYTES)/XOF_BLOCKBYTES) | | | | ------------------ | | | | | | 50| 8.75k|#define XOF_BLOCKBYTES SHAKE128_RATE | | | | | | ------------------ | | | | | | | | 8| 8.75k|#define SHAKE128_RATE OQS_SHA3_SHAKE128_RATE | | | | | | | | ------------------ | | | | | | | | | | 239| 8.75k|#define OQS_SHA3_SHAKE128_RATE 168 | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | | | #define REJ_UNIFORM_AVX_NBLOCKS ((12*KYBER_N/8*(1 << 12)/KYBER_Q + XOF_BLOCKBYTES)/XOF_BLOCKBYTES) | | | | ------------------ | | | | | | 50| 8.75k|#define XOF_BLOCKBYTES SHAKE128_RATE | | | | | | ------------------ | | | | | | | | 8| 8.75k|#define SHAKE128_RATE OQS_SHA3_SHAKE128_RATE | | | | | | | | ------------------ | | | | | | | | | | 239| 8.75k|#define OQS_SHA3_SHAKE128_RATE 168 | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ | | #define REJ_UNIFORM_AVX_BUFLEN (REJ_UNIFORM_AVX_NBLOCKS*XOF_BLOCKBYTES) | | ------------------ | | | | 50| 8.75k|#define XOF_BLOCKBYTES SHAKE128_RATE | | | | ------------------ | | | | | | 8| 8.75k|#define SHAKE128_RATE OQS_SHA3_SHAKE128_RATE | | | | | | ------------------ | | | | | | | | 239| 8.75k|#define OQS_SHA3_SHAKE128_RATE 168 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ | Branch (386:9): [True: 8.75k, False: 3.04k] | Branch (386:26): [True: 8.34k, False: 414] ------------------ 387| 8.34k| val0 = ((buf[pos+0] >> 0) | ((uint16_t)buf[pos+1] << 8)) & 0xFFF; 388| 8.34k| val1 = ((buf[pos+1] >> 4) | ((uint16_t)buf[pos+2] << 4)); 389| 8.34k| pos += 3; 390| | 391| 8.34k| if(val0 < KYBER_Q) ------------------ | | 34| 8.34k|#define KYBER_Q 3329 ------------------ | Branch (391:8): [True: 6.71k, False: 1.62k] ------------------ 392| 6.71k| r[ctr++] = val0; 393| 8.34k| if(val1 < KYBER_Q && ctr < KYBER_N) ------------------ | | 34| 16.6k|#define KYBER_Q 3329 ------------------ if(val1 < KYBER_Q && ctr < KYBER_N) ------------------ | | 33| 6.68k|#define KYBER_N 256 ------------------ | Branch (393:8): [True: 6.68k, False: 1.65k] | Branch (393:26): [True: 5.48k, False: 1.20k] ------------------ 394| 5.48k| r[ctr++] = val1; 395| 8.34k| } 396| | 397| 3.45k| return ctr; 398| 3.45k|} pqcrystals_kyber768_avx2_verify: 18| 128|{ 19| 128| size_t i; 20| 128| uint64_t r; 21| 128| __m256i f, g, h; 22| | 23| 128| h = _mm256_setzero_si256(); 24| 4.48k| for(i=0;i> 63; 39| 128| return r; 40| 128|} pqcrystals_kyber768_avx2_cmov: 56| 128|{ 57| 128| size_t i; 58| 128| __m256i xvec, rvec, bvec; 59| | 60| 128|#if defined(__GNUC__) || defined(__clang__) 61| | // Prevent the compiler from 62| | // 1) inferring that b is 0/1-valued, and 63| | // 2) handling the two cases with a branch. 64| | // This is not necessary when verify.c and kem.c are separate translation 65| | // units, but we expect that downstream consumers will copy this code and/or 66| | // change how it is built. 67| 128| __asm__("" : "+r"(b) : /* no inputs */); 68| 128|#endif 69| | 70| 128| bvec = _mm256_set1_epi64x(-(uint64_t)b); 71| 256| for(i=0;imethod_name = OQS_KEM_alg_ml_kem_1024; ------------------ | | 78| 24|#define OQS_KEM_alg_ml_kem_1024 "ML-KEM-1024" ------------------ 16| 24| kem->alg_version = "FIPS203"; 17| | 18| 24| kem->claimed_nist_level = 5; 19| 24| kem->ind_cca = true; 20| | 21| 24| kem->length_public_key = OQS_KEM_ml_kem_1024_length_public_key; ------------------ | | 39| 24|#define OQS_KEM_ml_kem_1024_length_public_key 1568 ------------------ 22| 24| kem->length_secret_key = OQS_KEM_ml_kem_1024_length_secret_key; ------------------ | | 40| 24|#define OQS_KEM_ml_kem_1024_length_secret_key 3168 ------------------ 23| 24| kem->length_ciphertext = OQS_KEM_ml_kem_1024_length_ciphertext; ------------------ | | 41| 24|#define OQS_KEM_ml_kem_1024_length_ciphertext 1568 ------------------ 24| 24| kem->length_shared_secret = OQS_KEM_ml_kem_1024_length_shared_secret; ------------------ | | 42| 24|#define OQS_KEM_ml_kem_1024_length_shared_secret 32 ------------------ 25| 24| kem->length_keypair_seed = OQS_KEM_ml_kem_1024_length_keypair_seed; ------------------ | | 43| 24|#define OQS_KEM_ml_kem_1024_length_keypair_seed 64 ------------------ 26| 24| kem->length_encaps_seed = OQS_KEM_ml_kem_1024_length_encaps_seed; ------------------ | | 44| 24|#define OQS_KEM_ml_kem_1024_length_encaps_seed 32 ------------------ 27| | 28| 24| kem->keypair = OQS_KEM_ml_kem_1024_keypair; 29| 24| kem->keypair_derand = OQS_KEM_ml_kem_1024_keypair_derand; 30| 24| kem->encaps = OQS_KEM_ml_kem_1024_encaps; 31| 24| kem->encaps_derand = OQS_KEM_ml_kem_1024_encaps_derand; 32| 24| kem->decaps = OQS_KEM_ml_kem_1024_decaps; 33| | 34| 24| return kem; 35| 24|} OQS_KEM_ml_kem_1024_keypair: 102| 24|OQS_API OQS_STATUS OQS_KEM_ml_kem_1024_keypair(uint8_t *public_key, uint8_t *secret_key) { 103| |#if defined(OQS_USE_CUPQC) && defined(OQS_ENABLE_KEM_ml_kem_1024_cuda) 104| | return (OQS_STATUS) cupqc_ml_kem_1024_keypair(public_key, secret_key); 105| |#elif defined(OQS_USE_ICICLE) && defined(OQS_ENABLE_KEM_ml_kem_1024_icicle_cuda) 106| | return (OQS_STATUS) icicle_ml_kem_1024_keypair(public_key, secret_key); 107| |#elif defined(OQS_ENABLE_KEM_ml_kem_1024_x86_64) 108| |#if defined(OQS_DIST_BUILD) 109| 24| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2) && OQS_CPU_has_extension(OQS_CPU_EXT_BMI2) && OQS_CPU_has_extension(OQS_CPU_EXT_POPCNT)) { ------------------ | Branch (109:6): [True: 24, False: 0] | Branch (109:49): [True: 24, False: 0] | Branch (109:92): [True: 24, False: 0] ------------------ 110| 24|#endif /* OQS_DIST_BUILD */ 111| 24| return (OQS_STATUS) PQCP_MLKEM_NATIVE_MLKEM1024_X86_64_keypair(public_key, secret_key); 112| 24|#if defined(OQS_DIST_BUILD) 113| 24| } else { 114| 0| return (OQS_STATUS) PQCP_MLKEM_NATIVE_MLKEM1024_C_keypair(public_key, secret_key); 115| 0| } 116| 24|#endif /* OQS_DIST_BUILD */ 117| |#elif defined(OQS_ENABLE_KEM_ml_kem_1024_aarch64) 118| |#if defined(OQS_DIST_BUILD) 119| | if (OQS_CPU_has_extension(OQS_CPU_EXT_ARM_NEON)) { 120| |#endif /* OQS_DIST_BUILD */ 121| | return (OQS_STATUS) PQCP_MLKEM_NATIVE_MLKEM1024_AARCH64_keypair(public_key, secret_key); 122| |#if defined(OQS_DIST_BUILD) 123| | } else { 124| | return (OQS_STATUS) PQCP_MLKEM_NATIVE_MLKEM1024_C_keypair(public_key, secret_key); 125| | } 126| |#endif /* OQS_DIST_BUILD */ 127| |#else 128| | return (OQS_STATUS) PQCP_MLKEM_NATIVE_MLKEM1024_C_keypair(public_key, secret_key); 129| |#endif 130| 24|} OQS_KEM_ml_kem_1024_encaps: 160| 24|OQS_API OQS_STATUS OQS_KEM_ml_kem_1024_encaps(uint8_t *ciphertext, uint8_t *shared_secret, const uint8_t *public_key) { 161| |#if defined(OQS_USE_CUPQC) && defined(OQS_ENABLE_KEM_ml_kem_1024_cuda) 162| | return (OQS_STATUS) cupqc_ml_kem_1024_enc(ciphertext, shared_secret, public_key); 163| |#elif defined(OQS_USE_ICICLE) && defined(OQS_ENABLE_KEM_ml_kem_1024_icicle_cuda) 164| | return (OQS_STATUS) icicle_ml_kem_1024_enc(ciphertext, shared_secret, public_key); 165| |#elif defined(OQS_ENABLE_KEM_ml_kem_1024_x86_64) 166| |#if defined(OQS_DIST_BUILD) 167| 24| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2) && OQS_CPU_has_extension(OQS_CPU_EXT_BMI2) && OQS_CPU_has_extension(OQS_CPU_EXT_POPCNT)) { ------------------ | Branch (167:6): [True: 24, False: 0] | Branch (167:49): [True: 24, False: 0] | Branch (167:92): [True: 24, False: 0] ------------------ 168| 24|#endif /* OQS_DIST_BUILD */ 169| 24| return (OQS_STATUS) PQCP_MLKEM_NATIVE_MLKEM1024_X86_64_enc(ciphertext, shared_secret, public_key); 170| 24|#if defined(OQS_DIST_BUILD) 171| 24| } else { 172| 0| return (OQS_STATUS) PQCP_MLKEM_NATIVE_MLKEM1024_C_enc(ciphertext, shared_secret, public_key); 173| 0| } 174| 24|#endif /* OQS_DIST_BUILD */ 175| |#elif defined(OQS_ENABLE_KEM_ml_kem_1024_aarch64) 176| |#if defined(OQS_DIST_BUILD) 177| | if (OQS_CPU_has_extension(OQS_CPU_EXT_ARM_NEON)) { 178| |#endif /* OQS_DIST_BUILD */ 179| | return (OQS_STATUS) PQCP_MLKEM_NATIVE_MLKEM1024_AARCH64_enc(ciphertext, shared_secret, public_key); 180| |#if defined(OQS_DIST_BUILD) 181| | } else { 182| | return (OQS_STATUS) PQCP_MLKEM_NATIVE_MLKEM1024_C_enc(ciphertext, shared_secret, public_key); 183| | } 184| |#endif /* OQS_DIST_BUILD */ 185| |#else 186| | return (OQS_STATUS) PQCP_MLKEM_NATIVE_MLKEM1024_C_enc(ciphertext, shared_secret, public_key); 187| |#endif 188| 24|} OQS_KEM_ml_kem_1024_decaps: 190| 24|OQS_API OQS_STATUS OQS_KEM_ml_kem_1024_decaps(uint8_t *shared_secret, const uint8_t *ciphertext, const uint8_t *secret_key) { 191| |#if defined(OQS_USE_CUPQC) && defined(OQS_ENABLE_KEM_ml_kem_1024_cuda) 192| | return (OQS_STATUS) cupqc_ml_kem_1024_dec(shared_secret, ciphertext, secret_key); 193| |#elif defined(OQS_USE_ICICLE) && defined(OQS_ENABLE_KEM_ml_kem_1024_icicle_cuda) 194| | return (OQS_STATUS) icicle_ml_kem_1024_dec(shared_secret, ciphertext, secret_key); 195| |#elif defined(OQS_ENABLE_KEM_ml_kem_1024_x86_64) 196| |#if defined(OQS_DIST_BUILD) 197| 24| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2) && OQS_CPU_has_extension(OQS_CPU_EXT_BMI2) && OQS_CPU_has_extension(OQS_CPU_EXT_POPCNT)) { ------------------ | Branch (197:6): [True: 24, False: 0] | Branch (197:49): [True: 24, False: 0] | Branch (197:92): [True: 24, False: 0] ------------------ 198| 24|#endif /* OQS_DIST_BUILD */ 199| 24| return (OQS_STATUS) PQCP_MLKEM_NATIVE_MLKEM1024_X86_64_dec(shared_secret, ciphertext, secret_key); 200| 24|#if defined(OQS_DIST_BUILD) 201| 24| } else { 202| 0| return (OQS_STATUS) PQCP_MLKEM_NATIVE_MLKEM1024_C_dec(shared_secret, ciphertext, secret_key); 203| 0| } 204| 24|#endif /* OQS_DIST_BUILD */ 205| |#elif defined(OQS_ENABLE_KEM_ml_kem_1024_aarch64) 206| |#if defined(OQS_DIST_BUILD) 207| | if (OQS_CPU_has_extension(OQS_CPU_EXT_ARM_NEON)) { 208| |#endif /* OQS_DIST_BUILD */ 209| | return (OQS_STATUS) PQCP_MLKEM_NATIVE_MLKEM1024_AARCH64_dec(shared_secret, ciphertext, secret_key); 210| |#if defined(OQS_DIST_BUILD) 211| | } else { 212| | return (OQS_STATUS) PQCP_MLKEM_NATIVE_MLKEM1024_C_dec(shared_secret, ciphertext, secret_key); 213| | } 214| |#endif /* OQS_DIST_BUILD */ 215| |#else 216| | return (OQS_STATUS) PQCP_MLKEM_NATIVE_MLKEM1024_C_dec(shared_secret, ciphertext, secret_key); 217| |#endif 218| 24|} OQS_KEM_ml_kem_512_new: 9| 30|OQS_KEM *OQS_KEM_ml_kem_512_new(void) { 10| | 11| 30| OQS_KEM *kem = OQS_MEM_calloc(1, sizeof(OQS_KEM)); 12| 30| if (kem == NULL) { ------------------ | Branch (12:6): [True: 0, False: 30] ------------------ 13| 0| return NULL; 14| 0| } 15| 30| kem->method_name = OQS_KEM_alg_ml_kem_512; ------------------ | | 74| 30|#define OQS_KEM_alg_ml_kem_512 "ML-KEM-512" ------------------ 16| 30| kem->alg_version = "FIPS203"; 17| | 18| 30| kem->claimed_nist_level = 1; 19| 30| kem->ind_cca = true; 20| | 21| 30| kem->length_public_key = OQS_KEM_ml_kem_512_length_public_key; ------------------ | | 9| 30|#define OQS_KEM_ml_kem_512_length_public_key 800 ------------------ 22| 30| kem->length_secret_key = OQS_KEM_ml_kem_512_length_secret_key; ------------------ | | 10| 30|#define OQS_KEM_ml_kem_512_length_secret_key 1632 ------------------ 23| 30| kem->length_ciphertext = OQS_KEM_ml_kem_512_length_ciphertext; ------------------ | | 11| 30|#define OQS_KEM_ml_kem_512_length_ciphertext 768 ------------------ 24| 30| kem->length_shared_secret = OQS_KEM_ml_kem_512_length_shared_secret; ------------------ | | 12| 30|#define OQS_KEM_ml_kem_512_length_shared_secret 32 ------------------ 25| 30| kem->length_keypair_seed = OQS_KEM_ml_kem_512_length_keypair_seed; ------------------ | | 13| 30|#define OQS_KEM_ml_kem_512_length_keypair_seed 64 ------------------ 26| 30| kem->length_encaps_seed = OQS_KEM_ml_kem_512_length_encaps_seed; ------------------ | | 14| 30|#define OQS_KEM_ml_kem_512_length_encaps_seed 32 ------------------ 27| | 28| 30| kem->keypair = OQS_KEM_ml_kem_512_keypair; 29| 30| kem->keypair_derand = OQS_KEM_ml_kem_512_keypair_derand; 30| 30| kem->encaps = OQS_KEM_ml_kem_512_encaps; 31| 30| kem->encaps_derand = OQS_KEM_ml_kem_512_encaps_derand; 32| 30| kem->decaps = OQS_KEM_ml_kem_512_decaps; 33| | 34| 30| return kem; 35| 30|} OQS_KEM_ml_kem_512_keypair: 102| 30|OQS_API OQS_STATUS OQS_KEM_ml_kem_512_keypair(uint8_t *public_key, uint8_t *secret_key) { 103| |#if defined(OQS_USE_CUPQC) && defined(OQS_ENABLE_KEM_ml_kem_512_cuda) 104| | return (OQS_STATUS) cupqc_ml_kem_512_keypair(public_key, secret_key); 105| |#elif defined(OQS_USE_ICICLE) && defined(OQS_ENABLE_KEM_ml_kem_512_icicle_cuda) 106| | return (OQS_STATUS) icicle_ml_kem_512_keypair(public_key, secret_key); 107| |#elif defined(OQS_ENABLE_KEM_ml_kem_512_x86_64) 108| |#if defined(OQS_DIST_BUILD) 109| 30| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2) && OQS_CPU_has_extension(OQS_CPU_EXT_BMI2) && OQS_CPU_has_extension(OQS_CPU_EXT_POPCNT)) { ------------------ | Branch (109:6): [True: 30, False: 0] | Branch (109:49): [True: 30, False: 0] | Branch (109:92): [True: 30, False: 0] ------------------ 110| 30|#endif /* OQS_DIST_BUILD */ 111| 30| return (OQS_STATUS) PQCP_MLKEM_NATIVE_MLKEM512_X86_64_keypair(public_key, secret_key); 112| 30|#if defined(OQS_DIST_BUILD) 113| 30| } else { 114| 0| return (OQS_STATUS) PQCP_MLKEM_NATIVE_MLKEM512_C_keypair(public_key, secret_key); 115| 0| } 116| 30|#endif /* OQS_DIST_BUILD */ 117| |#elif defined(OQS_ENABLE_KEM_ml_kem_512_aarch64) 118| |#if defined(OQS_DIST_BUILD) 119| | if (OQS_CPU_has_extension(OQS_CPU_EXT_ARM_NEON)) { 120| |#endif /* OQS_DIST_BUILD */ 121| | return (OQS_STATUS) PQCP_MLKEM_NATIVE_MLKEM512_AARCH64_keypair(public_key, secret_key); 122| |#if defined(OQS_DIST_BUILD) 123| | } else { 124| | return (OQS_STATUS) PQCP_MLKEM_NATIVE_MLKEM512_C_keypair(public_key, secret_key); 125| | } 126| |#endif /* OQS_DIST_BUILD */ 127| |#else 128| | return (OQS_STATUS) PQCP_MLKEM_NATIVE_MLKEM512_C_keypair(public_key, secret_key); 129| |#endif 130| 30|} OQS_KEM_ml_kem_512_encaps: 160| 30|OQS_API OQS_STATUS OQS_KEM_ml_kem_512_encaps(uint8_t *ciphertext, uint8_t *shared_secret, const uint8_t *public_key) { 161| |#if defined(OQS_USE_CUPQC) && defined(OQS_ENABLE_KEM_ml_kem_512_cuda) 162| | return (OQS_STATUS) cupqc_ml_kem_512_enc(ciphertext, shared_secret, public_key); 163| |#elif defined(OQS_USE_ICICLE) && defined(OQS_ENABLE_KEM_ml_kem_512_icicle_cuda) 164| | return (OQS_STATUS) icicle_ml_kem_512_enc(ciphertext, shared_secret, public_key); 165| |#elif defined(OQS_ENABLE_KEM_ml_kem_512_x86_64) 166| |#if defined(OQS_DIST_BUILD) 167| 30| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2) && OQS_CPU_has_extension(OQS_CPU_EXT_BMI2) && OQS_CPU_has_extension(OQS_CPU_EXT_POPCNT)) { ------------------ | Branch (167:6): [True: 30, False: 0] | Branch (167:49): [True: 30, False: 0] | Branch (167:92): [True: 30, False: 0] ------------------ 168| 30|#endif /* OQS_DIST_BUILD */ 169| 30| return (OQS_STATUS) PQCP_MLKEM_NATIVE_MLKEM512_X86_64_enc(ciphertext, shared_secret, public_key); 170| 30|#if defined(OQS_DIST_BUILD) 171| 30| } else { 172| 0| return (OQS_STATUS) PQCP_MLKEM_NATIVE_MLKEM512_C_enc(ciphertext, shared_secret, public_key); 173| 0| } 174| 30|#endif /* OQS_DIST_BUILD */ 175| |#elif defined(OQS_ENABLE_KEM_ml_kem_512_aarch64) 176| |#if defined(OQS_DIST_BUILD) 177| | if (OQS_CPU_has_extension(OQS_CPU_EXT_ARM_NEON)) { 178| |#endif /* OQS_DIST_BUILD */ 179| | return (OQS_STATUS) PQCP_MLKEM_NATIVE_MLKEM512_AARCH64_enc(ciphertext, shared_secret, public_key); 180| |#if defined(OQS_DIST_BUILD) 181| | } else { 182| | return (OQS_STATUS) PQCP_MLKEM_NATIVE_MLKEM512_C_enc(ciphertext, shared_secret, public_key); 183| | } 184| |#endif /* OQS_DIST_BUILD */ 185| |#else 186| | return (OQS_STATUS) PQCP_MLKEM_NATIVE_MLKEM512_C_enc(ciphertext, shared_secret, public_key); 187| |#endif 188| 30|} OQS_KEM_ml_kem_512_decaps: 190| 30|OQS_API OQS_STATUS OQS_KEM_ml_kem_512_decaps(uint8_t *shared_secret, const uint8_t *ciphertext, const uint8_t *secret_key) { 191| |#if defined(OQS_USE_CUPQC) && defined(OQS_ENABLE_KEM_ml_kem_512_cuda) 192| | return (OQS_STATUS) cupqc_ml_kem_512_dec(shared_secret, ciphertext, secret_key); 193| |#elif defined(OQS_USE_ICICLE) && defined(OQS_ENABLE_KEM_ml_kem_512_icicle_cuda) 194| | return (OQS_STATUS) icicle_ml_kem_512_dec(shared_secret, ciphertext, secret_key); 195| |#elif defined(OQS_ENABLE_KEM_ml_kem_512_x86_64) 196| |#if defined(OQS_DIST_BUILD) 197| 30| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2) && OQS_CPU_has_extension(OQS_CPU_EXT_BMI2) && OQS_CPU_has_extension(OQS_CPU_EXT_POPCNT)) { ------------------ | Branch (197:6): [True: 30, False: 0] | Branch (197:49): [True: 30, False: 0] | Branch (197:92): [True: 30, False: 0] ------------------ 198| 30|#endif /* OQS_DIST_BUILD */ 199| 30| return (OQS_STATUS) PQCP_MLKEM_NATIVE_MLKEM512_X86_64_dec(shared_secret, ciphertext, secret_key); 200| 30|#if defined(OQS_DIST_BUILD) 201| 30| } else { 202| 0| return (OQS_STATUS) PQCP_MLKEM_NATIVE_MLKEM512_C_dec(shared_secret, ciphertext, secret_key); 203| 0| } 204| 30|#endif /* OQS_DIST_BUILD */ 205| |#elif defined(OQS_ENABLE_KEM_ml_kem_512_aarch64) 206| |#if defined(OQS_DIST_BUILD) 207| | if (OQS_CPU_has_extension(OQS_CPU_EXT_ARM_NEON)) { 208| |#endif /* OQS_DIST_BUILD */ 209| | return (OQS_STATUS) PQCP_MLKEM_NATIVE_MLKEM512_AARCH64_dec(shared_secret, ciphertext, secret_key); 210| |#if defined(OQS_DIST_BUILD) 211| | } else { 212| | return (OQS_STATUS) PQCP_MLKEM_NATIVE_MLKEM512_C_dec(shared_secret, ciphertext, secret_key); 213| | } 214| |#endif /* OQS_DIST_BUILD */ 215| |#else 216| | return (OQS_STATUS) PQCP_MLKEM_NATIVE_MLKEM512_C_dec(shared_secret, ciphertext, secret_key); 217| |#endif 218| 30|} OQS_KEM_ml_kem_768_new: 9| 34|OQS_KEM *OQS_KEM_ml_kem_768_new(void) { 10| | 11| 34| OQS_KEM *kem = OQS_MEM_calloc(1, sizeof(OQS_KEM)); 12| 34| if (kem == NULL) { ------------------ | Branch (12:6): [True: 0, False: 34] ------------------ 13| 0| return NULL; 14| 0| } 15| 34| kem->method_name = OQS_KEM_alg_ml_kem_768; ------------------ | | 76| 34|#define OQS_KEM_alg_ml_kem_768 "ML-KEM-768" ------------------ 16| 34| kem->alg_version = "FIPS203"; 17| | 18| 34| kem->claimed_nist_level = 3; 19| 34| kem->ind_cca = true; 20| | 21| 34| kem->length_public_key = OQS_KEM_ml_kem_768_length_public_key; ------------------ | | 24| 34|#define OQS_KEM_ml_kem_768_length_public_key 1184 ------------------ 22| 34| kem->length_secret_key = OQS_KEM_ml_kem_768_length_secret_key; ------------------ | | 25| 34|#define OQS_KEM_ml_kem_768_length_secret_key 2400 ------------------ 23| 34| kem->length_ciphertext = OQS_KEM_ml_kem_768_length_ciphertext; ------------------ | | 26| 34|#define OQS_KEM_ml_kem_768_length_ciphertext 1088 ------------------ 24| 34| kem->length_shared_secret = OQS_KEM_ml_kem_768_length_shared_secret; ------------------ | | 27| 34|#define OQS_KEM_ml_kem_768_length_shared_secret 32 ------------------ 25| 34| kem->length_keypair_seed = OQS_KEM_ml_kem_768_length_keypair_seed; ------------------ | | 28| 34|#define OQS_KEM_ml_kem_768_length_keypair_seed 64 ------------------ 26| 34| kem->length_encaps_seed = OQS_KEM_ml_kem_768_length_encaps_seed; ------------------ | | 29| 34|#define OQS_KEM_ml_kem_768_length_encaps_seed 32 ------------------ 27| | 28| 34| kem->keypair = OQS_KEM_ml_kem_768_keypair; 29| 34| kem->keypair_derand = OQS_KEM_ml_kem_768_keypair_derand; 30| 34| kem->encaps = OQS_KEM_ml_kem_768_encaps; 31| 34| kem->encaps_derand = OQS_KEM_ml_kem_768_encaps_derand; 32| 34| kem->decaps = OQS_KEM_ml_kem_768_decaps; 33| | 34| 34| return kem; 35| 34|} OQS_KEM_ml_kem_768_keypair: 102| 34|OQS_API OQS_STATUS OQS_KEM_ml_kem_768_keypair(uint8_t *public_key, uint8_t *secret_key) { 103| |#if defined(OQS_USE_CUPQC) && defined(OQS_ENABLE_KEM_ml_kem_768_cuda) 104| | return (OQS_STATUS) cupqc_ml_kem_768_keypair(public_key, secret_key); 105| |#elif defined(OQS_USE_ICICLE) && defined(OQS_ENABLE_KEM_ml_kem_768_icicle_cuda) 106| | return (OQS_STATUS) icicle_ml_kem_768_keypair(public_key, secret_key); 107| |#elif defined(OQS_ENABLE_KEM_ml_kem_768_x86_64) 108| |#if defined(OQS_DIST_BUILD) 109| 34| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2) && OQS_CPU_has_extension(OQS_CPU_EXT_BMI2) && OQS_CPU_has_extension(OQS_CPU_EXT_POPCNT)) { ------------------ | Branch (109:6): [True: 34, False: 0] | Branch (109:49): [True: 34, False: 0] | Branch (109:92): [True: 34, False: 0] ------------------ 110| 34|#endif /* OQS_DIST_BUILD */ 111| 34| return (OQS_STATUS) PQCP_MLKEM_NATIVE_MLKEM768_X86_64_keypair(public_key, secret_key); 112| 34|#if defined(OQS_DIST_BUILD) 113| 34| } else { 114| 0| return (OQS_STATUS) PQCP_MLKEM_NATIVE_MLKEM768_C_keypair(public_key, secret_key); 115| 0| } 116| 34|#endif /* OQS_DIST_BUILD */ 117| |#elif defined(OQS_ENABLE_KEM_ml_kem_768_aarch64) 118| |#if defined(OQS_DIST_BUILD) 119| | if (OQS_CPU_has_extension(OQS_CPU_EXT_ARM_NEON)) { 120| |#endif /* OQS_DIST_BUILD */ 121| | return (OQS_STATUS) PQCP_MLKEM_NATIVE_MLKEM768_AARCH64_keypair(public_key, secret_key); 122| |#if defined(OQS_DIST_BUILD) 123| | } else { 124| | return (OQS_STATUS) PQCP_MLKEM_NATIVE_MLKEM768_C_keypair(public_key, secret_key); 125| | } 126| |#endif /* OQS_DIST_BUILD */ 127| |#else 128| | return (OQS_STATUS) PQCP_MLKEM_NATIVE_MLKEM768_C_keypair(public_key, secret_key); 129| |#endif 130| 34|} OQS_KEM_ml_kem_768_encaps: 160| 34|OQS_API OQS_STATUS OQS_KEM_ml_kem_768_encaps(uint8_t *ciphertext, uint8_t *shared_secret, const uint8_t *public_key) { 161| |#if defined(OQS_USE_CUPQC) && defined(OQS_ENABLE_KEM_ml_kem_768_cuda) 162| | return (OQS_STATUS) cupqc_ml_kem_768_enc(ciphertext, shared_secret, public_key); 163| |#elif defined(OQS_USE_ICICLE) && defined(OQS_ENABLE_KEM_ml_kem_768_icicle_cuda) 164| | return (OQS_STATUS) icicle_ml_kem_768_enc(ciphertext, shared_secret, public_key); 165| |#elif defined(OQS_ENABLE_KEM_ml_kem_768_x86_64) 166| |#if defined(OQS_DIST_BUILD) 167| 34| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2) && OQS_CPU_has_extension(OQS_CPU_EXT_BMI2) && OQS_CPU_has_extension(OQS_CPU_EXT_POPCNT)) { ------------------ | Branch (167:6): [True: 34, False: 0] | Branch (167:49): [True: 34, False: 0] | Branch (167:92): [True: 34, False: 0] ------------------ 168| 34|#endif /* OQS_DIST_BUILD */ 169| 34| return (OQS_STATUS) PQCP_MLKEM_NATIVE_MLKEM768_X86_64_enc(ciphertext, shared_secret, public_key); 170| 34|#if defined(OQS_DIST_BUILD) 171| 34| } else { 172| 0| return (OQS_STATUS) PQCP_MLKEM_NATIVE_MLKEM768_C_enc(ciphertext, shared_secret, public_key); 173| 0| } 174| 34|#endif /* OQS_DIST_BUILD */ 175| |#elif defined(OQS_ENABLE_KEM_ml_kem_768_aarch64) 176| |#if defined(OQS_DIST_BUILD) 177| | if (OQS_CPU_has_extension(OQS_CPU_EXT_ARM_NEON)) { 178| |#endif /* OQS_DIST_BUILD */ 179| | return (OQS_STATUS) PQCP_MLKEM_NATIVE_MLKEM768_AARCH64_enc(ciphertext, shared_secret, public_key); 180| |#if defined(OQS_DIST_BUILD) 181| | } else { 182| | return (OQS_STATUS) PQCP_MLKEM_NATIVE_MLKEM768_C_enc(ciphertext, shared_secret, public_key); 183| | } 184| |#endif /* OQS_DIST_BUILD */ 185| |#else 186| | return (OQS_STATUS) PQCP_MLKEM_NATIVE_MLKEM768_C_enc(ciphertext, shared_secret, public_key); 187| |#endif 188| 34|} OQS_KEM_ml_kem_768_decaps: 190| 34|OQS_API OQS_STATUS OQS_KEM_ml_kem_768_decaps(uint8_t *shared_secret, const uint8_t *ciphertext, const uint8_t *secret_key) { 191| |#if defined(OQS_USE_CUPQC) && defined(OQS_ENABLE_KEM_ml_kem_768_cuda) 192| | return (OQS_STATUS) cupqc_ml_kem_768_dec(shared_secret, ciphertext, secret_key); 193| |#elif defined(OQS_USE_ICICLE) && defined(OQS_ENABLE_KEM_ml_kem_768_icicle_cuda) 194| | return (OQS_STATUS) icicle_ml_kem_768_dec(shared_secret, ciphertext, secret_key); 195| |#elif defined(OQS_ENABLE_KEM_ml_kem_768_x86_64) 196| |#if defined(OQS_DIST_BUILD) 197| 34| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2) && OQS_CPU_has_extension(OQS_CPU_EXT_BMI2) && OQS_CPU_has_extension(OQS_CPU_EXT_POPCNT)) { ------------------ | Branch (197:6): [True: 34, False: 0] | Branch (197:49): [True: 34, False: 0] | Branch (197:92): [True: 34, False: 0] ------------------ 198| 34|#endif /* OQS_DIST_BUILD */ 199| 34| return (OQS_STATUS) PQCP_MLKEM_NATIVE_MLKEM768_X86_64_dec(shared_secret, ciphertext, secret_key); 200| 34|#if defined(OQS_DIST_BUILD) 201| 34| } else { 202| 0| return (OQS_STATUS) PQCP_MLKEM_NATIVE_MLKEM768_C_dec(shared_secret, ciphertext, secret_key); 203| 0| } 204| 34|#endif /* OQS_DIST_BUILD */ 205| |#elif defined(OQS_ENABLE_KEM_ml_kem_768_aarch64) 206| |#if defined(OQS_DIST_BUILD) 207| | if (OQS_CPU_has_extension(OQS_CPU_EXT_ARM_NEON)) { 208| |#endif /* OQS_DIST_BUILD */ 209| | return (OQS_STATUS) PQCP_MLKEM_NATIVE_MLKEM768_AARCH64_dec(shared_secret, ciphertext, secret_key); 210| |#if defined(OQS_DIST_BUILD) 211| | } else { 212| | return (OQS_STATUS) PQCP_MLKEM_NATIVE_MLKEM768_C_dec(shared_secret, ciphertext, secret_key); 213| | } 214| |#endif /* OQS_DIST_BUILD */ 215| |#else 216| | return (OQS_STATUS) PQCP_MLKEM_NATIVE_MLKEM768_C_dec(shared_secret, ciphertext, secret_key); 217| |#endif 218| 34|} PQCP_MLKEM_NATIVE_MLKEM1024_X86_64_poly_compress_d5: 324| 48|{ 325| 48|#if defined(MLK_USE_NATIVE_POLY_COMPRESS_D5) 326| 48| int ret; 327| 48| mlk_assert_bound(a, MLKEM_N, 0, MLKEM_Q); ------------------ | | 101| 48| do \ | | 102| 48| { \ | | 103| 48| } while (0) | | ------------------ | | | Branch (103:12): [Folded, False: 48] | | ------------------ ------------------ 328| 48| ret = mlk_poly_compress_d5_native(r, a->coeffs); 329| 48| if (ret == MLK_NATIVE_FUNC_SUCCESS) ------------------ | | 33| 48|#define MLK_NATIVE_FUNC_SUCCESS (0) ------------------ | Branch (329:7): [True: 48, False: 0] ------------------ 330| 48| { 331| 48| return; 332| 48| } 333| 0|#endif /* MLK_USE_NATIVE_POLY_COMPRESS_D5 */ 334| | 335| 0| mlk_poly_compress_d5_c(r, a); 336| 0|} PQCP_MLKEM_NATIVE_MLKEM1024_X86_64_poly_compress_d11: 398| 192|{ 399| 192|#if defined(MLK_USE_NATIVE_POLY_COMPRESS_D11) 400| 192| int ret; 401| 192| mlk_assert_bound(a, MLKEM_N, 0, MLKEM_Q); ------------------ | | 101| 192| do \ | | 102| 192| { \ | | 103| 192| } while (0) | | ------------------ | | | Branch (103:12): [Folded, False: 192] | | ------------------ ------------------ 402| 192| ret = mlk_poly_compress_d11_native(r, a->coeffs); 403| 192| if (ret == MLK_NATIVE_FUNC_SUCCESS) ------------------ | | 33| 192|#define MLK_NATIVE_FUNC_SUCCESS (0) ------------------ | Branch (403:7): [True: 192, False: 0] ------------------ 404| 192| { 405| 192| return; 406| 192| } 407| 0|#endif /* MLK_USE_NATIVE_POLY_COMPRESS_D11 */ 408| | 409| 0| mlk_poly_compress_d11_c(r, a); 410| 0|} PQCP_MLKEM_NATIVE_MLKEM1024_X86_64_poly_decompress_d5: 475| 24|{ 476| 24|#if defined(MLK_USE_NATIVE_POLY_DECOMPRESS_D5) 477| 24| int ret; 478| 24| ret = mlk_poly_decompress_d5_native(r->coeffs, a); 479| 24| if (ret == MLK_NATIVE_FUNC_SUCCESS) ------------------ | | 33| 24|#define MLK_NATIVE_FUNC_SUCCESS (0) ------------------ | Branch (479:7): [True: 24, False: 0] ------------------ 480| 24| { 481| 24| mlk_assert_bound(r, MLKEM_N, 0, MLKEM_Q); ------------------ | | 101| 24| do \ | | 102| 24| { \ | | 103| 24| } while (0) | | ------------------ | | | Branch (103:12): [Folded, False: 24] | | ------------------ ------------------ 482| 24| return; 483| 24| } 484| 0|#endif /* MLK_USE_NATIVE_POLY_DECOMPRESS_D5 */ 485| | 486| 0| mlk_poly_decompress_d5_c(r, a); 487| 0|} PQCP_MLKEM_NATIVE_MLKEM1024_X86_64_poly_decompress_d11: 543| 96|{ 544| 96|#if defined(MLK_USE_NATIVE_POLY_DECOMPRESS_D11) 545| 96| int ret; 546| 96| ret = mlk_poly_decompress_d11_native(r->coeffs, a); 547| 96| if (ret == MLK_NATIVE_FUNC_SUCCESS) ------------------ | | 33| 96|#define MLK_NATIVE_FUNC_SUCCESS (0) ------------------ | Branch (547:7): [True: 96, False: 0] ------------------ 548| 96| { 549| 96| mlk_assert_bound(r, MLKEM_N, 0, MLKEM_Q); ------------------ | | 101| 96| do \ | | 102| 96| { \ | | 103| 96| } while (0) | | ------------------ | | | Branch (103:12): [Folded, False: 96] | | ------------------ ------------------ 550| 96| return; 551| 96| } 552| 0|#endif /* MLK_USE_NATIVE_POLY_DECOMPRESS_D11 */ 553| | 554| 0| mlk_poly_decompress_d11_c(r, a); 555| 0|} PQCP_MLKEM_NATIVE_MLKEM1024_X86_64_poly_tobytes: 610| 288|{ 611| 288|#if defined(MLK_USE_NATIVE_POLY_TOBYTES) 612| 288| int ret; 613| 288| mlk_assert_bound(a, MLKEM_N, 0, MLKEM_Q); ------------------ | | 101| 288| do \ | | 102| 288| { \ | | 103| 288| } while (0) | | ------------------ | | | Branch (103:12): [Folded, False: 288] | | ------------------ ------------------ 614| 288| ret = mlk_poly_tobytes_native(r, a->coeffs); 615| 288| if (ret == MLK_NATIVE_FUNC_SUCCESS) ------------------ | | 33| 288|#define MLK_NATIVE_FUNC_SUCCESS (0) ------------------ | Branch (615:7): [True: 288, False: 0] ------------------ 616| 288| { 617| 288| return; 618| 288| } 619| 0|#endif /* MLK_USE_NATIVE_POLY_TOBYTES */ 620| | 621| 0| mlk_poly_tobytes_c(r, a); 622| 0|} PQCP_MLKEM_NATIVE_MLKEM1024_X86_64_poly_frombytes: 659| 384|{ 660| 384|#if defined(MLK_USE_NATIVE_POLY_FROMBYTES) 661| 384| int ret; 662| 384| ret = mlk_poly_frombytes_native(r->coeffs, a); 663| 384| if (ret == MLK_NATIVE_FUNC_SUCCESS) ------------------ | | 33| 384|#define MLK_NATIVE_FUNC_SUCCESS (0) ------------------ | Branch (663:7): [True: 384, False: 0] ------------------ 664| 384| { 665| 384| return; 666| 384| } 667| 0|#endif /* MLK_USE_NATIVE_POLY_FROMBYTES */ 668| | 669| 0| mlk_poly_frombytes_c(r, a); 670| 0|} PQCP_MLKEM_NATIVE_MLKEM1024_X86_64_poly_frommsg: 680| 48|{ 681| 48| unsigned i; 682| |#if (MLKEM_INDCPA_MSGBYTES != MLKEM_N / 8) 683| |#error "MLKEM_INDCPA_MSGBYTES must be equal to MLKEM_N/8 bytes!" 684| |#endif 685| | 686| 1.58k| for (i = 0; i < MLKEM_N / 8; i++) ------------------ | | 22| 1.58k|#define MLKEM_N 256 ------------------ | Branch (686:15): [True: 1.53k, False: 48] ------------------ 687| 1.53k| __loop__( 688| 1.53k| invariant(i <= MLKEM_N / 8) 689| 1.53k| invariant(array_bound(r->coeffs, 0, 8 * i, 0, MLKEM_Q)) 690| 1.53k| decreases(MLKEM_N / 8 - i)) 691| 1.53k| { 692| 1.53k| unsigned j; 693| 13.8k| for (j = 0; j < 8; j++) ------------------ | Branch (693:17): [True: 12.2k, False: 1.53k] ------------------ 694| 12.2k| __loop__( 695| 12.2k| invariant(i < MLKEM_N / 8 && j <= 8) 696| 12.2k| invariant(array_bound(r->coeffs, 0, 8 * i + j, 0, MLKEM_Q)) 697| 12.2k| decreases(8 - j)) 698| 12.2k| { 699| | /* mlk_ct_sel_int16(MLKEM_Q_HALF, 0, b) is `Decompress_1(b != 0)` 700| | * as per @[FIPS203, Eq (4.8)]. */ 701| | 702| | /* Prevent the compiler from recognizing this as a bit selection */ 703| 12.2k| uint8_t mask = mlk_value_barrier_u8((uint8_t)(1u << j)); 704| 12.2k| r->coeffs[8 * i + j] = mlk_ct_sel_int16(MLKEM_Q_HALF, 0, msg[i] & mask); ------------------ | | 24| 12.2k|#define MLKEM_Q_HALF ((MLKEM_Q + 1) / 2) /* 1665 */ | | ------------------ | | | | 23| 12.2k|#define MLKEM_Q 3329 | | ------------------ ------------------ 705| 12.2k| } 706| 1.53k| } 707| 48| mlk_assert_abs_bound(r, MLKEM_N, MLKEM_Q); ------------------ | | 105| 48| do \ | | 106| 48| { \ | | 107| 48| } while (0) | | ------------------ | | | Branch (107:12): [Folded, False: 48] | | ------------------ ------------------ 708| 48|} PQCP_MLKEM_NATIVE_MLKEM1024_X86_64_poly_tomsg: 718| 24|{ 719| 24| unsigned i; 720| 24| mlk_assert_bound(r, MLKEM_N, 0, MLKEM_Q); ------------------ | | 101| 24| do \ | | 102| 24| { \ | | 103| 24| } while (0) | | ------------------ | | | Branch (103:12): [Folded, False: 24] | | ------------------ ------------------ 721| | 722| 792| for (i = 0; i < MLKEM_N / 8; i++) ------------------ | | 22| 792|#define MLKEM_N 256 ------------------ | Branch (722:15): [True: 768, False: 24] ------------------ 723| 768| __loop__(invariant(i <= MLKEM_N / 8) 724| 768| decreases(MLKEM_N / 8 - i)) 725| 768| { 726| 768| unsigned j; 727| 768| msg[i] = 0; 728| 6.91k| for (j = 0; j < 8; j++) ------------------ | Branch (728:17): [True: 6.14k, False: 768] ------------------ 729| 6.14k| __loop__( 730| 6.14k| invariant(i <= MLKEM_N / 8 && j <= 8) 731| 6.14k| decreases(8 - j)) 732| 6.14k| { 733| 6.14k| uint32_t t = mlk_scalar_compress_d1(r->coeffs[8 * i + j]); 734| 6.14k| msg[i] |= (uint8_t)(t << j); 735| 6.14k| } 736| 768| } 737| 24|} PQCP_MLKEM_NATIVE_MLKEM1024_X86_64_gen_matrix: 223| 72|{ 224| 72| unsigned i, j; 225| 72| MLK_ALIGN uint8_t seed_ext[4][MLK_ALIGN_UP(MLKEM_SYMBYTES + 2)]; ------------------ | | 190| 72|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) ------------------ 226| | 227| 360| for (j = 0; j < 4; j++) ------------------ | Branch (227:15): [True: 288, False: 72] ------------------ 228| 288| { 229| 288| mlk_memcpy(seed_ext[j], seed, MLKEM_SYMBYTES); ------------------ | | 168| 288|#define mlk_memcpy memcpy ------------------ mlk_memcpy(seed_ext[j], seed, MLKEM_SYMBYTES); ------------------ | | 27| 288|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 230| 288| } 231| | 232| 72|#if !defined(MLK_CONFIG_SERIAL_FIPS202_ONLY) 233| | /* Sample 4 matrix entries a time. */ 234| 360| for (i = 0; i < (MLKEM_K * MLKEM_K / 4) * 4; i += 4) ------------------ | | 17| 360|#define MLKEM_K 4 ------------------ for (i = 0; i < (MLKEM_K * MLKEM_K / 4) * 4; i += 4) ------------------ | | 17| 360|#define MLKEM_K 4 ------------------ | Branch (234:15): [True: 288, False: 72] ------------------ 235| 288| { 236| 1.44k| for (j = 0; j < 4; j++) ------------------ | Branch (236:17): [True: 1.15k, False: 288] ------------------ 237| 1.15k| { 238| 1.15k| uint8_t x, y; 239| | /* MLKEM_K <= 4, so the values fit in uint8_t. */ 240| 1.15k| x = (uint8_t)((i + j) / MLKEM_K); ------------------ | | 17| 1.15k|#define MLKEM_K 4 ------------------ 241| 1.15k| y = (uint8_t)((i + j) % MLKEM_K); ------------------ | | 17| 1.15k|#define MLKEM_K 4 ------------------ 242| 1.15k| if (transposed) ------------------ | Branch (242:11): [True: 768, False: 384] ------------------ 243| 768| { 244| 768| seed_ext[j][MLKEM_SYMBYTES + 0] = x; ------------------ | | 27| 768|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 245| 768| seed_ext[j][MLKEM_SYMBYTES + 1] = y; ------------------ | | 27| 768|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 246| 768| } 247| 384| else 248| 384| { 249| 384| seed_ext[j][MLKEM_SYMBYTES + 0] = y; ------------------ | | 27| 384|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 250| 384| seed_ext[j][MLKEM_SYMBYTES + 1] = x; ------------------ | | 27| 384|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 251| 384| } 252| 1.15k| } 253| | 254| 288| mlk_poly_rej_uniform_x4(&a->vec[i / MLKEM_K].vec[i % MLKEM_K], ------------------ | | 55| 288|#define mlk_poly_rej_uniform_x4 MLK_NAMESPACE(poly_rej_uniform_x4) | | ------------------ | | | | 63| 288|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 288|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 288|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ mlk_poly_rej_uniform_x4(&a->vec[i / MLKEM_K].vec[i % MLKEM_K], ------------------ | | 17| 288|#define MLKEM_K 4 ------------------ mlk_poly_rej_uniform_x4(&a->vec[i / MLKEM_K].vec[i % MLKEM_K], ------------------ | | 17| 288|#define MLKEM_K 4 ------------------ 255| 288| &a->vec[(i + 1) / MLKEM_K].vec[(i + 1) % MLKEM_K], ------------------ | | 17| 288|#define MLKEM_K 4 ------------------ &a->vec[(i + 1) / MLKEM_K].vec[(i + 1) % MLKEM_K], ------------------ | | 17| 288|#define MLKEM_K 4 ------------------ 256| 288| &a->vec[(i + 2) / MLKEM_K].vec[(i + 2) % MLKEM_K], ------------------ | | 17| 288|#define MLKEM_K 4 ------------------ &a->vec[(i + 2) / MLKEM_K].vec[(i + 2) % MLKEM_K], ------------------ | | 17| 288|#define MLKEM_K 4 ------------------ 257| 288| &a->vec[(i + 3) / MLKEM_K].vec[(i + 3) % MLKEM_K], ------------------ | | 17| 288|#define MLKEM_K 4 ------------------ &a->vec[(i + 3) / MLKEM_K].vec[(i + 3) % MLKEM_K], ------------------ | | 17| 288|#define MLKEM_K 4 ------------------ 258| 288| seed_ext); 259| 288| } 260| |#else /* !MLK_CONFIG_SERIAL_FIPS202_ONLY */ 261| | /* When using serial FIPS202, sample all entries individually. */ 262| | i = 0; 263| |#endif /* MLK_CONFIG_SERIAL_FIPS202_ONLY */ 264| | 265| | /* For MLKEM_K == 3, sample the last entry individually. 266| | * When MLK_CONFIG_SERIAL_FIPS202_ONLY is set, sample all entries 267| | * individually. */ 268| 72| for (; i < MLKEM_K * MLKEM_K; i++) ------------------ | | 17| 72|#define MLKEM_K 4 ------------------ for (; i < MLKEM_K * MLKEM_K; i++) ------------------ | | 17| 72|#define MLKEM_K 4 ------------------ | Branch (268:10): [True: 0, False: 72] ------------------ 269| 0| { 270| 0| uint8_t x, y; 271| | /* MLKEM_K <= 4, so the values fit in uint8_t. */ 272| 0| x = (uint8_t)(i / MLKEM_K); ------------------ | | 17| 0|#define MLKEM_K 4 ------------------ 273| 0| y = (uint8_t)(i % MLKEM_K); ------------------ | | 17| 0|#define MLKEM_K 4 ------------------ 274| | 275| 0| if (transposed) ------------------ | Branch (275:9): [True: 0, False: 0] ------------------ 276| 0| { 277| 0| seed_ext[0][MLKEM_SYMBYTES + 0] = x; ------------------ | | 27| 0|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 278| 0| seed_ext[0][MLKEM_SYMBYTES + 1] = y; ------------------ | | 27| 0|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 279| 0| } 280| 0| else 281| 0| { 282| 0| seed_ext[0][MLKEM_SYMBYTES + 0] = y; ------------------ | | 27| 0|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 283| 0| seed_ext[0][MLKEM_SYMBYTES + 1] = x; ------------------ | | 27| 0|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 284| 0| } 285| | 286| 0| mlk_poly_rej_uniform(&a->vec[i / MLKEM_K].vec[i % MLKEM_K], seed_ext[0]); ------------------ | | 89| 0|#define mlk_poly_rej_uniform MLK_NAMESPACE(poly_rej_uniform) | | ------------------ | | | | 63| 0|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 0|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 0|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ mlk_poly_rej_uniform(&a->vec[i / MLKEM_K].vec[i % MLKEM_K], seed_ext[0]); ------------------ | | 17| 0|#define MLKEM_K 4 ------------------ mlk_poly_rej_uniform(&a->vec[i / MLKEM_K].vec[i % MLKEM_K], seed_ext[0]); ------------------ | | 17| 0|#define MLKEM_K 4 ------------------ 287| 0| } 288| | 289| 72| mlk_assert(i == MLKEM_K * MLKEM_K); ------------------ | | 97| 72| do \ | | 98| 72| { \ | | 99| 72| } while (0) | | ------------------ | | | Branch (99:12): [Folded, False: 72] | | ------------------ ------------------ 290| | 291| | /* 292| | * The public matrix is generated in NTT domain. If the native backend 293| | * uses a custom order in NTT domain, permute A accordingly. 294| | */ 295| 72| mlk_polymat_permute_bitrev_to_custom(a); ------------------ | | 42| 72| MLK_ADD_PARAM_SET(mlk_polymat_permute_bitrev_to_custom) | | ------------------ | | | | 48| 72|#define MLK_ADD_PARAM_SET(s) s | | ------------------ ------------------ 296| | 297| | /* Specification: Partially implements 298| | * @[FIPS203, Section 3.3, Destruction of intermediate values] */ 299| 72| mlk_zeroize(seed_ext, sizeof(seed_ext)); 300| 72|} PQCP_MLKEM_NATIVE_MLKEM1024_X86_64_indcpa_keypair_derand: 445| 24|{ 446| 24| int ret = 0; 447| 24| const uint8_t *publicseed; 448| 24| const uint8_t *noiseseed; 449| 24| MLK_ALLOC(buf, uint8_t, 2 * MLKEM_SYMBYTES, context); ------------------ | | 229| 24| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 24|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 24| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 450| 24| MLK_ALLOC(coins_with_domain_separator, uint8_t, MLKEM_SYMBYTES + 1, context); ------------------ | | 229| 24| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 24|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 24| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 451| 24| MLK_ALLOC(a, mlk_polymat, 1, context); ------------------ | | 229| 24| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 24|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 24| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 452| 24| MLK_ALLOC(e, mlk_polyvec, 1, context); ------------------ | | 229| 24| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 24|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 24| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 453| 24| MLK_ALLOC(pkpv, mlk_polyvec, 1, context); ------------------ | | 229| 24| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 24|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 24| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 454| 24| MLK_ALLOC(skpv, mlk_polyvec, 1, context); ------------------ | | 229| 24| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 24|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 24| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 455| 24| MLK_ALLOC(skpv_cache, mlk_polyvec_mulcache, 1, context); ------------------ | | 229| 24| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 24|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 24| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 456| | 457| 24| if (buf == NULL || coins_with_domain_separator == NULL || a == NULL || ------------------ | Branch (457:7): [True: 0, False: 24] | Branch (457:22): [True: 0, False: 24] | Branch (457:61): [True: 0, False: 24] ------------------ 458| 24| e == NULL || pkpv == NULL || skpv == NULL || skpv_cache == NULL) ------------------ | Branch (458:7): [True: 0, False: 24] | Branch (458:20): [True: 0, False: 24] | Branch (458:36): [True: 0, False: 24] | Branch (458:52): [True: 0, False: 24] ------------------ 459| 0| { 460| 0| ret = MLK_ERR_OUT_OF_MEMORY; ------------------ | | 275| 0|#define MLK_ERR_OUT_OF_MEMORY (-2) ------------------ 461| 0| goto cleanup; 462| 0| } 463| | 464| 24| publicseed = buf; 465| 24| noiseseed = buf + MLKEM_SYMBYTES; ------------------ | | 27| 24|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 466| | 467| | /* Concatenate coins with MLKEM_K for domain separation of security levels */ 468| 24| mlk_memcpy(coins_with_domain_separator, coins, MLKEM_SYMBYTES); ------------------ | | 168| 24|#define mlk_memcpy memcpy ------------------ mlk_memcpy(coins_with_domain_separator, coins, MLKEM_SYMBYTES); ------------------ | | 27| 24|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 469| 24| coins_with_domain_separator[MLKEM_SYMBYTES] = MLKEM_K; ------------------ | | 27| 24|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ coins_with_domain_separator[MLKEM_SYMBYTES] = MLKEM_K; ------------------ | | 17| 24|#define MLKEM_K 4 ------------------ 470| | 471| 24| mlk_hash_g(buf, coins_with_domain_separator, MLKEM_SYMBYTES + 1); ------------------ | | 32| 24|#define mlk_hash_g(OUT, IN, INBYTES) mlk_sha3_512(OUT, IN, INBYTES) | | ------------------ | | | | 20| 24|#define mlk_sha3_512 sha3_512 | | | | ------------------ | | | | | | 31| 24|#define sha3_512 OQS_SHA3_sha3_512 | | | | ------------------ | | ------------------ ------------------ 472| | 473| | /* 474| | * Declassify the public seed. 475| | * Required to use it in conditional-branches in rejection sampling. 476| | * This is needed because all output of randombytes is marked as secret 477| | * (=undefined) 478| | */ 479| 24| MLK_CT_TESTING_DECLASSIFY(publicseed, MLKEM_SYMBYTES); ------------------ | | 235| 24| do \ | | 236| 24| { \ | | 237| 24| } while (0) | | ------------------ | | | Branch (237:12): [Folded, False: 24] | | ------------------ ------------------ 480| | 481| 24| mlk_gen_matrix(a, publicseed, 0 /* no transpose */); ------------------ | | 22| 24|#define mlk_gen_matrix MLK_NAMESPACE_K(gen_matrix) | | ------------------ | | | | 64| 24|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 24|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 24|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 482| | 483| 24| mlk_keypair_getnoise_eta1(skpv, e, noiseseed); ------------------ | | 43| 24|#define mlk_keypair_getnoise_eta1 MLK_ADD_PARAM_SET(mlk_keypair_getnoise_eta1) | | ------------------ | | | | 48| 24|#define MLK_ADD_PARAM_SET(s) s | | ------------------ ------------------ 484| | 485| 24| mlk_polyvec_ntt(skpv); ------------------ | | 269| 24|#define mlk_polyvec_ntt MLK_NAMESPACE_K(polyvec_ntt) | | ------------------ | | | | 64| 24|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 24|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 24|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 486| 24| mlk_polyvec_ntt(e); ------------------ | | 269| 24|#define mlk_polyvec_ntt MLK_NAMESPACE_K(polyvec_ntt) | | ------------------ | | | | 64| 24|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 24|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 24|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 487| | 488| 24| mlk_polyvec_mulcache_compute(skpv_cache, skpv); ------------------ | | 353| 24|#define mlk_polyvec_mulcache_compute MLK_NAMESPACE_K(polyvec_mulcache_compute) | | ------------------ | | | | 64| 24|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 24|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 24|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 489| 24| mlk_matvec_mul(pkpv, a, skpv, skpv_cache); ------------------ | | 38| 24|#define mlk_matvec_mul MLK_ADD_PARAM_SET(mlk_matvec_mul) | | ------------------ | | | | 48| 24|#define MLK_ADD_PARAM_SET(s) s | | ------------------ ------------------ 490| 24| mlk_polyvec_tomont(pkpv); ------------------ | | 445| 24|#define mlk_polyvec_tomont MLK_NAMESPACE_K(polyvec_tomont) | | ------------------ | | | | 64| 24|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 24|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 24|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 491| | 492| 24| mlk_polyvec_add(pkpv, e); ------------------ | | 414| 24|#define mlk_polyvec_add MLK_NAMESPACE_K(polyvec_add) | | ------------------ | | | | 64| 24|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 24|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 24|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 493| 24| mlk_polyvec_reduce(pkpv); ------------------ | | 387| 24|#define mlk_polyvec_reduce MLK_NAMESPACE_K(polyvec_reduce) | | ------------------ | | | | 64| 24|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 24|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 24|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 494| 24| mlk_polyvec_reduce(skpv); ------------------ | | 387| 24|#define mlk_polyvec_reduce MLK_NAMESPACE_K(polyvec_reduce) | | ------------------ | | | | 64| 24|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 24|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 24|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 495| | 496| 24| mlk_pack_sk(sk, skpv); ------------------ | | 34| 24|#define mlk_pack_sk MLK_ADD_PARAM_SET(mlk_pack_sk) | | ------------------ | | | | 48| 24|#define MLK_ADD_PARAM_SET(s) s | | ------------------ ------------------ 497| 24| mlk_pack_pk(pk, pkpv, publicseed); ------------------ | | 32| 24|#define mlk_pack_pk MLK_ADD_PARAM_SET(mlk_pack_pk) | | ------------------ | | | | 48| 24|#define MLK_ADD_PARAM_SET(s) s | | ------------------ ------------------ 498| | 499| 24|cleanup: 500| | /* Specification: Partially implements 501| | * @[FIPS203, Section 3.3, Destruction of intermediate values] */ 502| 24| MLK_FREE(skpv_cache, mlk_polyvec_mulcache, 1, context); ------------------ | | 238| 24| do \ | | 239| 24| { \ | | 240| 24| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 24| (v) = NULL; \ | | 242| 24| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 24] | | ------------------ ------------------ 503| 24| MLK_FREE(skpv, mlk_polyvec, 1, context); ------------------ | | 238| 24| do \ | | 239| 24| { \ | | 240| 24| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 24| (v) = NULL; \ | | 242| 24| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 24] | | ------------------ ------------------ 504| 24| MLK_FREE(pkpv, mlk_polyvec, 1, context); ------------------ | | 238| 24| do \ | | 239| 24| { \ | | 240| 24| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 24| (v) = NULL; \ | | 242| 24| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 24] | | ------------------ ------------------ 505| 24| MLK_FREE(e, mlk_polyvec, 1, context); ------------------ | | 238| 24| do \ | | 239| 24| { \ | | 240| 24| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 24| (v) = NULL; \ | | 242| 24| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 24] | | ------------------ ------------------ 506| 24| MLK_FREE(a, mlk_polymat, 1, context); ------------------ | | 238| 24| do \ | | 239| 24| { \ | | 240| 24| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 24| (v) = NULL; \ | | 242| 24| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 24] | | ------------------ ------------------ 507| 24| MLK_FREE(coins_with_domain_separator, uint8_t, MLKEM_SYMBYTES + 1, context); ------------------ | | 238| 24| do \ | | 239| 24| { \ | | 240| 24| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 24| (v) = NULL; \ | | 242| 24| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 24] | | ------------------ ------------------ 508| | MLK_FREE(buf, uint8_t, 2 * MLKEM_SYMBYTES, context); ------------------ | | 238| 24| do \ | | 239| 24| { \ | | 240| 24| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 24| (v) = NULL; \ | | 242| 24| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 24] | | ------------------ ------------------ 509| 24| return ret; 510| 24|} PQCP_MLKEM_NATIVE_MLKEM1024_X86_64_indcpa_enc: 526| 48|{ 527| 48| int ret = 0; 528| 48| MLK_ALLOC(seed, uint8_t, MLKEM_SYMBYTES, context); ------------------ | | 229| 48| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 48|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 48| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 529| 48| MLK_ALLOC(at, mlk_polymat, 1, context); ------------------ | | 229| 48| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 48|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 48| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 530| 48| MLK_ALLOC(sp, mlk_polyvec, 1, context); ------------------ | | 229| 48| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 48|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 48| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 531| 48| MLK_ALLOC(pkpv, mlk_polyvec, 1, context); ------------------ | | 229| 48| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 48|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 48| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 532| 48| MLK_ALLOC(ep, mlk_polyvec, 1, context); ------------------ | | 229| 48| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 48|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 48| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 533| 48| MLK_ALLOC(b, mlk_polyvec, 1, context); ------------------ | | 229| 48| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 48|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 48| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 534| 48| MLK_ALLOC(v, mlk_poly, 1, context); ------------------ | | 229| 48| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 48|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 48| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 535| 48| MLK_ALLOC(k, mlk_poly, 1, context); ------------------ | | 229| 48| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 48|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 48| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 536| 48| MLK_ALLOC(epp, mlk_poly, 1, context); ------------------ | | 229| 48| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 48|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 48| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 537| 48| MLK_ALLOC(sp_cache, mlk_polyvec_mulcache, 1, context); ------------------ | | 229| 48| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 48|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 48| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 538| | 539| 48| if (seed == NULL || at == NULL || sp == NULL || pkpv == NULL || ep == NULL || ------------------ | Branch (539:7): [True: 0, False: 48] | Branch (539:23): [True: 0, False: 48] | Branch (539:37): [True: 0, False: 48] | Branch (539:51): [True: 0, False: 48] | Branch (539:67): [True: 0, False: 48] ------------------ 540| 48| b == NULL || v == NULL || k == NULL || epp == NULL || sp_cache == NULL) ------------------ | Branch (540:7): [True: 0, False: 48] | Branch (540:20): [True: 0, False: 48] | Branch (540:33): [True: 0, False: 48] | Branch (540:46): [True: 0, False: 48] | Branch (540:61): [True: 0, False: 48] ------------------ 541| 0| { 542| 0| ret = MLK_ERR_OUT_OF_MEMORY; ------------------ | | 275| 0|#define MLK_ERR_OUT_OF_MEMORY (-2) ------------------ 543| 0| goto cleanup; 544| 0| } 545| | 546| 48| mlk_unpack_pk(pkpv, seed, pk); ------------------ | | 33| 48|#define mlk_unpack_pk MLK_ADD_PARAM_SET(mlk_unpack_pk) | | ------------------ | | | | 48| 48|#define MLK_ADD_PARAM_SET(s) s | | ------------------ ------------------ 547| 48| mlk_poly_frommsg(k, m); ------------------ | | 555| 48|#define mlk_poly_frommsg MLK_NAMESPACE(poly_frommsg) | | ------------------ | | | | 63| 48|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 48|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 48|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 548| | 549| | /* 550| | * Declassify the public seed. 551| | * Required to use it in conditional-branches in rejection sampling. 552| | * This is needed because in re-encryption the publicseed originated from sk 553| | * which is marked undefined. 554| | */ 555| 48| MLK_CT_TESTING_DECLASSIFY(seed, MLKEM_SYMBYTES); ------------------ | | 235| 48| do \ | | 236| 48| { \ | | 237| 48| } while (0) | | ------------------ | | | Branch (237:12): [Folded, False: 48] | | ------------------ ------------------ 556| | 557| 48| mlk_gen_matrix(at, seed, 1 /* transpose */); ------------------ | | 22| 48|#define mlk_gen_matrix MLK_NAMESPACE_K(gen_matrix) | | ------------------ | | | | 64| 48|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 48|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 48|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 558| | 559| 48| mlk_enc_getnoise_eta1_eta2(sp, ep, epp, coins); ------------------ | | 44| 48|#define mlk_enc_getnoise_eta1_eta2 MLK_ADD_PARAM_SET(mlk_enc_getnoise_eta1_eta2) | | ------------------ | | | | 48| 48|#define MLK_ADD_PARAM_SET(s) s | | ------------------ ------------------ 560| | 561| 48| mlk_polyvec_ntt(sp); ------------------ | | 269| 48|#define mlk_polyvec_ntt MLK_NAMESPACE_K(polyvec_ntt) | | ------------------ | | | | 64| 48|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 48|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 48|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 562| | 563| 48| mlk_polyvec_mulcache_compute(sp_cache, sp); ------------------ | | 353| 48|#define mlk_polyvec_mulcache_compute MLK_NAMESPACE_K(polyvec_mulcache_compute) | | ------------------ | | | | 64| 48|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 48|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 48|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 564| 48| mlk_matvec_mul(b, at, sp, sp_cache); ------------------ | | 38| 48|#define mlk_matvec_mul MLK_ADD_PARAM_SET(mlk_matvec_mul) | | ------------------ | | | | 48| 48|#define MLK_ADD_PARAM_SET(s) s | | ------------------ ------------------ 565| 48| mlk_polyvec_basemul_acc_montgomery_cached(v, pkpv, sp, sp_cache); ------------------ | | 321| 48| MLK_NAMESPACE_K(polyvec_basemul_acc_montgomery_cached) | | ------------------ | | | | 64| 48|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 48|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 48|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 566| | 567| 48| mlk_polyvec_invntt_tomont(b); ------------------ | | 295| 48|#define mlk_polyvec_invntt_tomont MLK_NAMESPACE_K(polyvec_invntt_tomont) | | ------------------ | | | | 64| 48|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 48|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 48|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 568| 48| mlk_poly_invntt_tomont(v); ------------------ | | 263| 48|#define mlk_poly_invntt_tomont MLK_NAMESPACE(poly_invntt_tomont) | | ------------------ | | | | 63| 48|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 48|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 48|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 569| | 570| 48| mlk_polyvec_add(b, ep); ------------------ | | 414| 48|#define mlk_polyvec_add MLK_NAMESPACE_K(polyvec_add) | | ------------------ | | | | 64| 48|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 48|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 48|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 571| 48| mlk_poly_add(v, epp); ------------------ | | 181| 48|#define mlk_poly_add MLK_NAMESPACE(poly_add) | | ------------------ | | | | 63| 48|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 48|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 48|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 572| 48| mlk_poly_add(v, k); ------------------ | | 181| 48|#define mlk_poly_add MLK_NAMESPACE(poly_add) | | ------------------ | | | | 63| 48|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 48|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 48|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 573| | 574| 48| mlk_polyvec_reduce(b); ------------------ | | 387| 48|#define mlk_polyvec_reduce MLK_NAMESPACE_K(polyvec_reduce) | | ------------------ | | | | 64| 48|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 48|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 48|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 575| 48| mlk_poly_reduce(v); ------------------ | | 154| 48|#define mlk_poly_reduce MLK_NAMESPACE(poly_reduce) | | ------------------ | | | | 63| 48|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 48|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 48|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 576| | 577| 48| mlk_pack_ciphertext(c, b, v); ------------------ | | 36| 48|#define mlk_pack_ciphertext MLK_ADD_PARAM_SET(mlk_pack_ciphertext) | | ------------------ | | | | 48| 48|#define MLK_ADD_PARAM_SET(s) s | | ------------------ ------------------ 578| | 579| 48|cleanup: 580| | /* Specification: Partially implements 581| | * @[FIPS203, Section 3.3, Destruction of intermediate values] */ 582| 48| MLK_FREE(sp_cache, mlk_polyvec_mulcache, 1, context); ------------------ | | 238| 48| do \ | | 239| 48| { \ | | 240| 48| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 48| (v) = NULL; \ | | 242| 48| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 48] | | ------------------ ------------------ 583| 48| MLK_FREE(epp, mlk_poly, 1, context); ------------------ | | 238| 48| do \ | | 239| 48| { \ | | 240| 48| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 48| (v) = NULL; \ | | 242| 48| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 48] | | ------------------ ------------------ 584| 48| MLK_FREE(k, mlk_poly, 1, context); ------------------ | | 238| 48| do \ | | 239| 48| { \ | | 240| 48| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 48| (v) = NULL; \ | | 242| 48| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 48] | | ------------------ ------------------ 585| 48| MLK_FREE(v, mlk_poly, 1, context); ------------------ | | 238| 48| do \ | | 239| 48| { \ | | 240| 48| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 48| (v) = NULL; \ | | 242| 48| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 48] | | ------------------ ------------------ 586| 48| MLK_FREE(b, mlk_polyvec, 1, context); ------------------ | | 238| 48| do \ | | 239| 48| { \ | | 240| 48| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 48| (v) = NULL; \ | | 242| 48| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 48] | | ------------------ ------------------ 587| 48| MLK_FREE(ep, mlk_polyvec, 1, context); ------------------ | | 238| 48| do \ | | 239| 48| { \ | | 240| 48| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 48| (v) = NULL; \ | | 242| 48| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 48] | | ------------------ ------------------ 588| 48| MLK_FREE(pkpv, mlk_polyvec, 1, context); ------------------ | | 238| 48| do \ | | 239| 48| { \ | | 240| 48| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 48| (v) = NULL; \ | | 242| 48| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 48] | | ------------------ ------------------ 589| 48| MLK_FREE(sp, mlk_polyvec, 1, context); ------------------ | | 238| 48| do \ | | 239| 48| { \ | | 240| 48| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 48| (v) = NULL; \ | | 242| 48| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 48] | | ------------------ ------------------ 590| 48| MLK_FREE(at, mlk_polymat, 1, context); ------------------ | | 238| 48| do \ | | 239| 48| { \ | | 240| 48| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 48| (v) = NULL; \ | | 242| 48| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 48] | | ------------------ ------------------ 591| | MLK_FREE(seed, uint8_t, MLKEM_SYMBYTES, context); ------------------ | | 238| 48| do \ | | 239| 48| { \ | | 240| 48| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 48| (v) = NULL; \ | | 242| 48| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 48] | | ------------------ ------------------ 592| 48| return ret; 593| 48|} PQCP_MLKEM_NATIVE_MLKEM1024_X86_64_indcpa_dec: 603| 24|{ 604| 24| int ret = 0; 605| 24| MLK_ALLOC(b, mlk_polyvec, 1, context); ------------------ | | 229| 24| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 24|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 24| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 606| 24| MLK_ALLOC(skpv, mlk_polyvec, 1, context); ------------------ | | 229| 24| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 24|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 24| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 607| 24| MLK_ALLOC(v, mlk_poly, 1, context); ------------------ | | 229| 24| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 24|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 24| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 608| 24| MLK_ALLOC(sb, mlk_poly, 1, context); ------------------ | | 229| 24| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 24|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 24| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 609| 24| MLK_ALLOC(b_cache, mlk_polyvec_mulcache, 1, context); ------------------ | | 229| 24| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 24|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 24| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 610| | 611| 24| if (b == NULL || skpv == NULL || v == NULL || sb == NULL || b_cache == NULL) ------------------ | Branch (611:7): [True: 0, False: 24] | Branch (611:20): [True: 0, False: 24] | Branch (611:36): [True: 0, False: 24] | Branch (611:49): [True: 0, False: 24] | Branch (611:63): [True: 0, False: 24] ------------------ 612| 0| { 613| 0| ret = MLK_ERR_OUT_OF_MEMORY; ------------------ | | 275| 0|#define MLK_ERR_OUT_OF_MEMORY (-2) ------------------ 614| 0| goto cleanup; 615| 0| } 616| | 617| 24| mlk_unpack_ciphertext(b, v, c); ------------------ | | 37| 24|#define mlk_unpack_ciphertext MLK_ADD_PARAM_SET(mlk_unpack_ciphertext) | | ------------------ | | | | 48| 24|#define MLK_ADD_PARAM_SET(s) s | | ------------------ ------------------ 618| 24| mlk_unpack_sk(skpv, sk); ------------------ | | 35| 24|#define mlk_unpack_sk MLK_ADD_PARAM_SET(mlk_unpack_sk) | | ------------------ | | | | 48| 24|#define MLK_ADD_PARAM_SET(s) s | | ------------------ ------------------ 619| | 620| 24| mlk_polyvec_ntt(b); ------------------ | | 269| 24|#define mlk_polyvec_ntt MLK_NAMESPACE_K(polyvec_ntt) | | ------------------ | | | | 64| 24|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 24|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 24|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 621| 24| mlk_polyvec_mulcache_compute(b_cache, b); ------------------ | | 353| 24|#define mlk_polyvec_mulcache_compute MLK_NAMESPACE_K(polyvec_mulcache_compute) | | ------------------ | | | | 64| 24|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 24|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 24|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 622| 24| mlk_polyvec_basemul_acc_montgomery_cached(sb, skpv, b, b_cache); ------------------ | | 321| 24| MLK_NAMESPACE_K(polyvec_basemul_acc_montgomery_cached) | | ------------------ | | | | 64| 24|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 24|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 24|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 623| 24| mlk_poly_invntt_tomont(sb); ------------------ | | 263| 24|#define mlk_poly_invntt_tomont MLK_NAMESPACE(poly_invntt_tomont) | | ------------------ | | | | 63| 24|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 24|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 24|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 624| | 625| 24| mlk_poly_sub(v, sb); ------------------ | | 210| 24|#define mlk_poly_sub MLK_NAMESPACE(poly_sub) | | ------------------ | | | | 63| 24|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 24|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 24|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 626| 24| mlk_poly_reduce(v); ------------------ | | 154| 24|#define mlk_poly_reduce MLK_NAMESPACE(poly_reduce) | | ------------------ | | | | 63| 24|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 24|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 24|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 627| | 628| 24| mlk_poly_tomsg(m, v); ------------------ | | 577| 24|#define mlk_poly_tomsg MLK_NAMESPACE(poly_tomsg) | | ------------------ | | | | 63| 24|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 24|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 24|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 629| | 630| 24|cleanup: 631| | /* Specification: Partially implements 632| | * @[FIPS203, Section 3.3, Destruction of intermediate values] */ 633| 24| MLK_FREE(b_cache, mlk_polyvec_mulcache, 1, context); ------------------ | | 238| 24| do \ | | 239| 24| { \ | | 240| 24| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 24| (v) = NULL; \ | | 242| 24| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 24] | | ------------------ ------------------ 634| 24| MLK_FREE(sb, mlk_poly, 1, context); ------------------ | | 238| 24| do \ | | 239| 24| { \ | | 240| 24| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 24| (v) = NULL; \ | | 242| 24| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 24] | | ------------------ ------------------ 635| 24| MLK_FREE(v, mlk_poly, 1, context); ------------------ | | 238| 24| do \ | | 239| 24| { \ | | 240| 24| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 24| (v) = NULL; \ | | 242| 24| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 24] | | ------------------ ------------------ 636| 24| MLK_FREE(skpv, mlk_polyvec, 1, context); ------------------ | | 238| 24| do \ | | 239| 24| { \ | | 240| 24| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 24| (v) = NULL; \ | | 242| 24| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 24] | | ------------------ ------------------ 637| | MLK_FREE(b, mlk_polyvec, 1, context); ------------------ | | 238| 24| do \ | | 239| 24| { \ | | 240| 24| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 24| (v) = NULL; \ | | 242| 24| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 24] | | ------------------ ------------------ 638| 24| return ret; 639| 24|} PQCP_MLKEM_NATIVE_MLKEM1024_X86_64_check_pk: 45| 24|{ 46| 24| int ret = 0; 47| 24| MLK_ALLOC(p, mlk_polyvec, 1, context); ------------------ | | 229| 24| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 24|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 24| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 48| 24| MLK_ALLOC(p_reencoded, uint8_t, MLKEM_POLYVECBYTES, context); ------------------ | | 229| 24| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 24|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 24| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 49| | 50| 24| if (p == NULL || p_reencoded == NULL) ------------------ | Branch (50:7): [True: 0, False: 24] | Branch (50:20): [True: 0, False: 24] ------------------ 51| 0| { 52| 0| ret = MLK_ERR_OUT_OF_MEMORY; ------------------ | | 275| 0|#define MLK_ERR_OUT_OF_MEMORY (-2) ------------------ 53| 0| goto cleanup; 54| 0| } 55| | 56| 24| mlk_polyvec_frombytes(p, pk); ------------------ | | 247| 24|#define mlk_polyvec_frombytes MLK_NAMESPACE_K(polyvec_frombytes) | | ------------------ | | | | 64| 24|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 24|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 24|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 57| 24| mlk_polyvec_reduce(p); ------------------ | | 387| 24|#define mlk_polyvec_reduce MLK_NAMESPACE_K(polyvec_reduce) | | ------------------ | | | | 64| 24|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 24|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 24|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 58| 24| mlk_polyvec_tobytes(p_reencoded, p); ------------------ | | 225| 24|#define mlk_polyvec_tobytes MLK_NAMESPACE_K(polyvec_tobytes) | | ------------------ | | | | 64| 24|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 24|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 24|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 59| | 60| | /* We use a constant-time memcmp here to avoid having to 61| | * declassify the PK before the PCT has succeeded. */ 62| 24| ret = mlk_ct_memcmp(pk, p_reencoded, MLKEM_POLYVECBYTES) ? MLK_ERR_FAIL : 0; ------------------ | | 31| 24|#define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | ------------------ | | | | 17| 24|#define MLKEM_K 4 | | ------------------ | | #define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | ------------------ | | | | 30| 24|#define MLKEM_POLYBYTES 384 | | ------------------ ------------------ ret = mlk_ct_memcmp(pk, p_reencoded, MLKEM_POLYVECBYTES) ? MLK_ERR_FAIL : 0; ------------------ | | 272| 0|#define MLK_ERR_FAIL (-1) ------------------ | Branch (62:9): [True: 0, False: 24] ------------------ 63| | 64| 24|cleanup: 65| | /* Specification: Partially implements 66| | * @[FIPS203, Section 3.3, Destruction of intermediate values] */ 67| 24| MLK_FREE(p_reencoded, uint8_t, MLKEM_POLYVECBYTES, context); ------------------ | | 238| 24| do \ | | 239| 24| { \ | | 240| 24| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 24| (v) = NULL; \ | | 242| 24| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 24] | | ------------------ ------------------ 68| | MLK_FREE(p, mlk_polyvec, 1, context); ------------------ | | 238| 24| do \ | | 239| 24| { \ | | 240| 24| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 24| (v) = NULL; \ | | 242| 24| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 24] | | ------------------ ------------------ 69| 24| return ret; 70| 24|} PQCP_MLKEM_NATIVE_MLKEM1024_X86_64_check_sk: 78| 24|{ 79| 24| int ret = 0; 80| 24| MLK_ALLOC(test, uint8_t, MLKEM_SYMBYTES, context); ------------------ | | 229| 24| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 24|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 24| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 81| | 82| 24| if (test == NULL) ------------------ | Branch (82:7): [True: 0, False: 24] ------------------ 83| 0| { 84| 0| ret = MLK_ERR_OUT_OF_MEMORY; ------------------ | | 275| 0|#define MLK_ERR_OUT_OF_MEMORY (-2) ------------------ 85| 0| goto cleanup; 86| 0| } 87| | 88| | /* 89| | * The parts of `sk` being hashed and compared here are public, so 90| | * no public information is leaked through the runtime or the return value 91| | * of this function. 92| | */ 93| | 94| | /* Declassify the public part of the secret key */ 95| 24| MLK_CT_TESTING_DECLASSIFY(sk + MLKEM_INDCPA_SECRETKEYBYTES, ------------------ | | 235| 24| do \ | | 236| 24| { \ | | 237| 24| } while (0) | | ------------------ | | | Branch (237:12): [Folded, False: 24] | | ------------------ ------------------ 96| 24| MLKEM_INDCCA_PUBLICKEYBYTES); 97| 24| MLK_CT_TESTING_DECLASSIFY( ------------------ | | 235| 24| do \ | | 236| 24| { \ | | 237| 24| } while (0) | | ------------------ | | | Branch (237:12): [Folded, False: 24] | | ------------------ ------------------ 98| 24| sk + MLKEM_INDCCA_SECRETKEYBYTES - 2 * MLKEM_SYMBYTES, MLKEM_SYMBYTES); 99| | 100| 24| mlk_hash_h(test, sk + MLKEM_INDCPA_SECRETKEYBYTES, ------------------ | | 29| 24|#define mlk_hash_h(OUT, IN, INBYTES) mlk_sha3_256(OUT, IN, INBYTES) | | ------------------ | | | | 19| 24|#define mlk_sha3_256 sha3_256 | | | | ------------------ | | | | | | 15| 24|#define sha3_256 OQS_SHA3_sha3_256 | | | | ------------------ | | ------------------ ------------------ 101| 24| MLKEM_INDCCA_PUBLICKEYBYTES); 102| | /* This doesn't have to be a constant-time memcmp, but it's the only place 103| | * in the library where a normal memcmp would be used otherwise, so for sake 104| | * of minimizing stdlib dependency, we use our constant-time one anyway. */ 105| 24| ret = mlk_ct_memcmp(sk + MLKEM_INDCCA_SECRETKEYBYTES - 2 * MLKEM_SYMBYTES, ------------------ | | 72| 24| (MLKEM_INDCPA_SECRETKEYBYTES + MLKEM_INDCPA_PUBLICKEYBYTES + \ | | ------------------ | | | | 65| 24|#define MLKEM_INDCPA_SECRETKEYBYTES (MLKEM_POLYVECBYTES) | | | | ------------------ | | | | | | 31| 24|#define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | | | ------------------ | | | | | | | | 17| 24|#define MLKEM_K 4 | | | | | | ------------------ | | | | | | #define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | | | ------------------ | | | | | | | | 30| 24|#define MLKEM_POLYBYTES 384 | | | | | | ------------------ | | | | ------------------ | | ------------------ | | (MLKEM_INDCPA_SECRETKEYBYTES + MLKEM_INDCPA_PUBLICKEYBYTES + \ | | ------------------ | | | | 64| 24|#define MLKEM_INDCPA_PUBLICKEYBYTES (MLKEM_POLYVECBYTES + MLKEM_SYMBYTES) | | | | ------------------ | | | | | | 31| 24|#define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | | | ------------------ | | | | | | | | 17| 24|#define MLKEM_K 4 | | | | | | ------------------ | | | | | | #define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | | | ------------------ | | | | | | | | 30| 24|#define MLKEM_POLYBYTES 384 | | | | | | ------------------ | | | | ------------------ | | | | #define MLKEM_INDCPA_PUBLICKEYBYTES (MLKEM_POLYVECBYTES + MLKEM_SYMBYTES) | | | | ------------------ | | | | | | 27| 24|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ | | | | ------------------ | | ------------------ | | 73| 24| 2 * MLKEM_SYMBYTES) | | ------------------ | | | | 27| 24|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ | | ------------------ ------------------ ret = mlk_ct_memcmp(sk + MLKEM_INDCCA_SECRETKEYBYTES - 2 * MLKEM_SYMBYTES, ------------------ | | 27| 24|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ | Branch (105:9): [True: 0, False: 24] ------------------ 106| 24| test, MLKEM_SYMBYTES) ------------------ | | 27| 24|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 107| 24| ? MLK_ERR_FAIL ------------------ | | 272| 0|#define MLK_ERR_FAIL (-1) ------------------ 108| 24| : 0; 109| | 110| 24|cleanup: 111| | /* Specification: Partially implements 112| | * @[FIPS203, Section 3.3, Destruction of intermediate values] */ 113| | MLK_FREE(test, uint8_t, MLKEM_SYMBYTES, context); ------------------ | | 238| 24| do \ | | 239| 24| { \ | | 240| 24| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 24| (v) = NULL; \ | | 242| 24| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 24] | | ------------------ ------------------ 114| 24| return ret; 115| 24|} PQCP_MLKEM_NATIVE_MLKEM1024_X86_64_keypair_derand: 214| 24|{ 215| 24| int ret; 216| | 217| 24| ret = mlk_indcpa_keypair_derand(pk, sk, coins, context); ------------------ | | 49| 24| MLK_NAMESPACE_K(indcpa_keypair_derand) MLK_CONTEXT_PARAMETERS_3 | | ------------------ | | | | 64| 24|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 24|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 24|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ | | MLK_NAMESPACE_K(indcpa_keypair_derand) MLK_CONTEXT_PARAMETERS_3 | | ------------------ | | | | 212| 24|#define MLK_CONTEXT_PARAMETERS_3(arg0, arg1, arg2, context) (arg0, arg1, arg2) | | ------------------ ------------------ 218| 24| if (ret != 0) ------------------ | Branch (218:7): [True: 0, False: 24] ------------------ 219| 0| { 220| 0| goto cleanup; 221| 0| } 222| | 223| 24| mlk_memcpy(sk + MLKEM_INDCPA_SECRETKEYBYTES, pk, MLKEM_INDCCA_PUBLICKEYBYTES); ------------------ | | 168| 24|#define mlk_memcpy memcpy ------------------ mlk_memcpy(sk + MLKEM_INDCPA_SECRETKEYBYTES, pk, MLKEM_INDCCA_PUBLICKEYBYTES); ------------------ | | 65| 24|#define MLKEM_INDCPA_SECRETKEYBYTES (MLKEM_POLYVECBYTES) | | ------------------ | | | | 31| 24|#define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | ------------------ | | | | | | 17| 24|#define MLKEM_K 4 | | | | ------------------ | | | | #define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | ------------------ | | | | | | 30| 24|#define MLKEM_POLYBYTES 384 | | | | ------------------ | | ------------------ ------------------ mlk_memcpy(sk + MLKEM_INDCPA_SECRETKEYBYTES, pk, MLKEM_INDCCA_PUBLICKEYBYTES); ------------------ | | 69| 24|#define MLKEM_INDCCA_PUBLICKEYBYTES (MLKEM_INDCPA_PUBLICKEYBYTES) | | ------------------ | | | | 64| 24|#define MLKEM_INDCPA_PUBLICKEYBYTES (MLKEM_POLYVECBYTES + MLKEM_SYMBYTES) | | | | ------------------ | | | | | | 31| 24|#define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | | | ------------------ | | | | | | | | 17| 24|#define MLKEM_K 4 | | | | | | ------------------ | | | | | | #define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | | | ------------------ | | | | | | | | 30| 24|#define MLKEM_POLYBYTES 384 | | | | | | ------------------ | | | | ------------------ | | | | #define MLKEM_INDCPA_PUBLICKEYBYTES (MLKEM_POLYVECBYTES + MLKEM_SYMBYTES) | | | | ------------------ | | | | | | 27| 24|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ | | | | ------------------ | | ------------------ ------------------ 224| 24| mlk_hash_h(sk + MLKEM_INDCCA_SECRETKEYBYTES - 2 * MLKEM_SYMBYTES, pk, ------------------ | | 29| 24|#define mlk_hash_h(OUT, IN, INBYTES) mlk_sha3_256(OUT, IN, INBYTES) | | ------------------ | | | | 19| 24|#define mlk_sha3_256 sha3_256 | | | | ------------------ | | | | | | 15| 24|#define sha3_256 OQS_SHA3_sha3_256 | | | | ------------------ | | ------------------ ------------------ 225| 24| MLKEM_INDCCA_PUBLICKEYBYTES); 226| | /* Value z for pseudo-random output on reject */ 227| 24| mlk_memcpy(sk + MLKEM_INDCCA_SECRETKEYBYTES - MLKEM_SYMBYTES, ------------------ | | 168| 24|#define mlk_memcpy memcpy ------------------ mlk_memcpy(sk + MLKEM_INDCCA_SECRETKEYBYTES - MLKEM_SYMBYTES, ------------------ | | 72| 24| (MLKEM_INDCPA_SECRETKEYBYTES + MLKEM_INDCPA_PUBLICKEYBYTES + \ | | ------------------ | | | | 65| 24|#define MLKEM_INDCPA_SECRETKEYBYTES (MLKEM_POLYVECBYTES) | | | | ------------------ | | | | | | 31| 24|#define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | | | ------------------ | | | | | | | | 17| 24|#define MLKEM_K 4 | | | | | | ------------------ | | | | | | #define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | | | ------------------ | | | | | | | | 30| 24|#define MLKEM_POLYBYTES 384 | | | | | | ------------------ | | | | ------------------ | | ------------------ | | (MLKEM_INDCPA_SECRETKEYBYTES + MLKEM_INDCPA_PUBLICKEYBYTES + \ | | ------------------ | | | | 64| 24|#define MLKEM_INDCPA_PUBLICKEYBYTES (MLKEM_POLYVECBYTES + MLKEM_SYMBYTES) | | | | ------------------ | | | | | | 31| 24|#define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | | | ------------------ | | | | | | | | 17| 24|#define MLKEM_K 4 | | | | | | ------------------ | | | | | | #define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | | | ------------------ | | | | | | | | 30| 24|#define MLKEM_POLYBYTES 384 | | | | | | ------------------ | | | | ------------------ | | | | #define MLKEM_INDCPA_PUBLICKEYBYTES (MLKEM_POLYVECBYTES + MLKEM_SYMBYTES) | | | | ------------------ | | | | | | 27| 24|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ | | | | ------------------ | | ------------------ | | 73| 24| 2 * MLKEM_SYMBYTES) | | ------------------ | | | | 27| 24|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ | | ------------------ ------------------ mlk_memcpy(sk + MLKEM_INDCCA_SECRETKEYBYTES - MLKEM_SYMBYTES, ------------------ | | 27| 24|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 228| 24| coins + MLKEM_SYMBYTES, MLKEM_SYMBYTES); ------------------ | | 27| 24|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ coins + MLKEM_SYMBYTES, MLKEM_SYMBYTES); ------------------ | | 27| 24|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 229| | 230| | /* Declassify public key */ 231| 24| MLK_CT_TESTING_DECLASSIFY(pk, MLKEM_INDCCA_PUBLICKEYBYTES); ------------------ | | 235| 24| do \ | | 236| 24| { \ | | 237| 24| } while (0) | | ------------------ | | | Branch (237:12): [Folded, False: 24] | | ------------------ ------------------ 232| | 233| | /* Pairwise Consistency Test (PCT) @[FIPS140_3_IG, p.87] */ 234| 24| ret = mlk_check_pct(pk, sk, context); ------------------ | | 37| 24|#define mlk_check_pct MLK_ADD_PARAM_SET(mlk_check_pct) MLK_CONTEXT_PARAMETERS_2 | | ------------------ | | | | 48| 24|#define MLK_ADD_PARAM_SET(s) s | | ------------------ | | #define mlk_check_pct MLK_ADD_PARAM_SET(mlk_check_pct) MLK_CONTEXT_PARAMETERS_2 | | ------------------ | | | | 211| 24|#define MLK_CONTEXT_PARAMETERS_2(arg0, arg1, context) (arg0, arg1) | | ------------------ ------------------ 235| 24| if (ret != 0) ------------------ | Branch (235:7): [True: 0, False: 24] ------------------ 236| 0| { 237| 0| goto cleanup; 238| 0| } 239| | 240| 24|cleanup: 241| 24| if (ret != 0) ------------------ | Branch (241:7): [True: 0, False: 24] ------------------ 242| 0| { 243| 0| mlk_zeroize(pk, MLKEM_INDCCA_PUBLICKEYBYTES); ------------------ | | 69| 0|#define MLKEM_INDCCA_PUBLICKEYBYTES (MLKEM_INDCPA_PUBLICKEYBYTES) | | ------------------ | | | | 64| 0|#define MLKEM_INDCPA_PUBLICKEYBYTES (MLKEM_POLYVECBYTES + MLKEM_SYMBYTES) | | | | ------------------ | | | | | | 31| 0|#define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | | | ------------------ | | | | | | | | 17| 0|#define MLKEM_K 4 | | | | | | ------------------ | | | | | | #define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | | | ------------------ | | | | | | | | 30| 0|#define MLKEM_POLYBYTES 384 | | | | | | ------------------ | | | | ------------------ | | | | #define MLKEM_INDCPA_PUBLICKEYBYTES (MLKEM_POLYVECBYTES + MLKEM_SYMBYTES) | | | | ------------------ | | | | | | 27| 0|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ | | | | ------------------ | | ------------------ ------------------ 244| 0| mlk_zeroize(sk, MLKEM_INDCCA_SECRETKEYBYTES); ------------------ | | 72| 0| (MLKEM_INDCPA_SECRETKEYBYTES + MLKEM_INDCPA_PUBLICKEYBYTES + \ | | ------------------ | | | | 65| 0|#define MLKEM_INDCPA_SECRETKEYBYTES (MLKEM_POLYVECBYTES) | | | | ------------------ | | | | | | 31| 0|#define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | | | ------------------ | | | | | | | | 17| 0|#define MLKEM_K 4 | | | | | | ------------------ | | | | | | #define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | | | ------------------ | | | | | | | | 30| 0|#define MLKEM_POLYBYTES 384 | | | | | | ------------------ | | | | ------------------ | | ------------------ | | (MLKEM_INDCPA_SECRETKEYBYTES + MLKEM_INDCPA_PUBLICKEYBYTES + \ | | ------------------ | | | | 64| 0|#define MLKEM_INDCPA_PUBLICKEYBYTES (MLKEM_POLYVECBYTES + MLKEM_SYMBYTES) | | | | ------------------ | | | | | | 31| 0|#define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | | | ------------------ | | | | | | | | 17| 0|#define MLKEM_K 4 | | | | | | ------------------ | | | | | | #define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | | | ------------------ | | | | | | | | 30| 0|#define MLKEM_POLYBYTES 384 | | | | | | ------------------ | | | | ------------------ | | | | #define MLKEM_INDCPA_PUBLICKEYBYTES (MLKEM_POLYVECBYTES + MLKEM_SYMBYTES) | | | | ------------------ | | | | | | 27| 0|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ | | | | ------------------ | | ------------------ | | 73| 0| 2 * MLKEM_SYMBYTES) | | ------------------ | | | | 27| 0|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ | | ------------------ ------------------ 245| 0| } 246| | 247| 24| return ret; 248| 24|} PQCP_MLKEM_NATIVE_MLKEM1024_X86_64_keypair: 257| 24|{ 258| 24| int ret = 0; 259| 24| MLK_ALLOC(coins, uint8_t, 2 * MLKEM_SYMBYTES, context); ------------------ | | 229| 24| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 24|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 24| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 260| | 261| 24| if (coins == NULL) ------------------ | Branch (261:7): [True: 0, False: 24] ------------------ 262| 0| { 263| 0| ret = MLK_ERR_OUT_OF_MEMORY; ------------------ | | 275| 0|#define MLK_ERR_OUT_OF_MEMORY (-2) ------------------ 264| 0| goto cleanup; 265| 0| } 266| | 267| | /* Acquire necessary randomness, and mark it as secret. */ 268| 24| if (mlk_randombytes(coins, 2 * MLKEM_SYMBYTES) != 0) ------------------ | | 27| 24|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ | Branch (268:7): [True: 0, False: 24] ------------------ 269| 0| { 270| 0| ret = MLK_ERR_RNG_FAIL; ------------------ | | 278| 0|#define MLK_ERR_RNG_FAIL (-3) ------------------ 271| 0| goto cleanup; 272| 0| } 273| | 274| 24| MLK_CT_TESTING_SECRET(coins, 2 * MLKEM_SYMBYTES); ------------------ | | 231| 24| do \ | | 232| 24| { \ | | 233| 24| } while (0) | | ------------------ | | | Branch (233:12): [Folded, False: 24] | | ------------------ ------------------ 275| | 276| 24| ret = mlk_kem_keypair_derand(pk, sk, coins, context); ------------------ | | 50| 24| MLK_NAMESPACE_K(keypair_derand) MLK_CONTEXT_PARAMETERS_3 | | ------------------ | | | | 64| 24|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 24|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 24|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ | | MLK_NAMESPACE_K(keypair_derand) MLK_CONTEXT_PARAMETERS_3 | | ------------------ | | | | 212| 24|#define MLK_CONTEXT_PARAMETERS_3(arg0, arg1, arg2, context) (arg0, arg1, arg2) | | ------------------ ------------------ 277| | 278| 24|cleanup: 279| | /* Specification: Partially implements 280| | * @[FIPS203, Section 3.3, Destruction of intermediate values] */ 281| | MLK_FREE(coins, uint8_t, 2 * MLKEM_SYMBYTES, context); ------------------ | | 238| 24| do \ | | 239| 24| { \ | | 240| 24| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 24| (v) = NULL; \ | | 242| 24| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 24] | | ------------------ ------------------ 282| 24| return ret; 283| 24|} PQCP_MLKEM_NATIVE_MLKEM1024_X86_64_enc_derand: 295| 24|{ 296| 24| int ret = 0; 297| 24| MLK_ALLOC(buf, uint8_t, 2 * MLKEM_SYMBYTES, context); ------------------ | | 229| 24| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 24|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 24| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 298| 24| MLK_ALLOC(kr, uint8_t, 2 * MLKEM_SYMBYTES, context); ------------------ | | 229| 24| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 24|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 24| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 299| | 300| 24| if (buf == NULL || kr == NULL) ------------------ | Branch (300:7): [True: 0, False: 24] | Branch (300:22): [True: 0, False: 24] ------------------ 301| 0| { 302| 0| ret = MLK_ERR_OUT_OF_MEMORY; ------------------ | | 275| 0|#define MLK_ERR_OUT_OF_MEMORY (-2) ------------------ 303| 0| goto cleanup; 304| 0| } 305| | 306| | /* Specification: Implements @[FIPS203, Section 7.2, Modulus check] */ 307| 24| ret = mlk_kem_check_pk(pk, context); ------------------ | | 55| 24|#define mlk_kem_check_pk MLK_NAMESPACE_K(check_pk) MLK_CONTEXT_PARAMETERS_1 | | ------------------ | | | | 64| 24|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 24|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 24|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ | | #define mlk_kem_check_pk MLK_NAMESPACE_K(check_pk) MLK_CONTEXT_PARAMETERS_1 | | ------------------ | | | | 210| 24|#define MLK_CONTEXT_PARAMETERS_1(arg0, context) (arg0) | | ------------------ ------------------ 308| 24| if (ret != 0) ------------------ | Branch (308:7): [True: 0, False: 24] ------------------ 309| 0| { 310| 0| goto cleanup; 311| 0| } 312| | 313| 24| mlk_memcpy(buf, coins, MLKEM_SYMBYTES); ------------------ | | 168| 24|#define mlk_memcpy memcpy ------------------ mlk_memcpy(buf, coins, MLKEM_SYMBYTES); ------------------ | | 27| 24|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 314| | 315| | /* Multitarget countermeasure for coins + contributory KEM */ 316| 24| mlk_hash_h(buf + MLKEM_SYMBYTES, pk, MLKEM_INDCCA_PUBLICKEYBYTES); ------------------ | | 29| 24|#define mlk_hash_h(OUT, IN, INBYTES) mlk_sha3_256(OUT, IN, INBYTES) | | ------------------ | | | | 19| 24|#define mlk_sha3_256 sha3_256 | | | | ------------------ | | | | | | 15| 24|#define sha3_256 OQS_SHA3_sha3_256 | | | | ------------------ | | ------------------ ------------------ 317| 24| mlk_hash_g(kr, buf, 2 * MLKEM_SYMBYTES); ------------------ | | 32| 24|#define mlk_hash_g(OUT, IN, INBYTES) mlk_sha3_512(OUT, IN, INBYTES) | | ------------------ | | | | 20| 24|#define mlk_sha3_512 sha3_512 | | | | ------------------ | | | | | | 31| 24|#define sha3_512 OQS_SHA3_sha3_512 | | | | ------------------ | | ------------------ ------------------ 318| | 319| | /* coins are in kr+MLKEM_SYMBYTES */ 320| 24| ret = mlk_indcpa_enc(ct, buf, pk, kr + MLKEM_SYMBYTES, context); ------------------ | | 88| 24|#define mlk_indcpa_enc MLK_NAMESPACE_K(indcpa_enc) MLK_CONTEXT_PARAMETERS_4 | | ------------------ | | | | 64| 24|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 24|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 24|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ | | #define mlk_indcpa_enc MLK_NAMESPACE_K(indcpa_enc) MLK_CONTEXT_PARAMETERS_4 | | ------------------ | | | | 214| 24| (arg0, arg1, arg2, arg3) | | ------------------ ------------------ 321| 24| if (ret != 0) ------------------ | Branch (321:7): [True: 0, False: 24] ------------------ 322| 0| { 323| 0| goto cleanup; 324| 0| } 325| | 326| 24| mlk_memcpy(ss, kr, MLKEM_SYMBYTES); ------------------ | | 168| 24|#define mlk_memcpy memcpy ------------------ mlk_memcpy(ss, kr, MLKEM_SYMBYTES); ------------------ | | 27| 24|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 327| | 328| 24|cleanup: 329| | /* Specification: Partially implements 330| | * @[FIPS203, Section 3.3, Destruction of intermediate values] */ 331| 24| MLK_FREE(kr, uint8_t, 2 * MLKEM_SYMBYTES, context); ------------------ | | 238| 24| do \ | | 239| 24| { \ | | 240| 24| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 24| (v) = NULL; \ | | 242| 24| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 24] | | ------------------ ------------------ 332| | MLK_FREE(buf, uint8_t, 2 * MLKEM_SYMBYTES, context); ------------------ | | 238| 24| do \ | | 239| 24| { \ | | 240| 24| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 24| (v) = NULL; \ | | 242| 24| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 24] | | ------------------ ------------------ 333| 24| return ret; 334| 24|} PQCP_MLKEM_NATIVE_MLKEM1024_X86_64_enc: 344| 24|{ 345| 24| int ret = 0; 346| 24| MLK_ALLOC(coins, uint8_t, MLKEM_SYMBYTES, context); ------------------ | | 229| 24| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 24|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 24| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 347| | 348| 24| if (coins == NULL) ------------------ | Branch (348:7): [True: 0, False: 24] ------------------ 349| 0| { 350| 0| ret = MLK_ERR_OUT_OF_MEMORY; ------------------ | | 275| 0|#define MLK_ERR_OUT_OF_MEMORY (-2) ------------------ 351| 0| goto cleanup; 352| 0| } 353| | 354| 24| if (mlk_randombytes(coins, MLKEM_SYMBYTES) != 0) ------------------ | | 27| 24|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ | Branch (354:7): [True: 0, False: 24] ------------------ 355| 0| { 356| 0| ret = MLK_ERR_RNG_FAIL; ------------------ | | 278| 0|#define MLK_ERR_RNG_FAIL (-3) ------------------ 357| 0| goto cleanup; 358| 0| } 359| | 360| 24| MLK_CT_TESTING_SECRET(coins, MLKEM_SYMBYTES); ------------------ | | 231| 24| do \ | | 232| 24| { \ | | 233| 24| } while (0) | | ------------------ | | | Branch (233:12): [Folded, False: 24] | | ------------------ ------------------ 361| | 362| 24| ret = mlk_kem_enc_derand(ct, ss, pk, coins, context); ------------------ | | 52| 24|#define mlk_kem_enc_derand MLK_NAMESPACE_K(enc_derand) MLK_CONTEXT_PARAMETERS_4 | | ------------------ | | | | 64| 24|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 24|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 24|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ | | #define mlk_kem_enc_derand MLK_NAMESPACE_K(enc_derand) MLK_CONTEXT_PARAMETERS_4 | | ------------------ | | | | 214| 24| (arg0, arg1, arg2, arg3) | | ------------------ ------------------ 363| | 364| 24|cleanup: 365| | /* Specification: Partially implements 366| | * @[FIPS203, Section 3.3, Destruction of intermediate values] */ 367| | MLK_FREE(coins, uint8_t, MLKEM_SYMBYTES, context); ------------------ | | 238| 24| do \ | | 239| 24| { \ | | 240| 24| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 24| (v) = NULL; \ | | 242| 24| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 24] | | ------------------ ------------------ 368| 24| return ret; 369| 24|} PQCP_MLKEM_NATIVE_MLKEM1024_X86_64_dec: 380| 24|{ 381| 24| int ret = 0; 382| 24| uint8_t fail; 383| 24| const uint8_t *pk = sk + MLKEM_INDCPA_SECRETKEYBYTES; ------------------ | | 65| 24|#define MLKEM_INDCPA_SECRETKEYBYTES (MLKEM_POLYVECBYTES) | | ------------------ | | | | 31| 24|#define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | ------------------ | | | | | | 17| 24|#define MLKEM_K 4 | | | | ------------------ | | | | #define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | ------------------ | | | | | | 30| 24|#define MLKEM_POLYBYTES 384 | | | | ------------------ | | ------------------ ------------------ 384| 24| MLK_ALLOC(buf, uint8_t, 2 * MLKEM_SYMBYTES, context); ------------------ | | 229| 24| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 24|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 24| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 385| 24| MLK_ALLOC(kr, uint8_t, 2 * MLKEM_SYMBYTES, context); ------------------ | | 229| 24| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 24|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 24| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 386| 24| MLK_ALLOC(tmp, uint8_t, MLKEM_SYMBYTES + MLKEM_INDCCA_CIPHERTEXTBYTES, ------------------ | | 229| 24| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 24|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 24| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 387| 24| context); 388| | 389| 24| if (buf == NULL || kr == NULL || tmp == NULL) ------------------ | Branch (389:7): [True: 0, False: 24] | Branch (389:22): [True: 0, False: 24] | Branch (389:36): [True: 0, False: 24] ------------------ 390| 0| { 391| 0| ret = MLK_ERR_OUT_OF_MEMORY; ------------------ | | 275| 0|#define MLK_ERR_OUT_OF_MEMORY (-2) ------------------ 392| 0| goto cleanup; 393| 0| } 394| | 395| | /* Specification: Implements @[FIPS203, Section 7.3, Hash check] */ 396| 24| ret = mlk_kem_check_sk(sk, context); ------------------ | | 56| 24|#define mlk_kem_check_sk MLK_NAMESPACE_K(check_sk) MLK_CONTEXT_PARAMETERS_1 | | ------------------ | | | | 64| 24|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 24|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 24|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ | | #define mlk_kem_check_sk MLK_NAMESPACE_K(check_sk) MLK_CONTEXT_PARAMETERS_1 | | ------------------ | | | | 210| 24|#define MLK_CONTEXT_PARAMETERS_1(arg0, context) (arg0) | | ------------------ ------------------ 397| 24| if (ret != 0) ------------------ | Branch (397:7): [True: 0, False: 24] ------------------ 398| 0| { 399| 0| goto cleanup; 400| 0| } 401| | 402| 24| ret = mlk_indcpa_dec(buf, ct, sk, context); ------------------ | | 127| 24|#define mlk_indcpa_dec MLK_NAMESPACE_K(indcpa_dec) MLK_CONTEXT_PARAMETERS_3 | | ------------------ | | | | 64| 24|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 24|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 24|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ | | #define mlk_indcpa_dec MLK_NAMESPACE_K(indcpa_dec) MLK_CONTEXT_PARAMETERS_3 | | ------------------ | | | | 212| 24|#define MLK_CONTEXT_PARAMETERS_3(arg0, arg1, arg2, context) (arg0, arg1, arg2) | | ------------------ ------------------ 403| 24| if (ret != 0) ------------------ | Branch (403:7): [True: 0, False: 24] ------------------ 404| 0| { 405| 0| goto cleanup; 406| 0| } 407| | 408| | /* Multitarget countermeasure for coins + contributory KEM */ 409| 24| mlk_memcpy(buf + MLKEM_SYMBYTES, ------------------ | | 168| 24|#define mlk_memcpy memcpy ------------------ mlk_memcpy(buf + MLKEM_SYMBYTES, ------------------ | | 27| 24|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 410| 24| sk + MLKEM_INDCCA_SECRETKEYBYTES - 2 * MLKEM_SYMBYTES, ------------------ | | 72| 24| (MLKEM_INDCPA_SECRETKEYBYTES + MLKEM_INDCPA_PUBLICKEYBYTES + \ | | ------------------ | | | | 65| 24|#define MLKEM_INDCPA_SECRETKEYBYTES (MLKEM_POLYVECBYTES) | | | | ------------------ | | | | | | 31| 24|#define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | | | ------------------ | | | | | | | | 17| 24|#define MLKEM_K 4 | | | | | | ------------------ | | | | | | #define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | | | ------------------ | | | | | | | | 30| 24|#define MLKEM_POLYBYTES 384 | | | | | | ------------------ | | | | ------------------ | | ------------------ | | (MLKEM_INDCPA_SECRETKEYBYTES + MLKEM_INDCPA_PUBLICKEYBYTES + \ | | ------------------ | | | | 64| 24|#define MLKEM_INDCPA_PUBLICKEYBYTES (MLKEM_POLYVECBYTES + MLKEM_SYMBYTES) | | | | ------------------ | | | | | | 31| 24|#define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | | | ------------------ | | | | | | | | 17| 24|#define MLKEM_K 4 | | | | | | ------------------ | | | | | | #define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | | | ------------------ | | | | | | | | 30| 24|#define MLKEM_POLYBYTES 384 | | | | | | ------------------ | | | | ------------------ | | | | #define MLKEM_INDCPA_PUBLICKEYBYTES (MLKEM_POLYVECBYTES + MLKEM_SYMBYTES) | | | | ------------------ | | | | | | 27| 24|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ | | | | ------------------ | | ------------------ | | 73| 24| 2 * MLKEM_SYMBYTES) | | ------------------ | | | | 27| 24|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ | | ------------------ ------------------ sk + MLKEM_INDCCA_SECRETKEYBYTES - 2 * MLKEM_SYMBYTES, ------------------ | | 27| 24|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 411| 24| MLKEM_SYMBYTES); ------------------ | | 27| 24|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 412| 24| mlk_hash_g(kr, buf, 2 * MLKEM_SYMBYTES); ------------------ | | 32| 24|#define mlk_hash_g(OUT, IN, INBYTES) mlk_sha3_512(OUT, IN, INBYTES) | | ------------------ | | | | 20| 24|#define mlk_sha3_512 sha3_512 | | | | ------------------ | | | | | | 31| 24|#define sha3_512 OQS_SHA3_sha3_512 | | | | ------------------ | | ------------------ ------------------ 413| | 414| | /* Recompute and compare ciphertext */ 415| | /* coins are in kr+MLKEM_SYMBYTES */ 416| 24| ret = mlk_indcpa_enc(tmp, buf, pk, kr + MLKEM_SYMBYTES, context); ------------------ | | 88| 24|#define mlk_indcpa_enc MLK_NAMESPACE_K(indcpa_enc) MLK_CONTEXT_PARAMETERS_4 | | ------------------ | | | | 64| 24|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 24|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 24|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ | | #define mlk_indcpa_enc MLK_NAMESPACE_K(indcpa_enc) MLK_CONTEXT_PARAMETERS_4 | | ------------------ | | | | 214| 24| (arg0, arg1, arg2, arg3) | | ------------------ ------------------ 417| 24| if (ret != 0) ------------------ | Branch (417:7): [True: 0, False: 24] ------------------ 418| 0| { 419| 0| goto cleanup; 420| 0| } 421| | 422| 24| fail = mlk_ct_memcmp(ct, tmp, MLKEM_INDCCA_CIPHERTEXTBYTES); ------------------ | | 74| 24|#define MLKEM_INDCCA_CIPHERTEXTBYTES (MLKEM_INDCPA_BYTES) | | ------------------ | | | | 67| 24| (MLKEM_POLYVECCOMPRESSEDBYTES_DU + MLKEM_POLYCOMPRESSEDBYTES_DV) | | | | ------------------ | | | | | | 58| 24|#define MLKEM_POLYVECCOMPRESSEDBYTES_DU (MLKEM_K * MLKEM_POLYCOMPRESSEDBYTES_DU) | | | | | | ------------------ | | | | | | | | 17| 24|#define MLKEM_K 4 | | | | | | ------------------ | | | | | | #define MLKEM_POLYVECCOMPRESSEDBYTES_DU (MLKEM_K * MLKEM_POLYCOMPRESSEDBYTES_DU) | | | | | | ------------------ | | | | | | | | 57| 24|#define MLKEM_POLYCOMPRESSEDBYTES_DU MLKEM_POLYCOMPRESSEDBYTES_D11 | | | | | | | | ------------------ | | | | | | | | | | 36| 24|#define MLKEM_POLYCOMPRESSEDBYTES_D11 352 | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | | | (MLKEM_POLYVECCOMPRESSEDBYTES_DU + MLKEM_POLYCOMPRESSEDBYTES_DV) | | | | ------------------ | | | | | | 56| 24|#define MLKEM_POLYCOMPRESSEDBYTES_DV MLKEM_POLYCOMPRESSEDBYTES_D5 | | | | | | ------------------ | | | | | | | | 34| 24|#define MLKEM_POLYCOMPRESSEDBYTES_D5 160 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 423| | 424| | /* Compute rejection key */ 425| 24| mlk_memcpy(tmp, sk + MLKEM_INDCCA_SECRETKEYBYTES - MLKEM_SYMBYTES, ------------------ | | 168| 24|#define mlk_memcpy memcpy ------------------ mlk_memcpy(tmp, sk + MLKEM_INDCCA_SECRETKEYBYTES - MLKEM_SYMBYTES, ------------------ | | 72| 24| (MLKEM_INDCPA_SECRETKEYBYTES + MLKEM_INDCPA_PUBLICKEYBYTES + \ | | ------------------ | | | | 65| 24|#define MLKEM_INDCPA_SECRETKEYBYTES (MLKEM_POLYVECBYTES) | | | | ------------------ | | | | | | 31| 24|#define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | | | ------------------ | | | | | | | | 17| 24|#define MLKEM_K 4 | | | | | | ------------------ | | | | | | #define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | | | ------------------ | | | | | | | | 30| 24|#define MLKEM_POLYBYTES 384 | | | | | | ------------------ | | | | ------------------ | | ------------------ | | (MLKEM_INDCPA_SECRETKEYBYTES + MLKEM_INDCPA_PUBLICKEYBYTES + \ | | ------------------ | | | | 64| 24|#define MLKEM_INDCPA_PUBLICKEYBYTES (MLKEM_POLYVECBYTES + MLKEM_SYMBYTES) | | | | ------------------ | | | | | | 31| 24|#define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | | | ------------------ | | | | | | | | 17| 24|#define MLKEM_K 4 | | | | | | ------------------ | | | | | | #define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | | | ------------------ | | | | | | | | 30| 24|#define MLKEM_POLYBYTES 384 | | | | | | ------------------ | | | | ------------------ | | | | #define MLKEM_INDCPA_PUBLICKEYBYTES (MLKEM_POLYVECBYTES + MLKEM_SYMBYTES) | | | | ------------------ | | | | | | 27| 24|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ | | | | ------------------ | | ------------------ | | 73| 24| 2 * MLKEM_SYMBYTES) | | ------------------ | | | | 27| 24|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ | | ------------------ ------------------ mlk_memcpy(tmp, sk + MLKEM_INDCCA_SECRETKEYBYTES - MLKEM_SYMBYTES, ------------------ | | 27| 24|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 426| 24| MLKEM_SYMBYTES); ------------------ | | 27| 24|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 427| 24| mlk_memcpy(tmp + MLKEM_SYMBYTES, ct, MLKEM_INDCCA_CIPHERTEXTBYTES); ------------------ | | 168| 24|#define mlk_memcpy memcpy ------------------ mlk_memcpy(tmp + MLKEM_SYMBYTES, ct, MLKEM_INDCCA_CIPHERTEXTBYTES); ------------------ | | 27| 24|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ mlk_memcpy(tmp + MLKEM_SYMBYTES, ct, MLKEM_INDCCA_CIPHERTEXTBYTES); ------------------ | | 74| 24|#define MLKEM_INDCCA_CIPHERTEXTBYTES (MLKEM_INDCPA_BYTES) | | ------------------ | | | | 67| 24| (MLKEM_POLYVECCOMPRESSEDBYTES_DU + MLKEM_POLYCOMPRESSEDBYTES_DV) | | | | ------------------ | | | | | | 58| 24|#define MLKEM_POLYVECCOMPRESSEDBYTES_DU (MLKEM_K * MLKEM_POLYCOMPRESSEDBYTES_DU) | | | | | | ------------------ | | | | | | | | 17| 24|#define MLKEM_K 4 | | | | | | ------------------ | | | | | | #define MLKEM_POLYVECCOMPRESSEDBYTES_DU (MLKEM_K * MLKEM_POLYCOMPRESSEDBYTES_DU) | | | | | | ------------------ | | | | | | | | 57| 24|#define MLKEM_POLYCOMPRESSEDBYTES_DU MLKEM_POLYCOMPRESSEDBYTES_D11 | | | | | | | | ------------------ | | | | | | | | | | 36| 24|#define MLKEM_POLYCOMPRESSEDBYTES_D11 352 | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | | | (MLKEM_POLYVECCOMPRESSEDBYTES_DU + MLKEM_POLYCOMPRESSEDBYTES_DV) | | | | ------------------ | | | | | | 56| 24|#define MLKEM_POLYCOMPRESSEDBYTES_DV MLKEM_POLYCOMPRESSEDBYTES_D5 | | | | | | ------------------ | | | | | | | | 34| 24|#define MLKEM_POLYCOMPRESSEDBYTES_D5 160 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 428| 24| mlk_hash_j(ss, tmp, MLKEM_SYMBYTES + MLKEM_INDCCA_CIPHERTEXTBYTES); ------------------ | | 36| 24| mlk_shake256(OUT, MLKEM_SYMBYTES, IN, INBYTES) | | ------------------ | | | | 18| 24|#define mlk_shake256 shake256 | | | | ------------------ | | | | | | 12| 24|#define shake256 OQS_SHA3_shake256 | | | | ------------------ | | ------------------ | | mlk_shake256(OUT, MLKEM_SYMBYTES, IN, INBYTES) | | ------------------ | | | | 27| 24|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ | | ------------------ ------------------ 429| | 430| | /* Copy true key to return buffer if fail is 0 */ 431| 24| mlk_ct_cmov_zero(ss, kr, MLKEM_SYMBYTES, fail); ------------------ | | 27| 24|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 432| | 433| 24|cleanup: 434| | /* Specification: Partially implements 435| | * @[FIPS203, Section 3.3, Destruction of intermediate values] */ 436| 24| MLK_FREE(tmp, uint8_t, MLKEM_SYMBYTES + MLKEM_INDCCA_CIPHERTEXTBYTES, ------------------ | | 238| 24| do \ | | 239| 24| { \ | | 240| 24| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 24| (v) = NULL; \ | | 242| 24| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 24] | | ------------------ ------------------ 437| 24| context); 438| 24| MLK_FREE(kr, uint8_t, 2 * MLKEM_SYMBYTES, context); ------------------ | | 238| 24| do \ | | 239| 24| { \ | | 240| 24| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 24| (v) = NULL; \ | | 242| 24| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 24] | | ------------------ ------------------ 439| 24| MLK_FREE(buf, uint8_t, 2 * MLKEM_SYMBYTES, context); ------------------ | | 238| 24| do \ | | 239| 24| { \ | | 240| 24| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 24| (v) = NULL; \ | | 242| 24| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 24] | | ------------------ ------------------ 440| | 441| 24| return ret; 442| 24|} poly_k.c:mlk_polyvec_basemul_acc_montgomery_cached_k4_native: 157| 360|{ 158| 360| if (!mlk_sys_check_capability(MLK_SYS_CAP_AVX2)) ------------------ | Branch (158:7): [True: 0, False: 360] ------------------ 159| 0| { 160| 0| return MLK_NATIVE_FUNC_FALLBACK; ------------------ | | 38| 0|#define MLK_NATIVE_FUNC_FALLBACK (-1) ------------------ 161| 0| } 162| | 163| 360| mlk_polyvec_basemul_acc_montgomery_cached_k4_avx2_asm(r, a, b, b_cache); ------------------ | | 141| 360| MLK_NAMESPACE(polyvec_basemul_acc_montgomery_cached_k4_avx2_asm) | | ------------------ | | | | 63| 360|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 360|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 360|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 164| 360| return MLK_NATIVE_FUNC_SUCCESS; ------------------ | | 33| 360|#define MLK_NATIVE_FUNC_SUCCESS (0) ------------------ 165| 360|} compress.c:mlk_poly_compress_d5_native: 252| 48|{ 253| 48| if (!mlk_sys_check_capability(MLK_SYS_CAP_AVX2)) ------------------ | Branch (253:7): [True: 0, False: 48] ------------------ 254| 0| { 255| 0| return MLK_NATIVE_FUNC_FALLBACK; ------------------ | | 38| 0|#define MLK_NATIVE_FUNC_FALLBACK (-1) ------------------ 256| 0| } 257| | 258| 48| mlk_poly_compress_d5_avx2_asm(r, a, mlk_compress_d5_data); ------------------ | | 261| 48|#define mlk_poly_compress_d5_avx2_asm MLK_NAMESPACE(poly_compress_d5_avx2_asm) | | ------------------ | | | | 63| 48|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 48|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 48|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ mlk_poly_compress_d5_avx2_asm(r, a, mlk_compress_d5_data); ------------------ | | 31| 48|#define mlk_compress_d5_data MLK_NAMESPACE(compress_d5_data) | | ------------------ | | | | 63| 48|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 48|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 48|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 259| 48| return MLK_NATIVE_FUNC_SUCCESS; ------------------ | | 33| 48|#define MLK_NATIVE_FUNC_SUCCESS (0) ------------------ 260| 48|} compress.c:mlk_poly_compress_d11_native: 265| 192|{ 266| 192| if (!mlk_sys_check_capability(MLK_SYS_CAP_AVX2)) ------------------ | Branch (266:7): [True: 0, False: 192] ------------------ 267| 0| { 268| 0| return MLK_NATIVE_FUNC_FALLBACK; ------------------ | | 38| 0|#define MLK_NATIVE_FUNC_FALLBACK (-1) ------------------ 269| 0| } 270| | 271| 192| mlk_poly_compress_d11_avx2_asm(r, a, mlk_compress_d11_data); ------------------ | | 294| 192|#define mlk_poly_compress_d11_avx2_asm MLK_NAMESPACE(poly_compress_d11_avx2_asm) | | ------------------ | | | | 63| 192|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 192|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 192|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ mlk_poly_compress_d11_avx2_asm(r, a, mlk_compress_d11_data); ------------------ | | 37| 192|#define mlk_compress_d11_data MLK_NAMESPACE(compress_d11_data) | | ------------------ | | | | 63| 192|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 192|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 192|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 272| 192| return MLK_NATIVE_FUNC_SUCCESS; ------------------ | | 33| 192|#define MLK_NATIVE_FUNC_SUCCESS (0) ------------------ 273| 192|} compress.c:mlk_poly_decompress_d5_native: 278| 24|{ 279| 24| if (!mlk_sys_check_capability(MLK_SYS_CAP_AVX2)) ------------------ | Branch (279:7): [True: 0, False: 24] ------------------ 280| 0| { 281| 0| return MLK_NATIVE_FUNC_FALLBACK; ------------------ | | 38| 0|#define MLK_NATIVE_FUNC_FALLBACK (-1) ------------------ 282| 0| } 283| | 284| 24| mlk_poly_decompress_d5_avx2_asm(r, a, mlk_decompress_d5_data); ------------------ | | 278| 24| MLK_NAMESPACE(poly_decompress_d5_avx2_asm) | | ------------------ | | | | 63| 24|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 24|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 24|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ mlk_poly_decompress_d5_avx2_asm(r, a, mlk_decompress_d5_data); ------------------ | | 34| 24|#define mlk_decompress_d5_data MLK_NAMESPACE(decompress_d5_data) | | ------------------ | | | | 63| 24|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 24|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 24|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 285| 24| return MLK_NATIVE_FUNC_SUCCESS; ------------------ | | 33| 24|#define MLK_NATIVE_FUNC_SUCCESS (0) ------------------ 286| 24|} compress.c:mlk_poly_decompress_d11_native: 291| 96|{ 292| 96| if (!mlk_sys_check_capability(MLK_SYS_CAP_AVX2)) ------------------ | Branch (292:7): [True: 0, False: 96] ------------------ 293| 0| { 294| 0| return MLK_NATIVE_FUNC_FALLBACK; ------------------ | | 38| 0|#define MLK_NATIVE_FUNC_FALLBACK (-1) ------------------ 295| 0| } 296| | 297| 96| mlk_poly_decompress_d11_avx2_asm(r, a, mlk_decompress_d11_data); ------------------ | | 311| 96| MLK_NAMESPACE(poly_decompress_d11_avx2_asm) | | ------------------ | | | | 63| 96|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 96|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 96|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ mlk_poly_decompress_d11_avx2_asm(r, a, mlk_decompress_d11_data); ------------------ | | 40| 96|#define mlk_decompress_d11_data MLK_NAMESPACE(decompress_d11_data) | | ------------------ | | | | 63| 96|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 96|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 96|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 298| 96| return MLK_NATIVE_FUNC_SUCCESS; ------------------ | | 33| 96|#define MLK_NATIVE_FUNC_SUCCESS (0) ------------------ 299| 96|} PQCP_MLKEM_NATIVE_MLKEM1024_X86_64_poly_tomont: 132| 96|{ 133| 96|#if defined(MLK_USE_NATIVE_POLY_TOMONT) 134| 96| int ret; 135| 96| ret = mlk_poly_tomont_native(r->coeffs); 136| 96| if (ret == MLK_NATIVE_FUNC_SUCCESS) ------------------ | | 33| 96|#define MLK_NATIVE_FUNC_SUCCESS (0) ------------------ | Branch (136:7): [True: 96, False: 0] ------------------ 137| 96| { 138| 96| mlk_assert_abs_bound(r, MLKEM_N, MLKEM_Q); ------------------ | | 105| 96| do \ | | 106| 96| { \ | | 107| 96| } while (0) | | ------------------ | | | Branch (107:12): [Folded, False: 96] | | ------------------ ------------------ 139| 96| return; 140| 96| } 141| 0|#endif /* MLK_USE_NATIVE_POLY_TOMONT */ 142| | 143| 0| mlk_poly_tomont_c(r); 144| 0|} PQCP_MLKEM_NATIVE_MLKEM1024_X86_64_poly_reduce: 211| 552|{ 212| 552|#if defined(MLK_USE_NATIVE_POLY_REDUCE) 213| 552| int ret; 214| 552| ret = mlk_poly_reduce_native(r->coeffs); 215| 552| if (ret == MLK_NATIVE_FUNC_SUCCESS) ------------------ | | 33| 552|#define MLK_NATIVE_FUNC_SUCCESS (0) ------------------ | Branch (215:7): [True: 552, False: 0] ------------------ 216| 552| { 217| 552| mlk_assert_bound(r, MLKEM_N, 0, MLKEM_Q); ------------------ | | 101| 552| do \ | | 102| 552| { \ | | 103| 552| } while (0) | | ------------------ | | | Branch (103:12): [Folded, False: 552] | | ------------------ ------------------ 218| 552| return; 219| 552| } 220| 0|#endif /* MLK_USE_NATIVE_POLY_REDUCE */ 221| | 222| 0| mlk_poly_reduce_c(r); 223| 0|} PQCP_MLKEM_NATIVE_MLKEM1024_X86_64_poly_add: 230| 384|{ 231| 384| unsigned i; 232| 98.6k| for (i = 0; i < MLKEM_N; i++) ------------------ | | 22| 98.6k|#define MLKEM_N 256 ------------------ | Branch (232:15): [True: 98.3k, False: 384] ------------------ 233| 98.3k| __loop__( 234| 98.3k| invariant(i <= MLKEM_N) 235| 98.3k| invariant(forall(k0, i, MLKEM_N, r->coeffs[k0] == loop_entry(*r).coeffs[k0])) 236| 98.3k| invariant(forall(k1, 0, i, r->coeffs[k1] == loop_entry(*r).coeffs[k1] + b->coeffs[k1])) 237| 98.3k| decreases(MLKEM_N - i)) 238| 98.3k| { 239| | /* The preconditions imply that the addition stays within int16_t. */ 240| 98.3k| r->coeffs[i] = (int16_t)(r->coeffs[i] + b->coeffs[i]); 241| 98.3k| } 242| 384|} PQCP_MLKEM_NATIVE_MLKEM1024_X86_64_poly_sub: 249| 24|{ 250| 24| unsigned i; 251| 6.16k| for (i = 0; i < MLKEM_N; i++) ------------------ | | 22| 6.16k|#define MLKEM_N 256 ------------------ | Branch (251:15): [True: 6.14k, False: 24] ------------------ 252| 6.14k| __loop__( 253| 6.14k| invariant(i <= MLKEM_N) 254| 6.14k| invariant(forall(k0, i, MLKEM_N, r->coeffs[k0] == loop_entry(*r).coeffs[k0])) 255| 6.14k| invariant(forall(k1, 0, i, r->coeffs[k1] == loop_entry(*r).coeffs[k1] - b->coeffs[k1])) 256| 6.14k| decreases(MLKEM_N - i)) 257| 6.14k| { 258| | /* The preconditions imply that the subtraction stays within int16_t. */ 259| 6.14k| r->coeffs[i] = (int16_t)(r->coeffs[i] - b->coeffs[i]); 260| 6.14k| } 261| 24|} PQCP_MLKEM_NATIVE_MLKEM1024_X86_64_poly_mulcache_compute: 302| 384|{ 303| 384|#if defined(MLK_USE_NATIVE_POLY_MULCACHE_COMPUTE) 304| 384| int ret; 305| 384| ret = mlk_poly_mulcache_compute_native(x->coeffs, a->coeffs); 306| 384| if (ret == MLK_NATIVE_FUNC_SUCCESS) ------------------ | | 33| 384|#define MLK_NATIVE_FUNC_SUCCESS (0) ------------------ | Branch (306:7): [True: 384, False: 0] ------------------ 307| 384| { 308| 384| return; 309| 384| } 310| 0|#endif /* MLK_USE_NATIVE_POLY_MULCACHE_COMPUTE */ 311| | 312| 0| mlk_poly_mulcache_compute_c(x, a); 313| 0|} PQCP_MLKEM_NATIVE_MLKEM1024_X86_64_poly_ntt: 457| 480|{ 458| 480|#if defined(MLK_USE_NATIVE_NTT) 459| 480| int ret; 460| 480| mlk_assert_abs_bound(r, MLKEM_N, MLKEM_Q); ------------------ | | 105| 480| do \ | | 106| 480| { \ | | 107| 480| } while (0) | | ------------------ | | | Branch (107:12): [Folded, False: 480] | | ------------------ ------------------ 461| 480| ret = mlk_ntt_native(r->coeffs); 462| 480| if (ret == MLK_NATIVE_FUNC_SUCCESS) ------------------ | | 33| 480|#define MLK_NATIVE_FUNC_SUCCESS (0) ------------------ | Branch (462:7): [True: 480, False: 0] ------------------ 463| 480| { 464| 480| mlk_assert_abs_bound(r, MLKEM_N, MLK_NTT_BOUND); ------------------ | | 105| 480| do \ | | 106| 480| { \ | | 107| 480| } while (0) | | ------------------ | | | Branch (107:12): [Folded, False: 480] | | ------------------ ------------------ 465| 480| return; 466| 480| } 467| 0|#endif /* MLK_USE_NATIVE_NTT */ 468| | 469| 0| mlk_poly_ntt_c(r); 470| 0|} PQCP_MLKEM_NATIVE_MLKEM1024_X86_64_poly_invntt_tomont: 558| 264|{ 559| 264|#if defined(MLK_USE_NATIVE_INTT) 560| 264| int ret; 561| 264| ret = mlk_intt_native(r->coeffs); 562| 264| if (ret == MLK_NATIVE_FUNC_SUCCESS) ------------------ | | 33| 264|#define MLK_NATIVE_FUNC_SUCCESS (0) ------------------ | Branch (562:7): [True: 264, False: 0] ------------------ 563| 264| { 564| 264| mlk_assert_abs_bound(r, MLKEM_N, MLK_INVNTT_BOUND); ------------------ | | 105| 264| do \ | | 106| 264| { \ | | 107| 264| } while (0) | | ------------------ | | | Branch (107:12): [Folded, False: 264] | | ------------------ ------------------ 565| 264| return; 566| 264| } 567| 0|#endif /* MLK_USE_NATIVE_INTT */ 568| | 569| 0| mlk_poly_invntt_tomont_c(r); 570| 0|} PQCP_MLKEM_NATIVE_MLKEM1024_X86_64_polyvec_compress_du: 50| 48|{ 51| 48| unsigned i; 52| 48| mlk_assert_bound_2d(a->vec, MLKEM_K, MLKEM_N, 0, MLKEM_Q); ------------------ | | 110| 48| do \ | | 111| 48| { \ | | 112| 48| } while (0) | | ------------------ | | | Branch (112:12): [Folded, False: 48] | | ------------------ ------------------ 53| | 54| 240| for (i = 0; i < MLKEM_K; i++) ------------------ | | 17| 240|#define MLKEM_K 4 ------------------ | Branch (54:15): [True: 192, False: 48] ------------------ 55| 192| { 56| 192| mlk_poly_compress_du(r + i * MLKEM_POLYCOMPRESSEDBYTES_DU, &a->vec[i]); ------------------ | | 49| 192|#define mlk_poly_compress_du MLK_NAMESPACE_K(poly_compress_du) | | ------------------ | | | | 64| 192|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 192|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 192|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ mlk_poly_compress_du(r + i * MLKEM_POLYCOMPRESSEDBYTES_DU, &a->vec[i]); ------------------ | | 57| 192|#define MLKEM_POLYCOMPRESSEDBYTES_DU MLKEM_POLYCOMPRESSEDBYTES_D11 | | ------------------ | | | | 36| 192|#define MLKEM_POLYCOMPRESSEDBYTES_D11 352 | | ------------------ ------------------ 57| 192| } 58| 48|} PQCP_MLKEM_NATIVE_MLKEM1024_X86_64_polyvec_decompress_du: 64| 24|{ 65| 24| unsigned i; 66| 120| for (i = 0; i < MLKEM_K; i++) ------------------ | | 17| 120|#define MLKEM_K 4 ------------------ | Branch (66:15): [True: 96, False: 24] ------------------ 67| 96| { 68| 96| mlk_poly_decompress_du(&r->vec[i], a + i * MLKEM_POLYCOMPRESSEDBYTES_DU); ------------------ | | 79| 96|#define mlk_poly_decompress_du MLK_NAMESPACE_K(poly_decompress_du) | | ------------------ | | | | 64| 96|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 96|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 96|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ mlk_poly_decompress_du(&r->vec[i], a + i * MLKEM_POLYCOMPRESSEDBYTES_DU); ------------------ | | 57| 96|#define MLKEM_POLYCOMPRESSEDBYTES_DU MLKEM_POLYCOMPRESSEDBYTES_D11 | | ------------------ | | | | 36| 96|#define MLKEM_POLYCOMPRESSEDBYTES_D11 352 | | ------------------ ------------------ 69| 96| } 70| | 71| 24| mlk_assert_bound_2d(r->vec, MLKEM_K, MLKEM_N, 0, MLKEM_Q); ------------------ | | 110| 24| do \ | | 111| 24| { \ | | 112| 24| } while (0) | | ------------------ | | | Branch (112:12): [Folded, False: 24] | | ------------------ ------------------ 72| 24|} PQCP_MLKEM_NATIVE_MLKEM1024_X86_64_polyvec_tobytes: 81| 72|{ 82| 72| unsigned i; 83| 72| mlk_assert_bound_2d(a->vec, MLKEM_K, MLKEM_N, 0, MLKEM_Q); ------------------ | | 110| 72| do \ | | 111| 72| { \ | | 112| 72| } while (0) | | ------------------ | | | Branch (112:12): [Folded, False: 72] | | ------------------ ------------------ 84| | 85| 360| for (i = 0; i < MLKEM_K; i++) ------------------ | | 17| 360|#define MLKEM_K 4 ------------------ | Branch (85:15): [True: 288, False: 72] ------------------ 86| 288| __loop__( 87| 288| assigns(i, memory_slice(r, MLKEM_POLYVECBYTES)) 88| 288| invariant(i <= MLKEM_K) 89| 288| decreases(MLKEM_K - i) 90| 288| ) 91| 288| { 92| 288| mlk_poly_tobytes(&r[i * MLKEM_POLYBYTES], &a->vec[i]); ------------------ | | 512| 288|#define mlk_poly_tobytes MLK_NAMESPACE(poly_tobytes) | | ------------------ | | | | 63| 288|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 288|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 288|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ mlk_poly_tobytes(&r[i * MLKEM_POLYBYTES], &a->vec[i]); ------------------ | | 30| 288|#define MLKEM_POLYBYTES 384 ------------------ 93| 288| } 94| 72|} PQCP_MLKEM_NATIVE_MLKEM1024_X86_64_polyvec_frombytes: 99| 96|{ 100| 96| unsigned i; 101| 480| for (i = 0; i < MLKEM_K; i++) ------------------ | | 17| 480|#define MLKEM_K 4 ------------------ | Branch (101:15): [True: 384, False: 96] ------------------ 102| 384| { 103| 384| mlk_poly_frombytes(&r->vec[i], a + i * MLKEM_POLYBYTES); ------------------ | | 534| 384|#define mlk_poly_frombytes MLK_NAMESPACE(poly_frombytes) | | ------------------ | | | | 63| 384|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 384|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 384|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ mlk_poly_frombytes(&r->vec[i], a + i * MLKEM_POLYBYTES); ------------------ | | 30| 384|#define MLKEM_POLYBYTES 384 ------------------ 104| 384| } 105| | 106| 96| mlk_assert_bound_2d(r->vec, MLKEM_K, MLKEM_N, 0, MLKEM_UINT12_LIMIT); ------------------ | | 110| 96| do \ | | 111| 96| { \ | | 112| 96| } while (0) | | ------------------ | | | Branch (112:12): [Folded, False: 96] | | ------------------ ------------------ 107| 96|} PQCP_MLKEM_NATIVE_MLKEM1024_X86_64_polyvec_ntt: 112| 120|{ 113| 120| unsigned i; 114| 600| for (i = 0; i < MLKEM_K; i++) ------------------ | | 17| 600|#define MLKEM_K 4 ------------------ | Branch (114:15): [True: 480, False: 120] ------------------ 115| 480| { 116| 480| mlk_poly_ntt(&r->vec[i]); ------------------ | | 235| 480|#define mlk_poly_ntt MLK_NAMESPACE(poly_ntt) | | ------------------ | | | | 63| 480|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 480|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 480|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 117| 480| } 118| | 119| 120| mlk_assert_abs_bound_2d(r->vec, MLKEM_K, MLKEM_N, MLK_NTT_BOUND); ------------------ | | 115| 120| do \ | | 116| 120| { \ | | 117| 120| } while (0) | | ------------------ | | | Branch (117:12): [Folded, False: 120] | | ------------------ ------------------ 120| 120|} PQCP_MLKEM_NATIVE_MLKEM1024_X86_64_polyvec_invntt_tomont: 129| 48|{ 130| 48| unsigned i; 131| 240| for (i = 0; i < MLKEM_K; i++) ------------------ | | 17| 240|#define MLKEM_K 4 ------------------ | Branch (131:15): [True: 192, False: 48] ------------------ 132| 192| { 133| 192| mlk_poly_invntt_tomont(&r->vec[i]); ------------------ | | 263| 192|#define mlk_poly_invntt_tomont MLK_NAMESPACE(poly_invntt_tomont) | | ------------------ | | | | 63| 192|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 192|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 192|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 134| 192| } 135| | 136| 48| mlk_assert_abs_bound_2d(r->vec, MLKEM_K, MLKEM_N, MLK_INVNTT_BOUND); ------------------ | | 115| 48| do \ | | 116| 48| { \ | | 117| 48| } while (0) | | ------------------ | | | Branch (117:12): [Folded, False: 48] | | ------------------ ------------------ 137| 48|} PQCP_MLKEM_NATIVE_MLKEM1024_X86_64_polyvec_basemul_acc_montgomery_cached: 195| 360|{ 196| 360|#if defined(MLK_USE_NATIVE_POLYVEC_BASEMUL_ACC_MONTGOMERY_CACHED) 197| 360| { 198| 360| int ret; 199| 360| mlk_assert_bound_2d(a->vec, MLKEM_K, MLKEM_N, 0, MLKEM_UINT12_LIMIT); ------------------ | | 110| 360| do \ | | 111| 360| { \ | | 112| 360| } while (0) | | ------------------ | | | Branch (112:12): [Folded, False: 360] | | ------------------ ------------------ 200| |#if MLKEM_K == 2 201| | ret = mlk_polyvec_basemul_acc_montgomery_cached_k2_native( 202| | r->coeffs, (const int16_t *)a, (const int16_t *)b, 203| | (const int16_t *)b_cache); 204| |#elif MLKEM_K == 3 205| | ret = mlk_polyvec_basemul_acc_montgomery_cached_k3_native( 206| | r->coeffs, (const int16_t *)a, (const int16_t *)b, 207| | (const int16_t *)b_cache); 208| |#elif MLKEM_K == 4 209| | ret = mlk_polyvec_basemul_acc_montgomery_cached_k4_native( 210| 360| r->coeffs, (const int16_t *)a, (const int16_t *)b, 211| 360| (const int16_t *)b_cache); 212| 360|#endif 213| 360| if (ret == MLK_NATIVE_FUNC_SUCCESS) ------------------ | | 33| 360|#define MLK_NATIVE_FUNC_SUCCESS (0) ------------------ | Branch (213:9): [True: 360, False: 0] ------------------ 214| 360| { 215| 360| return; 216| 360| } 217| 360| } 218| 0|#endif /* MLK_USE_NATIVE_POLYVEC_BASEMUL_ACC_MONTGOMERY_CACHED */ 219| | 220| 0| mlk_polyvec_basemul_acc_montgomery_cached_c(r, a, b, b_cache); ------------------ | | 39| 0| MLK_ADD_PARAM_SET(mlk_polyvec_basemul_acc_montgomery_cached_c) | | ------------------ | | | | 48| 0|#define MLK_ADD_PARAM_SET(s) s | | ------------------ ------------------ 221| 0|} PQCP_MLKEM_NATIVE_MLKEM1024_X86_64_polyvec_mulcache_compute: 229| 96|{ 230| 96| unsigned i; 231| 480| for (i = 0; i < MLKEM_K; i++) ------------------ | | 17| 480|#define MLKEM_K 4 ------------------ | Branch (231:15): [True: 384, False: 96] ------------------ 232| 384| { 233| 384| mlk_poly_mulcache_compute(&x->vec[i], &a->vec[i]); ------------------ | | 123| 384|#define mlk_poly_mulcache_compute MLK_NAMESPACE(poly_mulcache_compute) | | ------------------ | | | | 63| 384|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 384|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 384|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 234| 384| } 235| 96|} PQCP_MLKEM_NATIVE_MLKEM1024_X86_64_polyvec_reduce: 246| 120|{ 247| 120| unsigned i; 248| 600| for (i = 0; i < MLKEM_K; i++) ------------------ | | 17| 600|#define MLKEM_K 4 ------------------ | Branch (248:15): [True: 480, False: 120] ------------------ 249| 480| { 250| 480| mlk_poly_reduce(&r->vec[i]); ------------------ | | 154| 480|#define mlk_poly_reduce MLK_NAMESPACE(poly_reduce) | | ------------------ | | | | 63| 480|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 480|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 480|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 251| 480| } 252| | 253| 120| mlk_assert_bound_2d(r->vec, MLKEM_K, MLKEM_N, 0, MLKEM_Q); ------------------ | | 110| 120| do \ | | 111| 120| { \ | | 112| 120| } while (0) | | ------------------ | | | Branch (112:12): [Folded, False: 120] | | ------------------ ------------------ 254| 120|} PQCP_MLKEM_NATIVE_MLKEM1024_X86_64_polyvec_add: 261| 72|{ 262| 72| unsigned i; 263| 360| for (i = 0; i < MLKEM_K; i++) ------------------ | | 17| 360|#define MLKEM_K 4 ------------------ | Branch (263:15): [True: 288, False: 72] ------------------ 264| 288| __loop__( 265| 288| assigns(i, memory_slice(r, sizeof(mlk_polyvec))) 266| 288| invariant(i <= MLKEM_K) 267| 288| invariant(forall(j0, i, MLKEM_K, 268| 288| forall(k0, 0, MLKEM_N, 269| 288| ((int32_t)r->vec[j0].coeffs[k0] + b->vec[j0].coeffs[k0] <= INT16_MAX) && 270| 288| ((int32_t)r->vec[j0].coeffs[k0] + b->vec[j0].coeffs[k0] >= INT16_MIN)))) 271| 288| invariant(forall(j2, 0, i, 272| 288| forall(k2, 0, MLKEM_N, 273| 288| (r->vec[j2].coeffs[k2] <= INT16_MAX) && 274| 288| (r->vec[j2].coeffs[k2] >= INT16_MIN)))) 275| 288| decreases(MLKEM_K - i) 276| 288| ) 277| 288| { 278| 288| mlk_poly_add(&r->vec[i], &b->vec[i]); ------------------ | | 181| 288|#define mlk_poly_add MLK_NAMESPACE(poly_add) | | ------------------ | | | | 63| 288|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 288|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 288|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 279| 288| } 280| 72|} PQCP_MLKEM_NATIVE_MLKEM1024_X86_64_polyvec_tomont: 285| 24|{ 286| 24| unsigned i; 287| 120| for (i = 0; i < MLKEM_K; i++) ------------------ | | 17| 120|#define MLKEM_K 4 ------------------ | Branch (287:15): [True: 96, False: 24] ------------------ 288| 96| { 289| 96| mlk_poly_tomont(&r->vec[i]); ------------------ | | 102| 96|#define mlk_poly_tomont MLK_NAMESPACE(poly_tomont) | | ------------------ | | | | 63| 96|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 96|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 96|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 290| 96| } 291| | 292| 24| mlk_assert_abs_bound_2d(r->vec, MLKEM_K, MLKEM_N, MLKEM_Q); ------------------ | | 115| 24| do \ | | 116| 24| { \ | | 117| 24| } while (0) | | ------------------ | | | Branch (117:12): [Folded, False: 24] | | ------------------ ------------------ 293| 24|} PQCP_MLKEM_NATIVE_MLKEM1024_X86_64_poly_getnoise_eta1_4x: 337| 144|{ 338| 144| MLK_ALIGN uint8_t buf[4][MLK_ALIGN_UP(MLKEM_ETA1 * MLKEM_N / 4)]; ------------------ | | 190| 144|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) ------------------ 339| 144| MLK_ALIGN uint8_t extkey[4][MLK_ALIGN_UP(MLKEM_SYMBYTES + 1)]; ------------------ | | 190| 144|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) ------------------ 340| 144| mlk_memcpy(extkey[0], seed, MLKEM_SYMBYTES); ------------------ | | 168| 144|#define mlk_memcpy memcpy ------------------ mlk_memcpy(extkey[0], seed, MLKEM_SYMBYTES); ------------------ | | 27| 144|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 341| 144| mlk_memcpy(extkey[1], seed, MLKEM_SYMBYTES); ------------------ | | 168| 144|#define mlk_memcpy memcpy ------------------ mlk_memcpy(extkey[1], seed, MLKEM_SYMBYTES); ------------------ | | 27| 144|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 342| 144| mlk_memcpy(extkey[2], seed, MLKEM_SYMBYTES); ------------------ | | 168| 144|#define mlk_memcpy memcpy ------------------ mlk_memcpy(extkey[2], seed, MLKEM_SYMBYTES); ------------------ | | 27| 144|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 343| 144| mlk_memcpy(extkey[3], seed, MLKEM_SYMBYTES); ------------------ | | 168| 144|#define mlk_memcpy memcpy ------------------ mlk_memcpy(extkey[3], seed, MLKEM_SYMBYTES); ------------------ | | 27| 144|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 344| 144| extkey[0][MLKEM_SYMBYTES] = nonce0; ------------------ | | 27| 144|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 345| 144| extkey[1][MLKEM_SYMBYTES] = nonce1; ------------------ | | 27| 144|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 346| 144| extkey[2][MLKEM_SYMBYTES] = nonce2; ------------------ | | 27| 144|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 347| 144| extkey[3][MLKEM_SYMBYTES] = nonce3; ------------------ | | 27| 144|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 348| | 349| 144|#if !defined(FIPS202_X4_DEFAULT_IMPLEMENTATION) && \ 350| 144| !defined(MLK_CONFIG_SERIAL_FIPS202_ONLY) 351| 144| mlk_prf_eta1_x4(buf, extkey); ------------------ | | 45| 144| mlk_shake256x4((OUT)[0], (OUT)[1], (OUT)[2], (OUT)[3], \ | | ------------------ | | | | 18| 144|#define mlk_shake256x4 shake256x4 | | | | ------------------ | | | | | | 36| 144|#define shake256x4 OQS_SHA3_shake256_x4 | | | | ------------------ | | ------------------ | | 46| 144| (MLKEM_ETA1 * MLKEM_N / 4), (IN)[0], (IN)[1], (IN)[2], \ | | ------------------ | | | | 53| 144|#define MLKEM_ETA1 2 | | ------------------ | | (MLKEM_ETA1 * MLKEM_N / 4), (IN)[0], (IN)[1], (IN)[2], \ | | ------------------ | | | | 22| 144|#define MLKEM_N 256 | | ------------------ | | 47| 144| (IN)[3], MLKEM_SYMBYTES + 1) | | ------------------ | | | | 27| 144|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ | | ------------------ ------------------ 352| |#else 353| | mlk_prf_eta1(buf[0], extkey[0]); 354| | mlk_prf_eta1(buf[1], extkey[1]); 355| | mlk_prf_eta1(buf[2], extkey[2]); 356| | if (r3 != NULL) 357| | { 358| | mlk_prf_eta1(buf[3], extkey[3]); 359| | } 360| |#endif /* !(!FIPS202_X4_DEFAULT_IMPLEMENTATION && \ 361| | !MLK_CONFIG_SERIAL_FIPS202_ONLY) */ 362| | 363| 144| mlk_poly_cbd_eta1(r0, buf[0]); ------------------ | | 36| 144|#define mlk_poly_cbd_eta1 MLK_ADD_PARAM_SET(mlk_poly_cbd_eta1) | | ------------------ | | | | 48| 144|#define MLK_ADD_PARAM_SET(s) s | | ------------------ ------------------ 364| 144| mlk_poly_cbd_eta1(r1, buf[1]); ------------------ | | 36| 144|#define mlk_poly_cbd_eta1 MLK_ADD_PARAM_SET(mlk_poly_cbd_eta1) | | ------------------ | | | | 48| 144|#define MLK_ADD_PARAM_SET(s) s | | ------------------ ------------------ 365| 144| mlk_poly_cbd_eta1(r2, buf[2]); ------------------ | | 36| 144|#define mlk_poly_cbd_eta1 MLK_ADD_PARAM_SET(mlk_poly_cbd_eta1) | | ------------------ | | | | 48| 144|#define MLK_ADD_PARAM_SET(s) s | | ------------------ ------------------ 366| 144| if (r3 != NULL) ------------------ | Branch (366:7): [True: 144, False: 0] ------------------ 367| 144| { 368| 144| mlk_poly_cbd_eta1(r3, buf[3]); ------------------ | | 36| 144|#define mlk_poly_cbd_eta1 MLK_ADD_PARAM_SET(mlk_poly_cbd_eta1) | | ------------------ | | | | 48| 144|#define MLK_ADD_PARAM_SET(s) s | | ------------------ ------------------ 369| 144| mlk_assert_abs_bound(r3, MLKEM_N, MLKEM_ETA1 + 1); ------------------ | | 105| 144| do \ | | 106| 144| { \ | | 107| 144| } while (0) | | ------------------ | | | Branch (107:12): [Folded, False: 144] | | ------------------ ------------------ 370| 144| } 371| | 372| 144| mlk_assert_abs_bound(r0, MLKEM_N, MLKEM_ETA1 + 1); ------------------ | | 105| 144| do \ | | 106| 144| { \ | | 107| 144| } while (0) | | ------------------ | | | Branch (107:12): [Folded, False: 144] | | ------------------ ------------------ 373| 144| mlk_assert_abs_bound(r1, MLKEM_N, MLKEM_ETA1 + 1); ------------------ | | 105| 144| do \ | | 106| 144| { \ | | 107| 144| } while (0) | | ------------------ | | | Branch (107:12): [Folded, False: 144] | | ------------------ ------------------ 374| 144| mlk_assert_abs_bound(r2, MLKEM_N, MLKEM_ETA1 + 1); ------------------ | | 105| 144| do \ | | 106| 144| { \ | | 107| 144| } while (0) | | ------------------ | | | Branch (107:12): [Folded, False: 144] | | ------------------ ------------------ 375| | 376| | /* Specification: Partially implements 377| | * @[FIPS203, Section 3.3, Destruction of intermediate values] */ 378| 144| mlk_zeroize(buf, sizeof(buf)); 379| 144| mlk_zeroize(extkey, sizeof(extkey)); 380| 144|} PQCP_MLKEM_NATIVE_MLKEM1024_X86_64_poly_getnoise_eta2: 417| 48|{ 418| 48| MLK_ALIGN uint8_t buf[MLKEM_ETA2 * MLKEM_N / 4]; ------------------ | | 190| 48|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) ------------------ 419| 48| MLK_ALIGN uint8_t extkey[MLKEM_SYMBYTES + 1]; ------------------ | | 190| 48|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) ------------------ 420| | 421| 48| mlk_memcpy(extkey, seed, MLKEM_SYMBYTES); ------------------ | | 168| 48|#define mlk_memcpy memcpy ------------------ mlk_memcpy(extkey, seed, MLKEM_SYMBYTES); ------------------ | | 27| 48|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 422| 48| extkey[MLKEM_SYMBYTES] = nonce; ------------------ | | 27| 48|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 423| 48| mlk_prf_eta2(buf, extkey); ------------------ | | 43| 48|#define mlk_prf_eta2(OUT, IN) mlk_prf_eta(MLKEM_ETA2, OUT, IN) | | ------------------ | | | | 41| 48| mlk_shake256(OUT, (ETA) * MLKEM_N / 4, IN, MLKEM_SYMBYTES + 1) | | | | ------------------ | | | | | | 18| 48|#define mlk_shake256 shake256 | | | | | | ------------------ | | | | | | | | 12| 48|#define shake256 OQS_SHA3_shake256 | | | | | | ------------------ | | | | ------------------ | | | | mlk_shake256(OUT, (ETA) * MLKEM_N / 4, IN, MLKEM_SYMBYTES + 1) | | | | ------------------ | | | | | | 22| 48|#define MLKEM_N 256 | | | | ------------------ | | | | mlk_shake256(OUT, (ETA) * MLKEM_N / 4, IN, MLKEM_SYMBYTES + 1) | | | | ------------------ | | | | | | 27| 48|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ | | | | ------------------ | | ------------------ ------------------ 424| | 425| 48| mlk_poly_cbd_eta2(r, buf); ------------------ | | 37| 48|#define mlk_poly_cbd_eta2 MLK_ADD_PARAM_SET(mlk_poly_cbd_eta2) | | ------------------ | | | | 48| 48|#define MLK_ADD_PARAM_SET(s) s | | ------------------ ------------------ 426| | 427| 48| mlk_assert_abs_bound(r, MLKEM_N, MLKEM_ETA2 + 1); ------------------ | | 105| 48| do \ | | 106| 48| { \ | | 107| 48| } while (0) | | ------------------ | | | Branch (107:12): [Folded, False: 48] | | ------------------ ------------------ 428| | 429| | /* Specification: Partially implements 430| | * @[FIPS203, Section 3.3, Destruction of intermediate values] */ 431| 48| mlk_zeroize(buf, sizeof(buf)); 432| 48| mlk_zeroize(extkey, sizeof(extkey)); 433| 48|} poly_k.c:PQCP_MLKEM_NATIVE_MLKEM1024_X86_64_poly_compress_du: 69| 192|{ 70| |#if MLKEM_DU == 10 71| | mlk_poly_compress_d10(r, a); 72| |#elif MLKEM_DU == 11 73| 192| mlk_poly_compress_d11(r, a); ------------------ | | 445| 192|#define mlk_poly_compress_d11 MLK_NAMESPACE(poly_compress_d11) | | ------------------ | | | | 63| 192|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 192|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 192|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 74| |#else 75| |#error "Invalid value of MLKEM_DU" 76| |#endif 77| 192|} poly_k.c:PQCP_MLKEM_NATIVE_MLKEM1024_X86_64_poly_decompress_du: 102| 96|{ 103| |#if MLKEM_DU == 10 104| | mlk_poly_decompress_d10(r, a); 105| |#elif MLKEM_DU == 11 106| 96| mlk_poly_decompress_d11(r, a); ------------------ | | 488| 96|#define mlk_poly_decompress_d11 MLK_NAMESPACE(poly_decompress_d11) | | ------------------ | | | | 63| 96|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 96|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 96|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 107| |#else 108| |#error "Invalid value of MLKEM_DU" 109| |#endif 110| 96|} indcpa.c:PQCP_MLKEM_NATIVE_MLKEM1024_X86_64_poly_compress_dv: 132| 48|{ 133| |#if MLKEM_DV == 4 134| | mlk_poly_compress_d4(r, a); 135| |#elif MLKEM_DV == 5 136| 48| mlk_poly_compress_d5(r, a); ------------------ | | 425| 48|#define mlk_poly_compress_d5 MLK_NAMESPACE(poly_compress_d5) | | ------------------ | | | | 63| 48|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 48|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 48|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 137| |#else 138| |#error "Invalid value of MLKEM_DV" 139| |#endif 140| 48|} indcpa.c:PQCP_MLKEM_NATIVE_MLKEM1024_X86_64_poly_decompress_dv: 166| 24|{ 167| |#if MLKEM_DV == 4 168| | mlk_poly_decompress_d4(r, a); 169| |#elif MLKEM_DV == 5 170| 24| mlk_poly_decompress_d5(r, a); ------------------ | | 465| 24|#define mlk_poly_decompress_d5 MLK_NAMESPACE(poly_decompress_d5) | | ------------------ | | | | 63| 24|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 24|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 24|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 171| |#else 172| |#error "Invalid value of MLKEM_DV" 173| |#endif 174| 24|} PQCP_MLKEM_NATIVE_MLKEM1024_X86_64_poly_rej_uniform_x4: 158| 288|{ 159| | /* Temporary buffers for XOF output before rejection sampling */ 160| 288| MLK_ALIGN uint8_t ------------------ | | 190| 288|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) ------------------ 161| 288| buf[4][MLK_ALIGN_UP(MLKEM_GEN_MATRIX_NBLOCKS * MLK_XOF_RATE)]; 162| | 163| | /* Tracks the number of coefficients we have already sampled */ 164| 288| unsigned ctr[4]; 165| 288| mlk_xof_x4_ctx statex; ------------------ | | 51| 288|#define mlk_xof_x4_ctx mlk_shake128x4ctx | | ------------------ | | | | 13| 288|#define mlk_shake128x4ctx shake128x4ctx | | | | ------------------ | | | | | | 51| 288|#define shake128x4ctx shake128x4incctx | | | | | | ------------------ | | | | | | | | 18| 288|#define shake128x4incctx OQS_SHA3_shake128_x4_inc_ctx | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 166| 288| unsigned buflen; 167| | 168| 288| mlk_xof_x4_init(&statex); ------------------ | | 59| 288|#define mlk_xof_x4_init(CTX) mlk_shake128x4_init((CTX)) | | ------------------ | | | | 16| 288|#define mlk_shake128x4_init shake128x4_init | | | | ------------------ | | | | | | 52| 288|#define shake128x4_init shake128x4_inc_init | | | | | | ------------------ | | | | | | | | 19| 288|#define shake128x4_inc_init OQS_SHA3_shake128_x4_inc_init | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 169| 288| mlk_xof_x4_absorb(&statex, seed, MLKEM_SYMBYTES + 2); ------------------ | | 61| 288| mlk_shake128x4_absorb_once((CTX), (IN)[0], (IN)[1], (IN)[2], (IN)[3], \ | | ------------------ | | | | 14| 288|#define mlk_shake128x4_absorb_once shake128x4_absorb_once | | | | ------------------ | | | | | | 39| 288|#define shake128x4_absorb_once OQS_SHA3_shake128_x4_absorb_once | | | | ------------------ | | ------------------ | | 62| 288| (INBYTES)) ------------------ 170| | 171| | /* 172| | * Initially, squeeze heuristic number of MLKEM_GEN_MATRIX_NBLOCKS. 173| | * This should generate the matrix entries with high probability. 174| | */ 175| 288| mlk_xof_x4_squeezeblocks(buf, MLKEM_GEN_MATRIX_NBLOCKS, &statex); ------------------ | | 64| 288| mlk_shake128x4_squeezeblocks((BUF)[0], (BUF)[1], (BUF)[2], (BUF)[3], \ | | ------------------ | | | | 15| 288|#define mlk_shake128x4_squeezeblocks shake128x4_squeezeblocks | | | | ------------------ | | | | | | 46| 288| OQS_SHA3_shake128_x4_inc_squeeze(OUT0, OUT1, OUT2, OUT3, (NBLOCKS)*OQS_SHA3_SHAKE128_RATE, STATE) | | | | | | ------------------ | | | | | | | | 239| 288|#define OQS_SHA3_SHAKE128_RATE 168 | | | | | | ------------------ | | | | ------------------ | | ------------------ | | 65| 288| (NBLOCKS), (CTX)) ------------------ 176| 288| buflen = MLKEM_GEN_MATRIX_NBLOCKS * MLK_XOF_RATE; ------------------ | | 146| 288| ((12 * MLKEM_N / 8 * ((uint32_t)1 << 12) / MLKEM_Q + MLK_XOF_RATE) / \ | | ------------------ | | | | 22| 288|#define MLKEM_N 256 | | ------------------ | | ((12 * MLKEM_N / 8 * ((uint32_t)1 << 12) / MLKEM_Q + MLK_XOF_RATE) / \ | | ------------------ | | | | 23| 288|#define MLKEM_Q 3329 | | ------------------ | | ((12 * MLKEM_N / 8 * ((uint32_t)1 << 12) / MLKEM_Q + MLK_XOF_RATE) / \ | | ------------------ | | | | 68| 288|#define MLK_XOF_RATE SHAKE128_RATE | | | | ------------------ | | | | | | 8| 288|#define SHAKE128_RATE OQS_SHA3_SHAKE128_RATE | | | | | | ------------------ | | | | | | | | 239| 288|#define OQS_SHA3_SHAKE128_RATE 168 | | | | | | ------------------ | | | | ------------------ | | ------------------ | | 147| 288| MLK_XOF_RATE) | | ------------------ | | | | 68| 288|#define MLK_XOF_RATE SHAKE128_RATE | | | | ------------------ | | | | | | 8| 288|#define SHAKE128_RATE OQS_SHA3_SHAKE128_RATE | | | | | | ------------------ | | | | | | | | 239| 288|#define OQS_SHA3_SHAKE128_RATE 168 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ buflen = MLKEM_GEN_MATRIX_NBLOCKS * MLK_XOF_RATE; ------------------ | | 68| 288|#define MLK_XOF_RATE SHAKE128_RATE | | ------------------ | | | | 8| 288|#define SHAKE128_RATE OQS_SHA3_SHAKE128_RATE | | | | ------------------ | | | | | | 239| 288|#define OQS_SHA3_SHAKE128_RATE 168 | | | | ------------------ | | ------------------ ------------------ 177| 288| ctr[0] = mlk_rej_uniform(vec0->coeffs, MLKEM_N, 0, buf[0], buflen); ------------------ | | 22| 288|#define MLKEM_N 256 ------------------ 178| 288| ctr[1] = mlk_rej_uniform(vec1->coeffs, MLKEM_N, 0, buf[1], buflen); ------------------ | | 22| 288|#define MLKEM_N 256 ------------------ 179| 288| ctr[2] = mlk_rej_uniform(vec2->coeffs, MLKEM_N, 0, buf[2], buflen); ------------------ | | 22| 288|#define MLKEM_N 256 ------------------ 180| 288| ctr[3] = mlk_rej_uniform(vec3->coeffs, MLKEM_N, 0, buf[3], buflen); ------------------ | | 22| 288|#define MLKEM_N 256 ------------------ 181| | 182| | /* 183| | * So long as not all matrix entries have been generated, squeeze 184| | * one more block a time until we're done. 185| | */ 186| 288| buflen = MLK_XOF_RATE; ------------------ | | 68| 288|#define MLK_XOF_RATE SHAKE128_RATE | | ------------------ | | | | 8| 288|#define SHAKE128_RATE OQS_SHA3_SHAKE128_RATE | | | | ------------------ | | | | | | 239| 288|#define OQS_SHA3_SHAKE128_RATE 168 | | | | ------------------ | | ------------------ ------------------ 187| 408| while (ctr[0] < MLKEM_N || ctr[1] < MLKEM_N || ctr[2] < MLKEM_N || ------------------ | | 22| 816|#define MLKEM_N 256 ------------------ while (ctr[0] < MLKEM_N || ctr[1] < MLKEM_N || ctr[2] < MLKEM_N || ------------------ | | 22| 777|#define MLKEM_N 256 ------------------ while (ctr[0] < MLKEM_N || ctr[1] < MLKEM_N || ctr[2] < MLKEM_N || ------------------ | | 22| 747|#define MLKEM_N 256 ------------------ | Branch (187:10): [True: 39, False: 369] | Branch (187:30): [True: 30, False: 339] | Branch (187:50): [True: 24, False: 315] ------------------ 188| 315| ctr[3] < MLKEM_N) ------------------ | | 22| 315|#define MLKEM_N 256 ------------------ | Branch (188:10): [True: 27, False: 288] ------------------ 189| 120| __loop__( 190| 120| assigns(ctr, statex, 191| 120| memory_slice(vec0, sizeof(mlk_poly)), 192| 120| memory_slice(vec1, sizeof(mlk_poly)), 193| 120| memory_slice(vec2, sizeof(mlk_poly)), 194| 120| memory_slice(vec3, sizeof(mlk_poly)), 195| 120| object_whole(buf)) 196| 120| invariant(ctr[0] <= MLKEM_N && ctr[1] <= MLKEM_N) 197| 120| invariant(ctr[2] <= MLKEM_N && ctr[3] <= MLKEM_N) 198| 120| invariant(array_bound(vec0->coeffs, 0, ctr[0], 0, MLKEM_Q)) 199| 120| invariant(array_bound(vec1->coeffs, 0, ctr[1], 0, MLKEM_Q)) 200| 120| invariant(array_bound(vec2->coeffs, 0, ctr[2], 0, MLKEM_Q)) 201| 120| invariant(array_bound(vec3->coeffs, 0, ctr[3], 0, MLKEM_Q))) 202| 120| { 203| 120| mlk_xof_x4_squeezeblocks(buf, 1, &statex); ------------------ | | 64| 120| mlk_shake128x4_squeezeblocks((BUF)[0], (BUF)[1], (BUF)[2], (BUF)[3], \ | | ------------------ | | | | 15| 120|#define mlk_shake128x4_squeezeblocks shake128x4_squeezeblocks | | | | ------------------ | | | | | | 46| 120| OQS_SHA3_shake128_x4_inc_squeeze(OUT0, OUT1, OUT2, OUT3, (NBLOCKS)*OQS_SHA3_SHAKE128_RATE, STATE) | | | | | | ------------------ | | | | | | | | 239| 120|#define OQS_SHA3_SHAKE128_RATE 168 | | | | | | ------------------ | | | | ------------------ | | ------------------ | | 65| 120| (NBLOCKS), (CTX)) ------------------ 204| 120| ctr[0] = mlk_rej_uniform(vec0->coeffs, MLKEM_N, ctr[0], buf[0], buflen); ------------------ | | 22| 120|#define MLKEM_N 256 ------------------ 205| 120| ctr[1] = mlk_rej_uniform(vec1->coeffs, MLKEM_N, ctr[1], buf[1], buflen); ------------------ | | 22| 120|#define MLKEM_N 256 ------------------ 206| 120| ctr[2] = mlk_rej_uniform(vec2->coeffs, MLKEM_N, ctr[2], buf[2], buflen); ------------------ | | 22| 120|#define MLKEM_N 256 ------------------ 207| 120| ctr[3] = mlk_rej_uniform(vec3->coeffs, MLKEM_N, ctr[3], buf[3], buflen); ------------------ | | 22| 120|#define MLKEM_N 256 ------------------ 208| 120| } 209| | 210| 288| mlk_xof_x4_release(&statex); ------------------ | | 66| 288|#define mlk_xof_x4_release(CTX) mlk_shake128x4_release((CTX)) | | ------------------ | | | | 17| 288|#define mlk_shake128x4_release shake128x4_release | | | | ------------------ | | | | | | 53| 288|#define shake128x4_release shake128x4_inc_ctx_release | | | | | | ------------------ | | | | | | | | 23| 288|#define shake128x4_inc_ctx_release OQS_SHA3_shake128_x4_inc_ctx_release | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 211| | 212| | /* Specification: Partially implements 213| | * @[FIPS203, Section 3.3, Destruction of intermediate values] */ 214| 288| mlk_zeroize(buf, sizeof(buf)); 215| 288|} PQCP_MLKEM_NATIVE_MLKEM1024_X86_64_poly_cbd2: 276| 624|{ 277| 624| unsigned i; 278| 20.5k| for (i = 0; i < MLKEM_N / 8; i++) ------------------ | | 22| 20.5k|#define MLKEM_N 256 ------------------ | Branch (278:15): [True: 19.9k, False: 624] ------------------ 279| 19.9k| __loop__( 280| 19.9k| invariant(i <= MLKEM_N / 8) 281| 19.9k| invariant(array_abs_bound(r->coeffs, 0, 8 * i, 3)) 282| 19.9k| decreases(MLKEM_N / 8 - i)) 283| 19.9k| { 284| 19.9k| unsigned j; 285| 19.9k| uint32_t t = mlk_load32_littleendian(buf + 4 * i); 286| 19.9k| uint32_t d = t & 0x55555555; 287| 19.9k| d += (t >> 1) & 0x55555555; 288| | 289| 179k| for (j = 0; j < 8; j++) ------------------ | Branch (289:17): [True: 159k, False: 19.9k] ------------------ 290| 159k| __loop__( 291| 159k| invariant(i <= MLKEM_N / 8 && j <= 8) 292| 159k| invariant(array_abs_bound(r->coeffs, 0, 8 * i + j, 3)) 293| 159k| decreases(8 - j)) 294| 159k| { 295| | /* Safety: The & 0x3 masks each value to 2 bits (range [0, 3]), so the 296| | * truncation and subsequent subtraction in int16_t is lossless. */ 297| 159k| const int16_t a = (int16_t)((d >> (4 * j + 0)) & 0x3); 298| 159k| const int16_t b = (int16_t)((d >> (4 * j + 2)) & 0x3); 299| 159k| r->coeffs[8 * i + j] = (int16_t)(a - b); 300| 159k| } 301| 19.9k| } 302| 624|} kem.c:mlk_randombytes: 178| 176|{ 179| 176| OQS_randombytes(ptr, len); 180| 176| return 0; 181| 176|} compress.c:mlk_scalar_compress_d1: 55| 22.5k|{ 56| | /* Compute as follows: 57| | * ``` 58| | * round(u * 2 / MLKEM_Q) 59| | * = round(u * 2 * (2^31 / MLKEM_Q) / 2^31) 60| | * ~= round(u * 2 * round(2^31 / MLKEM_Q) / 2^31) 61| | * ``` 62| | */ 63| | /* check-magic: 1290168 == 2*round(2^31 / MLKEM_Q) */ 64| 22.5k| uint32_t d0 = (uint32_t)u * 1290168; 65| | /* Unsigned shifting by 31 positions leaves only the top bit. */ 66| 22.5k| return (uint8_t)((d0 + ((uint32_t)1u << 30)) >> 31); 67| 22.5k|} indcpa.c:mlk_polymat_permute_bitrev_to_custom: 199| 264|{ 200| 264| unsigned i; 201| 1.03k| for (i = 0; i < MLKEM_K; i++) ------------------ | | 13| 1.03k|#define MLKEM_K 2 ------------------ | Branch (201:15): [True: 774, False: 264] ------------------ 202| 774| __loop__( 203| 774| assigns(i, memory_slice(a, sizeof(mlk_polymat))) 204| 774| invariant(i <= MLKEM_K) 205| 774| invariant(forall(x, 0, MLKEM_K, forall(y, 0, MLKEM_K, 206| 774| array_bound(a->vec[x].vec[y].coeffs, 0, MLKEM_N, 0, MLKEM_Q)))) 207| 774| decreases(MLKEM_K - i)) 208| 774| { 209| 774| mlk_polyvec_permute_bitrev_to_custom(&a->vec[i]); ------------------ | | 40| 774| MLK_ADD_PARAM_SET(mlk_polyvec_permute_bitrev_to_custom) | | ------------------ | | | | 48| 774|#define MLK_ADD_PARAM_SET(s) s | | ------------------ ------------------ 210| 774| } 211| 264|} indcpa.c:mlk_keypair_getnoise_eta1: 359| 88|{ 360| 88|#if MLKEM_K == 2 361| 88| mlk_poly_getnoise_eta1_4x(&pv->vec[0], &pv->vec[1], /* Fill elements of pv */ ------------------ | | 467| 88|#define mlk_poly_getnoise_eta1_4x MLK_NAMESPACE_K(poly_getnoise_eta1_4x) | | ------------------ | | | | 64| 88|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 88|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 88|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 362| 88| &e->vec[0], &e->vec[1], /* and two elements of e */ 363| 88| seed, 0, 1, 2, 3); 364| |#elif MLKEM_K == 3 365| | /* 366| | * Only the first three output buffers are needed, so we pass NULL as 367| | * the fourth parameter, and 0xFF as its dummy nonce. 368| | */ 369| | mlk_poly_getnoise_eta1_4x(&pv->vec[0], &pv->vec[1], &pv->vec[2], NULL, seed, 370| | 0, 1, 2, 0xFF); 371| | /* Same here */ 372| | mlk_poly_getnoise_eta1_4x(&e->vec[0], &e->vec[1], &e->vec[2], NULL, seed, 3, 373| | 4, 5, 0xFF); 374| |#elif MLKEM_K == 4 375| | mlk_poly_getnoise_eta1_4x(&pv->vec[0], &pv->vec[1], &pv->vec[2], &pv->vec[3], 376| | seed, 0, 1, 2, 3); 377| | mlk_poly_getnoise_eta1_4x(&e->vec[0], &e->vec[1], &e->vec[2], &e->vec[3], 378| | seed, 4, 5, 6, 7); 379| |#endif /* MLKEM_K == 4 */ 380| 88|} indcpa.c:mlk_matvec_mul: 325| 264|{ 326| 264| unsigned i; 327| 1.03k| for (i = 0; i < MLKEM_K; i++) ------------------ | | 13| 1.03k|#define MLKEM_K 2 ------------------ | Branch (327:15): [True: 774, False: 264] ------------------ 328| 774| __loop__( 329| 774| assigns(i, memory_slice(out, sizeof(mlk_polyvec))) 330| 774| invariant(i <= MLKEM_K) 331| 774| decreases(MLKEM_K - i)) 332| 774| { 333| 774| mlk_polyvec_basemul_acc_montgomery_cached(&out->vec[i], &a->vec[i], v, vc); ------------------ | | 321| 774| MLK_NAMESPACE_K(polyvec_basemul_acc_montgomery_cached) | | ------------------ | | | | 64| 774|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 774|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 774|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 334| 774| } 335| 264|} indcpa.c:mlk_pack_sk: 100| 88|{ 101| 88| mlk_assert_bound_2d(sk->vec, MLKEM_K, MLKEM_N, 0, MLKEM_Q); ------------------ | | 110| 88| do \ | | 111| 88| { \ | | 112| 88| } while (0) | | ------------------ | | | Branch (112:12): [Folded, False: 88] | | ------------------ ------------------ 102| 88| mlk_polyvec_tobytes(r, sk); ------------------ | | 225| 88|#define mlk_polyvec_tobytes MLK_NAMESPACE_K(polyvec_tobytes) | | ------------------ | | | | 64| 88|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 88|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 88|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 103| 88|} indcpa.c:mlk_pack_pk: 61| 88|{ 62| 88| mlk_assert_bound_2d(pk->vec, MLKEM_K, MLKEM_N, 0, MLKEM_Q); ------------------ | | 110| 88| do \ | | 111| 88| { \ | | 112| 88| } while (0) | | ------------------ | | | Branch (112:12): [Folded, False: 88] | | ------------------ ------------------ 63| 88| mlk_polyvec_tobytes(r, pk); ------------------ | | 225| 88|#define mlk_polyvec_tobytes MLK_NAMESPACE_K(polyvec_tobytes) | | ------------------ | | | | 64| 88|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 88|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 88|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 64| 88| mlk_memcpy(r + MLKEM_POLYVECBYTES, seed, MLKEM_SYMBYTES); ------------------ | | 168| 88|#define mlk_memcpy memcpy ------------------ mlk_memcpy(r + MLKEM_POLYVECBYTES, seed, MLKEM_SYMBYTES); ------------------ | | 31| 88|#define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | ------------------ | | | | 13| 88|#define MLKEM_K 2 | | ------------------ | | #define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | ------------------ | | | | 30| 88|#define MLKEM_POLYBYTES 384 | | ------------------ ------------------ mlk_memcpy(r + MLKEM_POLYVECBYTES, seed, MLKEM_SYMBYTES); ------------------ | | 27| 88|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 65| 88|} indcpa.c:mlk_unpack_pk: 80| 176|{ 81| 176| mlk_polyvec_frombytes(pk, packedpk); ------------------ | | 247| 176|#define mlk_polyvec_frombytes MLK_NAMESPACE_K(polyvec_frombytes) | | ------------------ | | | | 64| 176|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 176|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 176|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 82| 176| mlk_memcpy(seed, packedpk + MLKEM_POLYVECBYTES, MLKEM_SYMBYTES); ------------------ | | 168| 176|#define mlk_memcpy memcpy ------------------ mlk_memcpy(seed, packedpk + MLKEM_POLYVECBYTES, MLKEM_SYMBYTES); ------------------ | | 31| 176|#define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | ------------------ | | | | 13| 176|#define MLKEM_K 2 | | ------------------ | | #define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | ------------------ | | | | 30| 176|#define MLKEM_POLYBYTES 384 | | ------------------ ------------------ mlk_memcpy(seed, packedpk + MLKEM_POLYVECBYTES, MLKEM_SYMBYTES); ------------------ | | 27| 176|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 83| | 84| | /* NOTE: If a modulus check was conducted on the PK, we know at this 85| | * point that the coefficients of `pk` are unsigned canonical. The 86| | * specifications and proofs, however, do _not_ assume this, and instead 87| | * work with the easily provable bound by MLKEM_UINT12_LIMIT. */ 88| 176|} indcpa.c:mlk_enc_getnoise_eta1_eta2: 409| 176|{ 410| 176|#if MLKEM_K == 2 411| 176| mlk_poly_getnoise_eta1122_4x(&sp->vec[0], &sp->vec[1], &ep->vec[0], ------------------ | | 547| 176|#define mlk_poly_getnoise_eta1122_4x MLK_NAMESPACE_K(poly_getnoise_eta1122_4x) | | ------------------ | | | | 64| 176|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 176|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 176|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 412| 176| &ep->vec[1], coins, 0, 1, 2, 3); 413| 176| mlk_poly_getnoise_eta2(epp, coins, 4); ------------------ | | 520| 176|#define mlk_poly_getnoise_eta2 MLK_NAMESPACE_K(poly_getnoise_eta2) | | ------------------ | | | | 64| 176|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 176|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 176|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 414| |#elif MLKEM_K == 3 415| | /* 416| | * In this call, only the first three output buffers are needed, 417| | * so we pass NULL as the fourth parameter, and 0xFF as its dummy nonce. 418| | */ 419| | mlk_poly_getnoise_eta1_4x(&sp->vec[0], &sp->vec[1], &sp->vec[2], NULL, coins, 420| | 0, 1, 2, 0xFF /* irrelevant */); 421| | /* The fourth output buffer in this call _is_ used. */ 422| | mlk_poly_getnoise_eta2_4x(&ep->vec[0], &ep->vec[1], &ep->vec[2], epp, coins, 423| | 3, 4, 5, 6); 424| |#elif MLKEM_K == 4 425| | mlk_poly_getnoise_eta1_4x(&sp->vec[0], &sp->vec[1], &sp->vec[2], &sp->vec[3], 426| | coins, 0, 1, 2, 3); 427| | mlk_poly_getnoise_eta2_4x(&ep->vec[0], &ep->vec[1], &ep->vec[2], &ep->vec[3], 428| | coins, 4, 5, 6, 7); 429| | mlk_poly_getnoise_eta2(epp, coins, 8); 430| |#endif /* MLKEM_K == 4 */ 431| 176|} indcpa.c:mlk_pack_ciphertext: 132| 176|{ 133| 176| mlk_polyvec_compress_du(r, b); ------------------ | | 176| 176|#define mlk_polyvec_compress_du MLK_NAMESPACE_K(polyvec_compress_du) | | ------------------ | | | | 64| 176|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 176|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 176|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 134| 176| mlk_poly_compress_dv(r + MLKEM_POLYVECCOMPRESSEDBYTES_DU, v); ------------------ | | 112| 176|#define mlk_poly_compress_dv MLK_NAMESPACE_K(poly_compress_dv) | | ------------------ | | | | 64| 176|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 176|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 176|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ mlk_poly_compress_dv(r + MLKEM_POLYVECCOMPRESSEDBYTES_DU, v); ------------------ | | 44| 176|#define MLKEM_POLYVECCOMPRESSEDBYTES_DU (MLKEM_K * MLKEM_POLYCOMPRESSEDBYTES_DU) | | ------------------ | | | | 13| 176|#define MLKEM_K 2 | | ------------------ | | #define MLKEM_POLYVECCOMPRESSEDBYTES_DU (MLKEM_K * MLKEM_POLYCOMPRESSEDBYTES_DU) | | ------------------ | | | | 43| 176|#define MLKEM_POLYCOMPRESSEDBYTES_DU MLKEM_POLYCOMPRESSEDBYTES_D10 | | | | ------------------ | | | | | | 35| 176|#define MLKEM_POLYCOMPRESSEDBYTES_D10 320 | | | | ------------------ | | ------------------ ------------------ 135| 176|} indcpa.c:mlk_unpack_ciphertext: 149| 88|{ 150| 88| mlk_polyvec_decompress_du(b, c); ------------------ | | 200| 88|#define mlk_polyvec_decompress_du MLK_NAMESPACE_K(polyvec_decompress_du) | | ------------------ | | | | 64| 88|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 88|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 88|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 151| 88| mlk_poly_decompress_dv(v, c + MLKEM_POLYVECCOMPRESSEDBYTES_DU); ------------------ | | 143| 88|#define mlk_poly_decompress_dv MLK_NAMESPACE_K(poly_decompress_dv) | | ------------------ | | | | 64| 88|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 88|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 88|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ mlk_poly_decompress_dv(v, c + MLKEM_POLYVECCOMPRESSEDBYTES_DU); ------------------ | | 44| 88|#define MLKEM_POLYVECCOMPRESSEDBYTES_DU (MLKEM_K * MLKEM_POLYCOMPRESSEDBYTES_DU) | | ------------------ | | | | 13| 88|#define MLKEM_K 2 | | ------------------ | | #define MLKEM_POLYVECCOMPRESSEDBYTES_DU (MLKEM_K * MLKEM_POLYCOMPRESSEDBYTES_DU) | | ------------------ | | | | 43| 88|#define MLKEM_POLYCOMPRESSEDBYTES_DU MLKEM_POLYCOMPRESSEDBYTES_D10 | | | | ------------------ | | | | | | 35| 88|#define MLKEM_POLYCOMPRESSEDBYTES_D10 320 | | | | ------------------ | | ------------------ ------------------ 152| 88|} indcpa.c:mlk_unpack_sk: 115| 88|{ 116| 88| mlk_polyvec_frombytes(sk, packedsk); ------------------ | | 247| 88|#define mlk_polyvec_frombytes MLK_NAMESPACE_K(polyvec_frombytes) | | ------------------ | | | | 64| 88|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 88|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 88|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 117| 88|} kem.c:mlk_check_pct: 194| 88|{ 195| | /* Skip PCT */ 196| 88| ((void)pk); 197| 88| ((void)sk); 198| |#if defined(MLK_CONFIG_CONTEXT_PARAMETER) 199| | ((void)context); 200| |#endif 201| 88| return 0; 202| 88|} poly_k.c:mlk_poly_cbd_eta1: 318| 1.49k|{ 319| |#if MLKEM_ETA1 == 2 320| | mlk_poly_cbd2(r, buf); 321| |#elif MLKEM_ETA1 == 3 322| 1.49k| mlk_poly_cbd3(r, buf); ------------------ | | 37| 1.49k|#define mlk_poly_cbd3 MLK_NAMESPACE(poly_cbd3) | | ------------------ | | | | 63| 1.49k|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 1.49k|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 1.49k|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 323| |#else 324| |#error "Invalid value of MLKEM_ETA1" 325| |#endif 326| 1.49k|} poly_k.c:mlk_poly_cbd_eta2: 404| 228|{ 405| 228|#if MLKEM_ETA2 == 2 406| 228| mlk_poly_cbd2(r, buf); ------------------ | | 22| 228|#define mlk_poly_cbd2 MLK_NAMESPACE(poly_cbd2) | | ------------------ | | | | 63| 228|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 228|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 228|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 407| |#else 408| |#error "Invalid value of MLKEM_ETA2" 409| |#endif 410| 228|} sampling.c:mlk_rej_uniform_c: 45| 1.27k|{ 46| 1.27k| unsigned ctr, pos; 47| 1.27k| int16_t val0, val1; 48| | 49| 1.27k| mlk_assert_bound(r, offset, 0, MLKEM_Q); ------------------ | | 101| 1.27k| do \ | | 102| 1.27k| { \ | | 103| 1.27k| } while (0) | | ------------------ | | | Branch (103:12): [Folded, False: 1.27k] | | ------------------ ------------------ 50| | 51| 1.27k| ctr = offset; 52| 1.27k| pos = 0; 53| | /* pos + 3 cannot overflow due to the assumption buflen <= 4096 */ 54| 2.79k| while (ctr < target && pos + 3 <= buflen) ------------------ | Branch (54:10): [True: 1.52k, False: 1.27k] | Branch (54:26): [True: 1.52k, False: 0] ------------------ 55| 1.52k| __loop__( 56| 1.52k| invariant(offset <= ctr && ctr <= target && pos <= buflen) 57| 1.52k| invariant(array_bound(r, 0, ctr, 0, MLKEM_Q)) 58| 1.52k| decreases(buflen - pos)) 59| 1.52k| { 60| | /* Safety: 61| | * - The explicit cast to uint16_t ensures that << 8 does 62| | * not signed-overflow even on a 16-bit system. 63| | * - The conversion to int16_t is safe due to the explicit 0xFFF 64| | * truncation. 65| | */ 66| 1.52k| val0 = (int16_t)(((buf[pos + 0] >> 0) | ((uint16_t)buf[pos + 1] << 8)) & 67| 1.52k| 0xFFF); 68| 1.52k| val1 = (int16_t)(((buf[pos + 1] >> 4) | (buf[pos + 2] << 4)) & 0xFFF); 69| 1.52k| pos += 3; 70| | 71| 1.52k| if (val0 < MLKEM_Q) ------------------ | | 23| 1.52k|#define MLKEM_Q 3329 ------------------ | Branch (71:9): [True: 1.19k, False: 327] ------------------ 72| 1.19k| { 73| 1.19k| r[ctr++] = val0; 74| 1.19k| } 75| 1.52k| if (ctr < target && val1 < MLKEM_Q) ------------------ | | 23| 1.35k|#define MLKEM_Q 3329 ------------------ | Branch (75:9): [True: 1.35k, False: 171] | Branch (75:25): [True: 1.05k, False: 300] ------------------ 76| 1.05k| { 77| 1.05k| r[ctr++] = val1; 78| 1.05k| } 79| 1.52k| } 80| | 81| 1.27k| mlk_assert_bound(r, ctr, 0, MLKEM_Q); ------------------ | | 101| 1.27k| do \ | | 102| 1.27k| { \ | | 103| 1.27k| } while (0) | | ------------------ | | | Branch (103:12): [Folded, False: 1.27k] | | ------------------ ------------------ 82| 1.27k| return ctr; 83| 1.27k|} sampling.c:mlk_load32_littleendian: 264| 47.4k|{ 265| 47.4k| uint32_t r; 266| 47.4k| r = (uint32_t)x[0]; 267| 47.4k| r |= (uint32_t)x[1] << 8; 268| 47.4k| r |= (uint32_t)x[2] << 16; 269| 47.4k| r |= (uint32_t)x[3] << 24; 270| 47.4k| return r; 271| 47.4k|} sampling.c:mlk_load24_littleendian: 318| 15.3k|{ 319| 15.3k| uint32_t r; 320| 15.3k| r = (uint32_t)x[0]; 321| 15.3k| r |= (uint32_t)x[1] << 8; 322| 15.3k| r |= (uint32_t)x[2] << 16; 323| 15.3k| return r; 324| 15.3k|} kem.c:mlk_ct_memcmp: 346| 264|{ 347| 264| uint8_t r = 0, s = 0; 348| 264| unsigned i; 349| | 350| 199k| for (i = 0; i < len; i++) ------------------ | Branch (350:15): [True: 199k, False: 264] ------------------ 351| 199k| __loop__( 352| 199k| invariant(i <= len) 353| 199k| invariant((r == 0) == (forall(k, 0, i, (a[k] == b[k])))) 354| 199k| decreases(len - i)) 355| 199k| { 356| 199k| r |= a[i] ^ b[i]; 357| | /* s is useless, but prevents the loop from being aborted once r=0xff. */ 358| 199k| s ^= a[i] ^ b[i]; 359| 199k| } 360| | 361| | /* 362| | * - Convert r into a mask; this may not be necessary, but is an additional 363| | * safeguard 364| | * towards leaking information about a and b. 365| | * - XOR twice with s, separated by a value barrier, to prevent the compile 366| | * from dropping the s computation in the loop. 367| | */ 368| 264| return (mlk_value_barrier_u8(mlk_ct_cmask_nonzero_u8(r) ^ s) ^ s); 369| 264|} kem.c:mlk_value_barrier_u8: 129| 264|{ 130| 264| __asm__ volatile("" : "+r"(b)); 131| 264| return b; 132| 264|} kem.c:mlk_ct_cmask_nonzero_u8: 257| 3.08k|{ 258| 3.08k| uint16_t mask = mlk_ct_cmask_nonzero_u16((uint16_t)x); 259| 3.08k| return (uint8_t)(mask & 0xFF); 260| 3.08k|} kem.c:mlk_ct_cmask_nonzero_u16: 231| 3.08k|{ 232| 3.08k| int32_t tmp = mlk_value_barrier_i32(-((int32_t)x)); 233| | /* 234| | * PORTABILITY: Right-shift on a signed integer is 235| | * implementation-defined for negative left argument. 236| | * Here, we assume it's sign-preserving "arithmetic" shift right. 237| | * See (C99 6.5.7 (5)) 238| | */ 239| 3.08k| tmp >>= 16; 240| 3.08k| return mlk_cast_int32_to_uint16(tmp); 241| 3.08k|} kem.c:mlk_value_barrier_i32: 122| 3.08k|{ 123| 3.08k| __asm__ volatile("" : "+r"(b)); 124| 3.08k| return b; 125| 3.08k|} kem.c:mlk_cast_int32_to_uint16: 173| 3.08k|{ 174| | return (uint16_t)(x & (int32_t)UINT16_MAX); 175| 3.08k|} kem.c:mlk_zeroize: 432| 880|{ 433| 880| mlk_memset(ptr, 0, len); ------------------ | | 173| 880|#define mlk_memset memset ------------------ 434| | /* This follows OpenSSL and seems sufficient to prevent the compiler 435| | * from optimizing away the memset. 436| | * 437| | * If there was a reliable way to detect availability of memset_s(), 438| | * that would be preferred. */ 439| 880| __asm__ volatile("" : : "r"(ptr) : "memory"); 440| 880|} kem.c:mlk_ct_cmov_zero: 396| 88|{ 397| 88| size_t i; 398| 2.90k| for (i = 0; i < len; i++) ------------------ | Branch (398:15): [True: 2.81k, False: 88] ------------------ 399| 2.81k| __loop__( 400| 2.81k| invariant(i <= len) 401| 2.81k| invariant(forall(k, 0, i, r[k] == (b == 0 ? x[k] : loop_entry(r)[k]))) 402| 2.81k| decreases(len - i)) 403| 2.81k| { 404| 2.81k| r[i] = mlk_ct_sel_uint8(r[i], x[i], b); 405| 2.81k| } 406| 88|} kem.c:mlk_ct_sel_uint8: 313| 2.81k|{ 314| 2.81k| return b ^ (mlk_ct_cmask_nonzero_u8(cond) & (a ^ b)); 315| 2.81k|} poly_k.c:mlk_zeroize: 432| 1.09k|{ 433| 1.09k| mlk_memset(ptr, 0, len); ------------------ | | 173| 1.09k|#define mlk_memset memset ------------------ 434| | /* This follows OpenSSL and seems sufficient to prevent the compiler 435| | * from optimizing away the memset. 436| | * 437| | * If there was a reliable way to detect availability of memset_s(), 438| | * that would be preferred. */ 439| 1.09k| __asm__ volatile("" : : "r"(ptr) : "memory"); 440| 1.09k|} sampling.c:mlk_zeroize: 432| 684|{ 433| 684| mlk_memset(ptr, 0, len); ------------------ | | 173| 684|#define mlk_memset memset ------------------ 434| | /* This follows OpenSSL and seems sufficient to prevent the compiler 435| | * from optimizing away the memset. 436| | * 437| | * If there was a reliable way to detect availability of memset_s(), 438| | * that would be preferred. */ 439| 684| __asm__ volatile("" : : "r"(ptr) : "memory"); 440| 684|} compress.c:mlk_value_barrier_u8: 129| 45.0k|{ 130| 45.0k| __asm__ volatile("" : "+r"(b)); 131| 45.0k| return b; 132| 45.0k|} compress.c:mlk_ct_sel_int16: 291| 45.0k|{ 292| 45.0k| uint16_t au = mlk_cast_int16_to_uint16(a); 293| 45.0k| uint16_t bu = mlk_cast_int16_to_uint16(b); 294| 45.0k| uint16_t res = bu ^ (mlk_ct_cmask_nonzero_u16(cond) & (au ^ bu)); 295| 45.0k| return mlk_cast_uint16_to_int16(res); 296| 45.0k|} compress.c:mlk_cast_int16_to_uint16: 185| 90.1k|{ 186| 90.1k| return mlk_cast_int32_to_uint16(x); 187| 90.1k|} compress.c:mlk_cast_int32_to_uint16: 173| 135k|{ 174| | return (uint16_t)(x & (int32_t)UINT16_MAX); 175| 135k|} compress.c:mlk_ct_cmask_nonzero_u16: 231| 45.0k|{ 232| 45.0k| int32_t tmp = mlk_value_barrier_i32(-((int32_t)x)); 233| | /* 234| | * PORTABILITY: Right-shift on a signed integer is 235| | * implementation-defined for negative left argument. 236| | * Here, we assume it's sign-preserving "arithmetic" shift right. 237| | * See (C99 6.5.7 (5)) 238| | */ 239| 45.0k| tmp >>= 16; 240| 45.0k| return mlk_cast_int32_to_uint16(tmp); 241| 45.0k|} compress.c:mlk_value_barrier_i32: 122| 45.0k|{ 123| 45.0k| __asm__ volatile("" : "+r"(b)); 124| 45.0k| return b; 125| 45.0k|} compress.c:mlk_cast_uint16_to_int16: 151| 45.0k|{ 152| | /* 153| | * PORTABILITY: This relies on uint16_t -> int16_t 154| | * being implemented as the inverse of int16_t -> uint16_t, 155| | * which is implementation-defined (C99 6.3.1.3 (3)) 156| | * CBMC (correctly) fails to prove this conversion is OK, 157| | * so we have to suppress that check here 158| | */ 159| 45.0k| return (int16_t)x; 160| 45.0k|} indcpa.c:mlk_zeroize: 432| 3.08k|{ 433| 3.08k| mlk_memset(ptr, 0, len); ------------------ | | 173| 3.08k|#define mlk_memset memset ------------------ 434| | /* This follows OpenSSL and seems sufficient to prevent the compiler 435| | * from optimizing away the memset. 436| | * 437| | * If there was a reliable way to detect availability of memset_s(), 438| | * that would be preferred. */ 439| 3.08k| __asm__ volatile("" : : "r"(ptr) : "memory"); 440| 3.08k|} PQCP_MLKEM_NATIVE_MLKEM512_X86_64_poly_compress_d4: 80| 60|{ 81| 60|#if defined(MLK_USE_NATIVE_POLY_COMPRESS_D4) 82| 60| int ret; 83| 60| mlk_assert_bound(a, MLKEM_N, 0, MLKEM_Q); ------------------ | | 101| 60| do \ | | 102| 60| { \ | | 103| 60| } while (0) | | ------------------ | | | Branch (103:12): [Folded, False: 60] | | ------------------ ------------------ 84| 60| ret = mlk_poly_compress_d4_native(r, a->coeffs); 85| 60| if (ret == MLK_NATIVE_FUNC_SUCCESS) ------------------ | | 33| 60|#define MLK_NATIVE_FUNC_SUCCESS (0) ------------------ | Branch (85:7): [True: 60, False: 0] ------------------ 86| 60| { 87| 60| return; 88| 60| } 89| 0|#endif /* MLK_USE_NATIVE_POLY_COMPRESS_D4 */ 90| | 91| 0| mlk_poly_compress_d4_c(r, a); 92| 0|} PQCP_MLKEM_NATIVE_MLKEM512_X86_64_poly_compress_d10: 147| 120|{ 148| 120|#if defined(MLK_USE_NATIVE_POLY_COMPRESS_D10) 149| 120| int ret; 150| 120| mlk_assert_bound(a, MLKEM_N, 0, MLKEM_Q); ------------------ | | 101| 120| do \ | | 102| 120| { \ | | 103| 120| } while (0) | | ------------------ | | | Branch (103:12): [Folded, False: 120] | | ------------------ ------------------ 151| 120| ret = mlk_poly_compress_d10_native(r, a->coeffs); 152| 120| if (ret == MLK_NATIVE_FUNC_SUCCESS) ------------------ | | 33| 120|#define MLK_NATIVE_FUNC_SUCCESS (0) ------------------ | Branch (152:7): [True: 120, False: 0] ------------------ 153| 120| { 154| 120| return; 155| 120| } 156| 0|#endif /* MLK_USE_NATIVE_POLY_COMPRESS_D10 */ 157| | 158| 0| mlk_poly_compress_d10_c(r, a); 159| 0|} PQCP_MLKEM_NATIVE_MLKEM512_X86_64_poly_decompress_d4: 195| 30|{ 196| 30|#if defined(MLK_USE_NATIVE_POLY_DECOMPRESS_D4) 197| 30| int ret; 198| 30| ret = mlk_poly_decompress_d4_native(r->coeffs, a); 199| 30| if (ret == MLK_NATIVE_FUNC_SUCCESS) ------------------ | | 33| 30|#define MLK_NATIVE_FUNC_SUCCESS (0) ------------------ | Branch (199:7): [True: 30, False: 0] ------------------ 200| 30| { 201| 30| mlk_assert_bound(r, MLKEM_N, 0, MLKEM_Q); ------------------ | | 101| 30| do \ | | 102| 30| { \ | | 103| 30| } while (0) | | ------------------ | | | Branch (103:12): [Folded, False: 30] | | ------------------ ------------------ 202| 30| return; 203| 30| } 204| 0|#endif /* MLK_USE_NATIVE_POLY_DECOMPRESS_D4 */ 205| | 206| 0| mlk_poly_decompress_d4_c(r, a); 207| 0|} PQCP_MLKEM_NATIVE_MLKEM512_X86_64_poly_decompress_d10: 258| 60|{ 259| 60|#if defined(MLK_USE_NATIVE_POLY_DECOMPRESS_D10) 260| 60| int ret; 261| 60| ret = mlk_poly_decompress_d10_native(r->coeffs, a); 262| 60| if (ret == MLK_NATIVE_FUNC_SUCCESS) ------------------ | | 33| 60|#define MLK_NATIVE_FUNC_SUCCESS (0) ------------------ | Branch (262:7): [True: 60, False: 0] ------------------ 263| 60| { 264| 60| mlk_assert_bound(r, MLKEM_N, 0, MLKEM_Q); ------------------ | | 101| 60| do \ | | 102| 60| { \ | | 103| 60| } while (0) | | ------------------ | | | Branch (103:12): [Folded, False: 60] | | ------------------ ------------------ 265| 60| return; 266| 60| } 267| 0|#endif /* MLK_USE_NATIVE_POLY_DECOMPRESS_D10 */ 268| | 269| 0| mlk_poly_decompress_d10_c(r, a); 270| 0|} PQCP_MLKEM_NATIVE_MLKEM512_X86_64_poly_tobytes: 610| 180|{ 611| 180|#if defined(MLK_USE_NATIVE_POLY_TOBYTES) 612| 180| int ret; 613| 180| mlk_assert_bound(a, MLKEM_N, 0, MLKEM_Q); ------------------ | | 101| 180| do \ | | 102| 180| { \ | | 103| 180| } while (0) | | ------------------ | | | Branch (103:12): [Folded, False: 180] | | ------------------ ------------------ 614| 180| ret = mlk_poly_tobytes_native(r, a->coeffs); 615| 180| if (ret == MLK_NATIVE_FUNC_SUCCESS) ------------------ | | 33| 180|#define MLK_NATIVE_FUNC_SUCCESS (0) ------------------ | Branch (615:7): [True: 180, False: 0] ------------------ 616| 180| { 617| 180| return; 618| 180| } 619| 0|#endif /* MLK_USE_NATIVE_POLY_TOBYTES */ 620| | 621| 0| mlk_poly_tobytes_c(r, a); 622| 0|} PQCP_MLKEM_NATIVE_MLKEM512_X86_64_poly_frombytes: 659| 240|{ 660| 240|#if defined(MLK_USE_NATIVE_POLY_FROMBYTES) 661| 240| int ret; 662| 240| ret = mlk_poly_frombytes_native(r->coeffs, a); 663| 240| if (ret == MLK_NATIVE_FUNC_SUCCESS) ------------------ | | 33| 240|#define MLK_NATIVE_FUNC_SUCCESS (0) ------------------ | Branch (663:7): [True: 240, False: 0] ------------------ 664| 240| { 665| 240| return; 666| 240| } 667| 0|#endif /* MLK_USE_NATIVE_POLY_FROMBYTES */ 668| | 669| 0| mlk_poly_frombytes_c(r, a); 670| 0|} PQCP_MLKEM_NATIVE_MLKEM512_X86_64_poly_frommsg: 680| 60|{ 681| 60| unsigned i; 682| |#if (MLKEM_INDCPA_MSGBYTES != MLKEM_N / 8) 683| |#error "MLKEM_INDCPA_MSGBYTES must be equal to MLKEM_N/8 bytes!" 684| |#endif 685| | 686| 1.98k| for (i = 0; i < MLKEM_N / 8; i++) ------------------ | | 22| 1.98k|#define MLKEM_N 256 ------------------ | Branch (686:15): [True: 1.92k, False: 60] ------------------ 687| 1.92k| __loop__( 688| 1.92k| invariant(i <= MLKEM_N / 8) 689| 1.92k| invariant(array_bound(r->coeffs, 0, 8 * i, 0, MLKEM_Q)) 690| 1.92k| decreases(MLKEM_N / 8 - i)) 691| 1.92k| { 692| 1.92k| unsigned j; 693| 17.2k| for (j = 0; j < 8; j++) ------------------ | Branch (693:17): [True: 15.3k, False: 1.92k] ------------------ 694| 15.3k| __loop__( 695| 15.3k| invariant(i < MLKEM_N / 8 && j <= 8) 696| 15.3k| invariant(array_bound(r->coeffs, 0, 8 * i + j, 0, MLKEM_Q)) 697| 15.3k| decreases(8 - j)) 698| 15.3k| { 699| | /* mlk_ct_sel_int16(MLKEM_Q_HALF, 0, b) is `Decompress_1(b != 0)` 700| | * as per @[FIPS203, Eq (4.8)]. */ 701| | 702| | /* Prevent the compiler from recognizing this as a bit selection */ 703| 15.3k| uint8_t mask = mlk_value_barrier_u8((uint8_t)(1u << j)); 704| 15.3k| r->coeffs[8 * i + j] = mlk_ct_sel_int16(MLKEM_Q_HALF, 0, msg[i] & mask); ------------------ | | 24| 15.3k|#define MLKEM_Q_HALF ((MLKEM_Q + 1) / 2) /* 1665 */ | | ------------------ | | | | 23| 15.3k|#define MLKEM_Q 3329 | | ------------------ ------------------ 705| 15.3k| } 706| 1.92k| } 707| 60| mlk_assert_abs_bound(r, MLKEM_N, MLKEM_Q); ------------------ | | 105| 60| do \ | | 106| 60| { \ | | 107| 60| } while (0) | | ------------------ | | | Branch (107:12): [Folded, False: 60] | | ------------------ ------------------ 708| 60|} PQCP_MLKEM_NATIVE_MLKEM512_X86_64_poly_tomsg: 718| 30|{ 719| 30| unsigned i; 720| 30| mlk_assert_bound(r, MLKEM_N, 0, MLKEM_Q); ------------------ | | 101| 30| do \ | | 102| 30| { \ | | 103| 30| } while (0) | | ------------------ | | | Branch (103:12): [Folded, False: 30] | | ------------------ ------------------ 721| | 722| 990| for (i = 0; i < MLKEM_N / 8; i++) ------------------ | | 22| 990|#define MLKEM_N 256 ------------------ | Branch (722:15): [True: 960, False: 30] ------------------ 723| 960| __loop__(invariant(i <= MLKEM_N / 8) 724| 960| decreases(MLKEM_N / 8 - i)) 725| 960| { 726| 960| unsigned j; 727| 960| msg[i] = 0; 728| 8.64k| for (j = 0; j < 8; j++) ------------------ | Branch (728:17): [True: 7.68k, False: 960] ------------------ 729| 7.68k| __loop__( 730| 7.68k| invariant(i <= MLKEM_N / 8 && j <= 8) 731| 7.68k| decreases(8 - j)) 732| 7.68k| { 733| 7.68k| uint32_t t = mlk_scalar_compress_d1(r->coeffs[8 * i + j]); 734| 7.68k| msg[i] |= (uint8_t)(t << j); 735| 7.68k| } 736| 960| } 737| 30|} PQCP_MLKEM_NATIVE_MLKEM512_X86_64_gen_matrix: 223| 90|{ 224| 90| unsigned i, j; 225| 90| MLK_ALIGN uint8_t seed_ext[4][MLK_ALIGN_UP(MLKEM_SYMBYTES + 2)]; ------------------ | | 190| 90|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) ------------------ 226| | 227| 450| for (j = 0; j < 4; j++) ------------------ | Branch (227:15): [True: 360, False: 90] ------------------ 228| 360| { 229| 360| mlk_memcpy(seed_ext[j], seed, MLKEM_SYMBYTES); ------------------ | | 168| 360|#define mlk_memcpy memcpy ------------------ mlk_memcpy(seed_ext[j], seed, MLKEM_SYMBYTES); ------------------ | | 27| 360|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 230| 360| } 231| | 232| 90|#if !defined(MLK_CONFIG_SERIAL_FIPS202_ONLY) 233| | /* Sample 4 matrix entries a time. */ 234| 180| for (i = 0; i < (MLKEM_K * MLKEM_K / 4) * 4; i += 4) ------------------ | | 13| 180|#define MLKEM_K 2 ------------------ for (i = 0; i < (MLKEM_K * MLKEM_K / 4) * 4; i += 4) ------------------ | | 13| 180|#define MLKEM_K 2 ------------------ | Branch (234:15): [True: 90, False: 90] ------------------ 235| 90| { 236| 450| for (j = 0; j < 4; j++) ------------------ | Branch (236:17): [True: 360, False: 90] ------------------ 237| 360| { 238| 360| uint8_t x, y; 239| | /* MLKEM_K <= 4, so the values fit in uint8_t. */ 240| 360| x = (uint8_t)((i + j) / MLKEM_K); ------------------ | | 13| 360|#define MLKEM_K 2 ------------------ 241| 360| y = (uint8_t)((i + j) % MLKEM_K); ------------------ | | 13| 360|#define MLKEM_K 2 ------------------ 242| 360| if (transposed) ------------------ | Branch (242:11): [True: 240, False: 120] ------------------ 243| 240| { 244| 240| seed_ext[j][MLKEM_SYMBYTES + 0] = x; ------------------ | | 27| 240|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 245| 240| seed_ext[j][MLKEM_SYMBYTES + 1] = y; ------------------ | | 27| 240|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 246| 240| } 247| 120| else 248| 120| { 249| 120| seed_ext[j][MLKEM_SYMBYTES + 0] = y; ------------------ | | 27| 120|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 250| 120| seed_ext[j][MLKEM_SYMBYTES + 1] = x; ------------------ | | 27| 120|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 251| 120| } 252| 360| } 253| | 254| 90| mlk_poly_rej_uniform_x4(&a->vec[i / MLKEM_K].vec[i % MLKEM_K], ------------------ | | 55| 90|#define mlk_poly_rej_uniform_x4 MLK_NAMESPACE(poly_rej_uniform_x4) | | ------------------ | | | | 63| 90|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 90|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 90|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ mlk_poly_rej_uniform_x4(&a->vec[i / MLKEM_K].vec[i % MLKEM_K], ------------------ | | 13| 90|#define MLKEM_K 2 ------------------ mlk_poly_rej_uniform_x4(&a->vec[i / MLKEM_K].vec[i % MLKEM_K], ------------------ | | 13| 90|#define MLKEM_K 2 ------------------ 255| 90| &a->vec[(i + 1) / MLKEM_K].vec[(i + 1) % MLKEM_K], ------------------ | | 13| 90|#define MLKEM_K 2 ------------------ &a->vec[(i + 1) / MLKEM_K].vec[(i + 1) % MLKEM_K], ------------------ | | 13| 90|#define MLKEM_K 2 ------------------ 256| 90| &a->vec[(i + 2) / MLKEM_K].vec[(i + 2) % MLKEM_K], ------------------ | | 13| 90|#define MLKEM_K 2 ------------------ &a->vec[(i + 2) / MLKEM_K].vec[(i + 2) % MLKEM_K], ------------------ | | 13| 90|#define MLKEM_K 2 ------------------ 257| 90| &a->vec[(i + 3) / MLKEM_K].vec[(i + 3) % MLKEM_K], ------------------ | | 13| 90|#define MLKEM_K 2 ------------------ &a->vec[(i + 3) / MLKEM_K].vec[(i + 3) % MLKEM_K], ------------------ | | 13| 90|#define MLKEM_K 2 ------------------ 258| 90| seed_ext); 259| 90| } 260| |#else /* !MLK_CONFIG_SERIAL_FIPS202_ONLY */ 261| | /* When using serial FIPS202, sample all entries individually. */ 262| | i = 0; 263| |#endif /* MLK_CONFIG_SERIAL_FIPS202_ONLY */ 264| | 265| | /* For MLKEM_K == 3, sample the last entry individually. 266| | * When MLK_CONFIG_SERIAL_FIPS202_ONLY is set, sample all entries 267| | * individually. */ 268| 90| for (; i < MLKEM_K * MLKEM_K; i++) ------------------ | | 13| 90|#define MLKEM_K 2 ------------------ for (; i < MLKEM_K * MLKEM_K; i++) ------------------ | | 13| 90|#define MLKEM_K 2 ------------------ | Branch (268:10): [True: 0, False: 90] ------------------ 269| 0| { 270| 0| uint8_t x, y; 271| | /* MLKEM_K <= 4, so the values fit in uint8_t. */ 272| 0| x = (uint8_t)(i / MLKEM_K); ------------------ | | 13| 0|#define MLKEM_K 2 ------------------ 273| 0| y = (uint8_t)(i % MLKEM_K); ------------------ | | 13| 0|#define MLKEM_K 2 ------------------ 274| | 275| 0| if (transposed) ------------------ | Branch (275:9): [True: 0, False: 0] ------------------ 276| 0| { 277| 0| seed_ext[0][MLKEM_SYMBYTES + 0] = x; ------------------ | | 27| 0|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 278| 0| seed_ext[0][MLKEM_SYMBYTES + 1] = y; ------------------ | | 27| 0|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 279| 0| } 280| 0| else 281| 0| { 282| 0| seed_ext[0][MLKEM_SYMBYTES + 0] = y; ------------------ | | 27| 0|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 283| 0| seed_ext[0][MLKEM_SYMBYTES + 1] = x; ------------------ | | 27| 0|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 284| 0| } 285| | 286| 0| mlk_poly_rej_uniform(&a->vec[i / MLKEM_K].vec[i % MLKEM_K], seed_ext[0]); ------------------ | | 89| 0|#define mlk_poly_rej_uniform MLK_NAMESPACE(poly_rej_uniform) | | ------------------ | | | | 63| 0|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 0|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 0|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ mlk_poly_rej_uniform(&a->vec[i / MLKEM_K].vec[i % MLKEM_K], seed_ext[0]); ------------------ | | 13| 0|#define MLKEM_K 2 ------------------ mlk_poly_rej_uniform(&a->vec[i / MLKEM_K].vec[i % MLKEM_K], seed_ext[0]); ------------------ | | 13| 0|#define MLKEM_K 2 ------------------ 287| 0| } 288| | 289| 90| mlk_assert(i == MLKEM_K * MLKEM_K); ------------------ | | 97| 90| do \ | | 98| 90| { \ | | 99| 90| } while (0) | | ------------------ | | | Branch (99:12): [Folded, False: 90] | | ------------------ ------------------ 290| | 291| | /* 292| | * The public matrix is generated in NTT domain. If the native backend 293| | * uses a custom order in NTT domain, permute A accordingly. 294| | */ 295| 90| mlk_polymat_permute_bitrev_to_custom(a); ------------------ | | 42| 90| MLK_ADD_PARAM_SET(mlk_polymat_permute_bitrev_to_custom) | | ------------------ | | | | 48| 90|#define MLK_ADD_PARAM_SET(s) s | | ------------------ ------------------ 296| | 297| | /* Specification: Partially implements 298| | * @[FIPS203, Section 3.3, Destruction of intermediate values] */ 299| 90| mlk_zeroize(seed_ext, sizeof(seed_ext)); 300| 90|} PQCP_MLKEM_NATIVE_MLKEM512_X86_64_indcpa_keypair_derand: 445| 30|{ 446| 30| int ret = 0; 447| 30| const uint8_t *publicseed; 448| 30| const uint8_t *noiseseed; 449| 30| MLK_ALLOC(buf, uint8_t, 2 * MLKEM_SYMBYTES, context); ------------------ | | 229| 30| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 30|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 30| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 450| 30| MLK_ALLOC(coins_with_domain_separator, uint8_t, MLKEM_SYMBYTES + 1, context); ------------------ | | 229| 30| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 30|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 30| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 451| 30| MLK_ALLOC(a, mlk_polymat, 1, context); ------------------ | | 229| 30| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 30|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 30| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 452| 30| MLK_ALLOC(e, mlk_polyvec, 1, context); ------------------ | | 229| 30| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 30|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 30| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 453| 30| MLK_ALLOC(pkpv, mlk_polyvec, 1, context); ------------------ | | 229| 30| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 30|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 30| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 454| 30| MLK_ALLOC(skpv, mlk_polyvec, 1, context); ------------------ | | 229| 30| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 30|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 30| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 455| 30| MLK_ALLOC(skpv_cache, mlk_polyvec_mulcache, 1, context); ------------------ | | 229| 30| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 30|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 30| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 456| | 457| 30| if (buf == NULL || coins_with_domain_separator == NULL || a == NULL || ------------------ | Branch (457:7): [True: 0, False: 30] | Branch (457:22): [True: 0, False: 30] | Branch (457:61): [True: 0, False: 30] ------------------ 458| 30| e == NULL || pkpv == NULL || skpv == NULL || skpv_cache == NULL) ------------------ | Branch (458:7): [True: 0, False: 30] | Branch (458:20): [True: 0, False: 30] | Branch (458:36): [True: 0, False: 30] | Branch (458:52): [True: 0, False: 30] ------------------ 459| 0| { 460| 0| ret = MLK_ERR_OUT_OF_MEMORY; ------------------ | | 275| 0|#define MLK_ERR_OUT_OF_MEMORY (-2) ------------------ 461| 0| goto cleanup; 462| 0| } 463| | 464| 30| publicseed = buf; 465| 30| noiseseed = buf + MLKEM_SYMBYTES; ------------------ | | 27| 30|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 466| | 467| | /* Concatenate coins with MLKEM_K for domain separation of security levels */ 468| 30| mlk_memcpy(coins_with_domain_separator, coins, MLKEM_SYMBYTES); ------------------ | | 168| 30|#define mlk_memcpy memcpy ------------------ mlk_memcpy(coins_with_domain_separator, coins, MLKEM_SYMBYTES); ------------------ | | 27| 30|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 469| 30| coins_with_domain_separator[MLKEM_SYMBYTES] = MLKEM_K; ------------------ | | 27| 30|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ coins_with_domain_separator[MLKEM_SYMBYTES] = MLKEM_K; ------------------ | | 13| 30|#define MLKEM_K 2 ------------------ 470| | 471| 30| mlk_hash_g(buf, coins_with_domain_separator, MLKEM_SYMBYTES + 1); ------------------ | | 32| 30|#define mlk_hash_g(OUT, IN, INBYTES) mlk_sha3_512(OUT, IN, INBYTES) | | ------------------ | | | | 20| 30|#define mlk_sha3_512 sha3_512 | | | | ------------------ | | | | | | 31| 30|#define sha3_512 OQS_SHA3_sha3_512 | | | | ------------------ | | ------------------ ------------------ 472| | 473| | /* 474| | * Declassify the public seed. 475| | * Required to use it in conditional-branches in rejection sampling. 476| | * This is needed because all output of randombytes is marked as secret 477| | * (=undefined) 478| | */ 479| 30| MLK_CT_TESTING_DECLASSIFY(publicseed, MLKEM_SYMBYTES); ------------------ | | 235| 30| do \ | | 236| 30| { \ | | 237| 30| } while (0) | | ------------------ | | | Branch (237:12): [Folded, False: 30] | | ------------------ ------------------ 480| | 481| 30| mlk_gen_matrix(a, publicseed, 0 /* no transpose */); ------------------ | | 22| 30|#define mlk_gen_matrix MLK_NAMESPACE_K(gen_matrix) | | ------------------ | | | | 64| 30|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 30|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 30|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 482| | 483| 30| mlk_keypair_getnoise_eta1(skpv, e, noiseseed); ------------------ | | 43| 30|#define mlk_keypair_getnoise_eta1 MLK_ADD_PARAM_SET(mlk_keypair_getnoise_eta1) | | ------------------ | | | | 48| 30|#define MLK_ADD_PARAM_SET(s) s | | ------------------ ------------------ 484| | 485| 30| mlk_polyvec_ntt(skpv); ------------------ | | 269| 30|#define mlk_polyvec_ntt MLK_NAMESPACE_K(polyvec_ntt) | | ------------------ | | | | 64| 30|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 30|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 30|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 486| 30| mlk_polyvec_ntt(e); ------------------ | | 269| 30|#define mlk_polyvec_ntt MLK_NAMESPACE_K(polyvec_ntt) | | ------------------ | | | | 64| 30|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 30|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 30|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 487| | 488| 30| mlk_polyvec_mulcache_compute(skpv_cache, skpv); ------------------ | | 353| 30|#define mlk_polyvec_mulcache_compute MLK_NAMESPACE_K(polyvec_mulcache_compute) | | ------------------ | | | | 64| 30|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 30|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 30|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 489| 30| mlk_matvec_mul(pkpv, a, skpv, skpv_cache); ------------------ | | 38| 30|#define mlk_matvec_mul MLK_ADD_PARAM_SET(mlk_matvec_mul) | | ------------------ | | | | 48| 30|#define MLK_ADD_PARAM_SET(s) s | | ------------------ ------------------ 490| 30| mlk_polyvec_tomont(pkpv); ------------------ | | 445| 30|#define mlk_polyvec_tomont MLK_NAMESPACE_K(polyvec_tomont) | | ------------------ | | | | 64| 30|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 30|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 30|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 491| | 492| 30| mlk_polyvec_add(pkpv, e); ------------------ | | 414| 30|#define mlk_polyvec_add MLK_NAMESPACE_K(polyvec_add) | | ------------------ | | | | 64| 30|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 30|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 30|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 493| 30| mlk_polyvec_reduce(pkpv); ------------------ | | 387| 30|#define mlk_polyvec_reduce MLK_NAMESPACE_K(polyvec_reduce) | | ------------------ | | | | 64| 30|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 30|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 30|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 494| 30| mlk_polyvec_reduce(skpv); ------------------ | | 387| 30|#define mlk_polyvec_reduce MLK_NAMESPACE_K(polyvec_reduce) | | ------------------ | | | | 64| 30|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 30|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 30|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 495| | 496| 30| mlk_pack_sk(sk, skpv); ------------------ | | 34| 30|#define mlk_pack_sk MLK_ADD_PARAM_SET(mlk_pack_sk) | | ------------------ | | | | 48| 30|#define MLK_ADD_PARAM_SET(s) s | | ------------------ ------------------ 497| 30| mlk_pack_pk(pk, pkpv, publicseed); ------------------ | | 32| 30|#define mlk_pack_pk MLK_ADD_PARAM_SET(mlk_pack_pk) | | ------------------ | | | | 48| 30|#define MLK_ADD_PARAM_SET(s) s | | ------------------ ------------------ 498| | 499| 30|cleanup: 500| | /* Specification: Partially implements 501| | * @[FIPS203, Section 3.3, Destruction of intermediate values] */ 502| 30| MLK_FREE(skpv_cache, mlk_polyvec_mulcache, 1, context); ------------------ | | 238| 30| do \ | | 239| 30| { \ | | 240| 30| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 30| (v) = NULL; \ | | 242| 30| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 30] | | ------------------ ------------------ 503| 30| MLK_FREE(skpv, mlk_polyvec, 1, context); ------------------ | | 238| 30| do \ | | 239| 30| { \ | | 240| 30| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 30| (v) = NULL; \ | | 242| 30| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 30] | | ------------------ ------------------ 504| 30| MLK_FREE(pkpv, mlk_polyvec, 1, context); ------------------ | | 238| 30| do \ | | 239| 30| { \ | | 240| 30| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 30| (v) = NULL; \ | | 242| 30| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 30] | | ------------------ ------------------ 505| 30| MLK_FREE(e, mlk_polyvec, 1, context); ------------------ | | 238| 30| do \ | | 239| 30| { \ | | 240| 30| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 30| (v) = NULL; \ | | 242| 30| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 30] | | ------------------ ------------------ 506| 30| MLK_FREE(a, mlk_polymat, 1, context); ------------------ | | 238| 30| do \ | | 239| 30| { \ | | 240| 30| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 30| (v) = NULL; \ | | 242| 30| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 30] | | ------------------ ------------------ 507| 30| MLK_FREE(coins_with_domain_separator, uint8_t, MLKEM_SYMBYTES + 1, context); ------------------ | | 238| 30| do \ | | 239| 30| { \ | | 240| 30| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 30| (v) = NULL; \ | | 242| 30| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 30] | | ------------------ ------------------ 508| | MLK_FREE(buf, uint8_t, 2 * MLKEM_SYMBYTES, context); ------------------ | | 238| 30| do \ | | 239| 30| { \ | | 240| 30| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 30| (v) = NULL; \ | | 242| 30| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 30] | | ------------------ ------------------ 509| 30| return ret; 510| 30|} PQCP_MLKEM_NATIVE_MLKEM512_X86_64_indcpa_enc: 526| 60|{ 527| 60| int ret = 0; 528| 60| MLK_ALLOC(seed, uint8_t, MLKEM_SYMBYTES, context); ------------------ | | 229| 60| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 60|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 60| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 529| 60| MLK_ALLOC(at, mlk_polymat, 1, context); ------------------ | | 229| 60| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 60|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 60| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 530| 60| MLK_ALLOC(sp, mlk_polyvec, 1, context); ------------------ | | 229| 60| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 60|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 60| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 531| 60| MLK_ALLOC(pkpv, mlk_polyvec, 1, context); ------------------ | | 229| 60| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 60|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 60| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 532| 60| MLK_ALLOC(ep, mlk_polyvec, 1, context); ------------------ | | 229| 60| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 60|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 60| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 533| 60| MLK_ALLOC(b, mlk_polyvec, 1, context); ------------------ | | 229| 60| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 60|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 60| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 534| 60| MLK_ALLOC(v, mlk_poly, 1, context); ------------------ | | 229| 60| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 60|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 60| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 535| 60| MLK_ALLOC(k, mlk_poly, 1, context); ------------------ | | 229| 60| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 60|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 60| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 536| 60| MLK_ALLOC(epp, mlk_poly, 1, context); ------------------ | | 229| 60| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 60|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 60| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 537| 60| MLK_ALLOC(sp_cache, mlk_polyvec_mulcache, 1, context); ------------------ | | 229| 60| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 60|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 60| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 538| | 539| 60| if (seed == NULL || at == NULL || sp == NULL || pkpv == NULL || ep == NULL || ------------------ | Branch (539:7): [True: 0, False: 60] | Branch (539:23): [True: 0, False: 60] | Branch (539:37): [True: 0, False: 60] | Branch (539:51): [True: 0, False: 60] | Branch (539:67): [True: 0, False: 60] ------------------ 540| 60| b == NULL || v == NULL || k == NULL || epp == NULL || sp_cache == NULL) ------------------ | Branch (540:7): [True: 0, False: 60] | Branch (540:20): [True: 0, False: 60] | Branch (540:33): [True: 0, False: 60] | Branch (540:46): [True: 0, False: 60] | Branch (540:61): [True: 0, False: 60] ------------------ 541| 0| { 542| 0| ret = MLK_ERR_OUT_OF_MEMORY; ------------------ | | 275| 0|#define MLK_ERR_OUT_OF_MEMORY (-2) ------------------ 543| 0| goto cleanup; 544| 0| } 545| | 546| 60| mlk_unpack_pk(pkpv, seed, pk); ------------------ | | 33| 60|#define mlk_unpack_pk MLK_ADD_PARAM_SET(mlk_unpack_pk) | | ------------------ | | | | 48| 60|#define MLK_ADD_PARAM_SET(s) s | | ------------------ ------------------ 547| 60| mlk_poly_frommsg(k, m); ------------------ | | 555| 60|#define mlk_poly_frommsg MLK_NAMESPACE(poly_frommsg) | | ------------------ | | | | 63| 60|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 60|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 60|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 548| | 549| | /* 550| | * Declassify the public seed. 551| | * Required to use it in conditional-branches in rejection sampling. 552| | * This is needed because in re-encryption the publicseed originated from sk 553| | * which is marked undefined. 554| | */ 555| 60| MLK_CT_TESTING_DECLASSIFY(seed, MLKEM_SYMBYTES); ------------------ | | 235| 60| do \ | | 236| 60| { \ | | 237| 60| } while (0) | | ------------------ | | | Branch (237:12): [Folded, False: 60] | | ------------------ ------------------ 556| | 557| 60| mlk_gen_matrix(at, seed, 1 /* transpose */); ------------------ | | 22| 60|#define mlk_gen_matrix MLK_NAMESPACE_K(gen_matrix) | | ------------------ | | | | 64| 60|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 60|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 60|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 558| | 559| 60| mlk_enc_getnoise_eta1_eta2(sp, ep, epp, coins); ------------------ | | 44| 60|#define mlk_enc_getnoise_eta1_eta2 MLK_ADD_PARAM_SET(mlk_enc_getnoise_eta1_eta2) | | ------------------ | | | | 48| 60|#define MLK_ADD_PARAM_SET(s) s | | ------------------ ------------------ 560| | 561| 60| mlk_polyvec_ntt(sp); ------------------ | | 269| 60|#define mlk_polyvec_ntt MLK_NAMESPACE_K(polyvec_ntt) | | ------------------ | | | | 64| 60|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 60|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 60|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 562| | 563| 60| mlk_polyvec_mulcache_compute(sp_cache, sp); ------------------ | | 353| 60|#define mlk_polyvec_mulcache_compute MLK_NAMESPACE_K(polyvec_mulcache_compute) | | ------------------ | | | | 64| 60|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 60|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 60|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 564| 60| mlk_matvec_mul(b, at, sp, sp_cache); ------------------ | | 38| 60|#define mlk_matvec_mul MLK_ADD_PARAM_SET(mlk_matvec_mul) | | ------------------ | | | | 48| 60|#define MLK_ADD_PARAM_SET(s) s | | ------------------ ------------------ 565| 60| mlk_polyvec_basemul_acc_montgomery_cached(v, pkpv, sp, sp_cache); ------------------ | | 321| 60| MLK_NAMESPACE_K(polyvec_basemul_acc_montgomery_cached) | | ------------------ | | | | 64| 60|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 60|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 60|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 566| | 567| 60| mlk_polyvec_invntt_tomont(b); ------------------ | | 295| 60|#define mlk_polyvec_invntt_tomont MLK_NAMESPACE_K(polyvec_invntt_tomont) | | ------------------ | | | | 64| 60|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 60|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 60|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 568| 60| mlk_poly_invntt_tomont(v); ------------------ | | 263| 60|#define mlk_poly_invntt_tomont MLK_NAMESPACE(poly_invntt_tomont) | | ------------------ | | | | 63| 60|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 60|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 60|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 569| | 570| 60| mlk_polyvec_add(b, ep); ------------------ | | 414| 60|#define mlk_polyvec_add MLK_NAMESPACE_K(polyvec_add) | | ------------------ | | | | 64| 60|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 60|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 60|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 571| 60| mlk_poly_add(v, epp); ------------------ | | 181| 60|#define mlk_poly_add MLK_NAMESPACE(poly_add) | | ------------------ | | | | 63| 60|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 60|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 60|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 572| 60| mlk_poly_add(v, k); ------------------ | | 181| 60|#define mlk_poly_add MLK_NAMESPACE(poly_add) | | ------------------ | | | | 63| 60|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 60|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 60|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 573| | 574| 60| mlk_polyvec_reduce(b); ------------------ | | 387| 60|#define mlk_polyvec_reduce MLK_NAMESPACE_K(polyvec_reduce) | | ------------------ | | | | 64| 60|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 60|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 60|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 575| 60| mlk_poly_reduce(v); ------------------ | | 154| 60|#define mlk_poly_reduce MLK_NAMESPACE(poly_reduce) | | ------------------ | | | | 63| 60|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 60|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 60|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 576| | 577| 60| mlk_pack_ciphertext(c, b, v); ------------------ | | 36| 60|#define mlk_pack_ciphertext MLK_ADD_PARAM_SET(mlk_pack_ciphertext) | | ------------------ | | | | 48| 60|#define MLK_ADD_PARAM_SET(s) s | | ------------------ ------------------ 578| | 579| 60|cleanup: 580| | /* Specification: Partially implements 581| | * @[FIPS203, Section 3.3, Destruction of intermediate values] */ 582| 60| MLK_FREE(sp_cache, mlk_polyvec_mulcache, 1, context); ------------------ | | 238| 60| do \ | | 239| 60| { \ | | 240| 60| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 60| (v) = NULL; \ | | 242| 60| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 60] | | ------------------ ------------------ 583| 60| MLK_FREE(epp, mlk_poly, 1, context); ------------------ | | 238| 60| do \ | | 239| 60| { \ | | 240| 60| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 60| (v) = NULL; \ | | 242| 60| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 60] | | ------------------ ------------------ 584| 60| MLK_FREE(k, mlk_poly, 1, context); ------------------ | | 238| 60| do \ | | 239| 60| { \ | | 240| 60| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 60| (v) = NULL; \ | | 242| 60| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 60] | | ------------------ ------------------ 585| 60| MLK_FREE(v, mlk_poly, 1, context); ------------------ | | 238| 60| do \ | | 239| 60| { \ | | 240| 60| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 60| (v) = NULL; \ | | 242| 60| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 60] | | ------------------ ------------------ 586| 60| MLK_FREE(b, mlk_polyvec, 1, context); ------------------ | | 238| 60| do \ | | 239| 60| { \ | | 240| 60| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 60| (v) = NULL; \ | | 242| 60| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 60] | | ------------------ ------------------ 587| 60| MLK_FREE(ep, mlk_polyvec, 1, context); ------------------ | | 238| 60| do \ | | 239| 60| { \ | | 240| 60| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 60| (v) = NULL; \ | | 242| 60| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 60] | | ------------------ ------------------ 588| 60| MLK_FREE(pkpv, mlk_polyvec, 1, context); ------------------ | | 238| 60| do \ | | 239| 60| { \ | | 240| 60| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 60| (v) = NULL; \ | | 242| 60| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 60] | | ------------------ ------------------ 589| 60| MLK_FREE(sp, mlk_polyvec, 1, context); ------------------ | | 238| 60| do \ | | 239| 60| { \ | | 240| 60| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 60| (v) = NULL; \ | | 242| 60| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 60] | | ------------------ ------------------ 590| 60| MLK_FREE(at, mlk_polymat, 1, context); ------------------ | | 238| 60| do \ | | 239| 60| { \ | | 240| 60| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 60| (v) = NULL; \ | | 242| 60| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 60] | | ------------------ ------------------ 591| | MLK_FREE(seed, uint8_t, MLKEM_SYMBYTES, context); ------------------ | | 238| 60| do \ | | 239| 60| { \ | | 240| 60| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 60| (v) = NULL; \ | | 242| 60| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 60] | | ------------------ ------------------ 592| 60| return ret; 593| 60|} PQCP_MLKEM_NATIVE_MLKEM512_X86_64_indcpa_dec: 603| 30|{ 604| 30| int ret = 0; 605| 30| MLK_ALLOC(b, mlk_polyvec, 1, context); ------------------ | | 229| 30| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 30|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 30| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 606| 30| MLK_ALLOC(skpv, mlk_polyvec, 1, context); ------------------ | | 229| 30| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 30|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 30| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 607| 30| MLK_ALLOC(v, mlk_poly, 1, context); ------------------ | | 229| 30| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 30|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 30| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 608| 30| MLK_ALLOC(sb, mlk_poly, 1, context); ------------------ | | 229| 30| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 30|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 30| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 609| 30| MLK_ALLOC(b_cache, mlk_polyvec_mulcache, 1, context); ------------------ | | 229| 30| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 30|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 30| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 610| | 611| 30| if (b == NULL || skpv == NULL || v == NULL || sb == NULL || b_cache == NULL) ------------------ | Branch (611:7): [True: 0, False: 30] | Branch (611:20): [True: 0, False: 30] | Branch (611:36): [True: 0, False: 30] | Branch (611:49): [True: 0, False: 30] | Branch (611:63): [True: 0, False: 30] ------------------ 612| 0| { 613| 0| ret = MLK_ERR_OUT_OF_MEMORY; ------------------ | | 275| 0|#define MLK_ERR_OUT_OF_MEMORY (-2) ------------------ 614| 0| goto cleanup; 615| 0| } 616| | 617| 30| mlk_unpack_ciphertext(b, v, c); ------------------ | | 37| 30|#define mlk_unpack_ciphertext MLK_ADD_PARAM_SET(mlk_unpack_ciphertext) | | ------------------ | | | | 48| 30|#define MLK_ADD_PARAM_SET(s) s | | ------------------ ------------------ 618| 30| mlk_unpack_sk(skpv, sk); ------------------ | | 35| 30|#define mlk_unpack_sk MLK_ADD_PARAM_SET(mlk_unpack_sk) | | ------------------ | | | | 48| 30|#define MLK_ADD_PARAM_SET(s) s | | ------------------ ------------------ 619| | 620| 30| mlk_polyvec_ntt(b); ------------------ | | 269| 30|#define mlk_polyvec_ntt MLK_NAMESPACE_K(polyvec_ntt) | | ------------------ | | | | 64| 30|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 30|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 30|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 621| 30| mlk_polyvec_mulcache_compute(b_cache, b); ------------------ | | 353| 30|#define mlk_polyvec_mulcache_compute MLK_NAMESPACE_K(polyvec_mulcache_compute) | | ------------------ | | | | 64| 30|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 30|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 30|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 622| 30| mlk_polyvec_basemul_acc_montgomery_cached(sb, skpv, b, b_cache); ------------------ | | 321| 30| MLK_NAMESPACE_K(polyvec_basemul_acc_montgomery_cached) | | ------------------ | | | | 64| 30|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 30|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 30|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 623| 30| mlk_poly_invntt_tomont(sb); ------------------ | | 263| 30|#define mlk_poly_invntt_tomont MLK_NAMESPACE(poly_invntt_tomont) | | ------------------ | | | | 63| 30|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 30|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 30|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 624| | 625| 30| mlk_poly_sub(v, sb); ------------------ | | 210| 30|#define mlk_poly_sub MLK_NAMESPACE(poly_sub) | | ------------------ | | | | 63| 30|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 30|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 30|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 626| 30| mlk_poly_reduce(v); ------------------ | | 154| 30|#define mlk_poly_reduce MLK_NAMESPACE(poly_reduce) | | ------------------ | | | | 63| 30|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 30|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 30|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 627| | 628| 30| mlk_poly_tomsg(m, v); ------------------ | | 577| 30|#define mlk_poly_tomsg MLK_NAMESPACE(poly_tomsg) | | ------------------ | | | | 63| 30|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 30|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 30|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 629| | 630| 30|cleanup: 631| | /* Specification: Partially implements 632| | * @[FIPS203, Section 3.3, Destruction of intermediate values] */ 633| 30| MLK_FREE(b_cache, mlk_polyvec_mulcache, 1, context); ------------------ | | 238| 30| do \ | | 239| 30| { \ | | 240| 30| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 30| (v) = NULL; \ | | 242| 30| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 30] | | ------------------ ------------------ 634| 30| MLK_FREE(sb, mlk_poly, 1, context); ------------------ | | 238| 30| do \ | | 239| 30| { \ | | 240| 30| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 30| (v) = NULL; \ | | 242| 30| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 30] | | ------------------ ------------------ 635| 30| MLK_FREE(v, mlk_poly, 1, context); ------------------ | | 238| 30| do \ | | 239| 30| { \ | | 240| 30| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 30| (v) = NULL; \ | | 242| 30| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 30] | | ------------------ ------------------ 636| 30| MLK_FREE(skpv, mlk_polyvec, 1, context); ------------------ | | 238| 30| do \ | | 239| 30| { \ | | 240| 30| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 30| (v) = NULL; \ | | 242| 30| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 30] | | ------------------ ------------------ 637| | MLK_FREE(b, mlk_polyvec, 1, context); ------------------ | | 238| 30| do \ | | 239| 30| { \ | | 240| 30| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 30| (v) = NULL; \ | | 242| 30| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 30] | | ------------------ ------------------ 638| 30| return ret; 639| 30|} PQCP_MLKEM_NATIVE_MLKEM512_X86_64_check_pk: 45| 30|{ 46| 30| int ret = 0; 47| 30| MLK_ALLOC(p, mlk_polyvec, 1, context); ------------------ | | 229| 30| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 30|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 30| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 48| 30| MLK_ALLOC(p_reencoded, uint8_t, MLKEM_POLYVECBYTES, context); ------------------ | | 229| 30| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 30|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 30| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 49| | 50| 30| if (p == NULL || p_reencoded == NULL) ------------------ | Branch (50:7): [True: 0, False: 30] | Branch (50:20): [True: 0, False: 30] ------------------ 51| 0| { 52| 0| ret = MLK_ERR_OUT_OF_MEMORY; ------------------ | | 275| 0|#define MLK_ERR_OUT_OF_MEMORY (-2) ------------------ 53| 0| goto cleanup; 54| 0| } 55| | 56| 30| mlk_polyvec_frombytes(p, pk); ------------------ | | 247| 30|#define mlk_polyvec_frombytes MLK_NAMESPACE_K(polyvec_frombytes) | | ------------------ | | | | 64| 30|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 30|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 30|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 57| 30| mlk_polyvec_reduce(p); ------------------ | | 387| 30|#define mlk_polyvec_reduce MLK_NAMESPACE_K(polyvec_reduce) | | ------------------ | | | | 64| 30|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 30|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 30|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 58| 30| mlk_polyvec_tobytes(p_reencoded, p); ------------------ | | 225| 30|#define mlk_polyvec_tobytes MLK_NAMESPACE_K(polyvec_tobytes) | | ------------------ | | | | 64| 30|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 30|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 30|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 59| | 60| | /* We use a constant-time memcmp here to avoid having to 61| | * declassify the PK before the PCT has succeeded. */ 62| 30| ret = mlk_ct_memcmp(pk, p_reencoded, MLKEM_POLYVECBYTES) ? MLK_ERR_FAIL : 0; ------------------ | | 31| 30|#define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | ------------------ | | | | 13| 30|#define MLKEM_K 2 | | ------------------ | | #define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | ------------------ | | | | 30| 30|#define MLKEM_POLYBYTES 384 | | ------------------ ------------------ ret = mlk_ct_memcmp(pk, p_reencoded, MLKEM_POLYVECBYTES) ? MLK_ERR_FAIL : 0; ------------------ | | 272| 0|#define MLK_ERR_FAIL (-1) ------------------ | Branch (62:9): [True: 0, False: 30] ------------------ 63| | 64| 30|cleanup: 65| | /* Specification: Partially implements 66| | * @[FIPS203, Section 3.3, Destruction of intermediate values] */ 67| 30| MLK_FREE(p_reencoded, uint8_t, MLKEM_POLYVECBYTES, context); ------------------ | | 238| 30| do \ | | 239| 30| { \ | | 240| 30| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 30| (v) = NULL; \ | | 242| 30| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 30] | | ------------------ ------------------ 68| | MLK_FREE(p, mlk_polyvec, 1, context); ------------------ | | 238| 30| do \ | | 239| 30| { \ | | 240| 30| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 30| (v) = NULL; \ | | 242| 30| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 30] | | ------------------ ------------------ 69| 30| return ret; 70| 30|} PQCP_MLKEM_NATIVE_MLKEM512_X86_64_check_sk: 78| 30|{ 79| 30| int ret = 0; 80| 30| MLK_ALLOC(test, uint8_t, MLKEM_SYMBYTES, context); ------------------ | | 229| 30| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 30|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 30| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 81| | 82| 30| if (test == NULL) ------------------ | Branch (82:7): [True: 0, False: 30] ------------------ 83| 0| { 84| 0| ret = MLK_ERR_OUT_OF_MEMORY; ------------------ | | 275| 0|#define MLK_ERR_OUT_OF_MEMORY (-2) ------------------ 85| 0| goto cleanup; 86| 0| } 87| | 88| | /* 89| | * The parts of `sk` being hashed and compared here are public, so 90| | * no public information is leaked through the runtime or the return value 91| | * of this function. 92| | */ 93| | 94| | /* Declassify the public part of the secret key */ 95| 30| MLK_CT_TESTING_DECLASSIFY(sk + MLKEM_INDCPA_SECRETKEYBYTES, ------------------ | | 235| 30| do \ | | 236| 30| { \ | | 237| 30| } while (0) | | ------------------ | | | Branch (237:12): [Folded, False: 30] | | ------------------ ------------------ 96| 30| MLKEM_INDCCA_PUBLICKEYBYTES); 97| 30| MLK_CT_TESTING_DECLASSIFY( ------------------ | | 235| 30| do \ | | 236| 30| { \ | | 237| 30| } while (0) | | ------------------ | | | Branch (237:12): [Folded, False: 30] | | ------------------ ------------------ 98| 30| sk + MLKEM_INDCCA_SECRETKEYBYTES - 2 * MLKEM_SYMBYTES, MLKEM_SYMBYTES); 99| | 100| 30| mlk_hash_h(test, sk + MLKEM_INDCPA_SECRETKEYBYTES, ------------------ | | 29| 30|#define mlk_hash_h(OUT, IN, INBYTES) mlk_sha3_256(OUT, IN, INBYTES) | | ------------------ | | | | 19| 30|#define mlk_sha3_256 sha3_256 | | | | ------------------ | | | | | | 15| 30|#define sha3_256 OQS_SHA3_sha3_256 | | | | ------------------ | | ------------------ ------------------ 101| 30| MLKEM_INDCCA_PUBLICKEYBYTES); 102| | /* This doesn't have to be a constant-time memcmp, but it's the only place 103| | * in the library where a normal memcmp would be used otherwise, so for sake 104| | * of minimizing stdlib dependency, we use our constant-time one anyway. */ 105| 30| ret = mlk_ct_memcmp(sk + MLKEM_INDCCA_SECRETKEYBYTES - 2 * MLKEM_SYMBYTES, ------------------ | | 72| 30| (MLKEM_INDCPA_SECRETKEYBYTES + MLKEM_INDCPA_PUBLICKEYBYTES + \ | | ------------------ | | | | 65| 30|#define MLKEM_INDCPA_SECRETKEYBYTES (MLKEM_POLYVECBYTES) | | | | ------------------ | | | | | | 31| 30|#define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | | | ------------------ | | | | | | | | 13| 30|#define MLKEM_K 2 | | | | | | ------------------ | | | | | | #define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | | | ------------------ | | | | | | | | 30| 30|#define MLKEM_POLYBYTES 384 | | | | | | ------------------ | | | | ------------------ | | ------------------ | | (MLKEM_INDCPA_SECRETKEYBYTES + MLKEM_INDCPA_PUBLICKEYBYTES + \ | | ------------------ | | | | 64| 30|#define MLKEM_INDCPA_PUBLICKEYBYTES (MLKEM_POLYVECBYTES + MLKEM_SYMBYTES) | | | | ------------------ | | | | | | 31| 30|#define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | | | ------------------ | | | | | | | | 13| 30|#define MLKEM_K 2 | | | | | | ------------------ | | | | | | #define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | | | ------------------ | | | | | | | | 30| 30|#define MLKEM_POLYBYTES 384 | | | | | | ------------------ | | | | ------------------ | | | | #define MLKEM_INDCPA_PUBLICKEYBYTES (MLKEM_POLYVECBYTES + MLKEM_SYMBYTES) | | | | ------------------ | | | | | | 27| 30|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ | | | | ------------------ | | ------------------ | | 73| 30| 2 * MLKEM_SYMBYTES) | | ------------------ | | | | 27| 30|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ | | ------------------ ------------------ ret = mlk_ct_memcmp(sk + MLKEM_INDCCA_SECRETKEYBYTES - 2 * MLKEM_SYMBYTES, ------------------ | | 27| 30|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ | Branch (105:9): [True: 0, False: 30] ------------------ 106| 30| test, MLKEM_SYMBYTES) ------------------ | | 27| 30|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 107| 30| ? MLK_ERR_FAIL ------------------ | | 272| 0|#define MLK_ERR_FAIL (-1) ------------------ 108| 30| : 0; 109| | 110| 30|cleanup: 111| | /* Specification: Partially implements 112| | * @[FIPS203, Section 3.3, Destruction of intermediate values] */ 113| | MLK_FREE(test, uint8_t, MLKEM_SYMBYTES, context); ------------------ | | 238| 30| do \ | | 239| 30| { \ | | 240| 30| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 30| (v) = NULL; \ | | 242| 30| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 30] | | ------------------ ------------------ 114| 30| return ret; 115| 30|} PQCP_MLKEM_NATIVE_MLKEM512_X86_64_keypair_derand: 214| 30|{ 215| 30| int ret; 216| | 217| 30| ret = mlk_indcpa_keypair_derand(pk, sk, coins, context); ------------------ | | 49| 30| MLK_NAMESPACE_K(indcpa_keypair_derand) MLK_CONTEXT_PARAMETERS_3 | | ------------------ | | | | 64| 30|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 30|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 30|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ | | MLK_NAMESPACE_K(indcpa_keypair_derand) MLK_CONTEXT_PARAMETERS_3 | | ------------------ | | | | 212| 30|#define MLK_CONTEXT_PARAMETERS_3(arg0, arg1, arg2, context) (arg0, arg1, arg2) | | ------------------ ------------------ 218| 30| if (ret != 0) ------------------ | Branch (218:7): [True: 0, False: 30] ------------------ 219| 0| { 220| 0| goto cleanup; 221| 0| } 222| | 223| 30| mlk_memcpy(sk + MLKEM_INDCPA_SECRETKEYBYTES, pk, MLKEM_INDCCA_PUBLICKEYBYTES); ------------------ | | 168| 30|#define mlk_memcpy memcpy ------------------ mlk_memcpy(sk + MLKEM_INDCPA_SECRETKEYBYTES, pk, MLKEM_INDCCA_PUBLICKEYBYTES); ------------------ | | 65| 30|#define MLKEM_INDCPA_SECRETKEYBYTES (MLKEM_POLYVECBYTES) | | ------------------ | | | | 31| 30|#define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | ------------------ | | | | | | 13| 30|#define MLKEM_K 2 | | | | ------------------ | | | | #define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | ------------------ | | | | | | 30| 30|#define MLKEM_POLYBYTES 384 | | | | ------------------ | | ------------------ ------------------ mlk_memcpy(sk + MLKEM_INDCPA_SECRETKEYBYTES, pk, MLKEM_INDCCA_PUBLICKEYBYTES); ------------------ | | 69| 30|#define MLKEM_INDCCA_PUBLICKEYBYTES (MLKEM_INDCPA_PUBLICKEYBYTES) | | ------------------ | | | | 64| 30|#define MLKEM_INDCPA_PUBLICKEYBYTES (MLKEM_POLYVECBYTES + MLKEM_SYMBYTES) | | | | ------------------ | | | | | | 31| 30|#define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | | | ------------------ | | | | | | | | 13| 30|#define MLKEM_K 2 | | | | | | ------------------ | | | | | | #define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | | | ------------------ | | | | | | | | 30| 30|#define MLKEM_POLYBYTES 384 | | | | | | ------------------ | | | | ------------------ | | | | #define MLKEM_INDCPA_PUBLICKEYBYTES (MLKEM_POLYVECBYTES + MLKEM_SYMBYTES) | | | | ------------------ | | | | | | 27| 30|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ | | | | ------------------ | | ------------------ ------------------ 224| 30| mlk_hash_h(sk + MLKEM_INDCCA_SECRETKEYBYTES - 2 * MLKEM_SYMBYTES, pk, ------------------ | | 29| 30|#define mlk_hash_h(OUT, IN, INBYTES) mlk_sha3_256(OUT, IN, INBYTES) | | ------------------ | | | | 19| 30|#define mlk_sha3_256 sha3_256 | | | | ------------------ | | | | | | 15| 30|#define sha3_256 OQS_SHA3_sha3_256 | | | | ------------------ | | ------------------ ------------------ 225| 30| MLKEM_INDCCA_PUBLICKEYBYTES); 226| | /* Value z for pseudo-random output on reject */ 227| 30| mlk_memcpy(sk + MLKEM_INDCCA_SECRETKEYBYTES - MLKEM_SYMBYTES, ------------------ | | 168| 30|#define mlk_memcpy memcpy ------------------ mlk_memcpy(sk + MLKEM_INDCCA_SECRETKEYBYTES - MLKEM_SYMBYTES, ------------------ | | 72| 30| (MLKEM_INDCPA_SECRETKEYBYTES + MLKEM_INDCPA_PUBLICKEYBYTES + \ | | ------------------ | | | | 65| 30|#define MLKEM_INDCPA_SECRETKEYBYTES (MLKEM_POLYVECBYTES) | | | | ------------------ | | | | | | 31| 30|#define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | | | ------------------ | | | | | | | | 13| 30|#define MLKEM_K 2 | | | | | | ------------------ | | | | | | #define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | | | ------------------ | | | | | | | | 30| 30|#define MLKEM_POLYBYTES 384 | | | | | | ------------------ | | | | ------------------ | | ------------------ | | (MLKEM_INDCPA_SECRETKEYBYTES + MLKEM_INDCPA_PUBLICKEYBYTES + \ | | ------------------ | | | | 64| 30|#define MLKEM_INDCPA_PUBLICKEYBYTES (MLKEM_POLYVECBYTES + MLKEM_SYMBYTES) | | | | ------------------ | | | | | | 31| 30|#define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | | | ------------------ | | | | | | | | 13| 30|#define MLKEM_K 2 | | | | | | ------------------ | | | | | | #define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | | | ------------------ | | | | | | | | 30| 30|#define MLKEM_POLYBYTES 384 | | | | | | ------------------ | | | | ------------------ | | | | #define MLKEM_INDCPA_PUBLICKEYBYTES (MLKEM_POLYVECBYTES + MLKEM_SYMBYTES) | | | | ------------------ | | | | | | 27| 30|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ | | | | ------------------ | | ------------------ | | 73| 30| 2 * MLKEM_SYMBYTES) | | ------------------ | | | | 27| 30|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ | | ------------------ ------------------ mlk_memcpy(sk + MLKEM_INDCCA_SECRETKEYBYTES - MLKEM_SYMBYTES, ------------------ | | 27| 30|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 228| 30| coins + MLKEM_SYMBYTES, MLKEM_SYMBYTES); ------------------ | | 27| 30|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ coins + MLKEM_SYMBYTES, MLKEM_SYMBYTES); ------------------ | | 27| 30|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 229| | 230| | /* Declassify public key */ 231| 30| MLK_CT_TESTING_DECLASSIFY(pk, MLKEM_INDCCA_PUBLICKEYBYTES); ------------------ | | 235| 30| do \ | | 236| 30| { \ | | 237| 30| } while (0) | | ------------------ | | | Branch (237:12): [Folded, False: 30] | | ------------------ ------------------ 232| | 233| | /* Pairwise Consistency Test (PCT) @[FIPS140_3_IG, p.87] */ 234| 30| ret = mlk_check_pct(pk, sk, context); ------------------ | | 37| 30|#define mlk_check_pct MLK_ADD_PARAM_SET(mlk_check_pct) MLK_CONTEXT_PARAMETERS_2 | | ------------------ | | | | 48| 30|#define MLK_ADD_PARAM_SET(s) s | | ------------------ | | #define mlk_check_pct MLK_ADD_PARAM_SET(mlk_check_pct) MLK_CONTEXT_PARAMETERS_2 | | ------------------ | | | | 211| 30|#define MLK_CONTEXT_PARAMETERS_2(arg0, arg1, context) (arg0, arg1) | | ------------------ ------------------ 235| 30| if (ret != 0) ------------------ | Branch (235:7): [True: 0, False: 30] ------------------ 236| 0| { 237| 0| goto cleanup; 238| 0| } 239| | 240| 30|cleanup: 241| 30| if (ret != 0) ------------------ | Branch (241:7): [True: 0, False: 30] ------------------ 242| 0| { 243| 0| mlk_zeroize(pk, MLKEM_INDCCA_PUBLICKEYBYTES); ------------------ | | 69| 0|#define MLKEM_INDCCA_PUBLICKEYBYTES (MLKEM_INDCPA_PUBLICKEYBYTES) | | ------------------ | | | | 64| 0|#define MLKEM_INDCPA_PUBLICKEYBYTES (MLKEM_POLYVECBYTES + MLKEM_SYMBYTES) | | | | ------------------ | | | | | | 31| 0|#define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | | | ------------------ | | | | | | | | 13| 0|#define MLKEM_K 2 | | | | | | ------------------ | | | | | | #define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | | | ------------------ | | | | | | | | 30| 0|#define MLKEM_POLYBYTES 384 | | | | | | ------------------ | | | | ------------------ | | | | #define MLKEM_INDCPA_PUBLICKEYBYTES (MLKEM_POLYVECBYTES + MLKEM_SYMBYTES) | | | | ------------------ | | | | | | 27| 0|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ | | | | ------------------ | | ------------------ ------------------ 244| 0| mlk_zeroize(sk, MLKEM_INDCCA_SECRETKEYBYTES); ------------------ | | 72| 0| (MLKEM_INDCPA_SECRETKEYBYTES + MLKEM_INDCPA_PUBLICKEYBYTES + \ | | ------------------ | | | | 65| 0|#define MLKEM_INDCPA_SECRETKEYBYTES (MLKEM_POLYVECBYTES) | | | | ------------------ | | | | | | 31| 0|#define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | | | ------------------ | | | | | | | | 13| 0|#define MLKEM_K 2 | | | | | | ------------------ | | | | | | #define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | | | ------------------ | | | | | | | | 30| 0|#define MLKEM_POLYBYTES 384 | | | | | | ------------------ | | | | ------------------ | | ------------------ | | (MLKEM_INDCPA_SECRETKEYBYTES + MLKEM_INDCPA_PUBLICKEYBYTES + \ | | ------------------ | | | | 64| 0|#define MLKEM_INDCPA_PUBLICKEYBYTES (MLKEM_POLYVECBYTES + MLKEM_SYMBYTES) | | | | ------------------ | | | | | | 31| 0|#define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | | | ------------------ | | | | | | | | 13| 0|#define MLKEM_K 2 | | | | | | ------------------ | | | | | | #define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | | | ------------------ | | | | | | | | 30| 0|#define MLKEM_POLYBYTES 384 | | | | | | ------------------ | | | | ------------------ | | | | #define MLKEM_INDCPA_PUBLICKEYBYTES (MLKEM_POLYVECBYTES + MLKEM_SYMBYTES) | | | | ------------------ | | | | | | 27| 0|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ | | | | ------------------ | | ------------------ | | 73| 0| 2 * MLKEM_SYMBYTES) | | ------------------ | | | | 27| 0|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ | | ------------------ ------------------ 245| 0| } 246| | 247| 30| return ret; 248| 30|} PQCP_MLKEM_NATIVE_MLKEM512_X86_64_keypair: 257| 30|{ 258| 30| int ret = 0; 259| 30| MLK_ALLOC(coins, uint8_t, 2 * MLKEM_SYMBYTES, context); ------------------ | | 229| 30| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 30|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 30| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 260| | 261| 30| if (coins == NULL) ------------------ | Branch (261:7): [True: 0, False: 30] ------------------ 262| 0| { 263| 0| ret = MLK_ERR_OUT_OF_MEMORY; ------------------ | | 275| 0|#define MLK_ERR_OUT_OF_MEMORY (-2) ------------------ 264| 0| goto cleanup; 265| 0| } 266| | 267| | /* Acquire necessary randomness, and mark it as secret. */ 268| 30| if (mlk_randombytes(coins, 2 * MLKEM_SYMBYTES) != 0) ------------------ | | 27| 30|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ | Branch (268:7): [True: 0, False: 30] ------------------ 269| 0| { 270| 0| ret = MLK_ERR_RNG_FAIL; ------------------ | | 278| 0|#define MLK_ERR_RNG_FAIL (-3) ------------------ 271| 0| goto cleanup; 272| 0| } 273| | 274| 30| MLK_CT_TESTING_SECRET(coins, 2 * MLKEM_SYMBYTES); ------------------ | | 231| 30| do \ | | 232| 30| { \ | | 233| 30| } while (0) | | ------------------ | | | Branch (233:12): [Folded, False: 30] | | ------------------ ------------------ 275| | 276| 30| ret = mlk_kem_keypair_derand(pk, sk, coins, context); ------------------ | | 50| 30| MLK_NAMESPACE_K(keypair_derand) MLK_CONTEXT_PARAMETERS_3 | | ------------------ | | | | 64| 30|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 30|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 30|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ | | MLK_NAMESPACE_K(keypair_derand) MLK_CONTEXT_PARAMETERS_3 | | ------------------ | | | | 212| 30|#define MLK_CONTEXT_PARAMETERS_3(arg0, arg1, arg2, context) (arg0, arg1, arg2) | | ------------------ ------------------ 277| | 278| 30|cleanup: 279| | /* Specification: Partially implements 280| | * @[FIPS203, Section 3.3, Destruction of intermediate values] */ 281| | MLK_FREE(coins, uint8_t, 2 * MLKEM_SYMBYTES, context); ------------------ | | 238| 30| do \ | | 239| 30| { \ | | 240| 30| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 30| (v) = NULL; \ | | 242| 30| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 30] | | ------------------ ------------------ 282| 30| return ret; 283| 30|} PQCP_MLKEM_NATIVE_MLKEM512_X86_64_enc_derand: 295| 30|{ 296| 30| int ret = 0; 297| 30| MLK_ALLOC(buf, uint8_t, 2 * MLKEM_SYMBYTES, context); ------------------ | | 229| 30| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 30|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 30| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 298| 30| MLK_ALLOC(kr, uint8_t, 2 * MLKEM_SYMBYTES, context); ------------------ | | 229| 30| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 30|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 30| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 299| | 300| 30| if (buf == NULL || kr == NULL) ------------------ | Branch (300:7): [True: 0, False: 30] | Branch (300:22): [True: 0, False: 30] ------------------ 301| 0| { 302| 0| ret = MLK_ERR_OUT_OF_MEMORY; ------------------ | | 275| 0|#define MLK_ERR_OUT_OF_MEMORY (-2) ------------------ 303| 0| goto cleanup; 304| 0| } 305| | 306| | /* Specification: Implements @[FIPS203, Section 7.2, Modulus check] */ 307| 30| ret = mlk_kem_check_pk(pk, context); ------------------ | | 55| 30|#define mlk_kem_check_pk MLK_NAMESPACE_K(check_pk) MLK_CONTEXT_PARAMETERS_1 | | ------------------ | | | | 64| 30|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 30|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 30|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ | | #define mlk_kem_check_pk MLK_NAMESPACE_K(check_pk) MLK_CONTEXT_PARAMETERS_1 | | ------------------ | | | | 210| 30|#define MLK_CONTEXT_PARAMETERS_1(arg0, context) (arg0) | | ------------------ ------------------ 308| 30| if (ret != 0) ------------------ | Branch (308:7): [True: 0, False: 30] ------------------ 309| 0| { 310| 0| goto cleanup; 311| 0| } 312| | 313| 30| mlk_memcpy(buf, coins, MLKEM_SYMBYTES); ------------------ | | 168| 30|#define mlk_memcpy memcpy ------------------ mlk_memcpy(buf, coins, MLKEM_SYMBYTES); ------------------ | | 27| 30|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 314| | 315| | /* Multitarget countermeasure for coins + contributory KEM */ 316| 30| mlk_hash_h(buf + MLKEM_SYMBYTES, pk, MLKEM_INDCCA_PUBLICKEYBYTES); ------------------ | | 29| 30|#define mlk_hash_h(OUT, IN, INBYTES) mlk_sha3_256(OUT, IN, INBYTES) | | ------------------ | | | | 19| 30|#define mlk_sha3_256 sha3_256 | | | | ------------------ | | | | | | 15| 30|#define sha3_256 OQS_SHA3_sha3_256 | | | | ------------------ | | ------------------ ------------------ 317| 30| mlk_hash_g(kr, buf, 2 * MLKEM_SYMBYTES); ------------------ | | 32| 30|#define mlk_hash_g(OUT, IN, INBYTES) mlk_sha3_512(OUT, IN, INBYTES) | | ------------------ | | | | 20| 30|#define mlk_sha3_512 sha3_512 | | | | ------------------ | | | | | | 31| 30|#define sha3_512 OQS_SHA3_sha3_512 | | | | ------------------ | | ------------------ ------------------ 318| | 319| | /* coins are in kr+MLKEM_SYMBYTES */ 320| 30| ret = mlk_indcpa_enc(ct, buf, pk, kr + MLKEM_SYMBYTES, context); ------------------ | | 88| 30|#define mlk_indcpa_enc MLK_NAMESPACE_K(indcpa_enc) MLK_CONTEXT_PARAMETERS_4 | | ------------------ | | | | 64| 30|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 30|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 30|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ | | #define mlk_indcpa_enc MLK_NAMESPACE_K(indcpa_enc) MLK_CONTEXT_PARAMETERS_4 | | ------------------ | | | | 214| 30| (arg0, arg1, arg2, arg3) | | ------------------ ------------------ 321| 30| if (ret != 0) ------------------ | Branch (321:7): [True: 0, False: 30] ------------------ 322| 0| { 323| 0| goto cleanup; 324| 0| } 325| | 326| 30| mlk_memcpy(ss, kr, MLKEM_SYMBYTES); ------------------ | | 168| 30|#define mlk_memcpy memcpy ------------------ mlk_memcpy(ss, kr, MLKEM_SYMBYTES); ------------------ | | 27| 30|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 327| | 328| 30|cleanup: 329| | /* Specification: Partially implements 330| | * @[FIPS203, Section 3.3, Destruction of intermediate values] */ 331| 30| MLK_FREE(kr, uint8_t, 2 * MLKEM_SYMBYTES, context); ------------------ | | 238| 30| do \ | | 239| 30| { \ | | 240| 30| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 30| (v) = NULL; \ | | 242| 30| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 30] | | ------------------ ------------------ 332| | MLK_FREE(buf, uint8_t, 2 * MLKEM_SYMBYTES, context); ------------------ | | 238| 30| do \ | | 239| 30| { \ | | 240| 30| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 30| (v) = NULL; \ | | 242| 30| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 30] | | ------------------ ------------------ 333| 30| return ret; 334| 30|} PQCP_MLKEM_NATIVE_MLKEM512_X86_64_enc: 344| 30|{ 345| 30| int ret = 0; 346| 30| MLK_ALLOC(coins, uint8_t, MLKEM_SYMBYTES, context); ------------------ | | 229| 30| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 30|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 30| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 347| | 348| 30| if (coins == NULL) ------------------ | Branch (348:7): [True: 0, False: 30] ------------------ 349| 0| { 350| 0| ret = MLK_ERR_OUT_OF_MEMORY; ------------------ | | 275| 0|#define MLK_ERR_OUT_OF_MEMORY (-2) ------------------ 351| 0| goto cleanup; 352| 0| } 353| | 354| 30| if (mlk_randombytes(coins, MLKEM_SYMBYTES) != 0) ------------------ | | 27| 30|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ | Branch (354:7): [True: 0, False: 30] ------------------ 355| 0| { 356| 0| ret = MLK_ERR_RNG_FAIL; ------------------ | | 278| 0|#define MLK_ERR_RNG_FAIL (-3) ------------------ 357| 0| goto cleanup; 358| 0| } 359| | 360| 30| MLK_CT_TESTING_SECRET(coins, MLKEM_SYMBYTES); ------------------ | | 231| 30| do \ | | 232| 30| { \ | | 233| 30| } while (0) | | ------------------ | | | Branch (233:12): [Folded, False: 30] | | ------------------ ------------------ 361| | 362| 30| ret = mlk_kem_enc_derand(ct, ss, pk, coins, context); ------------------ | | 52| 30|#define mlk_kem_enc_derand MLK_NAMESPACE_K(enc_derand) MLK_CONTEXT_PARAMETERS_4 | | ------------------ | | | | 64| 30|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 30|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 30|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ | | #define mlk_kem_enc_derand MLK_NAMESPACE_K(enc_derand) MLK_CONTEXT_PARAMETERS_4 | | ------------------ | | | | 214| 30| (arg0, arg1, arg2, arg3) | | ------------------ ------------------ 363| | 364| 30|cleanup: 365| | /* Specification: Partially implements 366| | * @[FIPS203, Section 3.3, Destruction of intermediate values] */ 367| | MLK_FREE(coins, uint8_t, MLKEM_SYMBYTES, context); ------------------ | | 238| 30| do \ | | 239| 30| { \ | | 240| 30| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 30| (v) = NULL; \ | | 242| 30| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 30] | | ------------------ ------------------ 368| 30| return ret; 369| 30|} PQCP_MLKEM_NATIVE_MLKEM512_X86_64_dec: 380| 30|{ 381| 30| int ret = 0; 382| 30| uint8_t fail; 383| 30| const uint8_t *pk = sk + MLKEM_INDCPA_SECRETKEYBYTES; ------------------ | | 65| 30|#define MLKEM_INDCPA_SECRETKEYBYTES (MLKEM_POLYVECBYTES) | | ------------------ | | | | 31| 30|#define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | ------------------ | | | | | | 13| 30|#define MLKEM_K 2 | | | | ------------------ | | | | #define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | ------------------ | | | | | | 30| 30|#define MLKEM_POLYBYTES 384 | | | | ------------------ | | ------------------ ------------------ 384| 30| MLK_ALLOC(buf, uint8_t, 2 * MLKEM_SYMBYTES, context); ------------------ | | 229| 30| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 30|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 30| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 385| 30| MLK_ALLOC(kr, uint8_t, 2 * MLKEM_SYMBYTES, context); ------------------ | | 229| 30| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 30|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 30| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 386| 30| MLK_ALLOC(tmp, uint8_t, MLKEM_SYMBYTES + MLKEM_INDCCA_CIPHERTEXTBYTES, ------------------ | | 229| 30| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 30|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 30| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 387| 30| context); 388| | 389| 30| if (buf == NULL || kr == NULL || tmp == NULL) ------------------ | Branch (389:7): [True: 0, False: 30] | Branch (389:22): [True: 0, False: 30] | Branch (389:36): [True: 0, False: 30] ------------------ 390| 0| { 391| 0| ret = MLK_ERR_OUT_OF_MEMORY; ------------------ | | 275| 0|#define MLK_ERR_OUT_OF_MEMORY (-2) ------------------ 392| 0| goto cleanup; 393| 0| } 394| | 395| | /* Specification: Implements @[FIPS203, Section 7.3, Hash check] */ 396| 30| ret = mlk_kem_check_sk(sk, context); ------------------ | | 56| 30|#define mlk_kem_check_sk MLK_NAMESPACE_K(check_sk) MLK_CONTEXT_PARAMETERS_1 | | ------------------ | | | | 64| 30|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 30|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 30|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ | | #define mlk_kem_check_sk MLK_NAMESPACE_K(check_sk) MLK_CONTEXT_PARAMETERS_1 | | ------------------ | | | | 210| 30|#define MLK_CONTEXT_PARAMETERS_1(arg0, context) (arg0) | | ------------------ ------------------ 397| 30| if (ret != 0) ------------------ | Branch (397:7): [True: 0, False: 30] ------------------ 398| 0| { 399| 0| goto cleanup; 400| 0| } 401| | 402| 30| ret = mlk_indcpa_dec(buf, ct, sk, context); ------------------ | | 127| 30|#define mlk_indcpa_dec MLK_NAMESPACE_K(indcpa_dec) MLK_CONTEXT_PARAMETERS_3 | | ------------------ | | | | 64| 30|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 30|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 30|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ | | #define mlk_indcpa_dec MLK_NAMESPACE_K(indcpa_dec) MLK_CONTEXT_PARAMETERS_3 | | ------------------ | | | | 212| 30|#define MLK_CONTEXT_PARAMETERS_3(arg0, arg1, arg2, context) (arg0, arg1, arg2) | | ------------------ ------------------ 403| 30| if (ret != 0) ------------------ | Branch (403:7): [True: 0, False: 30] ------------------ 404| 0| { 405| 0| goto cleanup; 406| 0| } 407| | 408| | /* Multitarget countermeasure for coins + contributory KEM */ 409| 30| mlk_memcpy(buf + MLKEM_SYMBYTES, ------------------ | | 168| 30|#define mlk_memcpy memcpy ------------------ mlk_memcpy(buf + MLKEM_SYMBYTES, ------------------ | | 27| 30|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 410| 30| sk + MLKEM_INDCCA_SECRETKEYBYTES - 2 * MLKEM_SYMBYTES, ------------------ | | 72| 30| (MLKEM_INDCPA_SECRETKEYBYTES + MLKEM_INDCPA_PUBLICKEYBYTES + \ | | ------------------ | | | | 65| 30|#define MLKEM_INDCPA_SECRETKEYBYTES (MLKEM_POLYVECBYTES) | | | | ------------------ | | | | | | 31| 30|#define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | | | ------------------ | | | | | | | | 13| 30|#define MLKEM_K 2 | | | | | | ------------------ | | | | | | #define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | | | ------------------ | | | | | | | | 30| 30|#define MLKEM_POLYBYTES 384 | | | | | | ------------------ | | | | ------------------ | | ------------------ | | (MLKEM_INDCPA_SECRETKEYBYTES + MLKEM_INDCPA_PUBLICKEYBYTES + \ | | ------------------ | | | | 64| 30|#define MLKEM_INDCPA_PUBLICKEYBYTES (MLKEM_POLYVECBYTES + MLKEM_SYMBYTES) | | | | ------------------ | | | | | | 31| 30|#define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | | | ------------------ | | | | | | | | 13| 30|#define MLKEM_K 2 | | | | | | ------------------ | | | | | | #define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | | | ------------------ | | | | | | | | 30| 30|#define MLKEM_POLYBYTES 384 | | | | | | ------------------ | | | | ------------------ | | | | #define MLKEM_INDCPA_PUBLICKEYBYTES (MLKEM_POLYVECBYTES + MLKEM_SYMBYTES) | | | | ------------------ | | | | | | 27| 30|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ | | | | ------------------ | | ------------------ | | 73| 30| 2 * MLKEM_SYMBYTES) | | ------------------ | | | | 27| 30|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ | | ------------------ ------------------ sk + MLKEM_INDCCA_SECRETKEYBYTES - 2 * MLKEM_SYMBYTES, ------------------ | | 27| 30|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 411| 30| MLKEM_SYMBYTES); ------------------ | | 27| 30|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 412| 30| mlk_hash_g(kr, buf, 2 * MLKEM_SYMBYTES); ------------------ | | 32| 30|#define mlk_hash_g(OUT, IN, INBYTES) mlk_sha3_512(OUT, IN, INBYTES) | | ------------------ | | | | 20| 30|#define mlk_sha3_512 sha3_512 | | | | ------------------ | | | | | | 31| 30|#define sha3_512 OQS_SHA3_sha3_512 | | | | ------------------ | | ------------------ ------------------ 413| | 414| | /* Recompute and compare ciphertext */ 415| | /* coins are in kr+MLKEM_SYMBYTES */ 416| 30| ret = mlk_indcpa_enc(tmp, buf, pk, kr + MLKEM_SYMBYTES, context); ------------------ | | 88| 30|#define mlk_indcpa_enc MLK_NAMESPACE_K(indcpa_enc) MLK_CONTEXT_PARAMETERS_4 | | ------------------ | | | | 64| 30|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 30|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 30|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ | | #define mlk_indcpa_enc MLK_NAMESPACE_K(indcpa_enc) MLK_CONTEXT_PARAMETERS_4 | | ------------------ | | | | 214| 30| (arg0, arg1, arg2, arg3) | | ------------------ ------------------ 417| 30| if (ret != 0) ------------------ | Branch (417:7): [True: 0, False: 30] ------------------ 418| 0| { 419| 0| goto cleanup; 420| 0| } 421| | 422| 30| fail = mlk_ct_memcmp(ct, tmp, MLKEM_INDCCA_CIPHERTEXTBYTES); ------------------ | | 74| 30|#define MLKEM_INDCCA_CIPHERTEXTBYTES (MLKEM_INDCPA_BYTES) | | ------------------ | | | | 67| 30| (MLKEM_POLYVECCOMPRESSEDBYTES_DU + MLKEM_POLYCOMPRESSEDBYTES_DV) | | | | ------------------ | | | | | | 44| 30|#define MLKEM_POLYVECCOMPRESSEDBYTES_DU (MLKEM_K * MLKEM_POLYCOMPRESSEDBYTES_DU) | | | | | | ------------------ | | | | | | | | 13| 30|#define MLKEM_K 2 | | | | | | ------------------ | | | | | | #define MLKEM_POLYVECCOMPRESSEDBYTES_DU (MLKEM_K * MLKEM_POLYCOMPRESSEDBYTES_DU) | | | | | | ------------------ | | | | | | | | 43| 30|#define MLKEM_POLYCOMPRESSEDBYTES_DU MLKEM_POLYCOMPRESSEDBYTES_D10 | | | | | | | | ------------------ | | | | | | | | | | 35| 30|#define MLKEM_POLYCOMPRESSEDBYTES_D10 320 | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | | | (MLKEM_POLYVECCOMPRESSEDBYTES_DU + MLKEM_POLYCOMPRESSEDBYTES_DV) | | | | ------------------ | | | | | | 42| 30|#define MLKEM_POLYCOMPRESSEDBYTES_DV MLKEM_POLYCOMPRESSEDBYTES_D4 | | | | | | ------------------ | | | | | | | | 33| 30|#define MLKEM_POLYCOMPRESSEDBYTES_D4 128 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 423| | 424| | /* Compute rejection key */ 425| 30| mlk_memcpy(tmp, sk + MLKEM_INDCCA_SECRETKEYBYTES - MLKEM_SYMBYTES, ------------------ | | 168| 30|#define mlk_memcpy memcpy ------------------ mlk_memcpy(tmp, sk + MLKEM_INDCCA_SECRETKEYBYTES - MLKEM_SYMBYTES, ------------------ | | 72| 30| (MLKEM_INDCPA_SECRETKEYBYTES + MLKEM_INDCPA_PUBLICKEYBYTES + \ | | ------------------ | | | | 65| 30|#define MLKEM_INDCPA_SECRETKEYBYTES (MLKEM_POLYVECBYTES) | | | | ------------------ | | | | | | 31| 30|#define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | | | ------------------ | | | | | | | | 13| 30|#define MLKEM_K 2 | | | | | | ------------------ | | | | | | #define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | | | ------------------ | | | | | | | | 30| 30|#define MLKEM_POLYBYTES 384 | | | | | | ------------------ | | | | ------------------ | | ------------------ | | (MLKEM_INDCPA_SECRETKEYBYTES + MLKEM_INDCPA_PUBLICKEYBYTES + \ | | ------------------ | | | | 64| 30|#define MLKEM_INDCPA_PUBLICKEYBYTES (MLKEM_POLYVECBYTES + MLKEM_SYMBYTES) | | | | ------------------ | | | | | | 31| 30|#define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | | | ------------------ | | | | | | | | 13| 30|#define MLKEM_K 2 | | | | | | ------------------ | | | | | | #define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | | | ------------------ | | | | | | | | 30| 30|#define MLKEM_POLYBYTES 384 | | | | | | ------------------ | | | | ------------------ | | | | #define MLKEM_INDCPA_PUBLICKEYBYTES (MLKEM_POLYVECBYTES + MLKEM_SYMBYTES) | | | | ------------------ | | | | | | 27| 30|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ | | | | ------------------ | | ------------------ | | 73| 30| 2 * MLKEM_SYMBYTES) | | ------------------ | | | | 27| 30|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ | | ------------------ ------------------ mlk_memcpy(tmp, sk + MLKEM_INDCCA_SECRETKEYBYTES - MLKEM_SYMBYTES, ------------------ | | 27| 30|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 426| 30| MLKEM_SYMBYTES); ------------------ | | 27| 30|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 427| 30| mlk_memcpy(tmp + MLKEM_SYMBYTES, ct, MLKEM_INDCCA_CIPHERTEXTBYTES); ------------------ | | 168| 30|#define mlk_memcpy memcpy ------------------ mlk_memcpy(tmp + MLKEM_SYMBYTES, ct, MLKEM_INDCCA_CIPHERTEXTBYTES); ------------------ | | 27| 30|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ mlk_memcpy(tmp + MLKEM_SYMBYTES, ct, MLKEM_INDCCA_CIPHERTEXTBYTES); ------------------ | | 74| 30|#define MLKEM_INDCCA_CIPHERTEXTBYTES (MLKEM_INDCPA_BYTES) | | ------------------ | | | | 67| 30| (MLKEM_POLYVECCOMPRESSEDBYTES_DU + MLKEM_POLYCOMPRESSEDBYTES_DV) | | | | ------------------ | | | | | | 44| 30|#define MLKEM_POLYVECCOMPRESSEDBYTES_DU (MLKEM_K * MLKEM_POLYCOMPRESSEDBYTES_DU) | | | | | | ------------------ | | | | | | | | 13| 30|#define MLKEM_K 2 | | | | | | ------------------ | | | | | | #define MLKEM_POLYVECCOMPRESSEDBYTES_DU (MLKEM_K * MLKEM_POLYCOMPRESSEDBYTES_DU) | | | | | | ------------------ | | | | | | | | 43| 30|#define MLKEM_POLYCOMPRESSEDBYTES_DU MLKEM_POLYCOMPRESSEDBYTES_D10 | | | | | | | | ------------------ | | | | | | | | | | 35| 30|#define MLKEM_POLYCOMPRESSEDBYTES_D10 320 | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | | | (MLKEM_POLYVECCOMPRESSEDBYTES_DU + MLKEM_POLYCOMPRESSEDBYTES_DV) | | | | ------------------ | | | | | | 42| 30|#define MLKEM_POLYCOMPRESSEDBYTES_DV MLKEM_POLYCOMPRESSEDBYTES_D4 | | | | | | ------------------ | | | | | | | | 33| 30|#define MLKEM_POLYCOMPRESSEDBYTES_D4 128 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 428| 30| mlk_hash_j(ss, tmp, MLKEM_SYMBYTES + MLKEM_INDCCA_CIPHERTEXTBYTES); ------------------ | | 36| 30| mlk_shake256(OUT, MLKEM_SYMBYTES, IN, INBYTES) | | ------------------ | | | | 18| 30|#define mlk_shake256 shake256 | | | | ------------------ | | | | | | 12| 30|#define shake256 OQS_SHA3_shake256 | | | | ------------------ | | ------------------ | | mlk_shake256(OUT, MLKEM_SYMBYTES, IN, INBYTES) | | ------------------ | | | | 27| 30|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ | | ------------------ ------------------ 429| | 430| | /* Copy true key to return buffer if fail is 0 */ 431| 30| mlk_ct_cmov_zero(ss, kr, MLKEM_SYMBYTES, fail); ------------------ | | 27| 30|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 432| | 433| 30|cleanup: 434| | /* Specification: Partially implements 435| | * @[FIPS203, Section 3.3, Destruction of intermediate values] */ 436| 30| MLK_FREE(tmp, uint8_t, MLKEM_SYMBYTES + MLKEM_INDCCA_CIPHERTEXTBYTES, ------------------ | | 238| 30| do \ | | 239| 30| { \ | | 240| 30| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 30| (v) = NULL; \ | | 242| 30| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 30] | | ------------------ ------------------ 437| 30| context); 438| 30| MLK_FREE(kr, uint8_t, 2 * MLKEM_SYMBYTES, context); ------------------ | | 238| 30| do \ | | 239| 30| { \ | | 240| 30| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 30| (v) = NULL; \ | | 242| 30| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 30] | | ------------------ ------------------ 439| 30| MLK_FREE(buf, uint8_t, 2 * MLKEM_SYMBYTES, context); ------------------ | | 238| 30| do \ | | 239| 30| { \ | | 240| 30| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 30| (v) = NULL; \ | | 242| 30| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 30] | | ------------------ ------------------ 440| | 441| 30| return ret; 442| 30|} poly_k.c:mlk_polyvec_basemul_acc_montgomery_cached_k2_native: 125| 270|{ 126| 270| if (!mlk_sys_check_capability(MLK_SYS_CAP_AVX2)) ------------------ | Branch (126:7): [True: 0, False: 270] ------------------ 127| 0| { 128| 0| return MLK_NATIVE_FUNC_FALLBACK; ------------------ | | 38| 0|#define MLK_NATIVE_FUNC_FALLBACK (-1) ------------------ 129| 0| } 130| | 131| 270| mlk_polyvec_basemul_acc_montgomery_cached_k2_avx2_asm(r, a, b, b_cache); ------------------ | | 107| 270| MLK_NAMESPACE(polyvec_basemul_acc_montgomery_cached_k2_avx2_asm) | | ------------------ | | | | 63| 270|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 270|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 270|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 132| 270| return MLK_NATIVE_FUNC_SUCCESS; ------------------ | | 33| 270|#define MLK_NATIVE_FUNC_SUCCESS (0) ------------------ 133| 270|} sampling.c:mlk_rej_uniform_native: 50| 2.43k|{ 51| 2.43k| if (!mlk_sys_check_capability(MLK_SYS_CAP_AVX2) || len != MLKEM_N || ------------------ | | 22| 4.86k|#define MLKEM_N 256 ------------------ | Branch (51:7): [True: 0, False: 2.43k] | Branch (51:54): [True: 0, False: 2.43k] ------------------ 52| 2.43k| buflen % 12 != 0) ------------------ | Branch (52:7): [True: 0, False: 2.43k] ------------------ 53| 0| { 54| 0| return MLK_NATIVE_FUNC_FALLBACK; ------------------ | | 38| 0|#define MLK_NATIVE_FUNC_FALLBACK (-1) ------------------ 55| 0| } 56| 2.43k| return (int)mlk_rej_uniform_avx2_asm(r, buf, buflen, mlk_rej_uniform_table); ------------------ | | 20| 2.43k|#define mlk_rej_uniform_avx2_asm MLK_NAMESPACE(rej_uniform_avx2_asm) | | ------------------ | | | | 63| 2.43k|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 2.43k|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 2.43k|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ return (int)mlk_rej_uniform_avx2_asm(r, buf, buflen, mlk_rej_uniform_table); ------------------ | | 17| 2.43k|#define mlk_rej_uniform_table MLK_NAMESPACE(rej_uniform_table) | | ------------------ | | | | 63| 2.43k|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 2.43k|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 2.43k|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 57| 2.43k|} compress.c:mlk_poly_compress_d4_native: 198| 128|{ 199| 128| if (!mlk_sys_check_capability(MLK_SYS_CAP_AVX2)) ------------------ | Branch (199:7): [True: 0, False: 128] ------------------ 200| 0| { 201| 0| return MLK_NATIVE_FUNC_FALLBACK; ------------------ | | 38| 0|#define MLK_NATIVE_FUNC_FALLBACK (-1) ------------------ 202| 0| } 203| | 204| 128| mlk_poly_compress_d4_avx2_asm(r, a, mlk_compress_d4_data); ------------------ | | 195| 128|#define mlk_poly_compress_d4_avx2_asm MLK_NAMESPACE(poly_compress_d4_avx2_asm) | | ------------------ | | | | 63| 128|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 128|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 128|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ mlk_poly_compress_d4_avx2_asm(r, a, mlk_compress_d4_data); ------------------ | | 19| 128|#define mlk_compress_d4_data MLK_NAMESPACE(compress_d4_data) | | ------------------ | | | | 63| 128|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 128|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 128|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 205| 128| return MLK_NATIVE_FUNC_SUCCESS; ------------------ | | 33| 128|#define MLK_NATIVE_FUNC_SUCCESS (0) ------------------ 206| 128|} compress.c:mlk_poly_compress_d10_native: 211| 324|{ 212| 324| if (!mlk_sys_check_capability(MLK_SYS_CAP_AVX2)) ------------------ | Branch (212:7): [True: 0, False: 324] ------------------ 213| 0| { 214| 0| return MLK_NATIVE_FUNC_FALLBACK; ------------------ | | 38| 0|#define MLK_NATIVE_FUNC_FALLBACK (-1) ------------------ 215| 0| } 216| | 217| 324| mlk_poly_compress_d10_avx2_asm(r, a, mlk_compress_d10_data); ------------------ | | 228| 324|#define mlk_poly_compress_d10_avx2_asm MLK_NAMESPACE(poly_compress_d10_avx2_asm) | | ------------------ | | | | 63| 324|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 324|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 324|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ mlk_poly_compress_d10_avx2_asm(r, a, mlk_compress_d10_data); ------------------ | | 25| 324|#define mlk_compress_d10_data MLK_NAMESPACE(compress_d10_data) | | ------------------ | | | | 63| 324|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 324|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 324|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 218| 324| return MLK_NATIVE_FUNC_SUCCESS; ------------------ | | 33| 324|#define MLK_NATIVE_FUNC_SUCCESS (0) ------------------ 219| 324|} compress.c:mlk_poly_decompress_d4_native: 224| 64|{ 225| 64| if (!mlk_sys_check_capability(MLK_SYS_CAP_AVX2)) ------------------ | Branch (225:7): [True: 0, False: 64] ------------------ 226| 0| { 227| 0| return MLK_NATIVE_FUNC_FALLBACK; ------------------ | | 38| 0|#define MLK_NATIVE_FUNC_FALLBACK (-1) ------------------ 228| 0| } 229| | 230| 64| mlk_poly_decompress_d4_avx2_asm(r, a, mlk_decompress_d4_data); ------------------ | | 212| 64| MLK_NAMESPACE(poly_decompress_d4_avx2_asm) | | ------------------ | | | | 63| 64|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 64|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 64|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ mlk_poly_decompress_d4_avx2_asm(r, a, mlk_decompress_d4_data); ------------------ | | 22| 64|#define mlk_decompress_d4_data MLK_NAMESPACE(decompress_d4_data) | | ------------------ | | | | 63| 64|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 64|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 64|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 231| 64| return MLK_NATIVE_FUNC_SUCCESS; ------------------ | | 33| 64|#define MLK_NATIVE_FUNC_SUCCESS (0) ------------------ 232| 64|} compress.c:mlk_poly_decompress_d10_native: 237| 162|{ 238| 162| if (!mlk_sys_check_capability(MLK_SYS_CAP_AVX2)) ------------------ | Branch (238:7): [True: 0, False: 162] ------------------ 239| 0| { 240| 0| return MLK_NATIVE_FUNC_FALLBACK; ------------------ | | 38| 0|#define MLK_NATIVE_FUNC_FALLBACK (-1) ------------------ 241| 0| } 242| | 243| 162| mlk_poly_decompress_d10_avx2_asm(r, a, mlk_decompress_d10_data); ------------------ | | 245| 162| MLK_NAMESPACE(poly_decompress_d10_avx2_asm) | | ------------------ | | | | 63| 162|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 162|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 162|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ mlk_poly_decompress_d10_avx2_asm(r, a, mlk_decompress_d10_data); ------------------ | | 28| 162|#define mlk_decompress_d10_data MLK_NAMESPACE(decompress_d10_data) | | ------------------ | | | | 63| 162|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 162|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 162|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 244| 162| return MLK_NATIVE_FUNC_SUCCESS; ------------------ | | 33| 162|#define MLK_NATIVE_FUNC_SUCCESS (0) ------------------ 245| 162|} compress.c:mlk_poly_tobytes_native: 171| 774|{ 172| 774| if (!mlk_sys_check_capability(MLK_SYS_CAP_AVX2)) ------------------ | Branch (172:7): [True: 0, False: 774] ------------------ 173| 0| { 174| 0| return MLK_NATIVE_FUNC_FALLBACK; ------------------ | | 38| 0|#define MLK_NATIVE_FUNC_FALLBACK (-1) ------------------ 175| 0| } 176| | 177| 774| mlk_ntttobytes_avx2_asm(r, a); ------------------ | | 157| 774|#define mlk_ntttobytes_avx2_asm MLK_NAMESPACE(ntttobytes_avx2_asm) | | ------------------ | | | | 63| 774|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 774|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 774|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 178| 774| return MLK_NATIVE_FUNC_SUCCESS; ------------------ | | 33| 774|#define MLK_NATIVE_FUNC_SUCCESS (0) ------------------ 179| 774|} compress.c:mlk_poly_frombytes_native: 184| 1.03k|{ 185| 1.03k| if (!mlk_sys_check_capability(MLK_SYS_CAP_AVX2)) ------------------ | Branch (185:7): [True: 0, False: 1.03k] ------------------ 186| 0| { 187| 0| return MLK_NATIVE_FUNC_FALLBACK; ------------------ | | 38| 0|#define MLK_NATIVE_FUNC_FALLBACK (-1) ------------------ 188| 0| } 189| | 190| 1.03k| mlk_nttfrombytes_avx2_asm(r, a); ------------------ | | 170| 1.03k|#define mlk_nttfrombytes_avx2_asm MLK_NAMESPACE(nttfrombytes_avx2_asm) | | ------------------ | | | | 63| 1.03k|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 1.03k|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 1.03k|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 191| 1.03k| return MLK_NATIVE_FUNC_SUCCESS; ------------------ | | 33| 1.03k|#define MLK_NATIVE_FUNC_SUCCESS (0) ------------------ 192| 1.03k|} indcpa.c:mlk_poly_permute_bitrev_to_custom: 39| 2.43k|{ 40| 2.43k| if (mlk_sys_check_capability(MLK_SYS_CAP_AVX2)) ------------------ | Branch (40:7): [True: 2.43k, False: 0] ------------------ 41| 2.43k| { 42| 2.43k| mlk_nttunpack_avx2_asm(data); ------------------ | | 65| 2.43k|#define mlk_nttunpack_avx2_asm MLK_NAMESPACE(nttunpack_avx2_asm) | | ------------------ | | | | 63| 2.43k|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 2.43k|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 2.43k|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 43| 2.43k| } 44| 2.43k|} poly.c:mlk_poly_tomont_native: 97| 258|{ 98| 258| if (!mlk_sys_check_capability(MLK_SYS_CAP_AVX2)) ------------------ | Branch (98:7): [True: 0, False: 258] ------------------ 99| 0| { 100| 0| return MLK_NATIVE_FUNC_FALLBACK; ------------------ | | 38| 0|#define MLK_NATIVE_FUNC_FALLBACK (-1) ------------------ 101| 0| } 102| | 103| 258| mlk_tomont_avx2_asm(data); ------------------ | | 183| 258|#define mlk_tomont_avx2_asm MLK_NAMESPACE(tomont_avx2_asm) | | ------------------ | | | | 63| 258|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 258|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 258|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 104| 258| return MLK_NATIVE_FUNC_SUCCESS; ------------------ | | 33| 258|#define MLK_NATIVE_FUNC_SUCCESS (0) ------------------ 105| 258|} poly.c:mlk_poly_reduce_native: 85| 1.55k|{ 86| 1.55k| if (!mlk_sys_check_capability(MLK_SYS_CAP_AVX2)) ------------------ | Branch (86:7): [True: 0, False: 1.55k] ------------------ 87| 0| { 88| 0| return MLK_NATIVE_FUNC_FALLBACK; ------------------ | | 38| 0|#define MLK_NATIVE_FUNC_FALLBACK (-1) ------------------ 89| 0| } 90| | 91| 1.55k| mlk_reduce_avx2_asm(data); ------------------ | | 80| 1.55k|#define mlk_reduce_avx2_asm MLK_NAMESPACE(reduce_avx2_asm) | | ------------------ | | | | 63| 1.55k|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 1.55k|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 1.55k|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 92| 1.55k| return MLK_NATIVE_FUNC_SUCCESS; ------------------ | | 33| 1.55k|#define MLK_NATIVE_FUNC_SUCCESS (0) ------------------ 93| 1.55k|} poly.c:mlk_poly_mulcache_compute_native: 110| 1.03k|{ 111| 1.03k| if (!mlk_sys_check_capability(MLK_SYS_CAP_AVX2)) ------------------ | Branch (111:7): [True: 0, False: 1.03k] ------------------ 112| 0| { 113| 0| return MLK_NATIVE_FUNC_FALLBACK; ------------------ | | 38| 0|#define MLK_NATIVE_FUNC_FALLBACK (-1) ------------------ 114| 0| } 115| | 116| 1.03k| mlk_poly_mulcache_compute_avx2_asm(x, y, mlk_qdata); ------------------ | | 92| 1.03k| MLK_NAMESPACE(poly_mulcache_compute_avx2_asm) | | ------------------ | | | | 63| 1.03k|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 1.03k|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 1.03k|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ mlk_poly_mulcache_compute_avx2_asm(x, y, mlk_qdata); ------------------ | | 21| 1.03k|#define mlk_qdata MLK_NAMESPACE(qdata) | | ------------------ | | | | 63| 1.03k|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 1.03k|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 1.03k|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 117| 1.03k| return MLK_NATIVE_FUNC_SUCCESS; ------------------ | | 33| 1.03k|#define MLK_NATIVE_FUNC_SUCCESS (0) ------------------ 118| 1.03k|} poly.c:mlk_ntt_native: 61| 1.29k|{ 62| 1.29k| if (!mlk_sys_check_capability(MLK_SYS_CAP_AVX2)) ------------------ | Branch (62:7): [True: 0, False: 1.29k] ------------------ 63| 0| { 64| 0| return MLK_NATIVE_FUNC_FALLBACK; ------------------ | | 38| 0|#define MLK_NATIVE_FUNC_FALLBACK (-1) ------------------ 65| 0| } 66| | 67| 1.29k| mlk_ntt_avx2_asm(data, mlk_qdata); ------------------ | | 36| 1.29k|#define mlk_ntt_avx2_asm MLK_NAMESPACE(ntt_avx2_asm) | | ------------------ | | | | 63| 1.29k|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 1.29k|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 1.29k|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ mlk_ntt_avx2_asm(data, mlk_qdata); ------------------ | | 21| 1.29k|#define mlk_qdata MLK_NAMESPACE(qdata) | | ------------------ | | | | 63| 1.29k|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 1.29k|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 1.29k|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 68| 1.29k| return MLK_NATIVE_FUNC_SUCCESS; ------------------ | | 33| 1.29k|#define MLK_NATIVE_FUNC_SUCCESS (0) ------------------ 69| 1.29k|} poly.c:mlk_intt_native: 73| 780|{ 74| 780| if (!mlk_sys_check_capability(MLK_SYS_CAP_AVX2)) ------------------ | Branch (74:7): [True: 0, False: 780] ------------------ 75| 0| { 76| 0| return MLK_NATIVE_FUNC_FALLBACK; ------------------ | | 38| 0|#define MLK_NATIVE_FUNC_FALLBACK (-1) ------------------ 77| 0| } 78| | 79| 780| mlk_invntt_avx2_asm(data, mlk_qdata); ------------------ | | 51| 780|#define mlk_invntt_avx2_asm MLK_NAMESPACE(invntt_avx2_asm) | | ------------------ | | | | 63| 780|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 780|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 780|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ mlk_invntt_avx2_asm(data, mlk_qdata); ------------------ | | 21| 780|#define mlk_qdata MLK_NAMESPACE(qdata) | | ------------------ | | | | 63| 780|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 780|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 780|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 80| 780| return MLK_NATIVE_FUNC_SUCCESS; ------------------ | | 33| 780|#define MLK_NATIVE_FUNC_SUCCESS (0) ------------------ 81| 780|} PQCP_MLKEM_NATIVE_MLKEM512_X86_64_poly_tomont: 132| 60|{ 133| 60|#if defined(MLK_USE_NATIVE_POLY_TOMONT) 134| 60| int ret; 135| 60| ret = mlk_poly_tomont_native(r->coeffs); 136| 60| if (ret == MLK_NATIVE_FUNC_SUCCESS) ------------------ | | 33| 60|#define MLK_NATIVE_FUNC_SUCCESS (0) ------------------ | Branch (136:7): [True: 60, False: 0] ------------------ 137| 60| { 138| 60| mlk_assert_abs_bound(r, MLKEM_N, MLKEM_Q); ------------------ | | 105| 60| do \ | | 106| 60| { \ | | 107| 60| } while (0) | | ------------------ | | | Branch (107:12): [Folded, False: 60] | | ------------------ ------------------ 139| 60| return; 140| 60| } 141| 0|#endif /* MLK_USE_NATIVE_POLY_TOMONT */ 142| | 143| 0| mlk_poly_tomont_c(r); 144| 0|} PQCP_MLKEM_NATIVE_MLKEM512_X86_64_poly_reduce: 211| 390|{ 212| 390|#if defined(MLK_USE_NATIVE_POLY_REDUCE) 213| 390| int ret; 214| 390| ret = mlk_poly_reduce_native(r->coeffs); 215| 390| if (ret == MLK_NATIVE_FUNC_SUCCESS) ------------------ | | 33| 390|#define MLK_NATIVE_FUNC_SUCCESS (0) ------------------ | Branch (215:7): [True: 390, False: 0] ------------------ 216| 390| { 217| 390| mlk_assert_bound(r, MLKEM_N, 0, MLKEM_Q); ------------------ | | 101| 390| do \ | | 102| 390| { \ | | 103| 390| } while (0) | | ------------------ | | | Branch (103:12): [Folded, False: 390] | | ------------------ ------------------ 218| 390| return; 219| 390| } 220| 0|#endif /* MLK_USE_NATIVE_POLY_REDUCE */ 221| | 222| 0| mlk_poly_reduce_c(r); 223| 0|} PQCP_MLKEM_NATIVE_MLKEM512_X86_64_poly_add: 230| 300|{ 231| 300| unsigned i; 232| 77.1k| for (i = 0; i < MLKEM_N; i++) ------------------ | | 22| 77.1k|#define MLKEM_N 256 ------------------ | Branch (232:15): [True: 76.8k, False: 300] ------------------ 233| 76.8k| __loop__( 234| 76.8k| invariant(i <= MLKEM_N) 235| 76.8k| invariant(forall(k0, i, MLKEM_N, r->coeffs[k0] == loop_entry(*r).coeffs[k0])) 236| 76.8k| invariant(forall(k1, 0, i, r->coeffs[k1] == loop_entry(*r).coeffs[k1] + b->coeffs[k1])) 237| 76.8k| decreases(MLKEM_N - i)) 238| 76.8k| { 239| | /* The preconditions imply that the addition stays within int16_t. */ 240| 76.8k| r->coeffs[i] = (int16_t)(r->coeffs[i] + b->coeffs[i]); 241| 76.8k| } 242| 300|} PQCP_MLKEM_NATIVE_MLKEM512_X86_64_poly_sub: 249| 30|{ 250| 30| unsigned i; 251| 7.71k| for (i = 0; i < MLKEM_N; i++) ------------------ | | 22| 7.71k|#define MLKEM_N 256 ------------------ | Branch (251:15): [True: 7.68k, False: 30] ------------------ 252| 7.68k| __loop__( 253| 7.68k| invariant(i <= MLKEM_N) 254| 7.68k| invariant(forall(k0, i, MLKEM_N, r->coeffs[k0] == loop_entry(*r).coeffs[k0])) 255| 7.68k| invariant(forall(k1, 0, i, r->coeffs[k1] == loop_entry(*r).coeffs[k1] - b->coeffs[k1])) 256| 7.68k| decreases(MLKEM_N - i)) 257| 7.68k| { 258| | /* The preconditions imply that the subtraction stays within int16_t. */ 259| 7.68k| r->coeffs[i] = (int16_t)(r->coeffs[i] - b->coeffs[i]); 260| 7.68k| } 261| 30|} PQCP_MLKEM_NATIVE_MLKEM512_X86_64_poly_mulcache_compute: 302| 240|{ 303| 240|#if defined(MLK_USE_NATIVE_POLY_MULCACHE_COMPUTE) 304| 240| int ret; 305| 240| ret = mlk_poly_mulcache_compute_native(x->coeffs, a->coeffs); 306| 240| if (ret == MLK_NATIVE_FUNC_SUCCESS) ------------------ | | 33| 240|#define MLK_NATIVE_FUNC_SUCCESS (0) ------------------ | Branch (306:7): [True: 240, False: 0] ------------------ 307| 240| { 308| 240| return; 309| 240| } 310| 0|#endif /* MLK_USE_NATIVE_POLY_MULCACHE_COMPUTE */ 311| | 312| 0| mlk_poly_mulcache_compute_c(x, a); 313| 0|} PQCP_MLKEM_NATIVE_MLKEM512_X86_64_poly_ntt: 457| 300|{ 458| 300|#if defined(MLK_USE_NATIVE_NTT) 459| 300| int ret; 460| 300| mlk_assert_abs_bound(r, MLKEM_N, MLKEM_Q); ------------------ | | 105| 300| do \ | | 106| 300| { \ | | 107| 300| } while (0) | | ------------------ | | | Branch (107:12): [Folded, False: 300] | | ------------------ ------------------ 461| 300| ret = mlk_ntt_native(r->coeffs); 462| 300| if (ret == MLK_NATIVE_FUNC_SUCCESS) ------------------ | | 33| 300|#define MLK_NATIVE_FUNC_SUCCESS (0) ------------------ | Branch (462:7): [True: 300, False: 0] ------------------ 463| 300| { 464| 300| mlk_assert_abs_bound(r, MLKEM_N, MLK_NTT_BOUND); ------------------ | | 105| 300| do \ | | 106| 300| { \ | | 107| 300| } while (0) | | ------------------ | | | Branch (107:12): [Folded, False: 300] | | ------------------ ------------------ 465| 300| return; 466| 300| } 467| 0|#endif /* MLK_USE_NATIVE_NTT */ 468| | 469| 0| mlk_poly_ntt_c(r); 470| 0|} PQCP_MLKEM_NATIVE_MLKEM512_X86_64_poly_invntt_tomont: 558| 210|{ 559| 210|#if defined(MLK_USE_NATIVE_INTT) 560| 210| int ret; 561| 210| ret = mlk_intt_native(r->coeffs); 562| 210| if (ret == MLK_NATIVE_FUNC_SUCCESS) ------------------ | | 33| 210|#define MLK_NATIVE_FUNC_SUCCESS (0) ------------------ | Branch (562:7): [True: 210, False: 0] ------------------ 563| 210| { 564| 210| mlk_assert_abs_bound(r, MLKEM_N, MLK_INVNTT_BOUND); ------------------ | | 105| 210| do \ | | 106| 210| { \ | | 107| 210| } while (0) | | ------------------ | | | Branch (107:12): [Folded, False: 210] | | ------------------ ------------------ 565| 210| return; 566| 210| } 567| 0|#endif /* MLK_USE_NATIVE_INTT */ 568| | 569| 0| mlk_poly_invntt_tomont_c(r); 570| 0|} PQCP_MLKEM_NATIVE_MLKEM512_X86_64_polyvec_compress_du: 50| 60|{ 51| 60| unsigned i; 52| 60| mlk_assert_bound_2d(a->vec, MLKEM_K, MLKEM_N, 0, MLKEM_Q); ------------------ | | 110| 60| do \ | | 111| 60| { \ | | 112| 60| } while (0) | | ------------------ | | | Branch (112:12): [Folded, False: 60] | | ------------------ ------------------ 53| | 54| 180| for (i = 0; i < MLKEM_K; i++) ------------------ | | 13| 180|#define MLKEM_K 2 ------------------ | Branch (54:15): [True: 120, False: 60] ------------------ 55| 120| { 56| 120| mlk_poly_compress_du(r + i * MLKEM_POLYCOMPRESSEDBYTES_DU, &a->vec[i]); ------------------ | | 49| 120|#define mlk_poly_compress_du MLK_NAMESPACE_K(poly_compress_du) | | ------------------ | | | | 64| 120|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 120|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 120|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ mlk_poly_compress_du(r + i * MLKEM_POLYCOMPRESSEDBYTES_DU, &a->vec[i]); ------------------ | | 43| 120|#define MLKEM_POLYCOMPRESSEDBYTES_DU MLKEM_POLYCOMPRESSEDBYTES_D10 | | ------------------ | | | | 35| 120|#define MLKEM_POLYCOMPRESSEDBYTES_D10 320 | | ------------------ ------------------ 57| 120| } 58| 60|} PQCP_MLKEM_NATIVE_MLKEM512_X86_64_polyvec_decompress_du: 64| 30|{ 65| 30| unsigned i; 66| 90| for (i = 0; i < MLKEM_K; i++) ------------------ | | 13| 90|#define MLKEM_K 2 ------------------ | Branch (66:15): [True: 60, False: 30] ------------------ 67| 60| { 68| 60| mlk_poly_decompress_du(&r->vec[i], a + i * MLKEM_POLYCOMPRESSEDBYTES_DU); ------------------ | | 79| 60|#define mlk_poly_decompress_du MLK_NAMESPACE_K(poly_decompress_du) | | ------------------ | | | | 64| 60|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 60|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 60|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ mlk_poly_decompress_du(&r->vec[i], a + i * MLKEM_POLYCOMPRESSEDBYTES_DU); ------------------ | | 43| 60|#define MLKEM_POLYCOMPRESSEDBYTES_DU MLKEM_POLYCOMPRESSEDBYTES_D10 | | ------------------ | | | | 35| 60|#define MLKEM_POLYCOMPRESSEDBYTES_D10 320 | | ------------------ ------------------ 69| 60| } 70| | 71| 30| mlk_assert_bound_2d(r->vec, MLKEM_K, MLKEM_N, 0, MLKEM_Q); ------------------ | | 110| 30| do \ | | 111| 30| { \ | | 112| 30| } while (0) | | ------------------ | | | Branch (112:12): [Folded, False: 30] | | ------------------ ------------------ 72| 30|} PQCP_MLKEM_NATIVE_MLKEM512_X86_64_polyvec_tobytes: 81| 90|{ 82| 90| unsigned i; 83| 90| mlk_assert_bound_2d(a->vec, MLKEM_K, MLKEM_N, 0, MLKEM_Q); ------------------ | | 110| 90| do \ | | 111| 90| { \ | | 112| 90| } while (0) | | ------------------ | | | Branch (112:12): [Folded, False: 90] | | ------------------ ------------------ 84| | 85| 270| for (i = 0; i < MLKEM_K; i++) ------------------ | | 13| 270|#define MLKEM_K 2 ------------------ | Branch (85:15): [True: 180, False: 90] ------------------ 86| 180| __loop__( 87| 180| assigns(i, memory_slice(r, MLKEM_POLYVECBYTES)) 88| 180| invariant(i <= MLKEM_K) 89| 180| decreases(MLKEM_K - i) 90| 180| ) 91| 180| { 92| 180| mlk_poly_tobytes(&r[i * MLKEM_POLYBYTES], &a->vec[i]); ------------------ | | 512| 180|#define mlk_poly_tobytes MLK_NAMESPACE(poly_tobytes) | | ------------------ | | | | 63| 180|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 180|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 180|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ mlk_poly_tobytes(&r[i * MLKEM_POLYBYTES], &a->vec[i]); ------------------ | | 30| 180|#define MLKEM_POLYBYTES 384 ------------------ 93| 180| } 94| 90|} PQCP_MLKEM_NATIVE_MLKEM512_X86_64_polyvec_frombytes: 99| 120|{ 100| 120| unsigned i; 101| 360| for (i = 0; i < MLKEM_K; i++) ------------------ | | 13| 360|#define MLKEM_K 2 ------------------ | Branch (101:15): [True: 240, False: 120] ------------------ 102| 240| { 103| 240| mlk_poly_frombytes(&r->vec[i], a + i * MLKEM_POLYBYTES); ------------------ | | 534| 240|#define mlk_poly_frombytes MLK_NAMESPACE(poly_frombytes) | | ------------------ | | | | 63| 240|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 240|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 240|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ mlk_poly_frombytes(&r->vec[i], a + i * MLKEM_POLYBYTES); ------------------ | | 30| 240|#define MLKEM_POLYBYTES 384 ------------------ 104| 240| } 105| | 106| 120| mlk_assert_bound_2d(r->vec, MLKEM_K, MLKEM_N, 0, MLKEM_UINT12_LIMIT); ------------------ | | 110| 120| do \ | | 111| 120| { \ | | 112| 120| } while (0) | | ------------------ | | | Branch (112:12): [Folded, False: 120] | | ------------------ ------------------ 107| 120|} PQCP_MLKEM_NATIVE_MLKEM512_X86_64_polyvec_ntt: 112| 150|{ 113| 150| unsigned i; 114| 450| for (i = 0; i < MLKEM_K; i++) ------------------ | | 13| 450|#define MLKEM_K 2 ------------------ | Branch (114:15): [True: 300, False: 150] ------------------ 115| 300| { 116| 300| mlk_poly_ntt(&r->vec[i]); ------------------ | | 235| 300|#define mlk_poly_ntt MLK_NAMESPACE(poly_ntt) | | ------------------ | | | | 63| 300|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 300|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 300|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 117| 300| } 118| | 119| 150| mlk_assert_abs_bound_2d(r->vec, MLKEM_K, MLKEM_N, MLK_NTT_BOUND); ------------------ | | 115| 150| do \ | | 116| 150| { \ | | 117| 150| } while (0) | | ------------------ | | | Branch (117:12): [Folded, False: 150] | | ------------------ ------------------ 120| 150|} PQCP_MLKEM_NATIVE_MLKEM512_X86_64_polyvec_invntt_tomont: 129| 60|{ 130| 60| unsigned i; 131| 180| for (i = 0; i < MLKEM_K; i++) ------------------ | | 13| 180|#define MLKEM_K 2 ------------------ | Branch (131:15): [True: 120, False: 60] ------------------ 132| 120| { 133| 120| mlk_poly_invntt_tomont(&r->vec[i]); ------------------ | | 263| 120|#define mlk_poly_invntt_tomont MLK_NAMESPACE(poly_invntt_tomont) | | ------------------ | | | | 63| 120|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 120|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 120|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 134| 120| } 135| | 136| 60| mlk_assert_abs_bound_2d(r->vec, MLKEM_K, MLKEM_N, MLK_INVNTT_BOUND); ------------------ | | 115| 60| do \ | | 116| 60| { \ | | 117| 60| } while (0) | | ------------------ | | | Branch (117:12): [Folded, False: 60] | | ------------------ ------------------ 137| 60|} PQCP_MLKEM_NATIVE_MLKEM512_X86_64_polyvec_basemul_acc_montgomery_cached: 195| 270|{ 196| 270|#if defined(MLK_USE_NATIVE_POLYVEC_BASEMUL_ACC_MONTGOMERY_CACHED) 197| 270| { 198| 270| int ret; 199| 270| mlk_assert_bound_2d(a->vec, MLKEM_K, MLKEM_N, 0, MLKEM_UINT12_LIMIT); ------------------ | | 110| 270| do \ | | 111| 270| { \ | | 112| 270| } while (0) | | ------------------ | | | Branch (112:12): [Folded, False: 270] | | ------------------ ------------------ 200| 270|#if MLKEM_K == 2 201| 270| ret = mlk_polyvec_basemul_acc_montgomery_cached_k2_native( 202| 270| r->coeffs, (const int16_t *)a, (const int16_t *)b, 203| 270| (const int16_t *)b_cache); 204| |#elif MLKEM_K == 3 205| | ret = mlk_polyvec_basemul_acc_montgomery_cached_k3_native( 206| | r->coeffs, (const int16_t *)a, (const int16_t *)b, 207| | (const int16_t *)b_cache); 208| |#elif MLKEM_K == 4 209| | ret = mlk_polyvec_basemul_acc_montgomery_cached_k4_native( 210| | r->coeffs, (const int16_t *)a, (const int16_t *)b, 211| | (const int16_t *)b_cache); 212| |#endif 213| 270| if (ret == MLK_NATIVE_FUNC_SUCCESS) ------------------ | | 33| 270|#define MLK_NATIVE_FUNC_SUCCESS (0) ------------------ | Branch (213:9): [True: 270, False: 0] ------------------ 214| 270| { 215| 270| return; 216| 270| } 217| 270| } 218| 0|#endif /* MLK_USE_NATIVE_POLYVEC_BASEMUL_ACC_MONTGOMERY_CACHED */ 219| | 220| 0| mlk_polyvec_basemul_acc_montgomery_cached_c(r, a, b, b_cache); ------------------ | | 39| 0| MLK_ADD_PARAM_SET(mlk_polyvec_basemul_acc_montgomery_cached_c) | | ------------------ | | | | 48| 0|#define MLK_ADD_PARAM_SET(s) s | | ------------------ ------------------ 221| 0|} PQCP_MLKEM_NATIVE_MLKEM512_X86_64_polyvec_mulcache_compute: 229| 120|{ 230| 120| unsigned i; 231| 360| for (i = 0; i < MLKEM_K; i++) ------------------ | | 13| 360|#define MLKEM_K 2 ------------------ | Branch (231:15): [True: 240, False: 120] ------------------ 232| 240| { 233| 240| mlk_poly_mulcache_compute(&x->vec[i], &a->vec[i]); ------------------ | | 123| 240|#define mlk_poly_mulcache_compute MLK_NAMESPACE(poly_mulcache_compute) | | ------------------ | | | | 63| 240|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 240|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 240|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 234| 240| } 235| 120|} PQCP_MLKEM_NATIVE_MLKEM512_X86_64_polyvec_reduce: 246| 150|{ 247| 150| unsigned i; 248| 450| for (i = 0; i < MLKEM_K; i++) ------------------ | | 13| 450|#define MLKEM_K 2 ------------------ | Branch (248:15): [True: 300, False: 150] ------------------ 249| 300| { 250| 300| mlk_poly_reduce(&r->vec[i]); ------------------ | | 154| 300|#define mlk_poly_reduce MLK_NAMESPACE(poly_reduce) | | ------------------ | | | | 63| 300|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 300|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 300|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 251| 300| } 252| | 253| 150| mlk_assert_bound_2d(r->vec, MLKEM_K, MLKEM_N, 0, MLKEM_Q); ------------------ | | 110| 150| do \ | | 111| 150| { \ | | 112| 150| } while (0) | | ------------------ | | | Branch (112:12): [Folded, False: 150] | | ------------------ ------------------ 254| 150|} PQCP_MLKEM_NATIVE_MLKEM512_X86_64_polyvec_add: 261| 90|{ 262| 90| unsigned i; 263| 270| for (i = 0; i < MLKEM_K; i++) ------------------ | | 13| 270|#define MLKEM_K 2 ------------------ | Branch (263:15): [True: 180, False: 90] ------------------ 264| 180| __loop__( 265| 180| assigns(i, memory_slice(r, sizeof(mlk_polyvec))) 266| 180| invariant(i <= MLKEM_K) 267| 180| invariant(forall(j0, i, MLKEM_K, 268| 180| forall(k0, 0, MLKEM_N, 269| 180| ((int32_t)r->vec[j0].coeffs[k0] + b->vec[j0].coeffs[k0] <= INT16_MAX) && 270| 180| ((int32_t)r->vec[j0].coeffs[k0] + b->vec[j0].coeffs[k0] >= INT16_MIN)))) 271| 180| invariant(forall(j2, 0, i, 272| 180| forall(k2, 0, MLKEM_N, 273| 180| (r->vec[j2].coeffs[k2] <= INT16_MAX) && 274| 180| (r->vec[j2].coeffs[k2] >= INT16_MIN)))) 275| 180| decreases(MLKEM_K - i) 276| 180| ) 277| 180| { 278| 180| mlk_poly_add(&r->vec[i], &b->vec[i]); ------------------ | | 181| 180|#define mlk_poly_add MLK_NAMESPACE(poly_add) | | ------------------ | | | | 63| 180|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 180|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 180|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 279| 180| } 280| 90|} PQCP_MLKEM_NATIVE_MLKEM512_X86_64_polyvec_tomont: 285| 30|{ 286| 30| unsigned i; 287| 90| for (i = 0; i < MLKEM_K; i++) ------------------ | | 13| 90|#define MLKEM_K 2 ------------------ | Branch (287:15): [True: 60, False: 30] ------------------ 288| 60| { 289| 60| mlk_poly_tomont(&r->vec[i]); ------------------ | | 102| 60|#define mlk_poly_tomont MLK_NAMESPACE(poly_tomont) | | ------------------ | | | | 63| 60|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 60|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 60|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 290| 60| } 291| | 292| 30| mlk_assert_abs_bound_2d(r->vec, MLKEM_K, MLKEM_N, MLKEM_Q); ------------------ | | 115| 30| do \ | | 116| 30| { \ | | 117| 30| } while (0) | | ------------------ | | | Branch (117:12): [Folded, False: 30] | | ------------------ ------------------ 293| 30|} PQCP_MLKEM_NATIVE_MLKEM512_X86_64_poly_getnoise_eta1_4x: 337| 30|{ 338| 30| MLK_ALIGN uint8_t buf[4][MLK_ALIGN_UP(MLKEM_ETA1 * MLKEM_N / 4)]; ------------------ | | 190| 30|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) ------------------ 339| 30| MLK_ALIGN uint8_t extkey[4][MLK_ALIGN_UP(MLKEM_SYMBYTES + 1)]; ------------------ | | 190| 30|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) ------------------ 340| 30| mlk_memcpy(extkey[0], seed, MLKEM_SYMBYTES); ------------------ | | 168| 30|#define mlk_memcpy memcpy ------------------ mlk_memcpy(extkey[0], seed, MLKEM_SYMBYTES); ------------------ | | 27| 30|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 341| 30| mlk_memcpy(extkey[1], seed, MLKEM_SYMBYTES); ------------------ | | 168| 30|#define mlk_memcpy memcpy ------------------ mlk_memcpy(extkey[1], seed, MLKEM_SYMBYTES); ------------------ | | 27| 30|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 342| 30| mlk_memcpy(extkey[2], seed, MLKEM_SYMBYTES); ------------------ | | 168| 30|#define mlk_memcpy memcpy ------------------ mlk_memcpy(extkey[2], seed, MLKEM_SYMBYTES); ------------------ | | 27| 30|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 343| 30| mlk_memcpy(extkey[3], seed, MLKEM_SYMBYTES); ------------------ | | 168| 30|#define mlk_memcpy memcpy ------------------ mlk_memcpy(extkey[3], seed, MLKEM_SYMBYTES); ------------------ | | 27| 30|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 344| 30| extkey[0][MLKEM_SYMBYTES] = nonce0; ------------------ | | 27| 30|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 345| 30| extkey[1][MLKEM_SYMBYTES] = nonce1; ------------------ | | 27| 30|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 346| 30| extkey[2][MLKEM_SYMBYTES] = nonce2; ------------------ | | 27| 30|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 347| 30| extkey[3][MLKEM_SYMBYTES] = nonce3; ------------------ | | 27| 30|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 348| | 349| 30|#if !defined(FIPS202_X4_DEFAULT_IMPLEMENTATION) && \ 350| 30| !defined(MLK_CONFIG_SERIAL_FIPS202_ONLY) 351| 30| mlk_prf_eta1_x4(buf, extkey); ------------------ | | 45| 30| mlk_shake256x4((OUT)[0], (OUT)[1], (OUT)[2], (OUT)[3], \ | | ------------------ | | | | 18| 30|#define mlk_shake256x4 shake256x4 | | | | ------------------ | | | | | | 36| 30|#define shake256x4 OQS_SHA3_shake256_x4 | | | | ------------------ | | ------------------ | | 46| 30| (MLKEM_ETA1 * MLKEM_N / 4), (IN)[0], (IN)[1], (IN)[2], \ | | ------------------ | | | | 39| 30|#define MLKEM_ETA1 3 | | ------------------ | | (MLKEM_ETA1 * MLKEM_N / 4), (IN)[0], (IN)[1], (IN)[2], \ | | ------------------ | | | | 22| 30|#define MLKEM_N 256 | | ------------------ | | 47| 30| (IN)[3], MLKEM_SYMBYTES + 1) | | ------------------ | | | | 27| 30|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ | | ------------------ ------------------ 352| |#else 353| | mlk_prf_eta1(buf[0], extkey[0]); 354| | mlk_prf_eta1(buf[1], extkey[1]); 355| | mlk_prf_eta1(buf[2], extkey[2]); 356| | if (r3 != NULL) 357| | { 358| | mlk_prf_eta1(buf[3], extkey[3]); 359| | } 360| |#endif /* !(!FIPS202_X4_DEFAULT_IMPLEMENTATION && \ 361| | !MLK_CONFIG_SERIAL_FIPS202_ONLY) */ 362| | 363| 30| mlk_poly_cbd_eta1(r0, buf[0]); ------------------ | | 36| 30|#define mlk_poly_cbd_eta1 MLK_ADD_PARAM_SET(mlk_poly_cbd_eta1) | | ------------------ | | | | 48| 30|#define MLK_ADD_PARAM_SET(s) s | | ------------------ ------------------ 364| 30| mlk_poly_cbd_eta1(r1, buf[1]); ------------------ | | 36| 30|#define mlk_poly_cbd_eta1 MLK_ADD_PARAM_SET(mlk_poly_cbd_eta1) | | ------------------ | | | | 48| 30|#define MLK_ADD_PARAM_SET(s) s | | ------------------ ------------------ 365| 30| mlk_poly_cbd_eta1(r2, buf[2]); ------------------ | | 36| 30|#define mlk_poly_cbd_eta1 MLK_ADD_PARAM_SET(mlk_poly_cbd_eta1) | | ------------------ | | | | 48| 30|#define MLK_ADD_PARAM_SET(s) s | | ------------------ ------------------ 366| 30| if (r3 != NULL) ------------------ | Branch (366:7): [True: 30, False: 0] ------------------ 367| 30| { 368| 30| mlk_poly_cbd_eta1(r3, buf[3]); ------------------ | | 36| 30|#define mlk_poly_cbd_eta1 MLK_ADD_PARAM_SET(mlk_poly_cbd_eta1) | | ------------------ | | | | 48| 30|#define MLK_ADD_PARAM_SET(s) s | | ------------------ ------------------ 369| 30| mlk_assert_abs_bound(r3, MLKEM_N, MLKEM_ETA1 + 1); ------------------ | | 105| 30| do \ | | 106| 30| { \ | | 107| 30| } while (0) | | ------------------ | | | Branch (107:12): [Folded, False: 30] | | ------------------ ------------------ 370| 30| } 371| | 372| 30| mlk_assert_abs_bound(r0, MLKEM_N, MLKEM_ETA1 + 1); ------------------ | | 105| 30| do \ | | 106| 30| { \ | | 107| 30| } while (0) | | ------------------ | | | Branch (107:12): [Folded, False: 30] | | ------------------ ------------------ 373| 30| mlk_assert_abs_bound(r1, MLKEM_N, MLKEM_ETA1 + 1); ------------------ | | 105| 30| do \ | | 106| 30| { \ | | 107| 30| } while (0) | | ------------------ | | | Branch (107:12): [Folded, False: 30] | | ------------------ ------------------ 374| 30| mlk_assert_abs_bound(r2, MLKEM_N, MLKEM_ETA1 + 1); ------------------ | | 105| 30| do \ | | 106| 30| { \ | | 107| 30| } while (0) | | ------------------ | | | Branch (107:12): [Folded, False: 30] | | ------------------ ------------------ 375| | 376| | /* Specification: Partially implements 377| | * @[FIPS203, Section 3.3, Destruction of intermediate values] */ 378| 30| mlk_zeroize(buf, sizeof(buf)); 379| 30| mlk_zeroize(extkey, sizeof(extkey)); 380| 30|} PQCP_MLKEM_NATIVE_MLKEM512_X86_64_poly_getnoise_eta2: 417| 60|{ 418| 60| MLK_ALIGN uint8_t buf[MLKEM_ETA2 * MLKEM_N / 4]; ------------------ | | 190| 60|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) ------------------ 419| 60| MLK_ALIGN uint8_t extkey[MLKEM_SYMBYTES + 1]; ------------------ | | 190| 60|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) ------------------ 420| | 421| 60| mlk_memcpy(extkey, seed, MLKEM_SYMBYTES); ------------------ | | 168| 60|#define mlk_memcpy memcpy ------------------ mlk_memcpy(extkey, seed, MLKEM_SYMBYTES); ------------------ | | 27| 60|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 422| 60| extkey[MLKEM_SYMBYTES] = nonce; ------------------ | | 27| 60|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 423| 60| mlk_prf_eta2(buf, extkey); ------------------ | | 43| 60|#define mlk_prf_eta2(OUT, IN) mlk_prf_eta(MLKEM_ETA2, OUT, IN) | | ------------------ | | | | 41| 60| mlk_shake256(OUT, (ETA) * MLKEM_N / 4, IN, MLKEM_SYMBYTES + 1) | | | | ------------------ | | | | | | 18| 60|#define mlk_shake256 shake256 | | | | | | ------------------ | | | | | | | | 12| 60|#define shake256 OQS_SHA3_shake256 | | | | | | ------------------ | | | | ------------------ | | | | mlk_shake256(OUT, (ETA) * MLKEM_N / 4, IN, MLKEM_SYMBYTES + 1) | | | | ------------------ | | | | | | 22| 60|#define MLKEM_N 256 | | | | ------------------ | | | | mlk_shake256(OUT, (ETA) * MLKEM_N / 4, IN, MLKEM_SYMBYTES + 1) | | | | ------------------ | | | | | | 27| 60|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ | | | | ------------------ | | ------------------ ------------------ 424| | 425| 60| mlk_poly_cbd_eta2(r, buf); ------------------ | | 37| 60|#define mlk_poly_cbd_eta2 MLK_ADD_PARAM_SET(mlk_poly_cbd_eta2) | | ------------------ | | | | 48| 60|#define MLK_ADD_PARAM_SET(s) s | | ------------------ ------------------ 426| | 427| 60| mlk_assert_abs_bound(r, MLKEM_N, MLKEM_ETA2 + 1); ------------------ | | 105| 60| do \ | | 106| 60| { \ | | 107| 60| } while (0) | | ------------------ | | | Branch (107:12): [Folded, False: 60] | | ------------------ ------------------ 428| | 429| | /* Specification: Partially implements 430| | * @[FIPS203, Section 3.3, Destruction of intermediate values] */ 431| 60| mlk_zeroize(buf, sizeof(buf)); 432| 60| mlk_zeroize(extkey, sizeof(extkey)); 433| 60|} PQCP_MLKEM_NATIVE_MLKEM512_X86_64_poly_getnoise_eta1122_4x: 450| 60|{ 451| |#if MLKEM_ETA2 >= MLKEM_ETA1 452| |#error mlk_poly_getnoise_eta1122_4x assumes MLKEM_ETA1 > MLKEM_ETA2 453| |#endif 454| 60| MLK_ALIGN uint8_t buf[4][MLK_ALIGN_UP(MLKEM_ETA1 * MLKEM_N / 4)]; ------------------ | | 190| 60|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) ------------------ 455| 60| MLK_ALIGN uint8_t extkey[4][MLK_ALIGN_UP(MLKEM_SYMBYTES + 1)]; ------------------ | | 190| 60|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) ------------------ 456| | 457| 60| mlk_memcpy(extkey[0], seed, MLKEM_SYMBYTES); ------------------ | | 168| 60|#define mlk_memcpy memcpy ------------------ mlk_memcpy(extkey[0], seed, MLKEM_SYMBYTES); ------------------ | | 27| 60|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 458| 60| mlk_memcpy(extkey[1], seed, MLKEM_SYMBYTES); ------------------ | | 168| 60|#define mlk_memcpy memcpy ------------------ mlk_memcpy(extkey[1], seed, MLKEM_SYMBYTES); ------------------ | | 27| 60|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 459| 60| mlk_memcpy(extkey[2], seed, MLKEM_SYMBYTES); ------------------ | | 168| 60|#define mlk_memcpy memcpy ------------------ mlk_memcpy(extkey[2], seed, MLKEM_SYMBYTES); ------------------ | | 27| 60|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 460| 60| mlk_memcpy(extkey[3], seed, MLKEM_SYMBYTES); ------------------ | | 168| 60|#define mlk_memcpy memcpy ------------------ mlk_memcpy(extkey[3], seed, MLKEM_SYMBYTES); ------------------ | | 27| 60|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 461| 60| extkey[0][MLKEM_SYMBYTES] = nonce0; ------------------ | | 27| 60|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 462| 60| extkey[1][MLKEM_SYMBYTES] = nonce1; ------------------ | | 27| 60|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 463| 60| extkey[2][MLKEM_SYMBYTES] = nonce2; ------------------ | | 27| 60|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 464| 60| extkey[3][MLKEM_SYMBYTES] = nonce3; ------------------ | | 27| 60|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 465| | 466| | /* On systems with fast batched Keccak, we use 4-fold batched PRF, 467| | * even though that means generating more random data in buf[2] and buf[3] 468| | * than necessary. */ 469| 60|#if !defined(FIPS202_X4_DEFAULT_IMPLEMENTATION) && \ 470| 60| !defined(MLK_CONFIG_SERIAL_FIPS202_ONLY) 471| 60| mlk_prf_eta1_x4(buf, extkey); ------------------ | | 45| 60| mlk_shake256x4((OUT)[0], (OUT)[1], (OUT)[2], (OUT)[3], \ | | ------------------ | | | | 18| 60|#define mlk_shake256x4 shake256x4 | | | | ------------------ | | | | | | 36| 60|#define shake256x4 OQS_SHA3_shake256_x4 | | | | ------------------ | | ------------------ | | 46| 60| (MLKEM_ETA1 * MLKEM_N / 4), (IN)[0], (IN)[1], (IN)[2], \ | | ------------------ | | | | 39| 60|#define MLKEM_ETA1 3 | | ------------------ | | (MLKEM_ETA1 * MLKEM_N / 4), (IN)[0], (IN)[1], (IN)[2], \ | | ------------------ | | | | 22| 60|#define MLKEM_N 256 | | ------------------ | | 47| 60| (IN)[3], MLKEM_SYMBYTES + 1) | | ------------------ | | | | 27| 60|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ | | ------------------ ------------------ 472| |#else 473| | mlk_prf_eta1(buf[0], extkey[0]); 474| | mlk_prf_eta1(buf[1], extkey[1]); 475| | mlk_prf_eta2(buf[2], extkey[2]); 476| | mlk_prf_eta2(buf[3], extkey[3]); 477| |#endif /* !(!FIPS202_X4_DEFAULT_IMPLEMENTATION && \ 478| | !MLK_CONFIG_SERIAL_FIPS202_ONLY) */ 479| | 480| 60| mlk_poly_cbd_eta1(r0, buf[0]); ------------------ | | 36| 60|#define mlk_poly_cbd_eta1 MLK_ADD_PARAM_SET(mlk_poly_cbd_eta1) | | ------------------ | | | | 48| 60|#define MLK_ADD_PARAM_SET(s) s | | ------------------ ------------------ 481| 60| mlk_poly_cbd_eta1(r1, buf[1]); ------------------ | | 36| 60|#define mlk_poly_cbd_eta1 MLK_ADD_PARAM_SET(mlk_poly_cbd_eta1) | | ------------------ | | | | 48| 60|#define MLK_ADD_PARAM_SET(s) s | | ------------------ ------------------ 482| 60| mlk_poly_cbd_eta2(r2, buf[2]); ------------------ | | 37| 60|#define mlk_poly_cbd_eta2 MLK_ADD_PARAM_SET(mlk_poly_cbd_eta2) | | ------------------ | | | | 48| 60|#define MLK_ADD_PARAM_SET(s) s | | ------------------ ------------------ 483| 60| mlk_poly_cbd_eta2(r3, buf[3]); ------------------ | | 37| 60|#define mlk_poly_cbd_eta2 MLK_ADD_PARAM_SET(mlk_poly_cbd_eta2) | | ------------------ | | | | 48| 60|#define MLK_ADD_PARAM_SET(s) s | | ------------------ ------------------ 484| | 485| 60| mlk_assert_abs_bound(r0, MLKEM_N, MLKEM_ETA1 + 1); ------------------ | | 105| 60| do \ | | 106| 60| { \ | | 107| 60| } while (0) | | ------------------ | | | Branch (107:12): [Folded, False: 60] | | ------------------ ------------------ 486| 60| mlk_assert_abs_bound(r1, MLKEM_N, MLKEM_ETA1 + 1); ------------------ | | 105| 60| do \ | | 106| 60| { \ | | 107| 60| } while (0) | | ------------------ | | | Branch (107:12): [Folded, False: 60] | | ------------------ ------------------ 487| 60| mlk_assert_abs_bound(r2, MLKEM_N, MLKEM_ETA2 + 1); ------------------ | | 105| 60| do \ | | 106| 60| { \ | | 107| 60| } while (0) | | ------------------ | | | Branch (107:12): [Folded, False: 60] | | ------------------ ------------------ 488| 60| mlk_assert_abs_bound(r3, MLKEM_N, MLKEM_ETA2 + 1); ------------------ | | 105| 60| do \ | | 106| 60| { \ | | 107| 60| } while (0) | | ------------------ | | | Branch (107:12): [Folded, False: 60] | | ------------------ ------------------ 489| | 490| | /* Specification: Partially implements 491| | * @[FIPS203, Section 3.3, Destruction of intermediate values] */ 492| 60| mlk_zeroize(buf, sizeof(buf)); 493| 60| mlk_zeroize(extkey, sizeof(extkey)); 494| 60|} poly_k.c:PQCP_MLKEM_NATIVE_MLKEM512_X86_64_poly_compress_du: 69| 120|{ 70| 120|#if MLKEM_DU == 10 71| 120| mlk_poly_compress_d10(r, a); ------------------ | | 357| 120|#define mlk_poly_compress_d10 MLK_NAMESPACE(poly_compress_d10) | | ------------------ | | | | 63| 120|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 120|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 120|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 72| |#elif MLKEM_DU == 11 73| | mlk_poly_compress_d11(r, a); 74| |#else 75| |#error "Invalid value of MLKEM_DU" 76| |#endif 77| 120|} poly_k.c:PQCP_MLKEM_NATIVE_MLKEM512_X86_64_poly_decompress_du: 102| 60|{ 103| 60|#if MLKEM_DU == 10 104| 60| mlk_poly_decompress_d10(r, a); ------------------ | | 400| 60|#define mlk_poly_decompress_d10 MLK_NAMESPACE(poly_decompress_d10) | | ------------------ | | | | 63| 60|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 60|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 60|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 105| |#elif MLKEM_DU == 11 106| | mlk_poly_decompress_d11(r, a); 107| |#else 108| |#error "Invalid value of MLKEM_DU" 109| |#endif 110| 60|} indcpa.c:PQCP_MLKEM_NATIVE_MLKEM512_X86_64_poly_compress_dv: 132| 60|{ 133| 60|#if MLKEM_DV == 4 134| 60| mlk_poly_compress_d4(r, a); ------------------ | | 337| 60|#define mlk_poly_compress_d4 MLK_NAMESPACE(poly_compress_d4) | | ------------------ | | | | 63| 60|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 60|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 60|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 135| |#elif MLKEM_DV == 5 136| | mlk_poly_compress_d5(r, a); 137| |#else 138| |#error "Invalid value of MLKEM_DV" 139| |#endif 140| 60|} indcpa.c:PQCP_MLKEM_NATIVE_MLKEM512_X86_64_poly_decompress_dv: 166| 30|{ 167| 30|#if MLKEM_DV == 4 168| 30| mlk_poly_decompress_d4(r, a); ------------------ | | 377| 30|#define mlk_poly_decompress_d4 MLK_NAMESPACE(poly_decompress_d4) | | ------------------ | | | | 63| 30|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 30|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 30|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 169| |#elif MLKEM_DV == 5 170| | mlk_poly_decompress_d5(r, a); 171| |#else 172| |#error "Invalid value of MLKEM_DV" 173| |#endif 174| 30|} PQCP_MLKEM_NATIVE_MLKEM512_X86_64_poly_rej_uniform_x4: 158| 90|{ 159| | /* Temporary buffers for XOF output before rejection sampling */ 160| 90| MLK_ALIGN uint8_t ------------------ | | 190| 90|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) ------------------ 161| 90| buf[4][MLK_ALIGN_UP(MLKEM_GEN_MATRIX_NBLOCKS * MLK_XOF_RATE)]; 162| | 163| | /* Tracks the number of coefficients we have already sampled */ 164| 90| unsigned ctr[4]; 165| 90| mlk_xof_x4_ctx statex; ------------------ | | 51| 90|#define mlk_xof_x4_ctx mlk_shake128x4ctx | | ------------------ | | | | 13| 90|#define mlk_shake128x4ctx shake128x4ctx | | | | ------------------ | | | | | | 51| 90|#define shake128x4ctx shake128x4incctx | | | | | | ------------------ | | | | | | | | 18| 90|#define shake128x4incctx OQS_SHA3_shake128_x4_inc_ctx | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 166| 90| unsigned buflen; 167| | 168| 90| mlk_xof_x4_init(&statex); ------------------ | | 59| 90|#define mlk_xof_x4_init(CTX) mlk_shake128x4_init((CTX)) | | ------------------ | | | | 16| 90|#define mlk_shake128x4_init shake128x4_init | | | | ------------------ | | | | | | 52| 90|#define shake128x4_init shake128x4_inc_init | | | | | | ------------------ | | | | | | | | 19| 90|#define shake128x4_inc_init OQS_SHA3_shake128_x4_inc_init | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 169| 90| mlk_xof_x4_absorb(&statex, seed, MLKEM_SYMBYTES + 2); ------------------ | | 61| 90| mlk_shake128x4_absorb_once((CTX), (IN)[0], (IN)[1], (IN)[2], (IN)[3], \ | | ------------------ | | | | 14| 90|#define mlk_shake128x4_absorb_once shake128x4_absorb_once | | | | ------------------ | | | | | | 39| 90|#define shake128x4_absorb_once OQS_SHA3_shake128_x4_absorb_once | | | | ------------------ | | ------------------ | | 62| 90| (INBYTES)) ------------------ 170| | 171| | /* 172| | * Initially, squeeze heuristic number of MLKEM_GEN_MATRIX_NBLOCKS. 173| | * This should generate the matrix entries with high probability. 174| | */ 175| 90| mlk_xof_x4_squeezeblocks(buf, MLKEM_GEN_MATRIX_NBLOCKS, &statex); ------------------ | | 64| 90| mlk_shake128x4_squeezeblocks((BUF)[0], (BUF)[1], (BUF)[2], (BUF)[3], \ | | ------------------ | | | | 15| 90|#define mlk_shake128x4_squeezeblocks shake128x4_squeezeblocks | | | | ------------------ | | | | | | 46| 90| OQS_SHA3_shake128_x4_inc_squeeze(OUT0, OUT1, OUT2, OUT3, (NBLOCKS)*OQS_SHA3_SHAKE128_RATE, STATE) | | | | | | ------------------ | | | | | | | | 239| 90|#define OQS_SHA3_SHAKE128_RATE 168 | | | | | | ------------------ | | | | ------------------ | | ------------------ | | 65| 90| (NBLOCKS), (CTX)) ------------------ 176| 90| buflen = MLKEM_GEN_MATRIX_NBLOCKS * MLK_XOF_RATE; ------------------ | | 146| 90| ((12 * MLKEM_N / 8 * ((uint32_t)1 << 12) / MLKEM_Q + MLK_XOF_RATE) / \ | | ------------------ | | | | 22| 90|#define MLKEM_N 256 | | ------------------ | | ((12 * MLKEM_N / 8 * ((uint32_t)1 << 12) / MLKEM_Q + MLK_XOF_RATE) / \ | | ------------------ | | | | 23| 90|#define MLKEM_Q 3329 | | ------------------ | | ((12 * MLKEM_N / 8 * ((uint32_t)1 << 12) / MLKEM_Q + MLK_XOF_RATE) / \ | | ------------------ | | | | 68| 90|#define MLK_XOF_RATE SHAKE128_RATE | | | | ------------------ | | | | | | 8| 90|#define SHAKE128_RATE OQS_SHA3_SHAKE128_RATE | | | | | | ------------------ | | | | | | | | 239| 90|#define OQS_SHA3_SHAKE128_RATE 168 | | | | | | ------------------ | | | | ------------------ | | ------------------ | | 147| 90| MLK_XOF_RATE) | | ------------------ | | | | 68| 90|#define MLK_XOF_RATE SHAKE128_RATE | | | | ------------------ | | | | | | 8| 90|#define SHAKE128_RATE OQS_SHA3_SHAKE128_RATE | | | | | | ------------------ | | | | | | | | 239| 90|#define OQS_SHA3_SHAKE128_RATE 168 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ buflen = MLKEM_GEN_MATRIX_NBLOCKS * MLK_XOF_RATE; ------------------ | | 68| 90|#define MLK_XOF_RATE SHAKE128_RATE | | ------------------ | | | | 8| 90|#define SHAKE128_RATE OQS_SHA3_SHAKE128_RATE | | | | ------------------ | | | | | | 239| 90|#define OQS_SHA3_SHAKE128_RATE 168 | | | | ------------------ | | ------------------ ------------------ 177| 90| ctr[0] = mlk_rej_uniform(vec0->coeffs, MLKEM_N, 0, buf[0], buflen); ------------------ | | 22| 90|#define MLKEM_N 256 ------------------ 178| 90| ctr[1] = mlk_rej_uniform(vec1->coeffs, MLKEM_N, 0, buf[1], buflen); ------------------ | | 22| 90|#define MLKEM_N 256 ------------------ 179| 90| ctr[2] = mlk_rej_uniform(vec2->coeffs, MLKEM_N, 0, buf[2], buflen); ------------------ | | 22| 90|#define MLKEM_N 256 ------------------ 180| 90| ctr[3] = mlk_rej_uniform(vec3->coeffs, MLKEM_N, 0, buf[3], buflen); ------------------ | | 22| 90|#define MLKEM_N 256 ------------------ 181| | 182| | /* 183| | * So long as not all matrix entries have been generated, squeeze 184| | * one more block a time until we're done. 185| | */ 186| 90| buflen = MLK_XOF_RATE; ------------------ | | 68| 90|#define MLK_XOF_RATE SHAKE128_RATE | | ------------------ | | | | 8| 90|#define SHAKE128_RATE OQS_SHA3_SHAKE128_RATE | | | | ------------------ | | | | | | 239| 90|#define OQS_SHA3_SHAKE128_RATE 168 | | | | ------------------ | | ------------------ ------------------ 187| 180| while (ctr[0] < MLKEM_N || ctr[1] < MLKEM_N || ctr[2] < MLKEM_N || ------------------ | | 22| 360|#define MLKEM_N 256 ------------------ while (ctr[0] < MLKEM_N || ctr[1] < MLKEM_N || ctr[2] < MLKEM_N || ------------------ | | 22| 333|#define MLKEM_N 256 ------------------ while (ctr[0] < MLKEM_N || ctr[1] < MLKEM_N || ctr[2] < MLKEM_N || ------------------ | | 22| 307|#define MLKEM_N 256 ------------------ | Branch (187:10): [True: 27, False: 153] | Branch (187:30): [True: 26, False: 127] | Branch (187:50): [True: 19, False: 108] ------------------ 188| 108| ctr[3] < MLKEM_N) ------------------ | | 22| 108|#define MLKEM_N 256 ------------------ | Branch (188:10): [True: 18, False: 90] ------------------ 189| 90| __loop__( 190| 90| assigns(ctr, statex, 191| 90| memory_slice(vec0, sizeof(mlk_poly)), 192| 90| memory_slice(vec1, sizeof(mlk_poly)), 193| 90| memory_slice(vec2, sizeof(mlk_poly)), 194| 90| memory_slice(vec3, sizeof(mlk_poly)), 195| 90| object_whole(buf)) 196| 90| invariant(ctr[0] <= MLKEM_N && ctr[1] <= MLKEM_N) 197| 90| invariant(ctr[2] <= MLKEM_N && ctr[3] <= MLKEM_N) 198| 90| invariant(array_bound(vec0->coeffs, 0, ctr[0], 0, MLKEM_Q)) 199| 90| invariant(array_bound(vec1->coeffs, 0, ctr[1], 0, MLKEM_Q)) 200| 90| invariant(array_bound(vec2->coeffs, 0, ctr[2], 0, MLKEM_Q)) 201| 90| invariant(array_bound(vec3->coeffs, 0, ctr[3], 0, MLKEM_Q))) 202| 90| { 203| 90| mlk_xof_x4_squeezeblocks(buf, 1, &statex); ------------------ | | 64| 90| mlk_shake128x4_squeezeblocks((BUF)[0], (BUF)[1], (BUF)[2], (BUF)[3], \ | | ------------------ | | | | 15| 90|#define mlk_shake128x4_squeezeblocks shake128x4_squeezeblocks | | | | ------------------ | | | | | | 46| 90| OQS_SHA3_shake128_x4_inc_squeeze(OUT0, OUT1, OUT2, OUT3, (NBLOCKS)*OQS_SHA3_SHAKE128_RATE, STATE) | | | | | | ------------------ | | | | | | | | 239| 90|#define OQS_SHA3_SHAKE128_RATE 168 | | | | | | ------------------ | | | | ------------------ | | ------------------ | | 65| 90| (NBLOCKS), (CTX)) ------------------ 204| 90| ctr[0] = mlk_rej_uniform(vec0->coeffs, MLKEM_N, ctr[0], buf[0], buflen); ------------------ | | 22| 90|#define MLKEM_N 256 ------------------ 205| 90| ctr[1] = mlk_rej_uniform(vec1->coeffs, MLKEM_N, ctr[1], buf[1], buflen); ------------------ | | 22| 90|#define MLKEM_N 256 ------------------ 206| 90| ctr[2] = mlk_rej_uniform(vec2->coeffs, MLKEM_N, ctr[2], buf[2], buflen); ------------------ | | 22| 90|#define MLKEM_N 256 ------------------ 207| 90| ctr[3] = mlk_rej_uniform(vec3->coeffs, MLKEM_N, ctr[3], buf[3], buflen); ------------------ | | 22| 90|#define MLKEM_N 256 ------------------ 208| 90| } 209| | 210| 90| mlk_xof_x4_release(&statex); ------------------ | | 66| 90|#define mlk_xof_x4_release(CTX) mlk_shake128x4_release((CTX)) | | ------------------ | | | | 17| 90|#define mlk_shake128x4_release shake128x4_release | | | | ------------------ | | | | | | 53| 90|#define shake128x4_release shake128x4_inc_ctx_release | | | | | | ------------------ | | | | | | | | 23| 90|#define shake128x4_inc_ctx_release OQS_SHA3_shake128_x4_inc_ctx_release | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 211| | 212| | /* Specification: Partially implements 213| | * @[FIPS203, Section 3.3, Destruction of intermediate values] */ 214| 90| mlk_zeroize(buf, sizeof(buf)); 215| 90|} PQCP_MLKEM_NATIVE_MLKEM512_X86_64_poly_cbd2: 276| 180|{ 277| 180| unsigned i; 278| 5.94k| for (i = 0; i < MLKEM_N / 8; i++) ------------------ | | 22| 5.94k|#define MLKEM_N 256 ------------------ | Branch (278:15): [True: 5.76k, False: 180] ------------------ 279| 5.76k| __loop__( 280| 5.76k| invariant(i <= MLKEM_N / 8) 281| 5.76k| invariant(array_abs_bound(r->coeffs, 0, 8 * i, 3)) 282| 5.76k| decreases(MLKEM_N / 8 - i)) 283| 5.76k| { 284| 5.76k| unsigned j; 285| 5.76k| uint32_t t = mlk_load32_littleendian(buf + 4 * i); 286| 5.76k| uint32_t d = t & 0x55555555; 287| 5.76k| d += (t >> 1) & 0x55555555; 288| | 289| 51.8k| for (j = 0; j < 8; j++) ------------------ | Branch (289:17): [True: 46.0k, False: 5.76k] ------------------ 290| 46.0k| __loop__( 291| 46.0k| invariant(i <= MLKEM_N / 8 && j <= 8) 292| 46.0k| invariant(array_abs_bound(r->coeffs, 0, 8 * i + j, 3)) 293| 46.0k| decreases(8 - j)) 294| 46.0k| { 295| | /* Safety: The & 0x3 masks each value to 2 bits (range [0, 3]), so the 296| | * truncation and subsequent subtraction in int16_t is lossless. */ 297| 46.0k| const int16_t a = (int16_t)((d >> (4 * j + 0)) & 0x3); 298| 46.0k| const int16_t b = (int16_t)((d >> (4 * j + 2)) & 0x3); 299| 46.0k| r->coeffs[8 * i + j] = (int16_t)(a - b); 300| 46.0k| } 301| 5.76k| } 302| 180|} PQCP_MLKEM_NATIVE_MLKEM512_X86_64_poly_cbd3: 329| 240|{ 330| 240| unsigned i; 331| 15.6k| for (i = 0; i < MLKEM_N / 4; i++) ------------------ | | 22| 15.6k|#define MLKEM_N 256 ------------------ | Branch (331:15): [True: 15.3k, False: 240] ------------------ 332| 15.3k| __loop__( 333| 15.3k| invariant(i <= MLKEM_N / 4) 334| 15.3k| invariant(array_abs_bound(r->coeffs, 0, 4 * i, 4)) 335| 15.3k| decreases(MLKEM_N / 4 - i)) 336| 15.3k| { 337| 15.3k| unsigned j; 338| 15.3k| const uint32_t t = mlk_load24_littleendian(buf + 3 * i); 339| 15.3k| uint32_t d = t & 0x00249249; 340| 15.3k| d += (t >> 1) & 0x00249249; 341| 15.3k| d += (t >> 2) & 0x00249249; 342| | 343| 76.8k| for (j = 0; j < 4; j++) ------------------ | Branch (343:17): [True: 61.4k, False: 15.3k] ------------------ 344| 61.4k| __loop__( 345| 61.4k| invariant(i <= MLKEM_N / 4 && j <= 4) 346| 61.4k| invariant(array_abs_bound(r->coeffs, 0, 4 * i + j, 4)) 347| 61.4k| decreases(4 - j)) 348| 61.4k| { 349| | /* Safety: The & 0x7 masks each value to 3 bits (range [0, 7]), so the 350| | * truncation and subsequent subtraction in int16_t is lossless. */ 351| 61.4k| const int16_t a = (int16_t)((d >> (6 * j + 0)) & 0x7); 352| 61.4k| const int16_t b = (int16_t)((d >> (6 * j + 3)) & 0x7); 353| 61.4k| r->coeffs[4 * i + j] = (int16_t)(a - b); 354| 61.4k| } 355| 15.3k| } 356| 240|} poly_k.c:mlk_sys_check_capability: 289| 1.03k|{ 290| | /* By default, we rely on compile-time feature detection/specification: 291| | * If a feature is enabled at compile-time, we assume it is supported by 292| | * the host that the resulting library/binary will be built on. 293| | * If this assumption is not true, you MUST overwrite this function. 294| | * See the documentation of MLK_CONFIG_CUSTOM_CAPABILITY_FUNC in 295| | * mlkem_native_config.h for more information. */ 296| 1.03k| (void)cap; 297| 1.03k| return 1; 298| 1.03k|} sampling.c:mlk_sys_check_capability: 289| 2.43k|{ 290| | /* By default, we rely on compile-time feature detection/specification: 291| | * If a feature is enabled at compile-time, we assume it is supported by 292| | * the host that the resulting library/binary will be built on. 293| | * If this assumption is not true, you MUST overwrite this function. 294| | * See the documentation of MLK_CONFIG_CUSTOM_CAPABILITY_FUNC in 295| | * mlkem_native_config.h for more information. */ 296| 2.43k| (void)cap; 297| 2.43k| return 1; 298| 2.43k|} compress.c:mlk_sys_check_capability: 289| 2.84k|{ 290| | /* By default, we rely on compile-time feature detection/specification: 291| | * If a feature is enabled at compile-time, we assume it is supported by 292| | * the host that the resulting library/binary will be built on. 293| | * If this assumption is not true, you MUST overwrite this function. 294| | * See the documentation of MLK_CONFIG_CUSTOM_CAPABILITY_FUNC in 295| | * mlkem_native_config.h for more information. */ 296| 2.84k| (void)cap; 297| 2.84k| return 1; 298| 2.84k|} indcpa.c:mlk_sys_check_capability: 289| 2.43k|{ 290| | /* By default, we rely on compile-time feature detection/specification: 291| | * If a feature is enabled at compile-time, we assume it is supported by 292| | * the host that the resulting library/binary will be built on. 293| | * If this assumption is not true, you MUST overwrite this function. 294| | * See the documentation of MLK_CONFIG_CUSTOM_CAPABILITY_FUNC in 295| | * mlkem_native_config.h for more information. */ 296| 2.43k| (void)cap; 297| 2.43k| return 1; 298| 2.43k|} poly.c:mlk_sys_check_capability: 289| 4.91k|{ 290| | /* By default, we rely on compile-time feature detection/specification: 291| | * If a feature is enabled at compile-time, we assume it is supported by 292| | * the host that the resulting library/binary will be built on. 293| | * If this assumption is not true, you MUST overwrite this function. 294| | * See the documentation of MLK_CONFIG_CUSTOM_CAPABILITY_FUNC in 295| | * mlkem_native_config.h for more information. */ 296| 4.91k| (void)cap; 297| 4.91k| return 1; 298| 4.91k|} PQCP_MLKEM_NATIVE_MLKEM768_X86_64_poly_compress_d4: 80| 68|{ 81| 68|#if defined(MLK_USE_NATIVE_POLY_COMPRESS_D4) 82| 68| int ret; 83| 68| mlk_assert_bound(a, MLKEM_N, 0, MLKEM_Q); ------------------ | | 101| 68| do \ | | 102| 68| { \ | | 103| 68| } while (0) | | ------------------ | | | Branch (103:12): [Folded, False: 68] | | ------------------ ------------------ 84| 68| ret = mlk_poly_compress_d4_native(r, a->coeffs); 85| 68| if (ret == MLK_NATIVE_FUNC_SUCCESS) ------------------ | | 33| 68|#define MLK_NATIVE_FUNC_SUCCESS (0) ------------------ | Branch (85:7): [True: 68, False: 0] ------------------ 86| 68| { 87| 68| return; 88| 68| } 89| 0|#endif /* MLK_USE_NATIVE_POLY_COMPRESS_D4 */ 90| | 91| 0| mlk_poly_compress_d4_c(r, a); 92| 0|} PQCP_MLKEM_NATIVE_MLKEM768_X86_64_poly_compress_d10: 147| 204|{ 148| 204|#if defined(MLK_USE_NATIVE_POLY_COMPRESS_D10) 149| 204| int ret; 150| 204| mlk_assert_bound(a, MLKEM_N, 0, MLKEM_Q); ------------------ | | 101| 204| do \ | | 102| 204| { \ | | 103| 204| } while (0) | | ------------------ | | | Branch (103:12): [Folded, False: 204] | | ------------------ ------------------ 151| 204| ret = mlk_poly_compress_d10_native(r, a->coeffs); 152| 204| if (ret == MLK_NATIVE_FUNC_SUCCESS) ------------------ | | 33| 204|#define MLK_NATIVE_FUNC_SUCCESS (0) ------------------ | Branch (152:7): [True: 204, False: 0] ------------------ 153| 204| { 154| 204| return; 155| 204| } 156| 0|#endif /* MLK_USE_NATIVE_POLY_COMPRESS_D10 */ 157| | 158| 0| mlk_poly_compress_d10_c(r, a); 159| 0|} PQCP_MLKEM_NATIVE_MLKEM768_X86_64_poly_decompress_d4: 195| 34|{ 196| 34|#if defined(MLK_USE_NATIVE_POLY_DECOMPRESS_D4) 197| 34| int ret; 198| 34| ret = mlk_poly_decompress_d4_native(r->coeffs, a); 199| 34| if (ret == MLK_NATIVE_FUNC_SUCCESS) ------------------ | | 33| 34|#define MLK_NATIVE_FUNC_SUCCESS (0) ------------------ | Branch (199:7): [True: 34, False: 0] ------------------ 200| 34| { 201| 34| mlk_assert_bound(r, MLKEM_N, 0, MLKEM_Q); ------------------ | | 101| 34| do \ | | 102| 34| { \ | | 103| 34| } while (0) | | ------------------ | | | Branch (103:12): [Folded, False: 34] | | ------------------ ------------------ 202| 34| return; 203| 34| } 204| 0|#endif /* MLK_USE_NATIVE_POLY_DECOMPRESS_D4 */ 205| | 206| 0| mlk_poly_decompress_d4_c(r, a); 207| 0|} PQCP_MLKEM_NATIVE_MLKEM768_X86_64_poly_decompress_d10: 258| 102|{ 259| 102|#if defined(MLK_USE_NATIVE_POLY_DECOMPRESS_D10) 260| 102| int ret; 261| 102| ret = mlk_poly_decompress_d10_native(r->coeffs, a); 262| 102| if (ret == MLK_NATIVE_FUNC_SUCCESS) ------------------ | | 33| 102|#define MLK_NATIVE_FUNC_SUCCESS (0) ------------------ | Branch (262:7): [True: 102, False: 0] ------------------ 263| 102| { 264| 102| mlk_assert_bound(r, MLKEM_N, 0, MLKEM_Q); ------------------ | | 101| 102| do \ | | 102| 102| { \ | | 103| 102| } while (0) | | ------------------ | | | Branch (103:12): [Folded, False: 102] | | ------------------ ------------------ 265| 102| return; 266| 102| } 267| 0|#endif /* MLK_USE_NATIVE_POLY_DECOMPRESS_D10 */ 268| | 269| 0| mlk_poly_decompress_d10_c(r, a); 270| 0|} PQCP_MLKEM_NATIVE_MLKEM768_X86_64_poly_tobytes: 610| 306|{ 611| 306|#if defined(MLK_USE_NATIVE_POLY_TOBYTES) 612| 306| int ret; 613| 306| mlk_assert_bound(a, MLKEM_N, 0, MLKEM_Q); ------------------ | | 101| 306| do \ | | 102| 306| { \ | | 103| 306| } while (0) | | ------------------ | | | Branch (103:12): [Folded, False: 306] | | ------------------ ------------------ 614| 306| ret = mlk_poly_tobytes_native(r, a->coeffs); 615| 306| if (ret == MLK_NATIVE_FUNC_SUCCESS) ------------------ | | 33| 306|#define MLK_NATIVE_FUNC_SUCCESS (0) ------------------ | Branch (615:7): [True: 306, False: 0] ------------------ 616| 306| { 617| 306| return; 618| 306| } 619| 0|#endif /* MLK_USE_NATIVE_POLY_TOBYTES */ 620| | 621| 0| mlk_poly_tobytes_c(r, a); 622| 0|} PQCP_MLKEM_NATIVE_MLKEM768_X86_64_poly_frombytes: 659| 408|{ 660| 408|#if defined(MLK_USE_NATIVE_POLY_FROMBYTES) 661| 408| int ret; 662| 408| ret = mlk_poly_frombytes_native(r->coeffs, a); 663| 408| if (ret == MLK_NATIVE_FUNC_SUCCESS) ------------------ | | 33| 408|#define MLK_NATIVE_FUNC_SUCCESS (0) ------------------ | Branch (663:7): [True: 408, False: 0] ------------------ 664| 408| { 665| 408| return; 666| 408| } 667| 0|#endif /* MLK_USE_NATIVE_POLY_FROMBYTES */ 668| | 669| 0| mlk_poly_frombytes_c(r, a); 670| 0|} PQCP_MLKEM_NATIVE_MLKEM768_X86_64_poly_frommsg: 680| 68|{ 681| 68| unsigned i; 682| |#if (MLKEM_INDCPA_MSGBYTES != MLKEM_N / 8) 683| |#error "MLKEM_INDCPA_MSGBYTES must be equal to MLKEM_N/8 bytes!" 684| |#endif 685| | 686| 2.24k| for (i = 0; i < MLKEM_N / 8; i++) ------------------ | | 22| 2.24k|#define MLKEM_N 256 ------------------ | Branch (686:15): [True: 2.17k, False: 68] ------------------ 687| 2.17k| __loop__( 688| 2.17k| invariant(i <= MLKEM_N / 8) 689| 2.17k| invariant(array_bound(r->coeffs, 0, 8 * i, 0, MLKEM_Q)) 690| 2.17k| decreases(MLKEM_N / 8 - i)) 691| 2.17k| { 692| 2.17k| unsigned j; 693| 19.5k| for (j = 0; j < 8; j++) ------------------ | Branch (693:17): [True: 17.4k, False: 2.17k] ------------------ 694| 17.4k| __loop__( 695| 17.4k| invariant(i < MLKEM_N / 8 && j <= 8) 696| 17.4k| invariant(array_bound(r->coeffs, 0, 8 * i + j, 0, MLKEM_Q)) 697| 17.4k| decreases(8 - j)) 698| 17.4k| { 699| | /* mlk_ct_sel_int16(MLKEM_Q_HALF, 0, b) is `Decompress_1(b != 0)` 700| | * as per @[FIPS203, Eq (4.8)]. */ 701| | 702| | /* Prevent the compiler from recognizing this as a bit selection */ 703| 17.4k| uint8_t mask = mlk_value_barrier_u8((uint8_t)(1u << j)); 704| 17.4k| r->coeffs[8 * i + j] = mlk_ct_sel_int16(MLKEM_Q_HALF, 0, msg[i] & mask); ------------------ | | 24| 17.4k|#define MLKEM_Q_HALF ((MLKEM_Q + 1) / 2) /* 1665 */ | | ------------------ | | | | 23| 17.4k|#define MLKEM_Q 3329 | | ------------------ ------------------ 705| 17.4k| } 706| 2.17k| } 707| 68| mlk_assert_abs_bound(r, MLKEM_N, MLKEM_Q); ------------------ | | 105| 68| do \ | | 106| 68| { \ | | 107| 68| } while (0) | | ------------------ | | | Branch (107:12): [Folded, False: 68] | | ------------------ ------------------ 708| 68|} PQCP_MLKEM_NATIVE_MLKEM768_X86_64_poly_tomsg: 718| 34|{ 719| 34| unsigned i; 720| 34| mlk_assert_bound(r, MLKEM_N, 0, MLKEM_Q); ------------------ | | 101| 34| do \ | | 102| 34| { \ | | 103| 34| } while (0) | | ------------------ | | | Branch (103:12): [Folded, False: 34] | | ------------------ ------------------ 721| | 722| 1.12k| for (i = 0; i < MLKEM_N / 8; i++) ------------------ | | 22| 1.12k|#define MLKEM_N 256 ------------------ | Branch (722:15): [True: 1.08k, False: 34] ------------------ 723| 1.08k| __loop__(invariant(i <= MLKEM_N / 8) 724| 1.08k| decreases(MLKEM_N / 8 - i)) 725| 1.08k| { 726| 1.08k| unsigned j; 727| 1.08k| msg[i] = 0; 728| 9.79k| for (j = 0; j < 8; j++) ------------------ | Branch (728:17): [True: 8.70k, False: 1.08k] ------------------ 729| 8.70k| __loop__( 730| 8.70k| invariant(i <= MLKEM_N / 8 && j <= 8) 731| 8.70k| decreases(8 - j)) 732| 8.70k| { 733| 8.70k| uint32_t t = mlk_scalar_compress_d1(r->coeffs[8 * i + j]); 734| 8.70k| msg[i] |= (uint8_t)(t << j); 735| 8.70k| } 736| 1.08k| } 737| 34|} PQCP_MLKEM_NATIVE_MLKEM768_X86_64_gen_matrix: 223| 102|{ 224| 102| unsigned i, j; 225| 102| MLK_ALIGN uint8_t seed_ext[4][MLK_ALIGN_UP(MLKEM_SYMBYTES + 2)]; ------------------ | | 190| 102|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) ------------------ 226| | 227| 510| for (j = 0; j < 4; j++) ------------------ | Branch (227:15): [True: 408, False: 102] ------------------ 228| 408| { 229| 408| mlk_memcpy(seed_ext[j], seed, MLKEM_SYMBYTES); ------------------ | | 168| 408|#define mlk_memcpy memcpy ------------------ mlk_memcpy(seed_ext[j], seed, MLKEM_SYMBYTES); ------------------ | | 27| 408|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 230| 408| } 231| | 232| 102|#if !defined(MLK_CONFIG_SERIAL_FIPS202_ONLY) 233| | /* Sample 4 matrix entries a time. */ 234| 306| for (i = 0; i < (MLKEM_K * MLKEM_K / 4) * 4; i += 4) ------------------ | | 15| 306|#define MLKEM_K 3 ------------------ for (i = 0; i < (MLKEM_K * MLKEM_K / 4) * 4; i += 4) ------------------ | | 15| 306|#define MLKEM_K 3 ------------------ | Branch (234:15): [True: 204, False: 102] ------------------ 235| 204| { 236| 1.02k| for (j = 0; j < 4; j++) ------------------ | Branch (236:17): [True: 816, False: 204] ------------------ 237| 816| { 238| 816| uint8_t x, y; 239| | /* MLKEM_K <= 4, so the values fit in uint8_t. */ 240| 816| x = (uint8_t)((i + j) / MLKEM_K); ------------------ | | 15| 816|#define MLKEM_K 3 ------------------ 241| 816| y = (uint8_t)((i + j) % MLKEM_K); ------------------ | | 15| 816|#define MLKEM_K 3 ------------------ 242| 816| if (transposed) ------------------ | Branch (242:11): [True: 544, False: 272] ------------------ 243| 544| { 244| 544| seed_ext[j][MLKEM_SYMBYTES + 0] = x; ------------------ | | 27| 544|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 245| 544| seed_ext[j][MLKEM_SYMBYTES + 1] = y; ------------------ | | 27| 544|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 246| 544| } 247| 272| else 248| 272| { 249| 272| seed_ext[j][MLKEM_SYMBYTES + 0] = y; ------------------ | | 27| 272|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 250| 272| seed_ext[j][MLKEM_SYMBYTES + 1] = x; ------------------ | | 27| 272|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 251| 272| } 252| 816| } 253| | 254| 204| mlk_poly_rej_uniform_x4(&a->vec[i / MLKEM_K].vec[i % MLKEM_K], ------------------ | | 55| 204|#define mlk_poly_rej_uniform_x4 MLK_NAMESPACE(poly_rej_uniform_x4) | | ------------------ | | | | 63| 204|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 204|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 204|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ mlk_poly_rej_uniform_x4(&a->vec[i / MLKEM_K].vec[i % MLKEM_K], ------------------ | | 15| 204|#define MLKEM_K 3 ------------------ mlk_poly_rej_uniform_x4(&a->vec[i / MLKEM_K].vec[i % MLKEM_K], ------------------ | | 15| 204|#define MLKEM_K 3 ------------------ 255| 204| &a->vec[(i + 1) / MLKEM_K].vec[(i + 1) % MLKEM_K], ------------------ | | 15| 204|#define MLKEM_K 3 ------------------ &a->vec[(i + 1) / MLKEM_K].vec[(i + 1) % MLKEM_K], ------------------ | | 15| 204|#define MLKEM_K 3 ------------------ 256| 204| &a->vec[(i + 2) / MLKEM_K].vec[(i + 2) % MLKEM_K], ------------------ | | 15| 204|#define MLKEM_K 3 ------------------ &a->vec[(i + 2) / MLKEM_K].vec[(i + 2) % MLKEM_K], ------------------ | | 15| 204|#define MLKEM_K 3 ------------------ 257| 204| &a->vec[(i + 3) / MLKEM_K].vec[(i + 3) % MLKEM_K], ------------------ | | 15| 204|#define MLKEM_K 3 ------------------ &a->vec[(i + 3) / MLKEM_K].vec[(i + 3) % MLKEM_K], ------------------ | | 15| 204|#define MLKEM_K 3 ------------------ 258| 204| seed_ext); 259| 204| } 260| |#else /* !MLK_CONFIG_SERIAL_FIPS202_ONLY */ 261| | /* When using serial FIPS202, sample all entries individually. */ 262| | i = 0; 263| |#endif /* MLK_CONFIG_SERIAL_FIPS202_ONLY */ 264| | 265| | /* For MLKEM_K == 3, sample the last entry individually. 266| | * When MLK_CONFIG_SERIAL_FIPS202_ONLY is set, sample all entries 267| | * individually. */ 268| 204| for (; i < MLKEM_K * MLKEM_K; i++) ------------------ | | 15| 204|#define MLKEM_K 3 ------------------ for (; i < MLKEM_K * MLKEM_K; i++) ------------------ | | 15| 204|#define MLKEM_K 3 ------------------ | Branch (268:10): [True: 102, False: 102] ------------------ 269| 102| { 270| 102| uint8_t x, y; 271| | /* MLKEM_K <= 4, so the values fit in uint8_t. */ 272| 102| x = (uint8_t)(i / MLKEM_K); ------------------ | | 15| 102|#define MLKEM_K 3 ------------------ 273| 102| y = (uint8_t)(i % MLKEM_K); ------------------ | | 15| 102|#define MLKEM_K 3 ------------------ 274| | 275| 102| if (transposed) ------------------ | Branch (275:9): [True: 68, False: 34] ------------------ 276| 68| { 277| 68| seed_ext[0][MLKEM_SYMBYTES + 0] = x; ------------------ | | 27| 68|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 278| 68| seed_ext[0][MLKEM_SYMBYTES + 1] = y; ------------------ | | 27| 68|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 279| 68| } 280| 34| else 281| 34| { 282| 34| seed_ext[0][MLKEM_SYMBYTES + 0] = y; ------------------ | | 27| 34|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 283| 34| seed_ext[0][MLKEM_SYMBYTES + 1] = x; ------------------ | | 27| 34|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 284| 34| } 285| | 286| 102| mlk_poly_rej_uniform(&a->vec[i / MLKEM_K].vec[i % MLKEM_K], seed_ext[0]); ------------------ | | 89| 102|#define mlk_poly_rej_uniform MLK_NAMESPACE(poly_rej_uniform) | | ------------------ | | | | 63| 102|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 102|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 102|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ mlk_poly_rej_uniform(&a->vec[i / MLKEM_K].vec[i % MLKEM_K], seed_ext[0]); ------------------ | | 15| 102|#define MLKEM_K 3 ------------------ mlk_poly_rej_uniform(&a->vec[i / MLKEM_K].vec[i % MLKEM_K], seed_ext[0]); ------------------ | | 15| 102|#define MLKEM_K 3 ------------------ 287| 102| } 288| | 289| 102| mlk_assert(i == MLKEM_K * MLKEM_K); ------------------ | | 97| 102| do \ | | 98| 102| { \ | | 99| 102| } while (0) | | ------------------ | | | Branch (99:12): [Folded, False: 102] | | ------------------ ------------------ 290| | 291| | /* 292| | * The public matrix is generated in NTT domain. If the native backend 293| | * uses a custom order in NTT domain, permute A accordingly. 294| | */ 295| 102| mlk_polymat_permute_bitrev_to_custom(a); ------------------ | | 42| 102| MLK_ADD_PARAM_SET(mlk_polymat_permute_bitrev_to_custom) | | ------------------ | | | | 48| 102|#define MLK_ADD_PARAM_SET(s) s | | ------------------ ------------------ 296| | 297| | /* Specification: Partially implements 298| | * @[FIPS203, Section 3.3, Destruction of intermediate values] */ 299| 102| mlk_zeroize(seed_ext, sizeof(seed_ext)); 300| 102|} PQCP_MLKEM_NATIVE_MLKEM768_X86_64_indcpa_keypair_derand: 445| 34|{ 446| 34| int ret = 0; 447| 34| const uint8_t *publicseed; 448| 34| const uint8_t *noiseseed; 449| 34| MLK_ALLOC(buf, uint8_t, 2 * MLKEM_SYMBYTES, context); ------------------ | | 229| 34| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 34|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 34| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 450| 34| MLK_ALLOC(coins_with_domain_separator, uint8_t, MLKEM_SYMBYTES + 1, context); ------------------ | | 229| 34| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 34|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 34| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 451| 34| MLK_ALLOC(a, mlk_polymat, 1, context); ------------------ | | 229| 34| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 34|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 34| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 452| 34| MLK_ALLOC(e, mlk_polyvec, 1, context); ------------------ | | 229| 34| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 34|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 34| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 453| 34| MLK_ALLOC(pkpv, mlk_polyvec, 1, context); ------------------ | | 229| 34| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 34|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 34| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 454| 34| MLK_ALLOC(skpv, mlk_polyvec, 1, context); ------------------ | | 229| 34| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 34|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 34| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 455| 34| MLK_ALLOC(skpv_cache, mlk_polyvec_mulcache, 1, context); ------------------ | | 229| 34| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 34|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 34| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 456| | 457| 34| if (buf == NULL || coins_with_domain_separator == NULL || a == NULL || ------------------ | Branch (457:7): [True: 0, False: 34] | Branch (457:22): [True: 0, False: 34] | Branch (457:61): [True: 0, False: 34] ------------------ 458| 34| e == NULL || pkpv == NULL || skpv == NULL || skpv_cache == NULL) ------------------ | Branch (458:7): [True: 0, False: 34] | Branch (458:20): [True: 0, False: 34] | Branch (458:36): [True: 0, False: 34] | Branch (458:52): [True: 0, False: 34] ------------------ 459| 0| { 460| 0| ret = MLK_ERR_OUT_OF_MEMORY; ------------------ | | 275| 0|#define MLK_ERR_OUT_OF_MEMORY (-2) ------------------ 461| 0| goto cleanup; 462| 0| } 463| | 464| 34| publicseed = buf; 465| 34| noiseseed = buf + MLKEM_SYMBYTES; ------------------ | | 27| 34|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 466| | 467| | /* Concatenate coins with MLKEM_K for domain separation of security levels */ 468| 34| mlk_memcpy(coins_with_domain_separator, coins, MLKEM_SYMBYTES); ------------------ | | 168| 34|#define mlk_memcpy memcpy ------------------ mlk_memcpy(coins_with_domain_separator, coins, MLKEM_SYMBYTES); ------------------ | | 27| 34|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 469| 34| coins_with_domain_separator[MLKEM_SYMBYTES] = MLKEM_K; ------------------ | | 27| 34|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ coins_with_domain_separator[MLKEM_SYMBYTES] = MLKEM_K; ------------------ | | 15| 34|#define MLKEM_K 3 ------------------ 470| | 471| 34| mlk_hash_g(buf, coins_with_domain_separator, MLKEM_SYMBYTES + 1); ------------------ | | 32| 34|#define mlk_hash_g(OUT, IN, INBYTES) mlk_sha3_512(OUT, IN, INBYTES) | | ------------------ | | | | 20| 34|#define mlk_sha3_512 sha3_512 | | | | ------------------ | | | | | | 31| 34|#define sha3_512 OQS_SHA3_sha3_512 | | | | ------------------ | | ------------------ ------------------ 472| | 473| | /* 474| | * Declassify the public seed. 475| | * Required to use it in conditional-branches in rejection sampling. 476| | * This is needed because all output of randombytes is marked as secret 477| | * (=undefined) 478| | */ 479| 34| MLK_CT_TESTING_DECLASSIFY(publicseed, MLKEM_SYMBYTES); ------------------ | | 235| 34| do \ | | 236| 34| { \ | | 237| 34| } while (0) | | ------------------ | | | Branch (237:12): [Folded, False: 34] | | ------------------ ------------------ 480| | 481| 34| mlk_gen_matrix(a, publicseed, 0 /* no transpose */); ------------------ | | 22| 34|#define mlk_gen_matrix MLK_NAMESPACE_K(gen_matrix) | | ------------------ | | | | 64| 34|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 34|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 34|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 482| | 483| 34| mlk_keypair_getnoise_eta1(skpv, e, noiseseed); ------------------ | | 43| 34|#define mlk_keypair_getnoise_eta1 MLK_ADD_PARAM_SET(mlk_keypair_getnoise_eta1) | | ------------------ | | | | 48| 34|#define MLK_ADD_PARAM_SET(s) s | | ------------------ ------------------ 484| | 485| 34| mlk_polyvec_ntt(skpv); ------------------ | | 269| 34|#define mlk_polyvec_ntt MLK_NAMESPACE_K(polyvec_ntt) | | ------------------ | | | | 64| 34|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 34|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 34|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 486| 34| mlk_polyvec_ntt(e); ------------------ | | 269| 34|#define mlk_polyvec_ntt MLK_NAMESPACE_K(polyvec_ntt) | | ------------------ | | | | 64| 34|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 34|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 34|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 487| | 488| 34| mlk_polyvec_mulcache_compute(skpv_cache, skpv); ------------------ | | 353| 34|#define mlk_polyvec_mulcache_compute MLK_NAMESPACE_K(polyvec_mulcache_compute) | | ------------------ | | | | 64| 34|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 34|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 34|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 489| 34| mlk_matvec_mul(pkpv, a, skpv, skpv_cache); ------------------ | | 38| 34|#define mlk_matvec_mul MLK_ADD_PARAM_SET(mlk_matvec_mul) | | ------------------ | | | | 48| 34|#define MLK_ADD_PARAM_SET(s) s | | ------------------ ------------------ 490| 34| mlk_polyvec_tomont(pkpv); ------------------ | | 445| 34|#define mlk_polyvec_tomont MLK_NAMESPACE_K(polyvec_tomont) | | ------------------ | | | | 64| 34|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 34|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 34|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 491| | 492| 34| mlk_polyvec_add(pkpv, e); ------------------ | | 414| 34|#define mlk_polyvec_add MLK_NAMESPACE_K(polyvec_add) | | ------------------ | | | | 64| 34|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 34|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 34|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 493| 34| mlk_polyvec_reduce(pkpv); ------------------ | | 387| 34|#define mlk_polyvec_reduce MLK_NAMESPACE_K(polyvec_reduce) | | ------------------ | | | | 64| 34|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 34|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 34|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 494| 34| mlk_polyvec_reduce(skpv); ------------------ | | 387| 34|#define mlk_polyvec_reduce MLK_NAMESPACE_K(polyvec_reduce) | | ------------------ | | | | 64| 34|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 34|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 34|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 495| | 496| 34| mlk_pack_sk(sk, skpv); ------------------ | | 34| 34|#define mlk_pack_sk MLK_ADD_PARAM_SET(mlk_pack_sk) | | ------------------ | | | | 48| 34|#define MLK_ADD_PARAM_SET(s) s | | ------------------ ------------------ 497| 34| mlk_pack_pk(pk, pkpv, publicseed); ------------------ | | 32| 34|#define mlk_pack_pk MLK_ADD_PARAM_SET(mlk_pack_pk) | | ------------------ | | | | 48| 34|#define MLK_ADD_PARAM_SET(s) s | | ------------------ ------------------ 498| | 499| 34|cleanup: 500| | /* Specification: Partially implements 501| | * @[FIPS203, Section 3.3, Destruction of intermediate values] */ 502| 34| MLK_FREE(skpv_cache, mlk_polyvec_mulcache, 1, context); ------------------ | | 238| 34| do \ | | 239| 34| { \ | | 240| 34| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 34| (v) = NULL; \ | | 242| 34| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 34] | | ------------------ ------------------ 503| 34| MLK_FREE(skpv, mlk_polyvec, 1, context); ------------------ | | 238| 34| do \ | | 239| 34| { \ | | 240| 34| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 34| (v) = NULL; \ | | 242| 34| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 34] | | ------------------ ------------------ 504| 34| MLK_FREE(pkpv, mlk_polyvec, 1, context); ------------------ | | 238| 34| do \ | | 239| 34| { \ | | 240| 34| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 34| (v) = NULL; \ | | 242| 34| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 34] | | ------------------ ------------------ 505| 34| MLK_FREE(e, mlk_polyvec, 1, context); ------------------ | | 238| 34| do \ | | 239| 34| { \ | | 240| 34| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 34| (v) = NULL; \ | | 242| 34| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 34] | | ------------------ ------------------ 506| 34| MLK_FREE(a, mlk_polymat, 1, context); ------------------ | | 238| 34| do \ | | 239| 34| { \ | | 240| 34| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 34| (v) = NULL; \ | | 242| 34| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 34] | | ------------------ ------------------ 507| 34| MLK_FREE(coins_with_domain_separator, uint8_t, MLKEM_SYMBYTES + 1, context); ------------------ | | 238| 34| do \ | | 239| 34| { \ | | 240| 34| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 34| (v) = NULL; \ | | 242| 34| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 34] | | ------------------ ------------------ 508| | MLK_FREE(buf, uint8_t, 2 * MLKEM_SYMBYTES, context); ------------------ | | 238| 34| do \ | | 239| 34| { \ | | 240| 34| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 34| (v) = NULL; \ | | 242| 34| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 34] | | ------------------ ------------------ 509| 34| return ret; 510| 34|} PQCP_MLKEM_NATIVE_MLKEM768_X86_64_indcpa_enc: 526| 68|{ 527| 68| int ret = 0; 528| 68| MLK_ALLOC(seed, uint8_t, MLKEM_SYMBYTES, context); ------------------ | | 229| 68| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 68|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 68| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 529| 68| MLK_ALLOC(at, mlk_polymat, 1, context); ------------------ | | 229| 68| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 68|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 68| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 530| 68| MLK_ALLOC(sp, mlk_polyvec, 1, context); ------------------ | | 229| 68| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 68|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 68| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 531| 68| MLK_ALLOC(pkpv, mlk_polyvec, 1, context); ------------------ | | 229| 68| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 68|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 68| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 532| 68| MLK_ALLOC(ep, mlk_polyvec, 1, context); ------------------ | | 229| 68| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 68|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 68| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 533| 68| MLK_ALLOC(b, mlk_polyvec, 1, context); ------------------ | | 229| 68| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 68|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 68| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 534| 68| MLK_ALLOC(v, mlk_poly, 1, context); ------------------ | | 229| 68| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 68|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 68| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 535| 68| MLK_ALLOC(k, mlk_poly, 1, context); ------------------ | | 229| 68| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 68|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 68| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 536| 68| MLK_ALLOC(epp, mlk_poly, 1, context); ------------------ | | 229| 68| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 68|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 68| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 537| 68| MLK_ALLOC(sp_cache, mlk_polyvec_mulcache, 1, context); ------------------ | | 229| 68| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 68|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 68| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 538| | 539| 68| if (seed == NULL || at == NULL || sp == NULL || pkpv == NULL || ep == NULL || ------------------ | Branch (539:7): [True: 0, False: 68] | Branch (539:23): [True: 0, False: 68] | Branch (539:37): [True: 0, False: 68] | Branch (539:51): [True: 0, False: 68] | Branch (539:67): [True: 0, False: 68] ------------------ 540| 68| b == NULL || v == NULL || k == NULL || epp == NULL || sp_cache == NULL) ------------------ | Branch (540:7): [True: 0, False: 68] | Branch (540:20): [True: 0, False: 68] | Branch (540:33): [True: 0, False: 68] | Branch (540:46): [True: 0, False: 68] | Branch (540:61): [True: 0, False: 68] ------------------ 541| 0| { 542| 0| ret = MLK_ERR_OUT_OF_MEMORY; ------------------ | | 275| 0|#define MLK_ERR_OUT_OF_MEMORY (-2) ------------------ 543| 0| goto cleanup; 544| 0| } 545| | 546| 68| mlk_unpack_pk(pkpv, seed, pk); ------------------ | | 33| 68|#define mlk_unpack_pk MLK_ADD_PARAM_SET(mlk_unpack_pk) | | ------------------ | | | | 48| 68|#define MLK_ADD_PARAM_SET(s) s | | ------------------ ------------------ 547| 68| mlk_poly_frommsg(k, m); ------------------ | | 555| 68|#define mlk_poly_frommsg MLK_NAMESPACE(poly_frommsg) | | ------------------ | | | | 63| 68|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 68|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 68|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 548| | 549| | /* 550| | * Declassify the public seed. 551| | * Required to use it in conditional-branches in rejection sampling. 552| | * This is needed because in re-encryption the publicseed originated from sk 553| | * which is marked undefined. 554| | */ 555| 68| MLK_CT_TESTING_DECLASSIFY(seed, MLKEM_SYMBYTES); ------------------ | | 235| 68| do \ | | 236| 68| { \ | | 237| 68| } while (0) | | ------------------ | | | Branch (237:12): [Folded, False: 68] | | ------------------ ------------------ 556| | 557| 68| mlk_gen_matrix(at, seed, 1 /* transpose */); ------------------ | | 22| 68|#define mlk_gen_matrix MLK_NAMESPACE_K(gen_matrix) | | ------------------ | | | | 64| 68|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 68|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 68|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 558| | 559| 68| mlk_enc_getnoise_eta1_eta2(sp, ep, epp, coins); ------------------ | | 44| 68|#define mlk_enc_getnoise_eta1_eta2 MLK_ADD_PARAM_SET(mlk_enc_getnoise_eta1_eta2) | | ------------------ | | | | 48| 68|#define MLK_ADD_PARAM_SET(s) s | | ------------------ ------------------ 560| | 561| 68| mlk_polyvec_ntt(sp); ------------------ | | 269| 68|#define mlk_polyvec_ntt MLK_NAMESPACE_K(polyvec_ntt) | | ------------------ | | | | 64| 68|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 68|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 68|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 562| | 563| 68| mlk_polyvec_mulcache_compute(sp_cache, sp); ------------------ | | 353| 68|#define mlk_polyvec_mulcache_compute MLK_NAMESPACE_K(polyvec_mulcache_compute) | | ------------------ | | | | 64| 68|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 68|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 68|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 564| 68| mlk_matvec_mul(b, at, sp, sp_cache); ------------------ | | 38| 68|#define mlk_matvec_mul MLK_ADD_PARAM_SET(mlk_matvec_mul) | | ------------------ | | | | 48| 68|#define MLK_ADD_PARAM_SET(s) s | | ------------------ ------------------ 565| 68| mlk_polyvec_basemul_acc_montgomery_cached(v, pkpv, sp, sp_cache); ------------------ | | 321| 68| MLK_NAMESPACE_K(polyvec_basemul_acc_montgomery_cached) | | ------------------ | | | | 64| 68|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 68|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 68|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 566| | 567| 68| mlk_polyvec_invntt_tomont(b); ------------------ | | 295| 68|#define mlk_polyvec_invntt_tomont MLK_NAMESPACE_K(polyvec_invntt_tomont) | | ------------------ | | | | 64| 68|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 68|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 68|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 568| 68| mlk_poly_invntt_tomont(v); ------------------ | | 263| 68|#define mlk_poly_invntt_tomont MLK_NAMESPACE(poly_invntt_tomont) | | ------------------ | | | | 63| 68|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 68|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 68|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 569| | 570| 68| mlk_polyvec_add(b, ep); ------------------ | | 414| 68|#define mlk_polyvec_add MLK_NAMESPACE_K(polyvec_add) | | ------------------ | | | | 64| 68|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 68|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 68|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 571| 68| mlk_poly_add(v, epp); ------------------ | | 181| 68|#define mlk_poly_add MLK_NAMESPACE(poly_add) | | ------------------ | | | | 63| 68|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 68|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 68|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 572| 68| mlk_poly_add(v, k); ------------------ | | 181| 68|#define mlk_poly_add MLK_NAMESPACE(poly_add) | | ------------------ | | | | 63| 68|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 68|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 68|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 573| | 574| 68| mlk_polyvec_reduce(b); ------------------ | | 387| 68|#define mlk_polyvec_reduce MLK_NAMESPACE_K(polyvec_reduce) | | ------------------ | | | | 64| 68|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 68|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 68|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 575| 68| mlk_poly_reduce(v); ------------------ | | 154| 68|#define mlk_poly_reduce MLK_NAMESPACE(poly_reduce) | | ------------------ | | | | 63| 68|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 68|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 68|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 576| | 577| 68| mlk_pack_ciphertext(c, b, v); ------------------ | | 36| 68|#define mlk_pack_ciphertext MLK_ADD_PARAM_SET(mlk_pack_ciphertext) | | ------------------ | | | | 48| 68|#define MLK_ADD_PARAM_SET(s) s | | ------------------ ------------------ 578| | 579| 68|cleanup: 580| | /* Specification: Partially implements 581| | * @[FIPS203, Section 3.3, Destruction of intermediate values] */ 582| 68| MLK_FREE(sp_cache, mlk_polyvec_mulcache, 1, context); ------------------ | | 238| 68| do \ | | 239| 68| { \ | | 240| 68| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 68| (v) = NULL; \ | | 242| 68| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 68] | | ------------------ ------------------ 583| 68| MLK_FREE(epp, mlk_poly, 1, context); ------------------ | | 238| 68| do \ | | 239| 68| { \ | | 240| 68| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 68| (v) = NULL; \ | | 242| 68| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 68] | | ------------------ ------------------ 584| 68| MLK_FREE(k, mlk_poly, 1, context); ------------------ | | 238| 68| do \ | | 239| 68| { \ | | 240| 68| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 68| (v) = NULL; \ | | 242| 68| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 68] | | ------------------ ------------------ 585| 68| MLK_FREE(v, mlk_poly, 1, context); ------------------ | | 238| 68| do \ | | 239| 68| { \ | | 240| 68| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 68| (v) = NULL; \ | | 242| 68| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 68] | | ------------------ ------------------ 586| 68| MLK_FREE(b, mlk_polyvec, 1, context); ------------------ | | 238| 68| do \ | | 239| 68| { \ | | 240| 68| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 68| (v) = NULL; \ | | 242| 68| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 68] | | ------------------ ------------------ 587| 68| MLK_FREE(ep, mlk_polyvec, 1, context); ------------------ | | 238| 68| do \ | | 239| 68| { \ | | 240| 68| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 68| (v) = NULL; \ | | 242| 68| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 68] | | ------------------ ------------------ 588| 68| MLK_FREE(pkpv, mlk_polyvec, 1, context); ------------------ | | 238| 68| do \ | | 239| 68| { \ | | 240| 68| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 68| (v) = NULL; \ | | 242| 68| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 68] | | ------------------ ------------------ 589| 68| MLK_FREE(sp, mlk_polyvec, 1, context); ------------------ | | 238| 68| do \ | | 239| 68| { \ | | 240| 68| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 68| (v) = NULL; \ | | 242| 68| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 68] | | ------------------ ------------------ 590| 68| MLK_FREE(at, mlk_polymat, 1, context); ------------------ | | 238| 68| do \ | | 239| 68| { \ | | 240| 68| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 68| (v) = NULL; \ | | 242| 68| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 68] | | ------------------ ------------------ 591| | MLK_FREE(seed, uint8_t, MLKEM_SYMBYTES, context); ------------------ | | 238| 68| do \ | | 239| 68| { \ | | 240| 68| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 68| (v) = NULL; \ | | 242| 68| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 68] | | ------------------ ------------------ 592| 68| return ret; 593| 68|} PQCP_MLKEM_NATIVE_MLKEM768_X86_64_indcpa_dec: 603| 34|{ 604| 34| int ret = 0; 605| 34| MLK_ALLOC(b, mlk_polyvec, 1, context); ------------------ | | 229| 34| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 34|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 34| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 606| 34| MLK_ALLOC(skpv, mlk_polyvec, 1, context); ------------------ | | 229| 34| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 34|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 34| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 607| 34| MLK_ALLOC(v, mlk_poly, 1, context); ------------------ | | 229| 34| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 34|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 34| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 608| 34| MLK_ALLOC(sb, mlk_poly, 1, context); ------------------ | | 229| 34| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 34|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 34| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 609| 34| MLK_ALLOC(b_cache, mlk_polyvec_mulcache, 1, context); ------------------ | | 229| 34| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 34|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 34| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 610| | 611| 34| if (b == NULL || skpv == NULL || v == NULL || sb == NULL || b_cache == NULL) ------------------ | Branch (611:7): [True: 0, False: 34] | Branch (611:20): [True: 0, False: 34] | Branch (611:36): [True: 0, False: 34] | Branch (611:49): [True: 0, False: 34] | Branch (611:63): [True: 0, False: 34] ------------------ 612| 0| { 613| 0| ret = MLK_ERR_OUT_OF_MEMORY; ------------------ | | 275| 0|#define MLK_ERR_OUT_OF_MEMORY (-2) ------------------ 614| 0| goto cleanup; 615| 0| } 616| | 617| 34| mlk_unpack_ciphertext(b, v, c); ------------------ | | 37| 34|#define mlk_unpack_ciphertext MLK_ADD_PARAM_SET(mlk_unpack_ciphertext) | | ------------------ | | | | 48| 34|#define MLK_ADD_PARAM_SET(s) s | | ------------------ ------------------ 618| 34| mlk_unpack_sk(skpv, sk); ------------------ | | 35| 34|#define mlk_unpack_sk MLK_ADD_PARAM_SET(mlk_unpack_sk) | | ------------------ | | | | 48| 34|#define MLK_ADD_PARAM_SET(s) s | | ------------------ ------------------ 619| | 620| 34| mlk_polyvec_ntt(b); ------------------ | | 269| 34|#define mlk_polyvec_ntt MLK_NAMESPACE_K(polyvec_ntt) | | ------------------ | | | | 64| 34|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 34|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 34|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 621| 34| mlk_polyvec_mulcache_compute(b_cache, b); ------------------ | | 353| 34|#define mlk_polyvec_mulcache_compute MLK_NAMESPACE_K(polyvec_mulcache_compute) | | ------------------ | | | | 64| 34|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 34|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 34|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 622| 34| mlk_polyvec_basemul_acc_montgomery_cached(sb, skpv, b, b_cache); ------------------ | | 321| 34| MLK_NAMESPACE_K(polyvec_basemul_acc_montgomery_cached) | | ------------------ | | | | 64| 34|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 34|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 34|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 623| 34| mlk_poly_invntt_tomont(sb); ------------------ | | 263| 34|#define mlk_poly_invntt_tomont MLK_NAMESPACE(poly_invntt_tomont) | | ------------------ | | | | 63| 34|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 34|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 34|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 624| | 625| 34| mlk_poly_sub(v, sb); ------------------ | | 210| 34|#define mlk_poly_sub MLK_NAMESPACE(poly_sub) | | ------------------ | | | | 63| 34|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 34|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 34|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 626| 34| mlk_poly_reduce(v); ------------------ | | 154| 34|#define mlk_poly_reduce MLK_NAMESPACE(poly_reduce) | | ------------------ | | | | 63| 34|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 34|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 34|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 627| | 628| 34| mlk_poly_tomsg(m, v); ------------------ | | 577| 34|#define mlk_poly_tomsg MLK_NAMESPACE(poly_tomsg) | | ------------------ | | | | 63| 34|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 34|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 34|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 629| | 630| 34|cleanup: 631| | /* Specification: Partially implements 632| | * @[FIPS203, Section 3.3, Destruction of intermediate values] */ 633| 34| MLK_FREE(b_cache, mlk_polyvec_mulcache, 1, context); ------------------ | | 238| 34| do \ | | 239| 34| { \ | | 240| 34| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 34| (v) = NULL; \ | | 242| 34| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 34] | | ------------------ ------------------ 634| 34| MLK_FREE(sb, mlk_poly, 1, context); ------------------ | | 238| 34| do \ | | 239| 34| { \ | | 240| 34| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 34| (v) = NULL; \ | | 242| 34| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 34] | | ------------------ ------------------ 635| 34| MLK_FREE(v, mlk_poly, 1, context); ------------------ | | 238| 34| do \ | | 239| 34| { \ | | 240| 34| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 34| (v) = NULL; \ | | 242| 34| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 34] | | ------------------ ------------------ 636| 34| MLK_FREE(skpv, mlk_polyvec, 1, context); ------------------ | | 238| 34| do \ | | 239| 34| { \ | | 240| 34| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 34| (v) = NULL; \ | | 242| 34| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 34] | | ------------------ ------------------ 637| | MLK_FREE(b, mlk_polyvec, 1, context); ------------------ | | 238| 34| do \ | | 239| 34| { \ | | 240| 34| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 34| (v) = NULL; \ | | 242| 34| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 34] | | ------------------ ------------------ 638| 34| return ret; 639| 34|} PQCP_MLKEM_NATIVE_MLKEM768_X86_64_check_pk: 45| 34|{ 46| 34| int ret = 0; 47| 34| MLK_ALLOC(p, mlk_polyvec, 1, context); ------------------ | | 229| 34| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 34|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 34| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 48| 34| MLK_ALLOC(p_reencoded, uint8_t, MLKEM_POLYVECBYTES, context); ------------------ | | 229| 34| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 34|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 34| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 49| | 50| 34| if (p == NULL || p_reencoded == NULL) ------------------ | Branch (50:7): [True: 0, False: 34] | Branch (50:20): [True: 0, False: 34] ------------------ 51| 0| { 52| 0| ret = MLK_ERR_OUT_OF_MEMORY; ------------------ | | 275| 0|#define MLK_ERR_OUT_OF_MEMORY (-2) ------------------ 53| 0| goto cleanup; 54| 0| } 55| | 56| 34| mlk_polyvec_frombytes(p, pk); ------------------ | | 247| 34|#define mlk_polyvec_frombytes MLK_NAMESPACE_K(polyvec_frombytes) | | ------------------ | | | | 64| 34|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 34|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 34|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 57| 34| mlk_polyvec_reduce(p); ------------------ | | 387| 34|#define mlk_polyvec_reduce MLK_NAMESPACE_K(polyvec_reduce) | | ------------------ | | | | 64| 34|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 34|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 34|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 58| 34| mlk_polyvec_tobytes(p_reencoded, p); ------------------ | | 225| 34|#define mlk_polyvec_tobytes MLK_NAMESPACE_K(polyvec_tobytes) | | ------------------ | | | | 64| 34|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 34|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 34|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 59| | 60| | /* We use a constant-time memcmp here to avoid having to 61| | * declassify the PK before the PCT has succeeded. */ 62| 34| ret = mlk_ct_memcmp(pk, p_reencoded, MLKEM_POLYVECBYTES) ? MLK_ERR_FAIL : 0; ------------------ | | 31| 34|#define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | ------------------ | | | | 15| 34|#define MLKEM_K 3 | | ------------------ | | #define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | ------------------ | | | | 30| 34|#define MLKEM_POLYBYTES 384 | | ------------------ ------------------ ret = mlk_ct_memcmp(pk, p_reencoded, MLKEM_POLYVECBYTES) ? MLK_ERR_FAIL : 0; ------------------ | | 272| 0|#define MLK_ERR_FAIL (-1) ------------------ | Branch (62:9): [True: 0, False: 34] ------------------ 63| | 64| 34|cleanup: 65| | /* Specification: Partially implements 66| | * @[FIPS203, Section 3.3, Destruction of intermediate values] */ 67| 34| MLK_FREE(p_reencoded, uint8_t, MLKEM_POLYVECBYTES, context); ------------------ | | 238| 34| do \ | | 239| 34| { \ | | 240| 34| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 34| (v) = NULL; \ | | 242| 34| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 34] | | ------------------ ------------------ 68| | MLK_FREE(p, mlk_polyvec, 1, context); ------------------ | | 238| 34| do \ | | 239| 34| { \ | | 240| 34| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 34| (v) = NULL; \ | | 242| 34| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 34] | | ------------------ ------------------ 69| 34| return ret; 70| 34|} PQCP_MLKEM_NATIVE_MLKEM768_X86_64_check_sk: 78| 34|{ 79| 34| int ret = 0; 80| 34| MLK_ALLOC(test, uint8_t, MLKEM_SYMBYTES, context); ------------------ | | 229| 34| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 34|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 34| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 81| | 82| 34| if (test == NULL) ------------------ | Branch (82:7): [True: 0, False: 34] ------------------ 83| 0| { 84| 0| ret = MLK_ERR_OUT_OF_MEMORY; ------------------ | | 275| 0|#define MLK_ERR_OUT_OF_MEMORY (-2) ------------------ 85| 0| goto cleanup; 86| 0| } 87| | 88| | /* 89| | * The parts of `sk` being hashed and compared here are public, so 90| | * no public information is leaked through the runtime or the return value 91| | * of this function. 92| | */ 93| | 94| | /* Declassify the public part of the secret key */ 95| 34| MLK_CT_TESTING_DECLASSIFY(sk + MLKEM_INDCPA_SECRETKEYBYTES, ------------------ | | 235| 34| do \ | | 236| 34| { \ | | 237| 34| } while (0) | | ------------------ | | | Branch (237:12): [Folded, False: 34] | | ------------------ ------------------ 96| 34| MLKEM_INDCCA_PUBLICKEYBYTES); 97| 34| MLK_CT_TESTING_DECLASSIFY( ------------------ | | 235| 34| do \ | | 236| 34| { \ | | 237| 34| } while (0) | | ------------------ | | | Branch (237:12): [Folded, False: 34] | | ------------------ ------------------ 98| 34| sk + MLKEM_INDCCA_SECRETKEYBYTES - 2 * MLKEM_SYMBYTES, MLKEM_SYMBYTES); 99| | 100| 34| mlk_hash_h(test, sk + MLKEM_INDCPA_SECRETKEYBYTES, ------------------ | | 29| 34|#define mlk_hash_h(OUT, IN, INBYTES) mlk_sha3_256(OUT, IN, INBYTES) | | ------------------ | | | | 19| 34|#define mlk_sha3_256 sha3_256 | | | | ------------------ | | | | | | 15| 34|#define sha3_256 OQS_SHA3_sha3_256 | | | | ------------------ | | ------------------ ------------------ 101| 34| MLKEM_INDCCA_PUBLICKEYBYTES); 102| | /* This doesn't have to be a constant-time memcmp, but it's the only place 103| | * in the library where a normal memcmp would be used otherwise, so for sake 104| | * of minimizing stdlib dependency, we use our constant-time one anyway. */ 105| 34| ret = mlk_ct_memcmp(sk + MLKEM_INDCCA_SECRETKEYBYTES - 2 * MLKEM_SYMBYTES, ------------------ | | 72| 34| (MLKEM_INDCPA_SECRETKEYBYTES + MLKEM_INDCPA_PUBLICKEYBYTES + \ | | ------------------ | | | | 65| 34|#define MLKEM_INDCPA_SECRETKEYBYTES (MLKEM_POLYVECBYTES) | | | | ------------------ | | | | | | 31| 34|#define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | | | ------------------ | | | | | | | | 15| 34|#define MLKEM_K 3 | | | | | | ------------------ | | | | | | #define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | | | ------------------ | | | | | | | | 30| 34|#define MLKEM_POLYBYTES 384 | | | | | | ------------------ | | | | ------------------ | | ------------------ | | (MLKEM_INDCPA_SECRETKEYBYTES + MLKEM_INDCPA_PUBLICKEYBYTES + \ | | ------------------ | | | | 64| 34|#define MLKEM_INDCPA_PUBLICKEYBYTES (MLKEM_POLYVECBYTES + MLKEM_SYMBYTES) | | | | ------------------ | | | | | | 31| 34|#define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | | | ------------------ | | | | | | | | 15| 34|#define MLKEM_K 3 | | | | | | ------------------ | | | | | | #define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | | | ------------------ | | | | | | | | 30| 34|#define MLKEM_POLYBYTES 384 | | | | | | ------------------ | | | | ------------------ | | | | #define MLKEM_INDCPA_PUBLICKEYBYTES (MLKEM_POLYVECBYTES + MLKEM_SYMBYTES) | | | | ------------------ | | | | | | 27| 34|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ | | | | ------------------ | | ------------------ | | 73| 34| 2 * MLKEM_SYMBYTES) | | ------------------ | | | | 27| 34|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ | | ------------------ ------------------ ret = mlk_ct_memcmp(sk + MLKEM_INDCCA_SECRETKEYBYTES - 2 * MLKEM_SYMBYTES, ------------------ | | 27| 34|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ | Branch (105:9): [True: 0, False: 34] ------------------ 106| 34| test, MLKEM_SYMBYTES) ------------------ | | 27| 34|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 107| 34| ? MLK_ERR_FAIL ------------------ | | 272| 0|#define MLK_ERR_FAIL (-1) ------------------ 108| 34| : 0; 109| | 110| 34|cleanup: 111| | /* Specification: Partially implements 112| | * @[FIPS203, Section 3.3, Destruction of intermediate values] */ 113| | MLK_FREE(test, uint8_t, MLKEM_SYMBYTES, context); ------------------ | | 238| 34| do \ | | 239| 34| { \ | | 240| 34| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 34| (v) = NULL; \ | | 242| 34| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 34] | | ------------------ ------------------ 114| 34| return ret; 115| 34|} PQCP_MLKEM_NATIVE_MLKEM768_X86_64_keypair_derand: 214| 34|{ 215| 34| int ret; 216| | 217| 34| ret = mlk_indcpa_keypair_derand(pk, sk, coins, context); ------------------ | | 49| 34| MLK_NAMESPACE_K(indcpa_keypair_derand) MLK_CONTEXT_PARAMETERS_3 | | ------------------ | | | | 64| 34|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 34|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 34|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ | | MLK_NAMESPACE_K(indcpa_keypair_derand) MLK_CONTEXT_PARAMETERS_3 | | ------------------ | | | | 212| 34|#define MLK_CONTEXT_PARAMETERS_3(arg0, arg1, arg2, context) (arg0, arg1, arg2) | | ------------------ ------------------ 218| 34| if (ret != 0) ------------------ | Branch (218:7): [True: 0, False: 34] ------------------ 219| 0| { 220| 0| goto cleanup; 221| 0| } 222| | 223| 34| mlk_memcpy(sk + MLKEM_INDCPA_SECRETKEYBYTES, pk, MLKEM_INDCCA_PUBLICKEYBYTES); ------------------ | | 168| 34|#define mlk_memcpy memcpy ------------------ mlk_memcpy(sk + MLKEM_INDCPA_SECRETKEYBYTES, pk, MLKEM_INDCCA_PUBLICKEYBYTES); ------------------ | | 65| 34|#define MLKEM_INDCPA_SECRETKEYBYTES (MLKEM_POLYVECBYTES) | | ------------------ | | | | 31| 34|#define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | ------------------ | | | | | | 15| 34|#define MLKEM_K 3 | | | | ------------------ | | | | #define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | ------------------ | | | | | | 30| 34|#define MLKEM_POLYBYTES 384 | | | | ------------------ | | ------------------ ------------------ mlk_memcpy(sk + MLKEM_INDCPA_SECRETKEYBYTES, pk, MLKEM_INDCCA_PUBLICKEYBYTES); ------------------ | | 69| 34|#define MLKEM_INDCCA_PUBLICKEYBYTES (MLKEM_INDCPA_PUBLICKEYBYTES) | | ------------------ | | | | 64| 34|#define MLKEM_INDCPA_PUBLICKEYBYTES (MLKEM_POLYVECBYTES + MLKEM_SYMBYTES) | | | | ------------------ | | | | | | 31| 34|#define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | | | ------------------ | | | | | | | | 15| 34|#define MLKEM_K 3 | | | | | | ------------------ | | | | | | #define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | | | ------------------ | | | | | | | | 30| 34|#define MLKEM_POLYBYTES 384 | | | | | | ------------------ | | | | ------------------ | | | | #define MLKEM_INDCPA_PUBLICKEYBYTES (MLKEM_POLYVECBYTES + MLKEM_SYMBYTES) | | | | ------------------ | | | | | | 27| 34|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ | | | | ------------------ | | ------------------ ------------------ 224| 34| mlk_hash_h(sk + MLKEM_INDCCA_SECRETKEYBYTES - 2 * MLKEM_SYMBYTES, pk, ------------------ | | 29| 34|#define mlk_hash_h(OUT, IN, INBYTES) mlk_sha3_256(OUT, IN, INBYTES) | | ------------------ | | | | 19| 34|#define mlk_sha3_256 sha3_256 | | | | ------------------ | | | | | | 15| 34|#define sha3_256 OQS_SHA3_sha3_256 | | | | ------------------ | | ------------------ ------------------ 225| 34| MLKEM_INDCCA_PUBLICKEYBYTES); 226| | /* Value z for pseudo-random output on reject */ 227| 34| mlk_memcpy(sk + MLKEM_INDCCA_SECRETKEYBYTES - MLKEM_SYMBYTES, ------------------ | | 168| 34|#define mlk_memcpy memcpy ------------------ mlk_memcpy(sk + MLKEM_INDCCA_SECRETKEYBYTES - MLKEM_SYMBYTES, ------------------ | | 72| 34| (MLKEM_INDCPA_SECRETKEYBYTES + MLKEM_INDCPA_PUBLICKEYBYTES + \ | | ------------------ | | | | 65| 34|#define MLKEM_INDCPA_SECRETKEYBYTES (MLKEM_POLYVECBYTES) | | | | ------------------ | | | | | | 31| 34|#define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | | | ------------------ | | | | | | | | 15| 34|#define MLKEM_K 3 | | | | | | ------------------ | | | | | | #define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | | | ------------------ | | | | | | | | 30| 34|#define MLKEM_POLYBYTES 384 | | | | | | ------------------ | | | | ------------------ | | ------------------ | | (MLKEM_INDCPA_SECRETKEYBYTES + MLKEM_INDCPA_PUBLICKEYBYTES + \ | | ------------------ | | | | 64| 34|#define MLKEM_INDCPA_PUBLICKEYBYTES (MLKEM_POLYVECBYTES + MLKEM_SYMBYTES) | | | | ------------------ | | | | | | 31| 34|#define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | | | ------------------ | | | | | | | | 15| 34|#define MLKEM_K 3 | | | | | | ------------------ | | | | | | #define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | | | ------------------ | | | | | | | | 30| 34|#define MLKEM_POLYBYTES 384 | | | | | | ------------------ | | | | ------------------ | | | | #define MLKEM_INDCPA_PUBLICKEYBYTES (MLKEM_POLYVECBYTES + MLKEM_SYMBYTES) | | | | ------------------ | | | | | | 27| 34|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ | | | | ------------------ | | ------------------ | | 73| 34| 2 * MLKEM_SYMBYTES) | | ------------------ | | | | 27| 34|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ | | ------------------ ------------------ mlk_memcpy(sk + MLKEM_INDCCA_SECRETKEYBYTES - MLKEM_SYMBYTES, ------------------ | | 27| 34|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 228| 34| coins + MLKEM_SYMBYTES, MLKEM_SYMBYTES); ------------------ | | 27| 34|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ coins + MLKEM_SYMBYTES, MLKEM_SYMBYTES); ------------------ | | 27| 34|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 229| | 230| | /* Declassify public key */ 231| 34| MLK_CT_TESTING_DECLASSIFY(pk, MLKEM_INDCCA_PUBLICKEYBYTES); ------------------ | | 235| 34| do \ | | 236| 34| { \ | | 237| 34| } while (0) | | ------------------ | | | Branch (237:12): [Folded, False: 34] | | ------------------ ------------------ 232| | 233| | /* Pairwise Consistency Test (PCT) @[FIPS140_3_IG, p.87] */ 234| 34| ret = mlk_check_pct(pk, sk, context); ------------------ | | 37| 34|#define mlk_check_pct MLK_ADD_PARAM_SET(mlk_check_pct) MLK_CONTEXT_PARAMETERS_2 | | ------------------ | | | | 48| 34|#define MLK_ADD_PARAM_SET(s) s | | ------------------ | | #define mlk_check_pct MLK_ADD_PARAM_SET(mlk_check_pct) MLK_CONTEXT_PARAMETERS_2 | | ------------------ | | | | 211| 34|#define MLK_CONTEXT_PARAMETERS_2(arg0, arg1, context) (arg0, arg1) | | ------------------ ------------------ 235| 34| if (ret != 0) ------------------ | Branch (235:7): [True: 0, False: 34] ------------------ 236| 0| { 237| 0| goto cleanup; 238| 0| } 239| | 240| 34|cleanup: 241| 34| if (ret != 0) ------------------ | Branch (241:7): [True: 0, False: 34] ------------------ 242| 0| { 243| 0| mlk_zeroize(pk, MLKEM_INDCCA_PUBLICKEYBYTES); ------------------ | | 69| 0|#define MLKEM_INDCCA_PUBLICKEYBYTES (MLKEM_INDCPA_PUBLICKEYBYTES) | | ------------------ | | | | 64| 0|#define MLKEM_INDCPA_PUBLICKEYBYTES (MLKEM_POLYVECBYTES + MLKEM_SYMBYTES) | | | | ------------------ | | | | | | 31| 0|#define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | | | ------------------ | | | | | | | | 15| 0|#define MLKEM_K 3 | | | | | | ------------------ | | | | | | #define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | | | ------------------ | | | | | | | | 30| 0|#define MLKEM_POLYBYTES 384 | | | | | | ------------------ | | | | ------------------ | | | | #define MLKEM_INDCPA_PUBLICKEYBYTES (MLKEM_POLYVECBYTES + MLKEM_SYMBYTES) | | | | ------------------ | | | | | | 27| 0|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ | | | | ------------------ | | ------------------ ------------------ 244| 0| mlk_zeroize(sk, MLKEM_INDCCA_SECRETKEYBYTES); ------------------ | | 72| 0| (MLKEM_INDCPA_SECRETKEYBYTES + MLKEM_INDCPA_PUBLICKEYBYTES + \ | | ------------------ | | | | 65| 0|#define MLKEM_INDCPA_SECRETKEYBYTES (MLKEM_POLYVECBYTES) | | | | ------------------ | | | | | | 31| 0|#define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | | | ------------------ | | | | | | | | 15| 0|#define MLKEM_K 3 | | | | | | ------------------ | | | | | | #define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | | | ------------------ | | | | | | | | 30| 0|#define MLKEM_POLYBYTES 384 | | | | | | ------------------ | | | | ------------------ | | ------------------ | | (MLKEM_INDCPA_SECRETKEYBYTES + MLKEM_INDCPA_PUBLICKEYBYTES + \ | | ------------------ | | | | 64| 0|#define MLKEM_INDCPA_PUBLICKEYBYTES (MLKEM_POLYVECBYTES + MLKEM_SYMBYTES) | | | | ------------------ | | | | | | 31| 0|#define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | | | ------------------ | | | | | | | | 15| 0|#define MLKEM_K 3 | | | | | | ------------------ | | | | | | #define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | | | ------------------ | | | | | | | | 30| 0|#define MLKEM_POLYBYTES 384 | | | | | | ------------------ | | | | ------------------ | | | | #define MLKEM_INDCPA_PUBLICKEYBYTES (MLKEM_POLYVECBYTES + MLKEM_SYMBYTES) | | | | ------------------ | | | | | | 27| 0|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ | | | | ------------------ | | ------------------ | | 73| 0| 2 * MLKEM_SYMBYTES) | | ------------------ | | | | 27| 0|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ | | ------------------ ------------------ 245| 0| } 246| | 247| 34| return ret; 248| 34|} PQCP_MLKEM_NATIVE_MLKEM768_X86_64_keypair: 257| 34|{ 258| 34| int ret = 0; 259| 34| MLK_ALLOC(coins, uint8_t, 2 * MLKEM_SYMBYTES, context); ------------------ | | 229| 34| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 34|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 34| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 260| | 261| 34| if (coins == NULL) ------------------ | Branch (261:7): [True: 0, False: 34] ------------------ 262| 0| { 263| 0| ret = MLK_ERR_OUT_OF_MEMORY; ------------------ | | 275| 0|#define MLK_ERR_OUT_OF_MEMORY (-2) ------------------ 264| 0| goto cleanup; 265| 0| } 266| | 267| | /* Acquire necessary randomness, and mark it as secret. */ 268| 34| if (mlk_randombytes(coins, 2 * MLKEM_SYMBYTES) != 0) ------------------ | | 27| 34|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ | Branch (268:7): [True: 0, False: 34] ------------------ 269| 0| { 270| 0| ret = MLK_ERR_RNG_FAIL; ------------------ | | 278| 0|#define MLK_ERR_RNG_FAIL (-3) ------------------ 271| 0| goto cleanup; 272| 0| } 273| | 274| 34| MLK_CT_TESTING_SECRET(coins, 2 * MLKEM_SYMBYTES); ------------------ | | 231| 34| do \ | | 232| 34| { \ | | 233| 34| } while (0) | | ------------------ | | | Branch (233:12): [Folded, False: 34] | | ------------------ ------------------ 275| | 276| 34| ret = mlk_kem_keypair_derand(pk, sk, coins, context); ------------------ | | 50| 34| MLK_NAMESPACE_K(keypair_derand) MLK_CONTEXT_PARAMETERS_3 | | ------------------ | | | | 64| 34|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 34|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 34|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ | | MLK_NAMESPACE_K(keypair_derand) MLK_CONTEXT_PARAMETERS_3 | | ------------------ | | | | 212| 34|#define MLK_CONTEXT_PARAMETERS_3(arg0, arg1, arg2, context) (arg0, arg1, arg2) | | ------------------ ------------------ 277| | 278| 34|cleanup: 279| | /* Specification: Partially implements 280| | * @[FIPS203, Section 3.3, Destruction of intermediate values] */ 281| | MLK_FREE(coins, uint8_t, 2 * MLKEM_SYMBYTES, context); ------------------ | | 238| 34| do \ | | 239| 34| { \ | | 240| 34| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 34| (v) = NULL; \ | | 242| 34| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 34] | | ------------------ ------------------ 282| 34| return ret; 283| 34|} PQCP_MLKEM_NATIVE_MLKEM768_X86_64_enc_derand: 295| 34|{ 296| 34| int ret = 0; 297| 34| MLK_ALLOC(buf, uint8_t, 2 * MLKEM_SYMBYTES, context); ------------------ | | 229| 34| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 34|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 34| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 298| 34| MLK_ALLOC(kr, uint8_t, 2 * MLKEM_SYMBYTES, context); ------------------ | | 229| 34| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 34|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 34| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 299| | 300| 34| if (buf == NULL || kr == NULL) ------------------ | Branch (300:7): [True: 0, False: 34] | Branch (300:22): [True: 0, False: 34] ------------------ 301| 0| { 302| 0| ret = MLK_ERR_OUT_OF_MEMORY; ------------------ | | 275| 0|#define MLK_ERR_OUT_OF_MEMORY (-2) ------------------ 303| 0| goto cleanup; 304| 0| } 305| | 306| | /* Specification: Implements @[FIPS203, Section 7.2, Modulus check] */ 307| 34| ret = mlk_kem_check_pk(pk, context); ------------------ | | 55| 34|#define mlk_kem_check_pk MLK_NAMESPACE_K(check_pk) MLK_CONTEXT_PARAMETERS_1 | | ------------------ | | | | 64| 34|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 34|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 34|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ | | #define mlk_kem_check_pk MLK_NAMESPACE_K(check_pk) MLK_CONTEXT_PARAMETERS_1 | | ------------------ | | | | 210| 34|#define MLK_CONTEXT_PARAMETERS_1(arg0, context) (arg0) | | ------------------ ------------------ 308| 34| if (ret != 0) ------------------ | Branch (308:7): [True: 0, False: 34] ------------------ 309| 0| { 310| 0| goto cleanup; 311| 0| } 312| | 313| 34| mlk_memcpy(buf, coins, MLKEM_SYMBYTES); ------------------ | | 168| 34|#define mlk_memcpy memcpy ------------------ mlk_memcpy(buf, coins, MLKEM_SYMBYTES); ------------------ | | 27| 34|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 314| | 315| | /* Multitarget countermeasure for coins + contributory KEM */ 316| 34| mlk_hash_h(buf + MLKEM_SYMBYTES, pk, MLKEM_INDCCA_PUBLICKEYBYTES); ------------------ | | 29| 34|#define mlk_hash_h(OUT, IN, INBYTES) mlk_sha3_256(OUT, IN, INBYTES) | | ------------------ | | | | 19| 34|#define mlk_sha3_256 sha3_256 | | | | ------------------ | | | | | | 15| 34|#define sha3_256 OQS_SHA3_sha3_256 | | | | ------------------ | | ------------------ ------------------ 317| 34| mlk_hash_g(kr, buf, 2 * MLKEM_SYMBYTES); ------------------ | | 32| 34|#define mlk_hash_g(OUT, IN, INBYTES) mlk_sha3_512(OUT, IN, INBYTES) | | ------------------ | | | | 20| 34|#define mlk_sha3_512 sha3_512 | | | | ------------------ | | | | | | 31| 34|#define sha3_512 OQS_SHA3_sha3_512 | | | | ------------------ | | ------------------ ------------------ 318| | 319| | /* coins are in kr+MLKEM_SYMBYTES */ 320| 34| ret = mlk_indcpa_enc(ct, buf, pk, kr + MLKEM_SYMBYTES, context); ------------------ | | 88| 34|#define mlk_indcpa_enc MLK_NAMESPACE_K(indcpa_enc) MLK_CONTEXT_PARAMETERS_4 | | ------------------ | | | | 64| 34|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 34|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 34|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ | | #define mlk_indcpa_enc MLK_NAMESPACE_K(indcpa_enc) MLK_CONTEXT_PARAMETERS_4 | | ------------------ | | | | 214| 34| (arg0, arg1, arg2, arg3) | | ------------------ ------------------ 321| 34| if (ret != 0) ------------------ | Branch (321:7): [True: 0, False: 34] ------------------ 322| 0| { 323| 0| goto cleanup; 324| 0| } 325| | 326| 34| mlk_memcpy(ss, kr, MLKEM_SYMBYTES); ------------------ | | 168| 34|#define mlk_memcpy memcpy ------------------ mlk_memcpy(ss, kr, MLKEM_SYMBYTES); ------------------ | | 27| 34|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 327| | 328| 34|cleanup: 329| | /* Specification: Partially implements 330| | * @[FIPS203, Section 3.3, Destruction of intermediate values] */ 331| 34| MLK_FREE(kr, uint8_t, 2 * MLKEM_SYMBYTES, context); ------------------ | | 238| 34| do \ | | 239| 34| { \ | | 240| 34| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 34| (v) = NULL; \ | | 242| 34| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 34] | | ------------------ ------------------ 332| | MLK_FREE(buf, uint8_t, 2 * MLKEM_SYMBYTES, context); ------------------ | | 238| 34| do \ | | 239| 34| { \ | | 240| 34| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 34| (v) = NULL; \ | | 242| 34| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 34] | | ------------------ ------------------ 333| 34| return ret; 334| 34|} PQCP_MLKEM_NATIVE_MLKEM768_X86_64_enc: 344| 34|{ 345| 34| int ret = 0; 346| 34| MLK_ALLOC(coins, uint8_t, MLKEM_SYMBYTES, context); ------------------ | | 229| 34| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 34|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 34| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 347| | 348| 34| if (coins == NULL) ------------------ | Branch (348:7): [True: 0, False: 34] ------------------ 349| 0| { 350| 0| ret = MLK_ERR_OUT_OF_MEMORY; ------------------ | | 275| 0|#define MLK_ERR_OUT_OF_MEMORY (-2) ------------------ 351| 0| goto cleanup; 352| 0| } 353| | 354| 34| if (mlk_randombytes(coins, MLKEM_SYMBYTES) != 0) ------------------ | | 27| 34|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ | Branch (354:7): [True: 0, False: 34] ------------------ 355| 0| { 356| 0| ret = MLK_ERR_RNG_FAIL; ------------------ | | 278| 0|#define MLK_ERR_RNG_FAIL (-3) ------------------ 357| 0| goto cleanup; 358| 0| } 359| | 360| 34| MLK_CT_TESTING_SECRET(coins, MLKEM_SYMBYTES); ------------------ | | 231| 34| do \ | | 232| 34| { \ | | 233| 34| } while (0) | | ------------------ | | | Branch (233:12): [Folded, False: 34] | | ------------------ ------------------ 361| | 362| 34| ret = mlk_kem_enc_derand(ct, ss, pk, coins, context); ------------------ | | 52| 34|#define mlk_kem_enc_derand MLK_NAMESPACE_K(enc_derand) MLK_CONTEXT_PARAMETERS_4 | | ------------------ | | | | 64| 34|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 34|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 34|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ | | #define mlk_kem_enc_derand MLK_NAMESPACE_K(enc_derand) MLK_CONTEXT_PARAMETERS_4 | | ------------------ | | | | 214| 34| (arg0, arg1, arg2, arg3) | | ------------------ ------------------ 363| | 364| 34|cleanup: 365| | /* Specification: Partially implements 366| | * @[FIPS203, Section 3.3, Destruction of intermediate values] */ 367| | MLK_FREE(coins, uint8_t, MLKEM_SYMBYTES, context); ------------------ | | 238| 34| do \ | | 239| 34| { \ | | 240| 34| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 34| (v) = NULL; \ | | 242| 34| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 34] | | ------------------ ------------------ 368| 34| return ret; 369| 34|} PQCP_MLKEM_NATIVE_MLKEM768_X86_64_dec: 380| 34|{ 381| 34| int ret = 0; 382| 34| uint8_t fail; 383| 34| const uint8_t *pk = sk + MLKEM_INDCPA_SECRETKEYBYTES; ------------------ | | 65| 34|#define MLKEM_INDCPA_SECRETKEYBYTES (MLKEM_POLYVECBYTES) | | ------------------ | | | | 31| 34|#define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | ------------------ | | | | | | 15| 34|#define MLKEM_K 3 | | | | ------------------ | | | | #define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | ------------------ | | | | | | 30| 34|#define MLKEM_POLYBYTES 384 | | | | ------------------ | | ------------------ ------------------ 384| 34| MLK_ALLOC(buf, uint8_t, 2 * MLKEM_SYMBYTES, context); ------------------ | | 229| 34| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 34|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 34| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 385| 34| MLK_ALLOC(kr, uint8_t, 2 * MLKEM_SYMBYTES, context); ------------------ | | 229| 34| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 34|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 34| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 386| 34| MLK_ALLOC(tmp, uint8_t, MLKEM_SYMBYTES + MLKEM_INDCCA_CIPHERTEXTBYTES, ------------------ | | 229| 34| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 34|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 34| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 387| 34| context); 388| | 389| 34| if (buf == NULL || kr == NULL || tmp == NULL) ------------------ | Branch (389:7): [True: 0, False: 34] | Branch (389:22): [True: 0, False: 34] | Branch (389:36): [True: 0, False: 34] ------------------ 390| 0| { 391| 0| ret = MLK_ERR_OUT_OF_MEMORY; ------------------ | | 275| 0|#define MLK_ERR_OUT_OF_MEMORY (-2) ------------------ 392| 0| goto cleanup; 393| 0| } 394| | 395| | /* Specification: Implements @[FIPS203, Section 7.3, Hash check] */ 396| 34| ret = mlk_kem_check_sk(sk, context); ------------------ | | 56| 34|#define mlk_kem_check_sk MLK_NAMESPACE_K(check_sk) MLK_CONTEXT_PARAMETERS_1 | | ------------------ | | | | 64| 34|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 34|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 34|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ | | #define mlk_kem_check_sk MLK_NAMESPACE_K(check_sk) MLK_CONTEXT_PARAMETERS_1 | | ------------------ | | | | 210| 34|#define MLK_CONTEXT_PARAMETERS_1(arg0, context) (arg0) | | ------------------ ------------------ 397| 34| if (ret != 0) ------------------ | Branch (397:7): [True: 0, False: 34] ------------------ 398| 0| { 399| 0| goto cleanup; 400| 0| } 401| | 402| 34| ret = mlk_indcpa_dec(buf, ct, sk, context); ------------------ | | 127| 34|#define mlk_indcpa_dec MLK_NAMESPACE_K(indcpa_dec) MLK_CONTEXT_PARAMETERS_3 | | ------------------ | | | | 64| 34|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 34|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 34|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ | | #define mlk_indcpa_dec MLK_NAMESPACE_K(indcpa_dec) MLK_CONTEXT_PARAMETERS_3 | | ------------------ | | | | 212| 34|#define MLK_CONTEXT_PARAMETERS_3(arg0, arg1, arg2, context) (arg0, arg1, arg2) | | ------------------ ------------------ 403| 34| if (ret != 0) ------------------ | Branch (403:7): [True: 0, False: 34] ------------------ 404| 0| { 405| 0| goto cleanup; 406| 0| } 407| | 408| | /* Multitarget countermeasure for coins + contributory KEM */ 409| 34| mlk_memcpy(buf + MLKEM_SYMBYTES, ------------------ | | 168| 34|#define mlk_memcpy memcpy ------------------ mlk_memcpy(buf + MLKEM_SYMBYTES, ------------------ | | 27| 34|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 410| 34| sk + MLKEM_INDCCA_SECRETKEYBYTES - 2 * MLKEM_SYMBYTES, ------------------ | | 72| 34| (MLKEM_INDCPA_SECRETKEYBYTES + MLKEM_INDCPA_PUBLICKEYBYTES + \ | | ------------------ | | | | 65| 34|#define MLKEM_INDCPA_SECRETKEYBYTES (MLKEM_POLYVECBYTES) | | | | ------------------ | | | | | | 31| 34|#define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | | | ------------------ | | | | | | | | 15| 34|#define MLKEM_K 3 | | | | | | ------------------ | | | | | | #define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | | | ------------------ | | | | | | | | 30| 34|#define MLKEM_POLYBYTES 384 | | | | | | ------------------ | | | | ------------------ | | ------------------ | | (MLKEM_INDCPA_SECRETKEYBYTES + MLKEM_INDCPA_PUBLICKEYBYTES + \ | | ------------------ | | | | 64| 34|#define MLKEM_INDCPA_PUBLICKEYBYTES (MLKEM_POLYVECBYTES + MLKEM_SYMBYTES) | | | | ------------------ | | | | | | 31| 34|#define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | | | ------------------ | | | | | | | | 15| 34|#define MLKEM_K 3 | | | | | | ------------------ | | | | | | #define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | | | ------------------ | | | | | | | | 30| 34|#define MLKEM_POLYBYTES 384 | | | | | | ------------------ | | | | ------------------ | | | | #define MLKEM_INDCPA_PUBLICKEYBYTES (MLKEM_POLYVECBYTES + MLKEM_SYMBYTES) | | | | ------------------ | | | | | | 27| 34|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ | | | | ------------------ | | ------------------ | | 73| 34| 2 * MLKEM_SYMBYTES) | | ------------------ | | | | 27| 34|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ | | ------------------ ------------------ sk + MLKEM_INDCCA_SECRETKEYBYTES - 2 * MLKEM_SYMBYTES, ------------------ | | 27| 34|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 411| 34| MLKEM_SYMBYTES); ------------------ | | 27| 34|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 412| 34| mlk_hash_g(kr, buf, 2 * MLKEM_SYMBYTES); ------------------ | | 32| 34|#define mlk_hash_g(OUT, IN, INBYTES) mlk_sha3_512(OUT, IN, INBYTES) | | ------------------ | | | | 20| 34|#define mlk_sha3_512 sha3_512 | | | | ------------------ | | | | | | 31| 34|#define sha3_512 OQS_SHA3_sha3_512 | | | | ------------------ | | ------------------ ------------------ 413| | 414| | /* Recompute and compare ciphertext */ 415| | /* coins are in kr+MLKEM_SYMBYTES */ 416| 34| ret = mlk_indcpa_enc(tmp, buf, pk, kr + MLKEM_SYMBYTES, context); ------------------ | | 88| 34|#define mlk_indcpa_enc MLK_NAMESPACE_K(indcpa_enc) MLK_CONTEXT_PARAMETERS_4 | | ------------------ | | | | 64| 34|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 34|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 34|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ | | #define mlk_indcpa_enc MLK_NAMESPACE_K(indcpa_enc) MLK_CONTEXT_PARAMETERS_4 | | ------------------ | | | | 214| 34| (arg0, arg1, arg2, arg3) | | ------------------ ------------------ 417| 34| if (ret != 0) ------------------ | Branch (417:7): [True: 0, False: 34] ------------------ 418| 0| { 419| 0| goto cleanup; 420| 0| } 421| | 422| 34| fail = mlk_ct_memcmp(ct, tmp, MLKEM_INDCCA_CIPHERTEXTBYTES); ------------------ | | 74| 34|#define MLKEM_INDCCA_CIPHERTEXTBYTES (MLKEM_INDCPA_BYTES) | | ------------------ | | | | 67| 34| (MLKEM_POLYVECCOMPRESSEDBYTES_DU + MLKEM_POLYCOMPRESSEDBYTES_DV) | | | | ------------------ | | | | | | 51| 34|#define MLKEM_POLYVECCOMPRESSEDBYTES_DU (MLKEM_K * MLKEM_POLYCOMPRESSEDBYTES_DU) | | | | | | ------------------ | | | | | | | | 15| 34|#define MLKEM_K 3 | | | | | | ------------------ | | | | | | #define MLKEM_POLYVECCOMPRESSEDBYTES_DU (MLKEM_K * MLKEM_POLYCOMPRESSEDBYTES_DU) | | | | | | ------------------ | | | | | | | | 50| 34|#define MLKEM_POLYCOMPRESSEDBYTES_DU MLKEM_POLYCOMPRESSEDBYTES_D10 | | | | | | | | ------------------ | | | | | | | | | | 35| 34|#define MLKEM_POLYCOMPRESSEDBYTES_D10 320 | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | | | (MLKEM_POLYVECCOMPRESSEDBYTES_DU + MLKEM_POLYCOMPRESSEDBYTES_DV) | | | | ------------------ | | | | | | 49| 34|#define MLKEM_POLYCOMPRESSEDBYTES_DV MLKEM_POLYCOMPRESSEDBYTES_D4 | | | | | | ------------------ | | | | | | | | 33| 34|#define MLKEM_POLYCOMPRESSEDBYTES_D4 128 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 423| | 424| | /* Compute rejection key */ 425| 34| mlk_memcpy(tmp, sk + MLKEM_INDCCA_SECRETKEYBYTES - MLKEM_SYMBYTES, ------------------ | | 168| 34|#define mlk_memcpy memcpy ------------------ mlk_memcpy(tmp, sk + MLKEM_INDCCA_SECRETKEYBYTES - MLKEM_SYMBYTES, ------------------ | | 72| 34| (MLKEM_INDCPA_SECRETKEYBYTES + MLKEM_INDCPA_PUBLICKEYBYTES + \ | | ------------------ | | | | 65| 34|#define MLKEM_INDCPA_SECRETKEYBYTES (MLKEM_POLYVECBYTES) | | | | ------------------ | | | | | | 31| 34|#define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | | | ------------------ | | | | | | | | 15| 34|#define MLKEM_K 3 | | | | | | ------------------ | | | | | | #define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | | | ------------------ | | | | | | | | 30| 34|#define MLKEM_POLYBYTES 384 | | | | | | ------------------ | | | | ------------------ | | ------------------ | | (MLKEM_INDCPA_SECRETKEYBYTES + MLKEM_INDCPA_PUBLICKEYBYTES + \ | | ------------------ | | | | 64| 34|#define MLKEM_INDCPA_PUBLICKEYBYTES (MLKEM_POLYVECBYTES + MLKEM_SYMBYTES) | | | | ------------------ | | | | | | 31| 34|#define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | | | ------------------ | | | | | | | | 15| 34|#define MLKEM_K 3 | | | | | | ------------------ | | | | | | #define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | | | ------------------ | | | | | | | | 30| 34|#define MLKEM_POLYBYTES 384 | | | | | | ------------------ | | | | ------------------ | | | | #define MLKEM_INDCPA_PUBLICKEYBYTES (MLKEM_POLYVECBYTES + MLKEM_SYMBYTES) | | | | ------------------ | | | | | | 27| 34|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ | | | | ------------------ | | ------------------ | | 73| 34| 2 * MLKEM_SYMBYTES) | | ------------------ | | | | 27| 34|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ | | ------------------ ------------------ mlk_memcpy(tmp, sk + MLKEM_INDCCA_SECRETKEYBYTES - MLKEM_SYMBYTES, ------------------ | | 27| 34|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 426| 34| MLKEM_SYMBYTES); ------------------ | | 27| 34|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 427| 34| mlk_memcpy(tmp + MLKEM_SYMBYTES, ct, MLKEM_INDCCA_CIPHERTEXTBYTES); ------------------ | | 168| 34|#define mlk_memcpy memcpy ------------------ mlk_memcpy(tmp + MLKEM_SYMBYTES, ct, MLKEM_INDCCA_CIPHERTEXTBYTES); ------------------ | | 27| 34|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ mlk_memcpy(tmp + MLKEM_SYMBYTES, ct, MLKEM_INDCCA_CIPHERTEXTBYTES); ------------------ | | 74| 34|#define MLKEM_INDCCA_CIPHERTEXTBYTES (MLKEM_INDCPA_BYTES) | | ------------------ | | | | 67| 34| (MLKEM_POLYVECCOMPRESSEDBYTES_DU + MLKEM_POLYCOMPRESSEDBYTES_DV) | | | | ------------------ | | | | | | 51| 34|#define MLKEM_POLYVECCOMPRESSEDBYTES_DU (MLKEM_K * MLKEM_POLYCOMPRESSEDBYTES_DU) | | | | | | ------------------ | | | | | | | | 15| 34|#define MLKEM_K 3 | | | | | | ------------------ | | | | | | #define MLKEM_POLYVECCOMPRESSEDBYTES_DU (MLKEM_K * MLKEM_POLYCOMPRESSEDBYTES_DU) | | | | | | ------------------ | | | | | | | | 50| 34|#define MLKEM_POLYCOMPRESSEDBYTES_DU MLKEM_POLYCOMPRESSEDBYTES_D10 | | | | | | | | ------------------ | | | | | | | | | | 35| 34|#define MLKEM_POLYCOMPRESSEDBYTES_D10 320 | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | | | (MLKEM_POLYVECCOMPRESSEDBYTES_DU + MLKEM_POLYCOMPRESSEDBYTES_DV) | | | | ------------------ | | | | | | 49| 34|#define MLKEM_POLYCOMPRESSEDBYTES_DV MLKEM_POLYCOMPRESSEDBYTES_D4 | | | | | | ------------------ | | | | | | | | 33| 34|#define MLKEM_POLYCOMPRESSEDBYTES_D4 128 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 428| 34| mlk_hash_j(ss, tmp, MLKEM_SYMBYTES + MLKEM_INDCCA_CIPHERTEXTBYTES); ------------------ | | 36| 34| mlk_shake256(OUT, MLKEM_SYMBYTES, IN, INBYTES) | | ------------------ | | | | 18| 34|#define mlk_shake256 shake256 | | | | ------------------ | | | | | | 12| 34|#define shake256 OQS_SHA3_shake256 | | | | ------------------ | | ------------------ | | mlk_shake256(OUT, MLKEM_SYMBYTES, IN, INBYTES) | | ------------------ | | | | 27| 34|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ | | ------------------ ------------------ 429| | 430| | /* Copy true key to return buffer if fail is 0 */ 431| 34| mlk_ct_cmov_zero(ss, kr, MLKEM_SYMBYTES, fail); ------------------ | | 27| 34|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 432| | 433| 34|cleanup: 434| | /* Specification: Partially implements 435| | * @[FIPS203, Section 3.3, Destruction of intermediate values] */ 436| 34| MLK_FREE(tmp, uint8_t, MLKEM_SYMBYTES + MLKEM_INDCCA_CIPHERTEXTBYTES, ------------------ | | 238| 34| do \ | | 239| 34| { \ | | 240| 34| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 34| (v) = NULL; \ | | 242| 34| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 34] | | ------------------ ------------------ 437| 34| context); 438| 34| MLK_FREE(kr, uint8_t, 2 * MLKEM_SYMBYTES, context); ------------------ | | 238| 34| do \ | | 239| 34| { \ | | 240| 34| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 34| (v) = NULL; \ | | 242| 34| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 34] | | ------------------ ------------------ 439| 34| MLK_FREE(buf, uint8_t, 2 * MLKEM_SYMBYTES, context); ------------------ | | 238| 34| do \ | | 239| 34| { \ | | 240| 34| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 34| (v) = NULL; \ | | 242| 34| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 34] | | ------------------ ------------------ 440| | 441| 34| return ret; 442| 34|} poly_k.c:mlk_polyvec_basemul_acc_montgomery_cached_k3_native: 141| 408|{ 142| 408| if (!mlk_sys_check_capability(MLK_SYS_CAP_AVX2)) ------------------ | Branch (142:7): [True: 0, False: 408] ------------------ 143| 0| { 144| 0| return MLK_NATIVE_FUNC_FALLBACK; ------------------ | | 38| 0|#define MLK_NATIVE_FUNC_FALLBACK (-1) ------------------ 145| 0| } 146| | 147| 408| mlk_polyvec_basemul_acc_montgomery_cached_k3_avx2_asm(r, a, b, b_cache); ------------------ | | 124| 408| MLK_NAMESPACE(polyvec_basemul_acc_montgomery_cached_k3_avx2_asm) | | ------------------ | | | | 63| 408|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 408|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 408|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 148| 408| return MLK_NATIVE_FUNC_SUCCESS; ------------------ | | 33| 408|#define MLK_NATIVE_FUNC_SUCCESS (0) ------------------ 149| 408|} PQCP_MLKEM_NATIVE_MLKEM768_X86_64_poly_tomont: 132| 102|{ 133| 102|#if defined(MLK_USE_NATIVE_POLY_TOMONT) 134| 102| int ret; 135| 102| ret = mlk_poly_tomont_native(r->coeffs); 136| 102| if (ret == MLK_NATIVE_FUNC_SUCCESS) ------------------ | | 33| 102|#define MLK_NATIVE_FUNC_SUCCESS (0) ------------------ | Branch (136:7): [True: 102, False: 0] ------------------ 137| 102| { 138| 102| mlk_assert_abs_bound(r, MLKEM_N, MLKEM_Q); ------------------ | | 105| 102| do \ | | 106| 102| { \ | | 107| 102| } while (0) | | ------------------ | | | Branch (107:12): [Folded, False: 102] | | ------------------ ------------------ 139| 102| return; 140| 102| } 141| 0|#endif /* MLK_USE_NATIVE_POLY_TOMONT */ 142| | 143| 0| mlk_poly_tomont_c(r); 144| 0|} PQCP_MLKEM_NATIVE_MLKEM768_X86_64_poly_reduce: 211| 612|{ 212| 612|#if defined(MLK_USE_NATIVE_POLY_REDUCE) 213| 612| int ret; 214| 612| ret = mlk_poly_reduce_native(r->coeffs); 215| 612| if (ret == MLK_NATIVE_FUNC_SUCCESS) ------------------ | | 33| 612|#define MLK_NATIVE_FUNC_SUCCESS (0) ------------------ | Branch (215:7): [True: 612, False: 0] ------------------ 216| 612| { 217| 612| mlk_assert_bound(r, MLKEM_N, 0, MLKEM_Q); ------------------ | | 101| 612| do \ | | 102| 612| { \ | | 103| 612| } while (0) | | ------------------ | | | Branch (103:12): [Folded, False: 612] | | ------------------ ------------------ 218| 612| return; 219| 612| } 220| 0|#endif /* MLK_USE_NATIVE_POLY_REDUCE */ 221| | 222| 0| mlk_poly_reduce_c(r); 223| 0|} PQCP_MLKEM_NATIVE_MLKEM768_X86_64_poly_add: 230| 442|{ 231| 442| unsigned i; 232| 113k| for (i = 0; i < MLKEM_N; i++) ------------------ | | 22| 113k|#define MLKEM_N 256 ------------------ | Branch (232:15): [True: 113k, False: 442] ------------------ 233| 113k| __loop__( 234| 113k| invariant(i <= MLKEM_N) 235| 113k| invariant(forall(k0, i, MLKEM_N, r->coeffs[k0] == loop_entry(*r).coeffs[k0])) 236| 113k| invariant(forall(k1, 0, i, r->coeffs[k1] == loop_entry(*r).coeffs[k1] + b->coeffs[k1])) 237| 113k| decreases(MLKEM_N - i)) 238| 113k| { 239| | /* The preconditions imply that the addition stays within int16_t. */ 240| 113k| r->coeffs[i] = (int16_t)(r->coeffs[i] + b->coeffs[i]); 241| 113k| } 242| 442|} PQCP_MLKEM_NATIVE_MLKEM768_X86_64_poly_sub: 249| 34|{ 250| 34| unsigned i; 251| 8.73k| for (i = 0; i < MLKEM_N; i++) ------------------ | | 22| 8.73k|#define MLKEM_N 256 ------------------ | Branch (251:15): [True: 8.70k, False: 34] ------------------ 252| 8.70k| __loop__( 253| 8.70k| invariant(i <= MLKEM_N) 254| 8.70k| invariant(forall(k0, i, MLKEM_N, r->coeffs[k0] == loop_entry(*r).coeffs[k0])) 255| 8.70k| invariant(forall(k1, 0, i, r->coeffs[k1] == loop_entry(*r).coeffs[k1] - b->coeffs[k1])) 256| 8.70k| decreases(MLKEM_N - i)) 257| 8.70k| { 258| | /* The preconditions imply that the subtraction stays within int16_t. */ 259| 8.70k| r->coeffs[i] = (int16_t)(r->coeffs[i] - b->coeffs[i]); 260| 8.70k| } 261| 34|} PQCP_MLKEM_NATIVE_MLKEM768_X86_64_poly_mulcache_compute: 302| 408|{ 303| 408|#if defined(MLK_USE_NATIVE_POLY_MULCACHE_COMPUTE) 304| 408| int ret; 305| 408| ret = mlk_poly_mulcache_compute_native(x->coeffs, a->coeffs); 306| 408| if (ret == MLK_NATIVE_FUNC_SUCCESS) ------------------ | | 33| 408|#define MLK_NATIVE_FUNC_SUCCESS (0) ------------------ | Branch (306:7): [True: 408, False: 0] ------------------ 307| 408| { 308| 408| return; 309| 408| } 310| 0|#endif /* MLK_USE_NATIVE_POLY_MULCACHE_COMPUTE */ 311| | 312| 0| mlk_poly_mulcache_compute_c(x, a); 313| 0|} PQCP_MLKEM_NATIVE_MLKEM768_X86_64_poly_ntt: 457| 510|{ 458| 510|#if defined(MLK_USE_NATIVE_NTT) 459| 510| int ret; 460| 510| mlk_assert_abs_bound(r, MLKEM_N, MLKEM_Q); ------------------ | | 105| 510| do \ | | 106| 510| { \ | | 107| 510| } while (0) | | ------------------ | | | Branch (107:12): [Folded, False: 510] | | ------------------ ------------------ 461| 510| ret = mlk_ntt_native(r->coeffs); 462| 510| if (ret == MLK_NATIVE_FUNC_SUCCESS) ------------------ | | 33| 510|#define MLK_NATIVE_FUNC_SUCCESS (0) ------------------ | Branch (462:7): [True: 510, False: 0] ------------------ 463| 510| { 464| 510| mlk_assert_abs_bound(r, MLKEM_N, MLK_NTT_BOUND); ------------------ | | 105| 510| do \ | | 106| 510| { \ | | 107| 510| } while (0) | | ------------------ | | | Branch (107:12): [Folded, False: 510] | | ------------------ ------------------ 465| 510| return; 466| 510| } 467| 0|#endif /* MLK_USE_NATIVE_NTT */ 468| | 469| 0| mlk_poly_ntt_c(r); 470| 0|} PQCP_MLKEM_NATIVE_MLKEM768_X86_64_poly_invntt_tomont: 558| 306|{ 559| 306|#if defined(MLK_USE_NATIVE_INTT) 560| 306| int ret; 561| 306| ret = mlk_intt_native(r->coeffs); 562| 306| if (ret == MLK_NATIVE_FUNC_SUCCESS) ------------------ | | 33| 306|#define MLK_NATIVE_FUNC_SUCCESS (0) ------------------ | Branch (562:7): [True: 306, False: 0] ------------------ 563| 306| { 564| 306| mlk_assert_abs_bound(r, MLKEM_N, MLK_INVNTT_BOUND); ------------------ | | 105| 306| do \ | | 106| 306| { \ | | 107| 306| } while (0) | | ------------------ | | | Branch (107:12): [Folded, False: 306] | | ------------------ ------------------ 565| 306| return; 566| 306| } 567| 0|#endif /* MLK_USE_NATIVE_INTT */ 568| | 569| 0| mlk_poly_invntt_tomont_c(r); 570| 0|} PQCP_MLKEM_NATIVE_MLKEM768_X86_64_polyvec_compress_du: 50| 68|{ 51| 68| unsigned i; 52| 68| mlk_assert_bound_2d(a->vec, MLKEM_K, MLKEM_N, 0, MLKEM_Q); ------------------ | | 110| 68| do \ | | 111| 68| { \ | | 112| 68| } while (0) | | ------------------ | | | Branch (112:12): [Folded, False: 68] | | ------------------ ------------------ 53| | 54| 272| for (i = 0; i < MLKEM_K; i++) ------------------ | | 15| 272|#define MLKEM_K 3 ------------------ | Branch (54:15): [True: 204, False: 68] ------------------ 55| 204| { 56| 204| mlk_poly_compress_du(r + i * MLKEM_POLYCOMPRESSEDBYTES_DU, &a->vec[i]); ------------------ | | 49| 204|#define mlk_poly_compress_du MLK_NAMESPACE_K(poly_compress_du) | | ------------------ | | | | 64| 204|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 204|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 204|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ mlk_poly_compress_du(r + i * MLKEM_POLYCOMPRESSEDBYTES_DU, &a->vec[i]); ------------------ | | 50| 204|#define MLKEM_POLYCOMPRESSEDBYTES_DU MLKEM_POLYCOMPRESSEDBYTES_D10 | | ------------------ | | | | 35| 204|#define MLKEM_POLYCOMPRESSEDBYTES_D10 320 | | ------------------ ------------------ 57| 204| } 58| 68|} PQCP_MLKEM_NATIVE_MLKEM768_X86_64_polyvec_decompress_du: 64| 34|{ 65| 34| unsigned i; 66| 136| for (i = 0; i < MLKEM_K; i++) ------------------ | | 15| 136|#define MLKEM_K 3 ------------------ | Branch (66:15): [True: 102, False: 34] ------------------ 67| 102| { 68| 102| mlk_poly_decompress_du(&r->vec[i], a + i * MLKEM_POLYCOMPRESSEDBYTES_DU); ------------------ | | 79| 102|#define mlk_poly_decompress_du MLK_NAMESPACE_K(poly_decompress_du) | | ------------------ | | | | 64| 102|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 102|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 102|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ mlk_poly_decompress_du(&r->vec[i], a + i * MLKEM_POLYCOMPRESSEDBYTES_DU); ------------------ | | 50| 102|#define MLKEM_POLYCOMPRESSEDBYTES_DU MLKEM_POLYCOMPRESSEDBYTES_D10 | | ------------------ | | | | 35| 102|#define MLKEM_POLYCOMPRESSEDBYTES_D10 320 | | ------------------ ------------------ 69| 102| } 70| | 71| 34| mlk_assert_bound_2d(r->vec, MLKEM_K, MLKEM_N, 0, MLKEM_Q); ------------------ | | 110| 34| do \ | | 111| 34| { \ | | 112| 34| } while (0) | | ------------------ | | | Branch (112:12): [Folded, False: 34] | | ------------------ ------------------ 72| 34|} PQCP_MLKEM_NATIVE_MLKEM768_X86_64_polyvec_tobytes: 81| 102|{ 82| 102| unsigned i; 83| 102| mlk_assert_bound_2d(a->vec, MLKEM_K, MLKEM_N, 0, MLKEM_Q); ------------------ | | 110| 102| do \ | | 111| 102| { \ | | 112| 102| } while (0) | | ------------------ | | | Branch (112:12): [Folded, False: 102] | | ------------------ ------------------ 84| | 85| 408| for (i = 0; i < MLKEM_K; i++) ------------------ | | 15| 408|#define MLKEM_K 3 ------------------ | Branch (85:15): [True: 306, False: 102] ------------------ 86| 306| __loop__( 87| 306| assigns(i, memory_slice(r, MLKEM_POLYVECBYTES)) 88| 306| invariant(i <= MLKEM_K) 89| 306| decreases(MLKEM_K - i) 90| 306| ) 91| 306| { 92| 306| mlk_poly_tobytes(&r[i * MLKEM_POLYBYTES], &a->vec[i]); ------------------ | | 512| 306|#define mlk_poly_tobytes MLK_NAMESPACE(poly_tobytes) | | ------------------ | | | | 63| 306|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 306|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 306|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ mlk_poly_tobytes(&r[i * MLKEM_POLYBYTES], &a->vec[i]); ------------------ | | 30| 306|#define MLKEM_POLYBYTES 384 ------------------ 93| 306| } 94| 102|} PQCP_MLKEM_NATIVE_MLKEM768_X86_64_polyvec_frombytes: 99| 136|{ 100| 136| unsigned i; 101| 544| for (i = 0; i < MLKEM_K; i++) ------------------ | | 15| 544|#define MLKEM_K 3 ------------------ | Branch (101:15): [True: 408, False: 136] ------------------ 102| 408| { 103| 408| mlk_poly_frombytes(&r->vec[i], a + i * MLKEM_POLYBYTES); ------------------ | | 534| 408|#define mlk_poly_frombytes MLK_NAMESPACE(poly_frombytes) | | ------------------ | | | | 63| 408|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 408|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 408|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ mlk_poly_frombytes(&r->vec[i], a + i * MLKEM_POLYBYTES); ------------------ | | 30| 408|#define MLKEM_POLYBYTES 384 ------------------ 104| 408| } 105| | 106| 136| mlk_assert_bound_2d(r->vec, MLKEM_K, MLKEM_N, 0, MLKEM_UINT12_LIMIT); ------------------ | | 110| 136| do \ | | 111| 136| { \ | | 112| 136| } while (0) | | ------------------ | | | Branch (112:12): [Folded, False: 136] | | ------------------ ------------------ 107| 136|} PQCP_MLKEM_NATIVE_MLKEM768_X86_64_polyvec_ntt: 112| 170|{ 113| 170| unsigned i; 114| 680| for (i = 0; i < MLKEM_K; i++) ------------------ | | 15| 680|#define MLKEM_K 3 ------------------ | Branch (114:15): [True: 510, False: 170] ------------------ 115| 510| { 116| 510| mlk_poly_ntt(&r->vec[i]); ------------------ | | 235| 510|#define mlk_poly_ntt MLK_NAMESPACE(poly_ntt) | | ------------------ | | | | 63| 510|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 510|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 510|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 117| 510| } 118| | 119| 170| mlk_assert_abs_bound_2d(r->vec, MLKEM_K, MLKEM_N, MLK_NTT_BOUND); ------------------ | | 115| 170| do \ | | 116| 170| { \ | | 117| 170| } while (0) | | ------------------ | | | Branch (117:12): [Folded, False: 170] | | ------------------ ------------------ 120| 170|} PQCP_MLKEM_NATIVE_MLKEM768_X86_64_polyvec_invntt_tomont: 129| 68|{ 130| 68| unsigned i; 131| 272| for (i = 0; i < MLKEM_K; i++) ------------------ | | 15| 272|#define MLKEM_K 3 ------------------ | Branch (131:15): [True: 204, False: 68] ------------------ 132| 204| { 133| 204| mlk_poly_invntt_tomont(&r->vec[i]); ------------------ | | 263| 204|#define mlk_poly_invntt_tomont MLK_NAMESPACE(poly_invntt_tomont) | | ------------------ | | | | 63| 204|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 204|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 204|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 134| 204| } 135| | 136| 68| mlk_assert_abs_bound_2d(r->vec, MLKEM_K, MLKEM_N, MLK_INVNTT_BOUND); ------------------ | | 115| 68| do \ | | 116| 68| { \ | | 117| 68| } while (0) | | ------------------ | | | Branch (117:12): [Folded, False: 68] | | ------------------ ------------------ 137| 68|} PQCP_MLKEM_NATIVE_MLKEM768_X86_64_polyvec_basemul_acc_montgomery_cached: 195| 408|{ 196| 408|#if defined(MLK_USE_NATIVE_POLYVEC_BASEMUL_ACC_MONTGOMERY_CACHED) 197| 408| { 198| 408| int ret; 199| 408| mlk_assert_bound_2d(a->vec, MLKEM_K, MLKEM_N, 0, MLKEM_UINT12_LIMIT); ------------------ | | 110| 408| do \ | | 111| 408| { \ | | 112| 408| } while (0) | | ------------------ | | | Branch (112:12): [Folded, False: 408] | | ------------------ ------------------ 200| |#if MLKEM_K == 2 201| | ret = mlk_polyvec_basemul_acc_montgomery_cached_k2_native( 202| | r->coeffs, (const int16_t *)a, (const int16_t *)b, 203| | (const int16_t *)b_cache); 204| |#elif MLKEM_K == 3 205| | ret = mlk_polyvec_basemul_acc_montgomery_cached_k3_native( 206| 408| r->coeffs, (const int16_t *)a, (const int16_t *)b, 207| 408| (const int16_t *)b_cache); 208| |#elif MLKEM_K == 4 209| | ret = mlk_polyvec_basemul_acc_montgomery_cached_k4_native( 210| | r->coeffs, (const int16_t *)a, (const int16_t *)b, 211| | (const int16_t *)b_cache); 212| |#endif 213| 408| if (ret == MLK_NATIVE_FUNC_SUCCESS) ------------------ | | 33| 408|#define MLK_NATIVE_FUNC_SUCCESS (0) ------------------ | Branch (213:9): [True: 408, False: 0] ------------------ 214| 408| { 215| 408| return; 216| 408| } 217| 408| } 218| 0|#endif /* MLK_USE_NATIVE_POLYVEC_BASEMUL_ACC_MONTGOMERY_CACHED */ 219| | 220| 0| mlk_polyvec_basemul_acc_montgomery_cached_c(r, a, b, b_cache); ------------------ | | 39| 0| MLK_ADD_PARAM_SET(mlk_polyvec_basemul_acc_montgomery_cached_c) | | ------------------ | | | | 48| 0|#define MLK_ADD_PARAM_SET(s) s | | ------------------ ------------------ 221| 0|} PQCP_MLKEM_NATIVE_MLKEM768_X86_64_polyvec_mulcache_compute: 229| 136|{ 230| 136| unsigned i; 231| 544| for (i = 0; i < MLKEM_K; i++) ------------------ | | 15| 544|#define MLKEM_K 3 ------------------ | Branch (231:15): [True: 408, False: 136] ------------------ 232| 408| { 233| 408| mlk_poly_mulcache_compute(&x->vec[i], &a->vec[i]); ------------------ | | 123| 408|#define mlk_poly_mulcache_compute MLK_NAMESPACE(poly_mulcache_compute) | | ------------------ | | | | 63| 408|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 408|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 408|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 234| 408| } 235| 136|} PQCP_MLKEM_NATIVE_MLKEM768_X86_64_polyvec_reduce: 246| 170|{ 247| 170| unsigned i; 248| 680| for (i = 0; i < MLKEM_K; i++) ------------------ | | 15| 680|#define MLKEM_K 3 ------------------ | Branch (248:15): [True: 510, False: 170] ------------------ 249| 510| { 250| 510| mlk_poly_reduce(&r->vec[i]); ------------------ | | 154| 510|#define mlk_poly_reduce MLK_NAMESPACE(poly_reduce) | | ------------------ | | | | 63| 510|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 510|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 510|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 251| 510| } 252| | 253| 170| mlk_assert_bound_2d(r->vec, MLKEM_K, MLKEM_N, 0, MLKEM_Q); ------------------ | | 110| 170| do \ | | 111| 170| { \ | | 112| 170| } while (0) | | ------------------ | | | Branch (112:12): [Folded, False: 170] | | ------------------ ------------------ 254| 170|} PQCP_MLKEM_NATIVE_MLKEM768_X86_64_polyvec_add: 261| 102|{ 262| 102| unsigned i; 263| 408| for (i = 0; i < MLKEM_K; i++) ------------------ | | 15| 408|#define MLKEM_K 3 ------------------ | Branch (263:15): [True: 306, False: 102] ------------------ 264| 306| __loop__( 265| 306| assigns(i, memory_slice(r, sizeof(mlk_polyvec))) 266| 306| invariant(i <= MLKEM_K) 267| 306| invariant(forall(j0, i, MLKEM_K, 268| 306| forall(k0, 0, MLKEM_N, 269| 306| ((int32_t)r->vec[j0].coeffs[k0] + b->vec[j0].coeffs[k0] <= INT16_MAX) && 270| 306| ((int32_t)r->vec[j0].coeffs[k0] + b->vec[j0].coeffs[k0] >= INT16_MIN)))) 271| 306| invariant(forall(j2, 0, i, 272| 306| forall(k2, 0, MLKEM_N, 273| 306| (r->vec[j2].coeffs[k2] <= INT16_MAX) && 274| 306| (r->vec[j2].coeffs[k2] >= INT16_MIN)))) 275| 306| decreases(MLKEM_K - i) 276| 306| ) 277| 306| { 278| 306| mlk_poly_add(&r->vec[i], &b->vec[i]); ------------------ | | 181| 306|#define mlk_poly_add MLK_NAMESPACE(poly_add) | | ------------------ | | | | 63| 306|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 306|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 306|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 279| 306| } 280| 102|} PQCP_MLKEM_NATIVE_MLKEM768_X86_64_polyvec_tomont: 285| 34|{ 286| 34| unsigned i; 287| 136| for (i = 0; i < MLKEM_K; i++) ------------------ | | 15| 136|#define MLKEM_K 3 ------------------ | Branch (287:15): [True: 102, False: 34] ------------------ 288| 102| { 289| 102| mlk_poly_tomont(&r->vec[i]); ------------------ | | 102| 102|#define mlk_poly_tomont MLK_NAMESPACE(poly_tomont) | | ------------------ | | | | 63| 102|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 102|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 102|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 290| 102| } 291| | 292| 34| mlk_assert_abs_bound_2d(r->vec, MLKEM_K, MLKEM_N, MLKEM_Q); ------------------ | | 115| 34| do \ | | 116| 34| { \ | | 117| 34| } while (0) | | ------------------ | | | Branch (117:12): [Folded, False: 34] | | ------------------ ------------------ 293| 34|} PQCP_MLKEM_NATIVE_MLKEM768_X86_64_poly_getnoise_eta1_4x: 337| 204|{ 338| 204| MLK_ALIGN uint8_t buf[4][MLK_ALIGN_UP(MLKEM_ETA1 * MLKEM_N / 4)]; ------------------ | | 190| 204|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) ------------------ 339| 204| MLK_ALIGN uint8_t extkey[4][MLK_ALIGN_UP(MLKEM_SYMBYTES + 1)]; ------------------ | | 190| 204|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) ------------------ 340| 204| mlk_memcpy(extkey[0], seed, MLKEM_SYMBYTES); ------------------ | | 168| 204|#define mlk_memcpy memcpy ------------------ mlk_memcpy(extkey[0], seed, MLKEM_SYMBYTES); ------------------ | | 27| 204|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 341| 204| mlk_memcpy(extkey[1], seed, MLKEM_SYMBYTES); ------------------ | | 168| 204|#define mlk_memcpy memcpy ------------------ mlk_memcpy(extkey[1], seed, MLKEM_SYMBYTES); ------------------ | | 27| 204|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 342| 204| mlk_memcpy(extkey[2], seed, MLKEM_SYMBYTES); ------------------ | | 168| 204|#define mlk_memcpy memcpy ------------------ mlk_memcpy(extkey[2], seed, MLKEM_SYMBYTES); ------------------ | | 27| 204|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 343| 204| mlk_memcpy(extkey[3], seed, MLKEM_SYMBYTES); ------------------ | | 168| 204|#define mlk_memcpy memcpy ------------------ mlk_memcpy(extkey[3], seed, MLKEM_SYMBYTES); ------------------ | | 27| 204|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 344| 204| extkey[0][MLKEM_SYMBYTES] = nonce0; ------------------ | | 27| 204|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 345| 204| extkey[1][MLKEM_SYMBYTES] = nonce1; ------------------ | | 27| 204|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 346| 204| extkey[2][MLKEM_SYMBYTES] = nonce2; ------------------ | | 27| 204|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 347| 204| extkey[3][MLKEM_SYMBYTES] = nonce3; ------------------ | | 27| 204|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 348| | 349| 204|#if !defined(FIPS202_X4_DEFAULT_IMPLEMENTATION) && \ 350| 204| !defined(MLK_CONFIG_SERIAL_FIPS202_ONLY) 351| 204| mlk_prf_eta1_x4(buf, extkey); ------------------ | | 45| 204| mlk_shake256x4((OUT)[0], (OUT)[1], (OUT)[2], (OUT)[3], \ | | ------------------ | | | | 18| 204|#define mlk_shake256x4 shake256x4 | | | | ------------------ | | | | | | 36| 204|#define shake256x4 OQS_SHA3_shake256_x4 | | | | ------------------ | | ------------------ | | 46| 204| (MLKEM_ETA1 * MLKEM_N / 4), (IN)[0], (IN)[1], (IN)[2], \ | | ------------------ | | | | 46| 204|#define MLKEM_ETA1 2 | | ------------------ | | (MLKEM_ETA1 * MLKEM_N / 4), (IN)[0], (IN)[1], (IN)[2], \ | | ------------------ | | | | 22| 204|#define MLKEM_N 256 | | ------------------ | | 47| 204| (IN)[3], MLKEM_SYMBYTES + 1) | | ------------------ | | | | 27| 204|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ | | ------------------ ------------------ 352| |#else 353| | mlk_prf_eta1(buf[0], extkey[0]); 354| | mlk_prf_eta1(buf[1], extkey[1]); 355| | mlk_prf_eta1(buf[2], extkey[2]); 356| | if (r3 != NULL) 357| | { 358| | mlk_prf_eta1(buf[3], extkey[3]); 359| | } 360| |#endif /* !(!FIPS202_X4_DEFAULT_IMPLEMENTATION && \ 361| | !MLK_CONFIG_SERIAL_FIPS202_ONLY) */ 362| | 363| 204| mlk_poly_cbd_eta1(r0, buf[0]); ------------------ | | 36| 204|#define mlk_poly_cbd_eta1 MLK_ADD_PARAM_SET(mlk_poly_cbd_eta1) | | ------------------ | | | | 48| 204|#define MLK_ADD_PARAM_SET(s) s | | ------------------ ------------------ 364| 204| mlk_poly_cbd_eta1(r1, buf[1]); ------------------ | | 36| 204|#define mlk_poly_cbd_eta1 MLK_ADD_PARAM_SET(mlk_poly_cbd_eta1) | | ------------------ | | | | 48| 204|#define MLK_ADD_PARAM_SET(s) s | | ------------------ ------------------ 365| 204| mlk_poly_cbd_eta1(r2, buf[2]); ------------------ | | 36| 204|#define mlk_poly_cbd_eta1 MLK_ADD_PARAM_SET(mlk_poly_cbd_eta1) | | ------------------ | | | | 48| 204|#define MLK_ADD_PARAM_SET(s) s | | ------------------ ------------------ 366| 204| if (r3 != NULL) ------------------ | Branch (366:7): [True: 68, False: 136] ------------------ 367| 68| { 368| 68| mlk_poly_cbd_eta1(r3, buf[3]); ------------------ | | 36| 68|#define mlk_poly_cbd_eta1 MLK_ADD_PARAM_SET(mlk_poly_cbd_eta1) | | ------------------ | | | | 48| 68|#define MLK_ADD_PARAM_SET(s) s | | ------------------ ------------------ 369| 68| mlk_assert_abs_bound(r3, MLKEM_N, MLKEM_ETA1 + 1); ------------------ | | 105| 68| do \ | | 106| 68| { \ | | 107| 68| } while (0) | | ------------------ | | | Branch (107:12): [Folded, False: 68] | | ------------------ ------------------ 370| 68| } 371| | 372| 204| mlk_assert_abs_bound(r0, MLKEM_N, MLKEM_ETA1 + 1); ------------------ | | 105| 204| do \ | | 106| 204| { \ | | 107| 204| } while (0) | | ------------------ | | | Branch (107:12): [Folded, False: 204] | | ------------------ ------------------ 373| 204| mlk_assert_abs_bound(r1, MLKEM_N, MLKEM_ETA1 + 1); ------------------ | | 105| 204| do \ | | 106| 204| { \ | | 107| 204| } while (0) | | ------------------ | | | Branch (107:12): [Folded, False: 204] | | ------------------ ------------------ 374| 204| mlk_assert_abs_bound(r2, MLKEM_N, MLKEM_ETA1 + 1); ------------------ | | 105| 204| do \ | | 106| 204| { \ | | 107| 204| } while (0) | | ------------------ | | | Branch (107:12): [Folded, False: 204] | | ------------------ ------------------ 375| | 376| | /* Specification: Partially implements 377| | * @[FIPS203, Section 3.3, Destruction of intermediate values] */ 378| 204| mlk_zeroize(buf, sizeof(buf)); 379| 204| mlk_zeroize(extkey, sizeof(extkey)); 380| 204|} poly_k.c:PQCP_MLKEM_NATIVE_MLKEM768_X86_64_poly_compress_du: 69| 204|{ 70| 204|#if MLKEM_DU == 10 71| 204| mlk_poly_compress_d10(r, a); ------------------ | | 357| 204|#define mlk_poly_compress_d10 MLK_NAMESPACE(poly_compress_d10) | | ------------------ | | | | 63| 204|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 204|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 204|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 72| |#elif MLKEM_DU == 11 73| | mlk_poly_compress_d11(r, a); 74| |#else 75| |#error "Invalid value of MLKEM_DU" 76| |#endif 77| 204|} poly_k.c:PQCP_MLKEM_NATIVE_MLKEM768_X86_64_poly_decompress_du: 102| 102|{ 103| 102|#if MLKEM_DU == 10 104| 102| mlk_poly_decompress_d10(r, a); ------------------ | | 400| 102|#define mlk_poly_decompress_d10 MLK_NAMESPACE(poly_decompress_d10) | | ------------------ | | | | 63| 102|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 102|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 102|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 105| |#elif MLKEM_DU == 11 106| | mlk_poly_decompress_d11(r, a); 107| |#else 108| |#error "Invalid value of MLKEM_DU" 109| |#endif 110| 102|} indcpa.c:PQCP_MLKEM_NATIVE_MLKEM768_X86_64_poly_compress_dv: 132| 68|{ 133| 68|#if MLKEM_DV == 4 134| 68| mlk_poly_compress_d4(r, a); ------------------ | | 337| 68|#define mlk_poly_compress_d4 MLK_NAMESPACE(poly_compress_d4) | | ------------------ | | | | 63| 68|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 68|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 68|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 135| |#elif MLKEM_DV == 5 136| | mlk_poly_compress_d5(r, a); 137| |#else 138| |#error "Invalid value of MLKEM_DV" 139| |#endif 140| 68|} indcpa.c:PQCP_MLKEM_NATIVE_MLKEM768_X86_64_poly_decompress_dv: 166| 34|{ 167| 34|#if MLKEM_DV == 4 168| 34| mlk_poly_decompress_d4(r, a); ------------------ | | 377| 34|#define mlk_poly_decompress_d4 MLK_NAMESPACE(poly_decompress_d4) | | ------------------ | | | | 63| 34|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 34|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 34|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 169| |#elif MLKEM_DV == 5 170| | mlk_poly_decompress_d5(r, a); 171| |#else 172| |#error "Invalid value of MLKEM_DV" 173| |#endif 174| 34|} PQCP_MLKEM_NATIVE_MLKEM768_X86_64_poly_rej_uniform_x4: 158| 204|{ 159| | /* Temporary buffers for XOF output before rejection sampling */ 160| 204| MLK_ALIGN uint8_t ------------------ | | 190| 204|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) ------------------ 161| 204| buf[4][MLK_ALIGN_UP(MLKEM_GEN_MATRIX_NBLOCKS * MLK_XOF_RATE)]; 162| | 163| | /* Tracks the number of coefficients we have already sampled */ 164| 204| unsigned ctr[4]; 165| 204| mlk_xof_x4_ctx statex; ------------------ | | 51| 204|#define mlk_xof_x4_ctx mlk_shake128x4ctx | | ------------------ | | | | 13| 204|#define mlk_shake128x4ctx shake128x4ctx | | | | ------------------ | | | | | | 51| 204|#define shake128x4ctx shake128x4incctx | | | | | | ------------------ | | | | | | | | 18| 204|#define shake128x4incctx OQS_SHA3_shake128_x4_inc_ctx | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 166| 204| unsigned buflen; 167| | 168| 204| mlk_xof_x4_init(&statex); ------------------ | | 59| 204|#define mlk_xof_x4_init(CTX) mlk_shake128x4_init((CTX)) | | ------------------ | | | | 16| 204|#define mlk_shake128x4_init shake128x4_init | | | | ------------------ | | | | | | 52| 204|#define shake128x4_init shake128x4_inc_init | | | | | | ------------------ | | | | | | | | 19| 204|#define shake128x4_inc_init OQS_SHA3_shake128_x4_inc_init | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 169| 204| mlk_xof_x4_absorb(&statex, seed, MLKEM_SYMBYTES + 2); ------------------ | | 61| 204| mlk_shake128x4_absorb_once((CTX), (IN)[0], (IN)[1], (IN)[2], (IN)[3], \ | | ------------------ | | | | 14| 204|#define mlk_shake128x4_absorb_once shake128x4_absorb_once | | | | ------------------ | | | | | | 39| 204|#define shake128x4_absorb_once OQS_SHA3_shake128_x4_absorb_once | | | | ------------------ | | ------------------ | | 62| 204| (INBYTES)) ------------------ 170| | 171| | /* 172| | * Initially, squeeze heuristic number of MLKEM_GEN_MATRIX_NBLOCKS. 173| | * This should generate the matrix entries with high probability. 174| | */ 175| 204| mlk_xof_x4_squeezeblocks(buf, MLKEM_GEN_MATRIX_NBLOCKS, &statex); ------------------ | | 64| 204| mlk_shake128x4_squeezeblocks((BUF)[0], (BUF)[1], (BUF)[2], (BUF)[3], \ | | ------------------ | | | | 15| 204|#define mlk_shake128x4_squeezeblocks shake128x4_squeezeblocks | | | | ------------------ | | | | | | 46| 204| OQS_SHA3_shake128_x4_inc_squeeze(OUT0, OUT1, OUT2, OUT3, (NBLOCKS)*OQS_SHA3_SHAKE128_RATE, STATE) | | | | | | ------------------ | | | | | | | | 239| 204|#define OQS_SHA3_SHAKE128_RATE 168 | | | | | | ------------------ | | | | ------------------ | | ------------------ | | 65| 204| (NBLOCKS), (CTX)) ------------------ 176| 204| buflen = MLKEM_GEN_MATRIX_NBLOCKS * MLK_XOF_RATE; ------------------ | | 146| 204| ((12 * MLKEM_N / 8 * ((uint32_t)1 << 12) / MLKEM_Q + MLK_XOF_RATE) / \ | | ------------------ | | | | 22| 204|#define MLKEM_N 256 | | ------------------ | | ((12 * MLKEM_N / 8 * ((uint32_t)1 << 12) / MLKEM_Q + MLK_XOF_RATE) / \ | | ------------------ | | | | 23| 204|#define MLKEM_Q 3329 | | ------------------ | | ((12 * MLKEM_N / 8 * ((uint32_t)1 << 12) / MLKEM_Q + MLK_XOF_RATE) / \ | | ------------------ | | | | 68| 204|#define MLK_XOF_RATE SHAKE128_RATE | | | | ------------------ | | | | | | 8| 204|#define SHAKE128_RATE OQS_SHA3_SHAKE128_RATE | | | | | | ------------------ | | | | | | | | 239| 204|#define OQS_SHA3_SHAKE128_RATE 168 | | | | | | ------------------ | | | | ------------------ | | ------------------ | | 147| 204| MLK_XOF_RATE) | | ------------------ | | | | 68| 204|#define MLK_XOF_RATE SHAKE128_RATE | | | | ------------------ | | | | | | 8| 204|#define SHAKE128_RATE OQS_SHA3_SHAKE128_RATE | | | | | | ------------------ | | | | | | | | 239| 204|#define OQS_SHA3_SHAKE128_RATE 168 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ buflen = MLKEM_GEN_MATRIX_NBLOCKS * MLK_XOF_RATE; ------------------ | | 68| 204|#define MLK_XOF_RATE SHAKE128_RATE | | ------------------ | | | | 8| 204|#define SHAKE128_RATE OQS_SHA3_SHAKE128_RATE | | | | ------------------ | | | | | | 239| 204|#define OQS_SHA3_SHAKE128_RATE 168 | | | | ------------------ | | ------------------ ------------------ 177| 204| ctr[0] = mlk_rej_uniform(vec0->coeffs, MLKEM_N, 0, buf[0], buflen); ------------------ | | 22| 204|#define MLKEM_N 256 ------------------ 178| 204| ctr[1] = mlk_rej_uniform(vec1->coeffs, MLKEM_N, 0, buf[1], buflen); ------------------ | | 22| 204|#define MLKEM_N 256 ------------------ 179| 204| ctr[2] = mlk_rej_uniform(vec2->coeffs, MLKEM_N, 0, buf[2], buflen); ------------------ | | 22| 204|#define MLKEM_N 256 ------------------ 180| 204| ctr[3] = mlk_rej_uniform(vec3->coeffs, MLKEM_N, 0, buf[3], buflen); ------------------ | | 22| 204|#define MLKEM_N 256 ------------------ 181| | 182| | /* 183| | * So long as not all matrix entries have been generated, squeeze 184| | * one more block a time until we're done. 185| | */ 186| 204| buflen = MLK_XOF_RATE; ------------------ | | 68| 204|#define MLK_XOF_RATE SHAKE128_RATE | | ------------------ | | | | 8| 204|#define SHAKE128_RATE OQS_SHA3_SHAKE128_RATE | | | | ------------------ | | | | | | 239| 204|#define OQS_SHA3_SHAKE128_RATE 168 | | | | ------------------ | | ------------------ ------------------ 187| 308| while (ctr[0] < MLKEM_N || ctr[1] < MLKEM_N || ctr[2] < MLKEM_N || ------------------ | | 22| 616|#define MLKEM_N 256 ------------------ while (ctr[0] < MLKEM_N || ctr[1] < MLKEM_N || ctr[2] < MLKEM_N || ------------------ | | 22| 586|#define MLKEM_N 256 ------------------ while (ctr[0] < MLKEM_N || ctr[1] < MLKEM_N || ctr[2] < MLKEM_N || ------------------ | | 22| 558|#define MLKEM_N 256 ------------------ | Branch (187:10): [True: 30, False: 278] | Branch (187:30): [True: 28, False: 250] | Branch (187:50): [True: 23, False: 227] ------------------ 188| 227| ctr[3] < MLKEM_N) ------------------ | | 22| 227|#define MLKEM_N 256 ------------------ | Branch (188:10): [True: 23, False: 204] ------------------ 189| 104| __loop__( 190| 104| assigns(ctr, statex, 191| 104| memory_slice(vec0, sizeof(mlk_poly)), 192| 104| memory_slice(vec1, sizeof(mlk_poly)), 193| 104| memory_slice(vec2, sizeof(mlk_poly)), 194| 104| memory_slice(vec3, sizeof(mlk_poly)), 195| 104| object_whole(buf)) 196| 104| invariant(ctr[0] <= MLKEM_N && ctr[1] <= MLKEM_N) 197| 104| invariant(ctr[2] <= MLKEM_N && ctr[3] <= MLKEM_N) 198| 104| invariant(array_bound(vec0->coeffs, 0, ctr[0], 0, MLKEM_Q)) 199| 104| invariant(array_bound(vec1->coeffs, 0, ctr[1], 0, MLKEM_Q)) 200| 104| invariant(array_bound(vec2->coeffs, 0, ctr[2], 0, MLKEM_Q)) 201| 104| invariant(array_bound(vec3->coeffs, 0, ctr[3], 0, MLKEM_Q))) 202| 104| { 203| 104| mlk_xof_x4_squeezeblocks(buf, 1, &statex); ------------------ | | 64| 104| mlk_shake128x4_squeezeblocks((BUF)[0], (BUF)[1], (BUF)[2], (BUF)[3], \ | | ------------------ | | | | 15| 104|#define mlk_shake128x4_squeezeblocks shake128x4_squeezeblocks | | | | ------------------ | | | | | | 46| 104| OQS_SHA3_shake128_x4_inc_squeeze(OUT0, OUT1, OUT2, OUT3, (NBLOCKS)*OQS_SHA3_SHAKE128_RATE, STATE) | | | | | | ------------------ | | | | | | | | 239| 104|#define OQS_SHA3_SHAKE128_RATE 168 | | | | | | ------------------ | | | | ------------------ | | ------------------ | | 65| 104| (NBLOCKS), (CTX)) ------------------ 204| 104| ctr[0] = mlk_rej_uniform(vec0->coeffs, MLKEM_N, ctr[0], buf[0], buflen); ------------------ | | 22| 104|#define MLKEM_N 256 ------------------ 205| 104| ctr[1] = mlk_rej_uniform(vec1->coeffs, MLKEM_N, ctr[1], buf[1], buflen); ------------------ | | 22| 104|#define MLKEM_N 256 ------------------ 206| 104| ctr[2] = mlk_rej_uniform(vec2->coeffs, MLKEM_N, ctr[2], buf[2], buflen); ------------------ | | 22| 104|#define MLKEM_N 256 ------------------ 207| 104| ctr[3] = mlk_rej_uniform(vec3->coeffs, MLKEM_N, ctr[3], buf[3], buflen); ------------------ | | 22| 104|#define MLKEM_N 256 ------------------ 208| 104| } 209| | 210| 204| mlk_xof_x4_release(&statex); ------------------ | | 66| 204|#define mlk_xof_x4_release(CTX) mlk_shake128x4_release((CTX)) | | ------------------ | | | | 17| 204|#define mlk_shake128x4_release shake128x4_release | | | | ------------------ | | | | | | 53| 204|#define shake128x4_release shake128x4_inc_ctx_release | | | | | | ------------------ | | | | | | | | 23| 204|#define shake128x4_inc_ctx_release OQS_SHA3_shake128_x4_inc_ctx_release | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 211| | 212| | /* Specification: Partially implements 213| | * @[FIPS203, Section 3.3, Destruction of intermediate values] */ 214| 204| mlk_zeroize(buf, sizeof(buf)); 215| 204|} PQCP_MLKEM_NATIVE_MLKEM768_X86_64_poly_rej_uniform: 220| 102|{ 221| 102| mlk_xof_ctx state; ------------------ | | 50| 102|#define mlk_xof_ctx mlk_shake128ctx | | ------------------ | | | | 13| 102|#define mlk_shake128ctx shake128ctx | | | | ------------------ | | | | | | 54| 102|#define shake128ctx shake128incctx | | | | | | ------------------ | | | | | | | | 38| 102|#define shake128incctx OQS_SHA3_shake128_inc_ctx | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 222| 102| MLK_ALIGN uint8_t buf[MLKEM_GEN_MATRIX_NBLOCKS * MLK_XOF_RATE]; ------------------ | | 190| 102|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) ------------------ 223| 102| unsigned ctr, buflen; 224| | 225| 102| mlk_xof_init(&state); ------------------ | | 52| 102|#define mlk_xof_init(CTX) mlk_shake128_init((CTX)) | | ------------------ | | | | 16| 102|#define mlk_shake128_init shake128_init | | | | ------------------ | | | | | | 56| 102|#define shake128_init shake128_inc_init | | | | | | ------------------ | | | | | | | | 39| 102|#define shake128_inc_init OQS_SHA3_shake128_inc_init | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 226| 102| mlk_xof_absorb(&state, seed, MLKEM_SYMBYTES + 2); ------------------ | | 54| 102| mlk_shake128_absorb_once((CTX), (IN), (INBYTES)) | | ------------------ | | | | 14| 102|#define mlk_shake128_absorb_once shake128_absorb_once | | | | ------------------ | | | | | | 57| 102|#define shake128_absorb_once OQS_SHA3_shake128_absorb_once | | | | ------------------ | | ------------------ ------------------ 227| | 228| | /* Initially, squeeze + sample heuristic number of MLKEM_GEN_MATRIX_NBLOCKS. 229| | */ 230| | /* This should generate the matrix entry with high probability. */ 231| 102| mlk_xof_squeezeblocks(buf, MLKEM_GEN_MATRIX_NBLOCKS, &state); ------------------ | | 56| 102| mlk_shake128_squeezeblocks((BUF), (NBLOCKS), (CTX)) | | ------------------ | | | | 15| 102|#define mlk_shake128_squeezeblocks shake128_squeezeblocks | | | | ------------------ | | | | | | 64| 102| OQS_SHA3_shake128_inc_squeeze(OUT, (NBLOCKS)*OQS_SHA3_SHAKE128_RATE, STATE) | | | | | | ------------------ | | | | | | | | 239| 102|#define OQS_SHA3_SHAKE128_RATE 168 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 232| 102| buflen = MLKEM_GEN_MATRIX_NBLOCKS * MLK_XOF_RATE; ------------------ | | 146| 102| ((12 * MLKEM_N / 8 * ((uint32_t)1 << 12) / MLKEM_Q + MLK_XOF_RATE) / \ | | ------------------ | | | | 22| 102|#define MLKEM_N 256 | | ------------------ | | ((12 * MLKEM_N / 8 * ((uint32_t)1 << 12) / MLKEM_Q + MLK_XOF_RATE) / \ | | ------------------ | | | | 23| 102|#define MLKEM_Q 3329 | | ------------------ | | ((12 * MLKEM_N / 8 * ((uint32_t)1 << 12) / MLKEM_Q + MLK_XOF_RATE) / \ | | ------------------ | | | | 68| 102|#define MLK_XOF_RATE SHAKE128_RATE | | | | ------------------ | | | | | | 8| 102|#define SHAKE128_RATE OQS_SHA3_SHAKE128_RATE | | | | | | ------------------ | | | | | | | | 239| 102|#define OQS_SHA3_SHAKE128_RATE 168 | | | | | | ------------------ | | | | ------------------ | | ------------------ | | 147| 102| MLK_XOF_RATE) | | ------------------ | | | | 68| 102|#define MLK_XOF_RATE SHAKE128_RATE | | | | ------------------ | | | | | | 8| 102|#define SHAKE128_RATE OQS_SHA3_SHAKE128_RATE | | | | | | ------------------ | | | | | | | | 239| 102|#define OQS_SHA3_SHAKE128_RATE 168 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ buflen = MLKEM_GEN_MATRIX_NBLOCKS * MLK_XOF_RATE; ------------------ | | 68| 102|#define MLK_XOF_RATE SHAKE128_RATE | | ------------------ | | | | 8| 102|#define SHAKE128_RATE OQS_SHA3_SHAKE128_RATE | | | | ------------------ | | | | | | 239| 102|#define OQS_SHA3_SHAKE128_RATE 168 | | | | ------------------ | | ------------------ ------------------ 233| 102| ctr = mlk_rej_uniform(entry->coeffs, MLKEM_N, 0, buf, buflen); ------------------ | | 22| 102|#define MLKEM_N 256 ------------------ 234| | 235| | /* Squeeze + sample one more block a time until we're done */ 236| 102| buflen = MLK_XOF_RATE; ------------------ | | 68| 102|#define MLK_XOF_RATE SHAKE128_RATE | | ------------------ | | | | 8| 102|#define SHAKE128_RATE OQS_SHA3_SHAKE128_RATE | | | | ------------------ | | | | | | 239| 102|#define OQS_SHA3_SHAKE128_RATE 168 | | | | ------------------ | | ------------------ ------------------ 237| 120| while (ctr < MLKEM_N) ------------------ | | 22| 120|#define MLKEM_N 256 ------------------ | Branch (237:10): [True: 18, False: 102] ------------------ 238| 18| __loop__( 239| 18| assigns(ctr, state, memory_slice(entry, sizeof(mlk_poly)), object_whole(buf)) 240| 18| invariant(ctr <= MLKEM_N) 241| 18| invariant(array_bound(entry->coeffs, 0, ctr, 0, MLKEM_Q))) 242| 18| { 243| 18| mlk_xof_squeezeblocks(buf, 1, &state); ------------------ | | 56| 18| mlk_shake128_squeezeblocks((BUF), (NBLOCKS), (CTX)) | | ------------------ | | | | 15| 18|#define mlk_shake128_squeezeblocks shake128_squeezeblocks | | | | ------------------ | | | | | | 64| 18| OQS_SHA3_shake128_inc_squeeze(OUT, (NBLOCKS)*OQS_SHA3_SHAKE128_RATE, STATE) | | | | | | ------------------ | | | | | | | | 239| 18|#define OQS_SHA3_SHAKE128_RATE 168 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 244| 18| ctr = mlk_rej_uniform(entry->coeffs, MLKEM_N, ctr, buf, buflen); ------------------ | | 22| 18|#define MLKEM_N 256 ------------------ 245| 18| } 246| | 247| 102| mlk_xof_release(&state); ------------------ | | 57| 102|#define mlk_xof_release(CTX) mlk_shake128_release((CTX)) | | ------------------ | | | | 17| 102|#define mlk_shake128_release shake128_release | | | | ------------------ | | | | | | 55| 102|#define shake128_release shake128_inc_ctx_release | | | | | | ------------------ | | | | | | | | 43| 102|#define shake128_inc_ctx_release OQS_SHA3_shake128_inc_ctx_release | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 248| | 249| | /* Specification: Partially implements 250| | * @[FIPS203, Section 3.3, Destruction of intermediate values] */ 251| 102| mlk_zeroize(buf, sizeof(buf)); 252| 102|} PQCP_MLKEM_NATIVE_MLKEM768_X86_64_poly_cbd2: 276| 680|{ 277| 680| unsigned i; 278| 22.4k| for (i = 0; i < MLKEM_N / 8; i++) ------------------ | | 22| 22.4k|#define MLKEM_N 256 ------------------ | Branch (278:15): [True: 21.7k, False: 680] ------------------ 279| 21.7k| __loop__( 280| 21.7k| invariant(i <= MLKEM_N / 8) 281| 21.7k| invariant(array_abs_bound(r->coeffs, 0, 8 * i, 3)) 282| 21.7k| decreases(MLKEM_N / 8 - i)) 283| 21.7k| { 284| 21.7k| unsigned j; 285| 21.7k| uint32_t t = mlk_load32_littleendian(buf + 4 * i); 286| 21.7k| uint32_t d = t & 0x55555555; 287| 21.7k| d += (t >> 1) & 0x55555555; 288| | 289| 195k| for (j = 0; j < 8; j++) ------------------ | Branch (289:17): [True: 174k, False: 21.7k] ------------------ 290| 174k| __loop__( 291| 174k| invariant(i <= MLKEM_N / 8 && j <= 8) 292| 174k| invariant(array_abs_bound(r->coeffs, 0, 8 * i + j, 3)) 293| 174k| decreases(8 - j)) 294| 174k| { 295| | /* Safety: The & 0x3 masks each value to 2 bits (range [0, 3]), so the 296| | * truncation and subsequent subtraction in int16_t is lossless. */ 297| 174k| const int16_t a = (int16_t)((d >> (4 * j + 0)) & 0x3); 298| 174k| const int16_t b = (int16_t)((d >> (4 * j + 2)) & 0x3); 299| 174k| r->coeffs[8 * i + j] = (int16_t)(a - b); 300| 174k| } 301| 21.7k| } 302| 680|} OQS_KEM_ntru_hps2048509_new: 9| 182|OQS_KEM *OQS_KEM_ntru_hps2048509_new(void) { 10| | 11| 182| OQS_KEM *kem = OQS_MEM_calloc(1, sizeof(OQS_KEM)); 12| 182| if (kem == NULL) { ------------------ | Branch (12:6): [True: 0, False: 182] ------------------ 13| 0| return NULL; 14| 0| } 15| 182| kem->method_name = OQS_KEM_alg_ntru_hps2048509; ------------------ | | 81| 182|#define OQS_KEM_alg_ntru_hps2048509 "NTRU-HPS-2048-509" ------------------ 16| 182| kem->alg_version = "https://github.com/jschanck/ntru/tree/6d96ed37 reference implementation"; 17| | 18| 182| kem->claimed_nist_level = 1; 19| 182| kem->ind_cca = true; 20| | 21| 182| kem->length_public_key = OQS_KEM_ntru_hps2048509_length_public_key; ------------------ | | 9| 182|#define OQS_KEM_ntru_hps2048509_length_public_key 699 ------------------ 22| 182| kem->length_secret_key = OQS_KEM_ntru_hps2048509_length_secret_key; ------------------ | | 10| 182|#define OQS_KEM_ntru_hps2048509_length_secret_key 935 ------------------ 23| 182| kem->length_ciphertext = OQS_KEM_ntru_hps2048509_length_ciphertext; ------------------ | | 11| 182|#define OQS_KEM_ntru_hps2048509_length_ciphertext 699 ------------------ 24| 182| kem->length_shared_secret = OQS_KEM_ntru_hps2048509_length_shared_secret; ------------------ | | 12| 182|#define OQS_KEM_ntru_hps2048509_length_shared_secret 32 ------------------ 25| 182| kem->length_keypair_seed = OQS_KEM_ntru_hps2048509_length_keypair_seed; ------------------ | | 13| 182|#define OQS_KEM_ntru_hps2048509_length_keypair_seed 0 ------------------ 26| 182| kem->length_encaps_seed = OQS_KEM_ntru_hps2048509_length_encaps_seed; ------------------ | | 14| 182|#define OQS_KEM_ntru_hps2048509_length_encaps_seed 0 ------------------ 27| | 28| 182| kem->keypair = OQS_KEM_ntru_hps2048509_keypair; 29| 182| kem->keypair_derand = OQS_KEM_ntru_hps2048509_keypair_derand; 30| 182| kem->encaps = OQS_KEM_ntru_hps2048509_encaps; 31| 182| kem->encaps_derand = OQS_KEM_ntru_hps2048509_encaps_derand; 32| 182| kem->decaps = OQS_KEM_ntru_hps2048509_decaps; 33| | 34| 182| return kem; 35| 182|} OQS_KEM_ntru_hps2048509_keypair: 47| 182|OQS_API OQS_STATUS OQS_KEM_ntru_hps2048509_keypair(uint8_t *public_key, uint8_t *secret_key) { 48| 182|#if defined(OQS_ENABLE_KEM_ntru_hps2048509_avx2) 49| 182|#if defined(OQS_DIST_BUILD) 50| 182| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2) && OQS_CPU_has_extension(OQS_CPU_EXT_BMI2)) { ------------------ | Branch (50:6): [True: 182, False: 0] | Branch (50:49): [True: 182, False: 0] ------------------ 51| 182|#endif /* OQS_DIST_BUILD */ 52| 182| return (OQS_STATUS) PQCLEAN_NTRUHPS2048509_AVX2_crypto_kem_keypair(public_key, secret_key); 53| 182|#if defined(OQS_DIST_BUILD) 54| 182| } else { 55| 0| return (OQS_STATUS) PQCLEAN_NTRUHPS2048509_CLEAN_crypto_kem_keypair(public_key, secret_key); 56| 0| } 57| 182|#endif /* OQS_DIST_BUILD */ 58| |#else 59| | return (OQS_STATUS) PQCLEAN_NTRUHPS2048509_CLEAN_crypto_kem_keypair(public_key, secret_key); 60| |#endif 61| 182|} OQS_KEM_ntru_hps2048509_encaps: 78| 182|OQS_API OQS_STATUS OQS_KEM_ntru_hps2048509_encaps(uint8_t *ciphertext, uint8_t *shared_secret, const uint8_t *public_key) { 79| 182|#if defined(OQS_ENABLE_KEM_ntru_hps2048509_avx2) 80| 182|#if defined(OQS_DIST_BUILD) 81| 182| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2) && OQS_CPU_has_extension(OQS_CPU_EXT_BMI2)) { ------------------ | Branch (81:6): [True: 182, False: 0] | Branch (81:49): [True: 182, False: 0] ------------------ 82| 182|#endif /* OQS_DIST_BUILD */ 83| 182| return (OQS_STATUS) PQCLEAN_NTRUHPS2048509_AVX2_crypto_kem_enc(ciphertext, shared_secret, public_key); 84| 182|#if defined(OQS_DIST_BUILD) 85| 182| } else { 86| 0| return (OQS_STATUS) PQCLEAN_NTRUHPS2048509_CLEAN_crypto_kem_enc(ciphertext, shared_secret, public_key); 87| 0| } 88| 182|#endif /* OQS_DIST_BUILD */ 89| |#else 90| | return (OQS_STATUS) PQCLEAN_NTRUHPS2048509_CLEAN_crypto_kem_enc(ciphertext, shared_secret, public_key); 91| |#endif 92| 182|} OQS_KEM_ntru_hps2048509_decaps: 94| 182|OQS_API OQS_STATUS OQS_KEM_ntru_hps2048509_decaps(uint8_t *shared_secret, const uint8_t *ciphertext, const uint8_t *secret_key) { 95| 182|#if defined(OQS_ENABLE_KEM_ntru_hps2048509_avx2) 96| 182|#if defined(OQS_DIST_BUILD) 97| 182| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2) && OQS_CPU_has_extension(OQS_CPU_EXT_BMI2)) { ------------------ | Branch (97:6): [True: 182, False: 0] | Branch (97:49): [True: 182, False: 0] ------------------ 98| 182|#endif /* OQS_DIST_BUILD */ 99| 182| return (OQS_STATUS) PQCLEAN_NTRUHPS2048509_AVX2_crypto_kem_dec(shared_secret, ciphertext, secret_key); 100| 182|#if defined(OQS_DIST_BUILD) 101| 182| } else { 102| 0| return (OQS_STATUS) PQCLEAN_NTRUHPS2048509_CLEAN_crypto_kem_dec(shared_secret, ciphertext, secret_key); 103| 0| } 104| 182|#endif /* OQS_DIST_BUILD */ 105| |#else 106| | return (OQS_STATUS) PQCLEAN_NTRUHPS2048509_CLEAN_crypto_kem_dec(shared_secret, ciphertext, secret_key); 107| |#endif 108| 182|} OQS_KEM_ntru_hps2048677_new: 9| 14|OQS_KEM *OQS_KEM_ntru_hps2048677_new(void) { 10| | 11| 14| OQS_KEM *kem = OQS_MEM_calloc(1, sizeof(OQS_KEM)); 12| 14| if (kem == NULL) { ------------------ | Branch (12:6): [True: 0, False: 14] ------------------ 13| 0| return NULL; 14| 0| } 15| 14| kem->method_name = OQS_KEM_alg_ntru_hps2048677; ------------------ | | 83| 14|#define OQS_KEM_alg_ntru_hps2048677 "NTRU-HPS-2048-677" ------------------ 16| 14| kem->alg_version = "https://github.com/jschanck/ntru/tree/6d96ed37 reference implementation"; 17| | 18| 14| kem->claimed_nist_level = 3; 19| 14| kem->ind_cca = true; 20| | 21| 14| kem->length_public_key = OQS_KEM_ntru_hps2048677_length_public_key; ------------------ | | 24| 14|#define OQS_KEM_ntru_hps2048677_length_public_key 930 ------------------ 22| 14| kem->length_secret_key = OQS_KEM_ntru_hps2048677_length_secret_key; ------------------ | | 25| 14|#define OQS_KEM_ntru_hps2048677_length_secret_key 1234 ------------------ 23| 14| kem->length_ciphertext = OQS_KEM_ntru_hps2048677_length_ciphertext; ------------------ | | 26| 14|#define OQS_KEM_ntru_hps2048677_length_ciphertext 930 ------------------ 24| 14| kem->length_shared_secret = OQS_KEM_ntru_hps2048677_length_shared_secret; ------------------ | | 27| 14|#define OQS_KEM_ntru_hps2048677_length_shared_secret 32 ------------------ 25| 14| kem->length_keypair_seed = OQS_KEM_ntru_hps2048677_length_keypair_seed; ------------------ | | 28| 14|#define OQS_KEM_ntru_hps2048677_length_keypair_seed 0 ------------------ 26| 14| kem->length_encaps_seed = OQS_KEM_ntru_hps2048677_length_encaps_seed; ------------------ | | 29| 14|#define OQS_KEM_ntru_hps2048677_length_encaps_seed 0 ------------------ 27| | 28| 14| kem->keypair = OQS_KEM_ntru_hps2048677_keypair; 29| 14| kem->keypair_derand = OQS_KEM_ntru_hps2048677_keypair_derand; 30| 14| kem->encaps = OQS_KEM_ntru_hps2048677_encaps; 31| 14| kem->encaps_derand = OQS_KEM_ntru_hps2048677_encaps_derand; 32| 14| kem->decaps = OQS_KEM_ntru_hps2048677_decaps; 33| | 34| 14| return kem; 35| 14|} OQS_KEM_ntru_hps2048677_keypair: 47| 14|OQS_API OQS_STATUS OQS_KEM_ntru_hps2048677_keypair(uint8_t *public_key, uint8_t *secret_key) { 48| 14|#if defined(OQS_ENABLE_KEM_ntru_hps2048677_avx2) 49| 14|#if defined(OQS_DIST_BUILD) 50| 14| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2) && OQS_CPU_has_extension(OQS_CPU_EXT_BMI2)) { ------------------ | Branch (50:6): [True: 14, False: 0] | Branch (50:49): [True: 14, False: 0] ------------------ 51| 14|#endif /* OQS_DIST_BUILD */ 52| 14| return (OQS_STATUS) PQCLEAN_NTRUHPS2048677_AVX2_crypto_kem_keypair(public_key, secret_key); 53| 14|#if defined(OQS_DIST_BUILD) 54| 14| } else { 55| 0| return (OQS_STATUS) PQCLEAN_NTRUHPS2048677_CLEAN_crypto_kem_keypair(public_key, secret_key); 56| 0| } 57| 14|#endif /* OQS_DIST_BUILD */ 58| |#else 59| | return (OQS_STATUS) PQCLEAN_NTRUHPS2048677_CLEAN_crypto_kem_keypair(public_key, secret_key); 60| |#endif 61| 14|} OQS_KEM_ntru_hps2048677_encaps: 78| 14|OQS_API OQS_STATUS OQS_KEM_ntru_hps2048677_encaps(uint8_t *ciphertext, uint8_t *shared_secret, const uint8_t *public_key) { 79| 14|#if defined(OQS_ENABLE_KEM_ntru_hps2048677_avx2) 80| 14|#if defined(OQS_DIST_BUILD) 81| 14| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2) && OQS_CPU_has_extension(OQS_CPU_EXT_BMI2)) { ------------------ | Branch (81:6): [True: 14, False: 0] | Branch (81:49): [True: 14, False: 0] ------------------ 82| 14|#endif /* OQS_DIST_BUILD */ 83| 14| return (OQS_STATUS) PQCLEAN_NTRUHPS2048677_AVX2_crypto_kem_enc(ciphertext, shared_secret, public_key); 84| 14|#if defined(OQS_DIST_BUILD) 85| 14| } else { 86| 0| return (OQS_STATUS) PQCLEAN_NTRUHPS2048677_CLEAN_crypto_kem_enc(ciphertext, shared_secret, public_key); 87| 0| } 88| 14|#endif /* OQS_DIST_BUILD */ 89| |#else 90| | return (OQS_STATUS) PQCLEAN_NTRUHPS2048677_CLEAN_crypto_kem_enc(ciphertext, shared_secret, public_key); 91| |#endif 92| 14|} OQS_KEM_ntru_hps2048677_decaps: 94| 14|OQS_API OQS_STATUS OQS_KEM_ntru_hps2048677_decaps(uint8_t *shared_secret, const uint8_t *ciphertext, const uint8_t *secret_key) { 95| 14|#if defined(OQS_ENABLE_KEM_ntru_hps2048677_avx2) 96| 14|#if defined(OQS_DIST_BUILD) 97| 14| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2) && OQS_CPU_has_extension(OQS_CPU_EXT_BMI2)) { ------------------ | Branch (97:6): [True: 14, False: 0] | Branch (97:49): [True: 14, False: 0] ------------------ 98| 14|#endif /* OQS_DIST_BUILD */ 99| 14| return (OQS_STATUS) PQCLEAN_NTRUHPS2048677_AVX2_crypto_kem_dec(shared_secret, ciphertext, secret_key); 100| 14|#if defined(OQS_DIST_BUILD) 101| 14| } else { 102| 0| return (OQS_STATUS) PQCLEAN_NTRUHPS2048677_CLEAN_crypto_kem_dec(shared_secret, ciphertext, secret_key); 103| 0| } 104| 14|#endif /* OQS_DIST_BUILD */ 105| |#else 106| | return (OQS_STATUS) PQCLEAN_NTRUHPS2048677_CLEAN_crypto_kem_dec(shared_secret, ciphertext, secret_key); 107| |#endif 108| 14|} OQS_KEM_ntru_hps40961229_new: 9| 42|OQS_KEM *OQS_KEM_ntru_hps40961229_new(void) { 10| | 11| 42| OQS_KEM *kem = OQS_MEM_calloc(1, sizeof(OQS_KEM)); 12| 42| if (kem == NULL) { ------------------ | Branch (12:6): [True: 0, False: 42] ------------------ 13| 0| return NULL; 14| 0| } 15| 42| kem->method_name = OQS_KEM_alg_ntru_hps40961229; ------------------ | | 87| 42|#define OQS_KEM_alg_ntru_hps40961229 "NTRU-HPS-4096-1229" ------------------ 16| 42| kem->alg_version = "https://github.com/jschanck/ntru/tree/6d96ed37 reference implementation"; 17| | 18| 42| kem->claimed_nist_level = 5; 19| 42| kem->ind_cca = true; 20| | 21| 42| kem->length_public_key = OQS_KEM_ntru_hps40961229_length_public_key; ------------------ | | 54| 42|#define OQS_KEM_ntru_hps40961229_length_public_key 1842 ------------------ 22| 42| kem->length_secret_key = OQS_KEM_ntru_hps40961229_length_secret_key; ------------------ | | 55| 42|#define OQS_KEM_ntru_hps40961229_length_secret_key 2366 ------------------ 23| 42| kem->length_ciphertext = OQS_KEM_ntru_hps40961229_length_ciphertext; ------------------ | | 56| 42|#define OQS_KEM_ntru_hps40961229_length_ciphertext 1842 ------------------ 24| 42| kem->length_shared_secret = OQS_KEM_ntru_hps40961229_length_shared_secret; ------------------ | | 57| 42|#define OQS_KEM_ntru_hps40961229_length_shared_secret 32 ------------------ 25| 42| kem->length_keypair_seed = OQS_KEM_ntru_hps40961229_length_keypair_seed; ------------------ | | 58| 42|#define OQS_KEM_ntru_hps40961229_length_keypair_seed 0 ------------------ 26| 42| kem->length_encaps_seed = OQS_KEM_ntru_hps40961229_length_encaps_seed; ------------------ | | 59| 42|#define OQS_KEM_ntru_hps40961229_length_encaps_seed 0 ------------------ 27| | 28| 42| kem->keypair = OQS_KEM_ntru_hps40961229_keypair; 29| 42| kem->keypair_derand = OQS_KEM_ntru_hps40961229_keypair_derand; 30| 42| kem->encaps = OQS_KEM_ntru_hps40961229_encaps; 31| 42| kem->encaps_derand = OQS_KEM_ntru_hps40961229_encaps_derand; 32| 42| kem->decaps = OQS_KEM_ntru_hps40961229_decaps; 33| | 34| 42| return kem; 35| 42|} OQS_KEM_ntru_hps40961229_keypair: 41| 42|OQS_API OQS_STATUS OQS_KEM_ntru_hps40961229_keypair(uint8_t *public_key, uint8_t *secret_key) { 42| 42| return (OQS_STATUS) PQCLEAN_NTRUHPS40961229_CLEAN_crypto_kem_keypair(public_key, secret_key); 43| 42|} OQS_KEM_ntru_hps40961229_encaps: 60| 42|OQS_API OQS_STATUS OQS_KEM_ntru_hps40961229_encaps(uint8_t *ciphertext, uint8_t *shared_secret, const uint8_t *public_key) { 61| 42| return (OQS_STATUS) PQCLEAN_NTRUHPS40961229_CLEAN_crypto_kem_enc(ciphertext, shared_secret, public_key); 62| 42|} OQS_KEM_ntru_hps40961229_decaps: 64| 42|OQS_API OQS_STATUS OQS_KEM_ntru_hps40961229_decaps(uint8_t *shared_secret, const uint8_t *ciphertext, const uint8_t *secret_key) { 65| 42| return (OQS_STATUS) PQCLEAN_NTRUHPS40961229_CLEAN_crypto_kem_dec(shared_secret, ciphertext, secret_key); 66| 42|} OQS_KEM_ntru_hps4096821_new: 9| 89|OQS_KEM *OQS_KEM_ntru_hps4096821_new(void) { 10| | 11| 89| OQS_KEM *kem = OQS_MEM_calloc(1, sizeof(OQS_KEM)); 12| 89| if (kem == NULL) { ------------------ | Branch (12:6): [True: 0, False: 89] ------------------ 13| 0| return NULL; 14| 0| } 15| 89| kem->method_name = OQS_KEM_alg_ntru_hps4096821; ------------------ | | 85| 89|#define OQS_KEM_alg_ntru_hps4096821 "NTRU-HPS-4096-821" ------------------ 16| 89| kem->alg_version = "https://github.com/jschanck/ntru/tree/6d96ed37 reference implementation"; 17| | 18| 89| kem->claimed_nist_level = 5; 19| 89| kem->ind_cca = true; 20| | 21| 89| kem->length_public_key = OQS_KEM_ntru_hps4096821_length_public_key; ------------------ | | 39| 89|#define OQS_KEM_ntru_hps4096821_length_public_key 1230 ------------------ 22| 89| kem->length_secret_key = OQS_KEM_ntru_hps4096821_length_secret_key; ------------------ | | 40| 89|#define OQS_KEM_ntru_hps4096821_length_secret_key 1590 ------------------ 23| 89| kem->length_ciphertext = OQS_KEM_ntru_hps4096821_length_ciphertext; ------------------ | | 41| 89|#define OQS_KEM_ntru_hps4096821_length_ciphertext 1230 ------------------ 24| 89| kem->length_shared_secret = OQS_KEM_ntru_hps4096821_length_shared_secret; ------------------ | | 42| 89|#define OQS_KEM_ntru_hps4096821_length_shared_secret 32 ------------------ 25| 89| kem->length_keypair_seed = OQS_KEM_ntru_hps4096821_length_keypair_seed; ------------------ | | 43| 89|#define OQS_KEM_ntru_hps4096821_length_keypair_seed 0 ------------------ 26| 89| kem->length_encaps_seed = OQS_KEM_ntru_hps4096821_length_encaps_seed; ------------------ | | 44| 89|#define OQS_KEM_ntru_hps4096821_length_encaps_seed 0 ------------------ 27| | 28| 89| kem->keypair = OQS_KEM_ntru_hps4096821_keypair; 29| 89| kem->keypair_derand = OQS_KEM_ntru_hps4096821_keypair_derand; 30| 89| kem->encaps = OQS_KEM_ntru_hps4096821_encaps; 31| 89| kem->encaps_derand = OQS_KEM_ntru_hps4096821_encaps_derand; 32| 89| kem->decaps = OQS_KEM_ntru_hps4096821_decaps; 33| | 34| 89| return kem; 35| 89|} OQS_KEM_ntru_hps4096821_keypair: 47| 89|OQS_API OQS_STATUS OQS_KEM_ntru_hps4096821_keypair(uint8_t *public_key, uint8_t *secret_key) { 48| 89|#if defined(OQS_ENABLE_KEM_ntru_hps4096821_avx2) 49| 89|#if defined(OQS_DIST_BUILD) 50| 89| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2) && OQS_CPU_has_extension(OQS_CPU_EXT_BMI2)) { ------------------ | Branch (50:6): [True: 89, False: 0] | Branch (50:49): [True: 89, False: 0] ------------------ 51| 89|#endif /* OQS_DIST_BUILD */ 52| 89| return (OQS_STATUS) PQCLEAN_NTRUHPS4096821_AVX2_crypto_kem_keypair(public_key, secret_key); 53| 89|#if defined(OQS_DIST_BUILD) 54| 89| } else { 55| 0| return (OQS_STATUS) PQCLEAN_NTRUHPS4096821_CLEAN_crypto_kem_keypair(public_key, secret_key); 56| 0| } 57| 89|#endif /* OQS_DIST_BUILD */ 58| |#else 59| | return (OQS_STATUS) PQCLEAN_NTRUHPS4096821_CLEAN_crypto_kem_keypair(public_key, secret_key); 60| |#endif 61| 89|} OQS_KEM_ntru_hps4096821_encaps: 78| 89|OQS_API OQS_STATUS OQS_KEM_ntru_hps4096821_encaps(uint8_t *ciphertext, uint8_t *shared_secret, const uint8_t *public_key) { 79| 89|#if defined(OQS_ENABLE_KEM_ntru_hps4096821_avx2) 80| 89|#if defined(OQS_DIST_BUILD) 81| 89| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2) && OQS_CPU_has_extension(OQS_CPU_EXT_BMI2)) { ------------------ | Branch (81:6): [True: 89, False: 0] | Branch (81:49): [True: 89, False: 0] ------------------ 82| 89|#endif /* OQS_DIST_BUILD */ 83| 89| return (OQS_STATUS) PQCLEAN_NTRUHPS4096821_AVX2_crypto_kem_enc(ciphertext, shared_secret, public_key); 84| 89|#if defined(OQS_DIST_BUILD) 85| 89| } else { 86| 0| return (OQS_STATUS) PQCLEAN_NTRUHPS4096821_CLEAN_crypto_kem_enc(ciphertext, shared_secret, public_key); 87| 0| } 88| 89|#endif /* OQS_DIST_BUILD */ 89| |#else 90| | return (OQS_STATUS) PQCLEAN_NTRUHPS4096821_CLEAN_crypto_kem_enc(ciphertext, shared_secret, public_key); 91| |#endif 92| 89|} OQS_KEM_ntru_hps4096821_decaps: 94| 89|OQS_API OQS_STATUS OQS_KEM_ntru_hps4096821_decaps(uint8_t *shared_secret, const uint8_t *ciphertext, const uint8_t *secret_key) { 95| 89|#if defined(OQS_ENABLE_KEM_ntru_hps4096821_avx2) 96| 89|#if defined(OQS_DIST_BUILD) 97| 89| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2) && OQS_CPU_has_extension(OQS_CPU_EXT_BMI2)) { ------------------ | Branch (97:6): [True: 89, False: 0] | Branch (97:49): [True: 89, False: 0] ------------------ 98| 89|#endif /* OQS_DIST_BUILD */ 99| 89| return (OQS_STATUS) PQCLEAN_NTRUHPS4096821_AVX2_crypto_kem_dec(shared_secret, ciphertext, secret_key); 100| 89|#if defined(OQS_DIST_BUILD) 101| 89| } else { 102| 0| return (OQS_STATUS) PQCLEAN_NTRUHPS4096821_CLEAN_crypto_kem_dec(shared_secret, ciphertext, secret_key); 103| 0| } 104| 89|#endif /* OQS_DIST_BUILD */ 105| |#else 106| | return (OQS_STATUS) PQCLEAN_NTRUHPS4096821_CLEAN_crypto_kem_dec(shared_secret, ciphertext, secret_key); 107| |#endif 108| 89|} OQS_KEM_ntru_hrss1373_new: 9| 3|OQS_KEM *OQS_KEM_ntru_hrss1373_new(void) { 10| | 11| 3| OQS_KEM *kem = OQS_MEM_calloc(1, sizeof(OQS_KEM)); 12| 3| if (kem == NULL) { ------------------ | Branch (12:6): [True: 0, False: 3] ------------------ 13| 0| return NULL; 14| 0| } 15| 3| kem->method_name = OQS_KEM_alg_ntru_hrss1373; ------------------ | | 91| 3|#define OQS_KEM_alg_ntru_hrss1373 "NTRU-HRSS-1373" ------------------ 16| 3| kem->alg_version = "https://github.com/jschanck/ntru/tree/6d96ed37 reference implementation"; 17| | 18| 3| kem->claimed_nist_level = 5; 19| 3| kem->ind_cca = true; 20| | 21| 3| kem->length_public_key = OQS_KEM_ntru_hrss1373_length_public_key; ------------------ | | 84| 3|#define OQS_KEM_ntru_hrss1373_length_public_key 2401 ------------------ 22| 3| kem->length_secret_key = OQS_KEM_ntru_hrss1373_length_secret_key; ------------------ | | 85| 3|#define OQS_KEM_ntru_hrss1373_length_secret_key 2983 ------------------ 23| 3| kem->length_ciphertext = OQS_KEM_ntru_hrss1373_length_ciphertext; ------------------ | | 86| 3|#define OQS_KEM_ntru_hrss1373_length_ciphertext 2401 ------------------ 24| 3| kem->length_shared_secret = OQS_KEM_ntru_hrss1373_length_shared_secret; ------------------ | | 87| 3|#define OQS_KEM_ntru_hrss1373_length_shared_secret 32 ------------------ 25| 3| kem->length_keypair_seed = OQS_KEM_ntru_hrss1373_length_keypair_seed; ------------------ | | 88| 3|#define OQS_KEM_ntru_hrss1373_length_keypair_seed 0 ------------------ 26| 3| kem->length_encaps_seed = OQS_KEM_ntru_hrss1373_length_encaps_seed; ------------------ | | 89| 3|#define OQS_KEM_ntru_hrss1373_length_encaps_seed 0 ------------------ 27| | 28| 3| kem->keypair = OQS_KEM_ntru_hrss1373_keypair; 29| 3| kem->keypair_derand = OQS_KEM_ntru_hrss1373_keypair_derand; 30| 3| kem->encaps = OQS_KEM_ntru_hrss1373_encaps; 31| 3| kem->encaps_derand = OQS_KEM_ntru_hrss1373_encaps_derand; 32| 3| kem->decaps = OQS_KEM_ntru_hrss1373_decaps; 33| | 34| 3| return kem; 35| 3|} OQS_KEM_ntru_hrss1373_keypair: 41| 3|OQS_API OQS_STATUS OQS_KEM_ntru_hrss1373_keypair(uint8_t *public_key, uint8_t *secret_key) { 42| 3| return (OQS_STATUS) PQCLEAN_NTRUHRSS1373_CLEAN_crypto_kem_keypair(public_key, secret_key); 43| 3|} OQS_KEM_ntru_hrss1373_encaps: 60| 3|OQS_API OQS_STATUS OQS_KEM_ntru_hrss1373_encaps(uint8_t *ciphertext, uint8_t *shared_secret, const uint8_t *public_key) { 61| 3| return (OQS_STATUS) PQCLEAN_NTRUHRSS1373_CLEAN_crypto_kem_enc(ciphertext, shared_secret, public_key); 62| 3|} OQS_KEM_ntru_hrss1373_decaps: 64| 3|OQS_API OQS_STATUS OQS_KEM_ntru_hrss1373_decaps(uint8_t *shared_secret, const uint8_t *ciphertext, const uint8_t *secret_key) { 65| 3| return (OQS_STATUS) PQCLEAN_NTRUHRSS1373_CLEAN_crypto_kem_dec(shared_secret, ciphertext, secret_key); 66| 3|} OQS_KEM_ntru_hrss701_new: 9| 6|OQS_KEM *OQS_KEM_ntru_hrss701_new(void) { 10| | 11| 6| OQS_KEM *kem = OQS_MEM_calloc(1, sizeof(OQS_KEM)); 12| 6| if (kem == NULL) { ------------------ | Branch (12:6): [True: 0, False: 6] ------------------ 13| 0| return NULL; 14| 0| } 15| 6| kem->method_name = OQS_KEM_alg_ntru_hrss701; ------------------ | | 89| 6|#define OQS_KEM_alg_ntru_hrss701 "NTRU-HRSS-701" ------------------ 16| 6| kem->alg_version = "https://github.com/jschanck/ntru/tree/6d96ed37 reference implementation"; 17| | 18| 6| kem->claimed_nist_level = 3; 19| 6| kem->ind_cca = true; 20| | 21| 6| kem->length_public_key = OQS_KEM_ntru_hrss701_length_public_key; ------------------ | | 69| 6|#define OQS_KEM_ntru_hrss701_length_public_key 1138 ------------------ 22| 6| kem->length_secret_key = OQS_KEM_ntru_hrss701_length_secret_key; ------------------ | | 70| 6|#define OQS_KEM_ntru_hrss701_length_secret_key 1450 ------------------ 23| 6| kem->length_ciphertext = OQS_KEM_ntru_hrss701_length_ciphertext; ------------------ | | 71| 6|#define OQS_KEM_ntru_hrss701_length_ciphertext 1138 ------------------ 24| 6| kem->length_shared_secret = OQS_KEM_ntru_hrss701_length_shared_secret; ------------------ | | 72| 6|#define OQS_KEM_ntru_hrss701_length_shared_secret 32 ------------------ 25| 6| kem->length_keypair_seed = OQS_KEM_ntru_hrss701_length_keypair_seed; ------------------ | | 73| 6|#define OQS_KEM_ntru_hrss701_length_keypair_seed 0 ------------------ 26| 6| kem->length_encaps_seed = OQS_KEM_ntru_hrss701_length_encaps_seed; ------------------ | | 74| 6|#define OQS_KEM_ntru_hrss701_length_encaps_seed 0 ------------------ 27| | 28| 6| kem->keypair = OQS_KEM_ntru_hrss701_keypair; 29| 6| kem->keypair_derand = OQS_KEM_ntru_hrss701_keypair_derand; 30| 6| kem->encaps = OQS_KEM_ntru_hrss701_encaps; 31| 6| kem->encaps_derand = OQS_KEM_ntru_hrss701_encaps_derand; 32| 6| kem->decaps = OQS_KEM_ntru_hrss701_decaps; 33| | 34| 6| return kem; 35| 6|} OQS_KEM_ntru_hrss701_keypair: 47| 6|OQS_API OQS_STATUS OQS_KEM_ntru_hrss701_keypair(uint8_t *public_key, uint8_t *secret_key) { 48| 6|#if defined(OQS_ENABLE_KEM_ntru_hrss701_avx2) 49| 6|#if defined(OQS_DIST_BUILD) 50| 6| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2) && OQS_CPU_has_extension(OQS_CPU_EXT_BMI2)) { ------------------ | Branch (50:6): [True: 6, False: 0] | Branch (50:49): [True: 6, False: 0] ------------------ 51| 6|#endif /* OQS_DIST_BUILD */ 52| 6| return (OQS_STATUS) PQCLEAN_NTRUHRSS701_AVX2_crypto_kem_keypair(public_key, secret_key); 53| 6|#if defined(OQS_DIST_BUILD) 54| 6| } else { 55| 0| return (OQS_STATUS) PQCLEAN_NTRUHRSS701_CLEAN_crypto_kem_keypair(public_key, secret_key); 56| 0| } 57| 6|#endif /* OQS_DIST_BUILD */ 58| |#else 59| | return (OQS_STATUS) PQCLEAN_NTRUHRSS701_CLEAN_crypto_kem_keypair(public_key, secret_key); 60| |#endif 61| 6|} OQS_KEM_ntru_hrss701_encaps: 78| 6|OQS_API OQS_STATUS OQS_KEM_ntru_hrss701_encaps(uint8_t *ciphertext, uint8_t *shared_secret, const uint8_t *public_key) { 79| 6|#if defined(OQS_ENABLE_KEM_ntru_hrss701_avx2) 80| 6|#if defined(OQS_DIST_BUILD) 81| 6| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2) && OQS_CPU_has_extension(OQS_CPU_EXT_BMI2)) { ------------------ | Branch (81:6): [True: 6, False: 0] | Branch (81:49): [True: 6, False: 0] ------------------ 82| 6|#endif /* OQS_DIST_BUILD */ 83| 6| return (OQS_STATUS) PQCLEAN_NTRUHRSS701_AVX2_crypto_kem_enc(ciphertext, shared_secret, public_key); 84| 6|#if defined(OQS_DIST_BUILD) 85| 6| } else { 86| 0| return (OQS_STATUS) PQCLEAN_NTRUHRSS701_CLEAN_crypto_kem_enc(ciphertext, shared_secret, public_key); 87| 0| } 88| 6|#endif /* OQS_DIST_BUILD */ 89| |#else 90| | return (OQS_STATUS) PQCLEAN_NTRUHRSS701_CLEAN_crypto_kem_enc(ciphertext, shared_secret, public_key); 91| |#endif 92| 6|} OQS_KEM_ntru_hrss701_decaps: 94| 6|OQS_API OQS_STATUS OQS_KEM_ntru_hrss701_decaps(uint8_t *shared_secret, const uint8_t *ciphertext, const uint8_t *secret_key) { 95| 6|#if defined(OQS_ENABLE_KEM_ntru_hrss701_avx2) 96| 6|#if defined(OQS_DIST_BUILD) 97| 6| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2) && OQS_CPU_has_extension(OQS_CPU_EXT_BMI2)) { ------------------ | Branch (97:6): [True: 6, False: 0] | Branch (97:49): [True: 6, False: 0] ------------------ 98| 6|#endif /* OQS_DIST_BUILD */ 99| 6| return (OQS_STATUS) PQCLEAN_NTRUHRSS701_AVX2_crypto_kem_dec(shared_secret, ciphertext, secret_key); 100| 6|#if defined(OQS_DIST_BUILD) 101| 6| } else { 102| 0| return (OQS_STATUS) PQCLEAN_NTRUHRSS701_CLEAN_crypto_kem_dec(shared_secret, ciphertext, secret_key); 103| 0| } 104| 6|#endif /* OQS_DIST_BUILD */ 105| |#else 106| | return (OQS_STATUS) PQCLEAN_NTRUHRSS701_CLEAN_crypto_kem_dec(shared_secret, ciphertext, secret_key); 107| |#endif 108| 6|} PQCLEAN_NTRUHPS2048509_AVX2_cmov: 4| 182|void PQCLEAN_NTRUHPS2048509_AVX2_cmov(unsigned char *r, const unsigned char *x, size_t len, unsigned char b) { 5| 182| size_t i; 6| | 7| 182| b = (~b + 1); 8| 6.00k| for (i = 0; i < len; i++) { ------------------ | Branch (8:17): [True: 5.82k, False: 182] ------------------ 9| 5.82k| r[i] ^= b & (x[i] ^ r[i]); 10| 5.82k| } 11| 182|} PQCLEAN_NTRUHPS2048509_AVX2_crypto_sort_int32: 903| 728|void PQCLEAN_NTRUHPS2048509_AVX2_crypto_sort_int32(int32 *x, size_t n) { 904| 728| size_t q, i, j; 905| | 906| 728| if (n <= 8) { ------------------ | Branch (906:9): [True: 0, False: 728] ------------------ 907| 0| if (n == 8) { ------------------ | Branch (907:13): [True: 0, False: 0] ------------------ 908| 0| int32_MINMAX(&x[0], &x[1]); 909| 0| int32_MINMAX(&x[1], &x[2]); 910| 0| int32_MINMAX(&x[2], &x[3]); 911| 0| int32_MINMAX(&x[3], &x[4]); 912| 0| int32_MINMAX(&x[4], &x[5]); 913| 0| int32_MINMAX(&x[5], &x[6]); 914| 0| int32_MINMAX(&x[6], &x[7]); 915| 0| } 916| 0| if (n >= 7) { ------------------ | Branch (916:13): [True: 0, False: 0] ------------------ 917| 0| int32_MINMAX(&x[0], &x[1]); 918| 0| int32_MINMAX(&x[1], &x[2]); 919| 0| int32_MINMAX(&x[2], &x[3]); 920| 0| int32_MINMAX(&x[3], &x[4]); 921| 0| int32_MINMAX(&x[4], &x[5]); 922| 0| int32_MINMAX(&x[5], &x[6]); 923| 0| } 924| 0| if (n >= 6) { ------------------ | Branch (924:13): [True: 0, False: 0] ------------------ 925| 0| int32_MINMAX(&x[0], &x[1]); 926| 0| int32_MINMAX(&x[1], &x[2]); 927| 0| int32_MINMAX(&x[2], &x[3]); 928| 0| int32_MINMAX(&x[3], &x[4]); 929| 0| int32_MINMAX(&x[4], &x[5]); 930| 0| } 931| 0| if (n >= 5) { ------------------ | Branch (931:13): [True: 0, False: 0] ------------------ 932| 0| int32_MINMAX(&x[0], &x[1]); 933| 0| int32_MINMAX(&x[1], &x[2]); 934| 0| int32_MINMAX(&x[2], &x[3]); 935| 0| int32_MINMAX(&x[3], &x[4]); 936| 0| } 937| 0| if (n >= 4) { ------------------ | Branch (937:13): [True: 0, False: 0] ------------------ 938| 0| int32_MINMAX(&x[0], &x[1]); 939| 0| int32_MINMAX(&x[1], &x[2]); 940| 0| int32_MINMAX(&x[2], &x[3]); 941| 0| } 942| 0| if (n >= 3) { ------------------ | Branch (942:13): [True: 0, False: 0] ------------------ 943| 0| int32_MINMAX(&x[0], &x[1]); 944| 0| int32_MINMAX(&x[1], &x[2]); 945| 0| } 946| 0| if (n >= 2) { ------------------ | Branch (946:13): [True: 0, False: 0] ------------------ 947| 0| int32_MINMAX(&x[0], &x[1]); 948| 0| } 949| 0| return; 950| 0| } 951| | 952| 728| if (!(n & (n - 1))) { ------------------ | Branch (952:9): [True: 0, False: 728] ------------------ 953| 0| int32_sort_2power(x, n, 0); 954| 0| return; 955| 0| } 956| | 957| 728| q = 8; 958| 4.00k| while (q < n - q) { ------------------ | Branch (958:12): [True: 3.27k, False: 728] ------------------ 959| 3.27k| q += q; 960| 3.27k| } 961| | /* n > q >= 8 */ 962| | 963| 728| if (q <= 128) { /* n <= 256 */ ------------------ | Branch (963:9): [True: 364, False: 364] ------------------ 964| 364| int32x8 y[32]; 965| 6.18k| for (i = q >> 3; i < q >> 2; ++i) { ------------------ | Branch (965:26): [True: 5.82k, False: 364] ------------------ 966| 5.82k| y[i] = _mm256_set1_epi32(0x7fffffff); 967| 5.82k| } 968| 92.0k| for (i = 0; i < n; ++i) { ------------------ | Branch (968:21): [True: 91.7k, False: 364] ------------------ 969| 91.7k| ((int32 *) y)[i] = x[i]; 970| 91.7k| } 971| 364| int32_sort_2power((int32 *) y, 2 * q, 0); 972| 92.0k| for (i = 0; i < n; ++i) { ------------------ | Branch (972:21): [True: 91.7k, False: 364] ------------------ 973| 91.7k| x[i] = ((int32 *) y)[i]; 974| 91.7k| } 975| 364| return; 976| 364| } 977| | 978| 364| int32_sort_2power(x, q, 1); 979| 364| PQCLEAN_NTRUHPS2048509_AVX2_crypto_sort_int32(x + q, n - q); 980| | 981| 728| while (q >= 64) { ------------------ | Branch (981:12): [True: 364, False: 364] ------------------ 982| 364| q >>= 2; 983| 364| j = int32_threestages(x, n, q); 984| 364| minmax_vector(x + j, x + j + 4 * q, n - 4 * q - j); 985| 364| if (j + 4 * q <= n) { ------------------ | Branch (985:13): [True: 364, False: 0] ------------------ 986| 3.27k| for (i = j; i < j + q; i += 8) { ------------------ | Branch (986:25): [True: 2.91k, False: 364] ------------------ 987| 2.91k| int32x8 x0 = int32x8_load(&x[i]); ------------------ | | 9| 2.91k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 988| 2.91k| int32x8 x1 = int32x8_load(&x[i + q]); ------------------ | | 9| 2.91k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 989| 2.91k| int32x8 x2 = int32x8_load(&x[i + 2 * q]); ------------------ | | 9| 2.91k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 990| 2.91k| int32x8 x3 = int32x8_load(&x[i + 3 * q]); ------------------ | | 9| 2.91k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 991| 2.91k| int32x8_MINMAX(x0, x2); ------------------ | | 15| 2.91k| do { \ | | 16| 2.91k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 2.91k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 2.91k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 2.91k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 2.91k| (a) = c; \ | | 19| 2.91k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 2.91k] | | ------------------ ------------------ 992| 2.91k| int32x8_MINMAX(x1, x3); ------------------ | | 15| 2.91k| do { \ | | 16| 2.91k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 2.91k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 2.91k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 2.91k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 2.91k| (a) = c; \ | | 19| 2.91k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 2.91k] | | ------------------ ------------------ 993| 2.91k| int32x8_MINMAX(x0, x1); ------------------ | | 15| 2.91k| do { \ | | 16| 2.91k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 2.91k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 2.91k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 2.91k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 2.91k| (a) = c; \ | | 19| 2.91k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 2.91k] | | ------------------ ------------------ 994| 2.91k| int32x8_MINMAX(x2, x3); ------------------ | | 15| 2.91k| do { \ | | 16| 2.91k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 2.91k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 2.91k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 2.91k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 2.91k| (a) = c; \ | | 19| 2.91k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 2.91k] | | ------------------ ------------------ 995| 2.91k| int32x8_store(&x[i], x0); ------------------ | | 10| 2.91k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 996| 2.91k| int32x8_store(&x[i + q], x1); ------------------ | | 10| 2.91k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 997| 2.91k| int32x8_store(&x[i + 2 * q], x2); ------------------ | | 10| 2.91k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 998| 2.91k| int32x8_store(&x[i + 3 * q], x3); ------------------ | | 10| 2.91k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 999| 2.91k| } 1000| 364| j += 4 * q; 1001| 364| } 1002| 364| minmax_vector(x + j, x + j + 2 * q, n - 2 * q - j); 1003| 364| if (j + 2 * q <= n) { ------------------ | Branch (1003:13): [True: 364, False: 0] ------------------ 1004| 3.27k| for (i = j; i < j + q; i += 8) { ------------------ | Branch (1004:25): [True: 2.91k, False: 364] ------------------ 1005| 2.91k| int32x8 x0 = int32x8_load(&x[i]); ------------------ | | 9| 2.91k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 1006| 2.91k| int32x8 x1 = int32x8_load(&x[i + q]); ------------------ | | 9| 2.91k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 1007| 2.91k| int32x8_MINMAX(x0, x1); ------------------ | | 15| 2.91k| do { \ | | 16| 2.91k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 2.91k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 2.91k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 2.91k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 2.91k| (a) = c; \ | | 19| 2.91k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 2.91k] | | ------------------ ------------------ 1008| 2.91k| int32x8_store(&x[i], x0); ------------------ | | 10| 2.91k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 1009| 2.91k| int32x8_store(&x[i + q], x1); ------------------ | | 10| 2.91k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 1010| 2.91k| } 1011| 364| j += 2 * q; 1012| 364| } 1013| 364| minmax_vector(x + j, x + j + q, n - q - j); 1014| 364| q >>= 1; 1015| 364| } 1016| 364| if (q == 32) { ------------------ | Branch (1016:9): [True: 364, False: 0] ------------------ 1017| 364| j = 0; 1018| 2.91k| for (; j + 64 <= n; j += 64) { ------------------ | Branch (1018:16): [True: 2.54k, False: 364] ------------------ 1019| 2.54k| int32x8 x0 = int32x8_load(&x[j]); ------------------ | | 9| 2.54k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 1020| 2.54k| int32x8 x1 = int32x8_load(&x[j + 8]); ------------------ | | 9| 2.54k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 1021| 2.54k| int32x8 x2 = int32x8_load(&x[j + 16]); ------------------ | | 9| 2.54k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 1022| 2.54k| int32x8 x3 = int32x8_load(&x[j + 24]); ------------------ | | 9| 2.54k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 1023| 2.54k| int32x8 x4 = int32x8_load(&x[j + 32]); ------------------ | | 9| 2.54k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 1024| 2.54k| int32x8 x5 = int32x8_load(&x[j + 40]); ------------------ | | 9| 2.54k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 1025| 2.54k| int32x8 x6 = int32x8_load(&x[j + 48]); ------------------ | | 9| 2.54k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 1026| 2.54k| int32x8 x7 = int32x8_load(&x[j + 56]); ------------------ | | 9| 2.54k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 1027| 2.54k| int32x8_MINMAX(x0, x4); ------------------ | | 15| 2.54k| do { \ | | 16| 2.54k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 2.54k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 2.54k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 2.54k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 2.54k| (a) = c; \ | | 19| 2.54k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 2.54k] | | ------------------ ------------------ 1028| 2.54k| int32x8_MINMAX(x1, x5); ------------------ | | 15| 2.54k| do { \ | | 16| 2.54k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 2.54k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 2.54k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 2.54k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 2.54k| (a) = c; \ | | 19| 2.54k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 2.54k] | | ------------------ ------------------ 1029| 2.54k| int32x8_MINMAX(x2, x6); ------------------ | | 15| 2.54k| do { \ | | 16| 2.54k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 2.54k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 2.54k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 2.54k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 2.54k| (a) = c; \ | | 19| 2.54k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 2.54k] | | ------------------ ------------------ 1030| 2.54k| int32x8_MINMAX(x3, x7); ------------------ | | 15| 2.54k| do { \ | | 16| 2.54k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 2.54k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 2.54k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 2.54k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 2.54k| (a) = c; \ | | 19| 2.54k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 2.54k] | | ------------------ ------------------ 1031| 2.54k| int32x8_MINMAX(x0, x2); ------------------ | | 15| 2.54k| do { \ | | 16| 2.54k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 2.54k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 2.54k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 2.54k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 2.54k| (a) = c; \ | | 19| 2.54k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 2.54k] | | ------------------ ------------------ 1032| 2.54k| int32x8_MINMAX(x1, x3); ------------------ | | 15| 2.54k| do { \ | | 16| 2.54k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 2.54k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 2.54k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 2.54k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 2.54k| (a) = c; \ | | 19| 2.54k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 2.54k] | | ------------------ ------------------ 1033| 2.54k| int32x8_MINMAX(x4, x6); ------------------ | | 15| 2.54k| do { \ | | 16| 2.54k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 2.54k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 2.54k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 2.54k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 2.54k| (a) = c; \ | | 19| 2.54k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 2.54k] | | ------------------ ------------------ 1034| 2.54k| int32x8_MINMAX(x5, x7); ------------------ | | 15| 2.54k| do { \ | | 16| 2.54k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 2.54k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 2.54k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 2.54k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 2.54k| (a) = c; \ | | 19| 2.54k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 2.54k] | | ------------------ ------------------ 1035| 2.54k| int32x8_MINMAX(x0, x1); ------------------ | | 15| 2.54k| do { \ | | 16| 2.54k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 2.54k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 2.54k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 2.54k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 2.54k| (a) = c; \ | | 19| 2.54k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 2.54k] | | ------------------ ------------------ 1036| 2.54k| int32x8_MINMAX(x2, x3); ------------------ | | 15| 2.54k| do { \ | | 16| 2.54k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 2.54k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 2.54k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 2.54k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 2.54k| (a) = c; \ | | 19| 2.54k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 2.54k] | | ------------------ ------------------ 1037| 2.54k| int32x8_MINMAX(x4, x5); ------------------ | | 15| 2.54k| do { \ | | 16| 2.54k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 2.54k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 2.54k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 2.54k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 2.54k| (a) = c; \ | | 19| 2.54k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 2.54k] | | ------------------ ------------------ 1038| 2.54k| int32x8_MINMAX(x6, x7); ------------------ | | 15| 2.54k| do { \ | | 16| 2.54k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 2.54k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 2.54k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 2.54k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 2.54k| (a) = c; \ | | 19| 2.54k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 2.54k] | | ------------------ ------------------ 1039| 2.54k| int32x8 a0 = _mm256_permute2x128_si256(x0, x1, 0x20); 1040| 2.54k| int32x8 a1 = _mm256_permute2x128_si256(x0, x1, 0x31); 1041| 2.54k| int32x8 a2 = _mm256_permute2x128_si256(x2, x3, 0x20); 1042| 2.54k| int32x8 a3 = _mm256_permute2x128_si256(x2, x3, 0x31); 1043| 2.54k| int32x8 a4 = _mm256_permute2x128_si256(x4, x5, 0x20); 1044| 2.54k| int32x8 a5 = _mm256_permute2x128_si256(x4, x5, 0x31); 1045| 2.54k| int32x8 a6 = _mm256_permute2x128_si256(x6, x7, 0x20); 1046| 2.54k| int32x8 a7 = _mm256_permute2x128_si256(x6, x7, 0x31); 1047| 2.54k| int32x8_MINMAX(a0, a1); ------------------ | | 15| 2.54k| do { \ | | 16| 2.54k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 2.54k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 2.54k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 2.54k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 2.54k| (a) = c; \ | | 19| 2.54k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 2.54k] | | ------------------ ------------------ 1048| 2.54k| int32x8_MINMAX(a2, a3); ------------------ | | 15| 2.54k| do { \ | | 16| 2.54k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 2.54k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 2.54k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 2.54k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 2.54k| (a) = c; \ | | 19| 2.54k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 2.54k] | | ------------------ ------------------ 1049| 2.54k| int32x8_MINMAX(a4, a5); ------------------ | | 15| 2.54k| do { \ | | 16| 2.54k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 2.54k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 2.54k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 2.54k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 2.54k| (a) = c; \ | | 19| 2.54k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 2.54k] | | ------------------ ------------------ 1050| 2.54k| int32x8_MINMAX(a6, a7); ------------------ | | 15| 2.54k| do { \ | | 16| 2.54k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 2.54k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 2.54k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 2.54k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 2.54k| (a) = c; \ | | 19| 2.54k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 2.54k] | | ------------------ ------------------ 1051| 2.54k| int32x8 b0 = _mm256_permute2x128_si256(a0, a1, 0x20); 1052| 2.54k| int32x8 b1 = _mm256_permute2x128_si256(a0, a1, 0x31); 1053| 2.54k| int32x8 b2 = _mm256_permute2x128_si256(a2, a3, 0x20); 1054| 2.54k| int32x8 b3 = _mm256_permute2x128_si256(a2, a3, 0x31); 1055| 2.54k| int32x8 b4 = _mm256_permute2x128_si256(a4, a5, 0x20); 1056| 2.54k| int32x8 b5 = _mm256_permute2x128_si256(a4, a5, 0x31); 1057| 2.54k| int32x8 b6 = _mm256_permute2x128_si256(a6, a7, 0x20); 1058| 2.54k| int32x8 b7 = _mm256_permute2x128_si256(a6, a7, 0x31); 1059| 2.54k| int32x8 c0 = _mm256_unpacklo_epi64(b0, b1); 1060| 2.54k| int32x8 c1 = _mm256_unpackhi_epi64(b0, b1); 1061| 2.54k| int32x8 c2 = _mm256_unpacklo_epi64(b2, b3); 1062| 2.54k| int32x8 c3 = _mm256_unpackhi_epi64(b2, b3); 1063| 2.54k| int32x8 c4 = _mm256_unpacklo_epi64(b4, b5); 1064| 2.54k| int32x8 c5 = _mm256_unpackhi_epi64(b4, b5); 1065| 2.54k| int32x8 c6 = _mm256_unpacklo_epi64(b6, b7); 1066| 2.54k| int32x8 c7 = _mm256_unpackhi_epi64(b6, b7); 1067| 2.54k| int32x8_MINMAX(c0, c1); ------------------ | | 15| 2.54k| do { \ | | 16| 2.54k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 2.54k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 2.54k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 2.54k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 2.54k| (a) = c; \ | | 19| 2.54k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 2.54k] | | ------------------ ------------------ 1068| 2.54k| int32x8_MINMAX(c2, c3); ------------------ | | 15| 2.54k| do { \ | | 16| 2.54k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 2.54k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 2.54k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 2.54k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 2.54k| (a) = c; \ | | 19| 2.54k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 2.54k] | | ------------------ ------------------ 1069| 2.54k| int32x8_MINMAX(c4, c5); ------------------ | | 15| 2.54k| do { \ | | 16| 2.54k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 2.54k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 2.54k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 2.54k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 2.54k| (a) = c; \ | | 19| 2.54k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 2.54k] | | ------------------ ------------------ 1070| 2.54k| int32x8_MINMAX(c6, c7); ------------------ | | 15| 2.54k| do { \ | | 16| 2.54k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 2.54k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 2.54k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 2.54k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 2.54k| (a) = c; \ | | 19| 2.54k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 2.54k] | | ------------------ ------------------ 1071| 2.54k| int32x8 d0 = _mm256_unpacklo_epi32(c0, c1); 1072| 2.54k| int32x8 d1 = _mm256_unpackhi_epi32(c0, c1); 1073| 2.54k| int32x8 d2 = _mm256_unpacklo_epi32(c2, c3); 1074| 2.54k| int32x8 d3 = _mm256_unpackhi_epi32(c2, c3); 1075| 2.54k| int32x8 d4 = _mm256_unpacklo_epi32(c4, c5); 1076| 2.54k| int32x8 d5 = _mm256_unpackhi_epi32(c4, c5); 1077| 2.54k| int32x8 d6 = _mm256_unpacklo_epi32(c6, c7); 1078| 2.54k| int32x8 d7 = _mm256_unpackhi_epi32(c6, c7); 1079| 2.54k| int32x8 e0 = _mm256_unpacklo_epi64(d0, d1); 1080| 2.54k| int32x8 e1 = _mm256_unpackhi_epi64(d0, d1); 1081| 2.54k| int32x8 e2 = _mm256_unpacklo_epi64(d2, d3); 1082| 2.54k| int32x8 e3 = _mm256_unpackhi_epi64(d2, d3); 1083| 2.54k| int32x8 e4 = _mm256_unpacklo_epi64(d4, d5); 1084| 2.54k| int32x8 e5 = _mm256_unpackhi_epi64(d4, d5); 1085| 2.54k| int32x8 e6 = _mm256_unpacklo_epi64(d6, d7); 1086| 2.54k| int32x8 e7 = _mm256_unpackhi_epi64(d6, d7); 1087| 2.54k| int32x8_MINMAX(e0, e1); ------------------ | | 15| 2.54k| do { \ | | 16| 2.54k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 2.54k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 2.54k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 2.54k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 2.54k| (a) = c; \ | | 19| 2.54k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 2.54k] | | ------------------ ------------------ 1088| 2.54k| int32x8_MINMAX(e2, e3); ------------------ | | 15| 2.54k| do { \ | | 16| 2.54k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 2.54k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 2.54k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 2.54k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 2.54k| (a) = c; \ | | 19| 2.54k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 2.54k] | | ------------------ ------------------ 1089| 2.54k| int32x8_MINMAX(e4, e5); ------------------ | | 15| 2.54k| do { \ | | 16| 2.54k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 2.54k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 2.54k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 2.54k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 2.54k| (a) = c; \ | | 19| 2.54k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 2.54k] | | ------------------ ------------------ 1090| 2.54k| int32x8_MINMAX(e6, e7); ------------------ | | 15| 2.54k| do { \ | | 16| 2.54k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 2.54k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 2.54k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 2.54k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 2.54k| (a) = c; \ | | 19| 2.54k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 2.54k] | | ------------------ ------------------ 1091| 2.54k| int32x8 f0 = _mm256_unpacklo_epi32(e0, e1); 1092| 2.54k| int32x8 f1 = _mm256_unpackhi_epi32(e0, e1); 1093| 2.54k| int32x8 f2 = _mm256_unpacklo_epi32(e2, e3); 1094| 2.54k| int32x8 f3 = _mm256_unpackhi_epi32(e2, e3); 1095| 2.54k| int32x8 f4 = _mm256_unpacklo_epi32(e4, e5); 1096| 2.54k| int32x8 f5 = _mm256_unpackhi_epi32(e4, e5); 1097| 2.54k| int32x8 f6 = _mm256_unpacklo_epi32(e6, e7); 1098| 2.54k| int32x8 f7 = _mm256_unpackhi_epi32(e6, e7); 1099| 2.54k| int32x8_store(&x[j], f0); ------------------ | | 10| 2.54k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 1100| 2.54k| int32x8_store(&x[j + 8], f1); ------------------ | | 10| 2.54k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 1101| 2.54k| int32x8_store(&x[j + 16], f2); ------------------ | | 10| 2.54k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 1102| 2.54k| int32x8_store(&x[j + 24], f3); ------------------ | | 10| 2.54k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 1103| 2.54k| int32x8_store(&x[j + 32], f4); ------------------ | | 10| 2.54k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 1104| 2.54k| int32x8_store(&x[j + 40], f5); ------------------ | | 10| 2.54k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 1105| 2.54k| int32x8_store(&x[j + 48], f6); ------------------ | | 10| 2.54k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 1106| 2.54k| int32x8_store(&x[j + 56], f7); ------------------ | | 10| 2.54k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 1107| 2.54k| } 1108| 364| minmax_vector(x + j, x + j + 32, n - 32 - j); 1109| 364| goto continue16; 1110| 364| } 1111| 0| if (q == 16) { ------------------ | Branch (1111:9): [True: 0, False: 0] ------------------ 1112| 0| j = 0; 1113| 364|continue16: 1114| 728| for (; j + 32 <= n; j += 32) { ------------------ | Branch (1114:16): [True: 364, False: 364] ------------------ 1115| 364| int32x8 x0 = int32x8_load(&x[j]); ------------------ | | 9| 364|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 1116| 364| int32x8 x1 = int32x8_load(&x[j + 8]); ------------------ | | 9| 364|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 1117| 364| int32x8 x2 = int32x8_load(&x[j + 16]); ------------------ | | 9| 364|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 1118| 364| int32x8 x3 = int32x8_load(&x[j + 24]); ------------------ | | 9| 364|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 1119| 364| int32x8_MINMAX(x0, x2); ------------------ | | 15| 364| do { \ | | 16| 364| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 364|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 364| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 364|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 364| (a) = c; \ | | 19| 364| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 364] | | ------------------ ------------------ 1120| 364| int32x8_MINMAX(x1, x3); ------------------ | | 15| 364| do { \ | | 16| 364| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 364|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 364| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 364|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 364| (a) = c; \ | | 19| 364| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 364] | | ------------------ ------------------ 1121| 364| int32x8_MINMAX(x0, x1); ------------------ | | 15| 364| do { \ | | 16| 364| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 364|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 364| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 364|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 364| (a) = c; \ | | 19| 364| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 364] | | ------------------ ------------------ 1122| 364| int32x8_MINMAX(x2, x3); ------------------ | | 15| 364| do { \ | | 16| 364| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 364|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 364| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 364|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 364| (a) = c; \ | | 19| 364| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 364] | | ------------------ ------------------ 1123| 364| int32x8 a0 = _mm256_permute2x128_si256(x0, x1, 0x20); 1124| 364| int32x8 a1 = _mm256_permute2x128_si256(x0, x1, 0x31); 1125| 364| int32x8 a2 = _mm256_permute2x128_si256(x2, x3, 0x20); 1126| 364| int32x8 a3 = _mm256_permute2x128_si256(x2, x3, 0x31); 1127| 364| int32x8_MINMAX(a0, a1); ------------------ | | 15| 364| do { \ | | 16| 364| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 364|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 364| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 364|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 364| (a) = c; \ | | 19| 364| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 364] | | ------------------ ------------------ 1128| 364| int32x8_MINMAX(a2, a3); ------------------ | | 15| 364| do { \ | | 16| 364| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 364|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 364| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 364|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 364| (a) = c; \ | | 19| 364| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 364] | | ------------------ ------------------ 1129| 364| int32x8 b0 = _mm256_permute2x128_si256(a0, a1, 0x20); 1130| 364| int32x8 b1 = _mm256_permute2x128_si256(a0, a1, 0x31); 1131| 364| int32x8 b2 = _mm256_permute2x128_si256(a2, a3, 0x20); 1132| 364| int32x8 b3 = _mm256_permute2x128_si256(a2, a3, 0x31); 1133| 364| int32x8 c0 = _mm256_unpacklo_epi64(b0, b1); 1134| 364| int32x8 c1 = _mm256_unpackhi_epi64(b0, b1); 1135| 364| int32x8 c2 = _mm256_unpacklo_epi64(b2, b3); 1136| 364| int32x8 c3 = _mm256_unpackhi_epi64(b2, b3); 1137| 364| int32x8_MINMAX(c0, c1); ------------------ | | 15| 364| do { \ | | 16| 364| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 364|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 364| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 364|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 364| (a) = c; \ | | 19| 364| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 364] | | ------------------ ------------------ 1138| 364| int32x8_MINMAX(c2, c3); ------------------ | | 15| 364| do { \ | | 16| 364| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 364|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 364| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 364|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 364| (a) = c; \ | | 19| 364| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 364] | | ------------------ ------------------ 1139| 364| int32x8 d0 = _mm256_unpacklo_epi32(c0, c1); 1140| 364| int32x8 d1 = _mm256_unpackhi_epi32(c0, c1); 1141| 364| int32x8 d2 = _mm256_unpacklo_epi32(c2, c3); 1142| 364| int32x8 d3 = _mm256_unpackhi_epi32(c2, c3); 1143| 364| int32x8 e0 = _mm256_unpacklo_epi64(d0, d1); 1144| 364| int32x8 e1 = _mm256_unpackhi_epi64(d0, d1); 1145| 364| int32x8 e2 = _mm256_unpacklo_epi64(d2, d3); 1146| 364| int32x8 e3 = _mm256_unpackhi_epi64(d2, d3); 1147| 364| int32x8_MINMAX(e0, e1); ------------------ | | 15| 364| do { \ | | 16| 364| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 364|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 364| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 364|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 364| (a) = c; \ | | 19| 364| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 364] | | ------------------ ------------------ 1148| 364| int32x8_MINMAX(e2, e3); ------------------ | | 15| 364| do { \ | | 16| 364| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 364|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 364| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 364|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 364| (a) = c; \ | | 19| 364| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 364] | | ------------------ ------------------ 1149| 364| int32x8 f0 = _mm256_unpacklo_epi32(e0, e1); 1150| 364| int32x8 f1 = _mm256_unpackhi_epi32(e0, e1); 1151| 364| int32x8 f2 = _mm256_unpacklo_epi32(e2, e3); 1152| 364| int32x8 f3 = _mm256_unpackhi_epi32(e2, e3); 1153| 364| int32x8_store(&x[j], f0); ------------------ | | 10| 364|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 1154| 364| int32x8_store(&x[j + 8], f1); ------------------ | | 10| 364|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 1155| 364| int32x8_store(&x[j + 16], f2); ------------------ | | 10| 364|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 1156| 364| int32x8_store(&x[j + 24], f3); ------------------ | | 10| 364|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 1157| 364| } 1158| 364| minmax_vector(x + j, x + j + 16, n - 16 - j); 1159| 364| goto continue8; 1160| 0| } 1161| | /* q == 8 */ 1162| 0| j = 0; 1163| 364|continue8: 1164| 728| for (; j + 16 <= n; j += 16) { ------------------ | Branch (1164:12): [True: 364, False: 364] ------------------ 1165| 364| int32x8 x0 = int32x8_load(&x[j]); ------------------ | | 9| 364|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 1166| 364| int32x8 x1 = int32x8_load(&x[j + 8]); ------------------ | | 9| 364|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 1167| 364| int32x8_MINMAX(x0, x1); ------------------ | | 15| 364| do { \ | | 16| 364| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 364|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 364| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 364|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 364| (a) = c; \ | | 19| 364| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 364] | | ------------------ ------------------ 1168| 364| int32x8_store(&x[j], x0); ------------------ | | 10| 364|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 1169| 364| int32x8_store(&x[j + 8], x1); ------------------ | | 10| 364|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 1170| 364| int32x8 a0 = _mm256_permute2x128_si256(x0, x1, 0x20); /* x0123y0123 */ 1171| 364| int32x8 a1 = _mm256_permute2x128_si256(x0, x1, 0x31); /* x4567y4567 */ 1172| 364| int32x8_MINMAX(a0, a1); ------------------ | | 15| 364| do { \ | | 16| 364| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 364|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 364| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 364|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 364| (a) = c; \ | | 19| 364| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 364] | | ------------------ ------------------ 1173| 364| int32x8 b0 = _mm256_permute2x128_si256(a0, a1, 0x20); /* x01234567 */ 1174| 364| int32x8 b1 = _mm256_permute2x128_si256(a0, a1, 0x31); /* y01234567 */ 1175| 364| int32x8 c0 = _mm256_unpacklo_epi64(b0, b1); /* x01y01x45y45 */ 1176| 364| int32x8 c1 = _mm256_unpackhi_epi64(b0, b1); /* x23y23x67y67 */ 1177| 364| int32x8_MINMAX(c0, c1); ------------------ | | 15| 364| do { \ | | 16| 364| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 364|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 364| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 364|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 364| (a) = c; \ | | 19| 364| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 364] | | ------------------ ------------------ 1178| 364| int32x8 d0 = _mm256_unpacklo_epi32(c0, c1); /* x02x13x46x57 */ 1179| 364| int32x8 d1 = _mm256_unpackhi_epi32(c0, c1); /* y02y13y46y57 */ 1180| 364| int32x8 e0 = _mm256_unpacklo_epi64(d0, d1); /* x02y02x46y46 */ 1181| 364| int32x8 e1 = _mm256_unpackhi_epi64(d0, d1); /* x13y13x57y57 */ 1182| 364| int32x8_MINMAX(e0, e1); ------------------ | | 15| 364| do { \ | | 16| 364| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 364|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 364| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 364|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 364| (a) = c; \ | | 19| 364| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 364] | | ------------------ ------------------ 1183| 364| int32x8 f0 = _mm256_unpacklo_epi32(e0, e1); /* x01234567 */ 1184| 364| int32x8 f1 = _mm256_unpackhi_epi32(e0, e1); /* y01234567 */ 1185| 364| int32x8_store(&x[j], f0); ------------------ | | 10| 364|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 1186| 364| int32x8_store(&x[j + 8], f1); ------------------ | | 10| 364|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 1187| 364| } 1188| 364| minmax_vector(x + j, x + j + 8, n - 8 - j); 1189| 364| if (j + 8 <= n) { ------------------ | Branch (1189:9): [True: 364, False: 0] ------------------ 1190| 364| int32_MINMAX(&x[j], &x[j + 4]); 1191| 364| int32_MINMAX(&x[j + 1], &x[j + 5]); 1192| 364| int32_MINMAX(&x[j + 2], &x[j + 6]); 1193| 364| int32_MINMAX(&x[j + 3], &x[j + 7]); 1194| 364| int32_MINMAX(&x[j], &x[j + 2]); 1195| 364| int32_MINMAX(&x[j + 1], &x[j + 3]); 1196| 364| int32_MINMAX(&x[j], &x[j + 1]); 1197| 364| int32_MINMAX(&x[j + 2], &x[j + 3]); 1198| 364| int32_MINMAX(&x[j + 4], &x[j + 6]); 1199| 364| int32_MINMAX(&x[j + 5], &x[j + 7]); 1200| 364| int32_MINMAX(&x[j + 4], &x[j + 5]); 1201| 364| int32_MINMAX(&x[j + 6], &x[j + 7]); 1202| 364| j += 8; 1203| 364| } 1204| 364| minmax_vector(x + j, x + j + 4, n - 4 - j); 1205| 364| if (j + 4 <= n) { ------------------ | Branch (1205:9): [True: 364, False: 0] ------------------ 1206| 364| int32_MINMAX(&x[j], &x[j + 2]); 1207| 364| int32_MINMAX(&x[j + 1], &x[j + 3]); 1208| 364| int32_MINMAX(&x[j], &x[j + 1]); 1209| 364| int32_MINMAX(&x[j + 2], &x[j + 3]); 1210| 364| j += 4; 1211| 364| } 1212| 364| if (j + 3 <= n) { ------------------ | Branch (1212:9): [True: 0, False: 364] ------------------ 1213| 0| int32_MINMAX(&x[j], &x[j + 2]); 1214| 0| } 1215| 364| if (j + 2 <= n) { ------------------ | Branch (1215:9): [True: 0, False: 364] ------------------ 1216| 0| int32_MINMAX(&x[j], &x[j + 1]); 1217| 0| } 1218| 364|} crypto_sort_int32.c:int32_MINMAX: 21| 10.3k|static inline void int32_MINMAX(int32 *a, int32 *b) { 22| 10.3k| int32 ab = *b ^ *a; ------------------ | | 6| 10.3k|#define int32 int32_t ------------------ 23| 10.3k| int32 c = (int32)((int64_t) * b - (int64_t) * a); ------------------ | | 6| 10.3k|#define int32 int32_t ------------------ 24| 10.3k| c ^= ab & (c ^ *b); 25| 10.3k| c >>= 31; 26| 10.3k| c &= ab; 27| 10.3k| *a ^= c; 28| 10.3k| *b ^= c; 29| 10.3k|} crypto_sort_int32.c:int32_sort_2power: 176| 1.31k|static void int32_sort_2power(int32 *x, size_t n, int flagdown) { 177| 1.31k| size_t p, q, i, j, k; 178| 1.31k| int32x8 mask; 179| | 180| 1.31k| if (n == 8) { ------------------ | Branch (180:9): [True: 0, False: 1.31k] ------------------ 181| 0| int32 x0 = x[0]; ------------------ | | 6| 0|#define int32 int32_t ------------------ 182| 0| int32 x1 = x[1]; ------------------ | | 6| 0|#define int32 int32_t ------------------ 183| 0| int32 x2 = x[2]; ------------------ | | 6| 0|#define int32 int32_t ------------------ 184| 0| int32 x3 = x[3]; ------------------ | | 6| 0|#define int32 int32_t ------------------ 185| 0| int32 x4 = x[4]; ------------------ | | 6| 0|#define int32 int32_t ------------------ 186| 0| int32 x5 = x[5]; ------------------ | | 6| 0|#define int32 int32_t ------------------ 187| 0| int32 x6 = x[6]; ------------------ | | 6| 0|#define int32 int32_t ------------------ 188| 0| int32 x7 = x[7]; ------------------ | | 6| 0|#define int32 int32_t ------------------ 189| | 190| | /* odd-even sort instead of bitonic sort */ 191| | 192| 0| int32_MINMAX(&x1, &x0); 193| 0| int32_MINMAX(&x3, &x2); 194| 0| int32_MINMAX(&x2, &x0); 195| 0| int32_MINMAX(&x3, &x1); 196| 0| int32_MINMAX(&x2, &x1); 197| | 198| 0| int32_MINMAX(&x5, &x4); 199| 0| int32_MINMAX(&x7, &x6); 200| 0| int32_MINMAX(&x6, &x4); 201| 0| int32_MINMAX(&x7, &x5); 202| 0| int32_MINMAX(&x6, &x5); 203| | 204| 0| int32_MINMAX(&x4, &x0); 205| 0| int32_MINMAX(&x6, &x2); 206| 0| int32_MINMAX(&x4, &x2); 207| | 208| 0| int32_MINMAX(&x5, &x1); 209| 0| int32_MINMAX(&x7, &x3); 210| 0| int32_MINMAX(&x5, &x3); 211| | 212| 0| int32_MINMAX(&x2, &x1); 213| 0| int32_MINMAX(&x4, &x3); 214| 0| int32_MINMAX(&x6, &x5); 215| | 216| 0| x[0] = x0; 217| 0| x[1] = x1; 218| 0| x[2] = x2; 219| 0| x[3] = x3; 220| 0| x[4] = x4; 221| 0| x[5] = x5; 222| 0| x[6] = x6; 223| 0| x[7] = x7; 224| 0| return; 225| 0| } 226| | 227| 1.31k| if (n == 16) { ------------------ | Branch (227:9): [True: 0, False: 1.31k] ------------------ 228| 0| int32x8 x0, x1, b0, b1, c0, c1; 229| | 230| 0| x0 = int32x8_load(&x[0]); ------------------ | | 9| 0|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 231| 0| x1 = int32x8_load(&x[8]); ------------------ | | 9| 0|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 232| | 233| 0| mask = _mm256_set_epi32(0, 0, -1, -1, 0, 0, -1, -1); 234| | 235| 0| x0 ^= mask; /* A01234567 */ 236| 0| x1 ^= mask; /* B01234567 */ 237| | 238| 0| b0 = _mm256_unpacklo_epi32(x0, x1); /* AB0AB1AB4AB5 */ 239| 0| b1 = _mm256_unpackhi_epi32(x0, x1); /* AB2AB3AB6AB7 */ 240| | 241| 0| c0 = _mm256_unpacklo_epi64(b0, b1); /* AB0AB2AB4AB6 */ 242| 0| c1 = _mm256_unpackhi_epi64(b0, b1); /* AB1AB3AB5AB7 */ 243| | 244| 0| int32x8_MINMAX(c0, c1); ------------------ | | 15| 0| do { \ | | 16| 0| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 0|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 0| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 0|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 0| (a) = c; \ | | 19| 0| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 0] | | ------------------ ------------------ 245| | 246| 0| mask = _mm256_set_epi32(0, 0, -1, -1, -1, -1, 0, 0); 247| 0| c0 ^= mask; 248| 0| c1 ^= mask; 249| | 250| 0| b0 = _mm256_unpacklo_epi32(c0, c1); /* A01B01A45B45 */ 251| 0| b1 = _mm256_unpackhi_epi32(c0, c1); /* A23B23A67B67 */ 252| | 253| 0| int32x8_MINMAX(b0, b1); ------------------ | | 15| 0| do { \ | | 16| 0| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 0|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 0| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 0|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 0| (a) = c; \ | | 19| 0| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 0] | | ------------------ ------------------ 254| | 255| 0| x0 = _mm256_unpacklo_epi64(b0, b1); /* A01234567 */ 256| 0| x1 = _mm256_unpackhi_epi64(b0, b1); /* B01234567 */ 257| | 258| 0| b0 = _mm256_unpacklo_epi32(x0, x1); /* AB0AB1AB4AB5 */ 259| 0| b1 = _mm256_unpackhi_epi32(x0, x1); /* AB2AB3AB6AB7 */ 260| | 261| 0| c0 = _mm256_unpacklo_epi64(b0, b1); /* AB0AB2AB4AB6 */ 262| 0| c1 = _mm256_unpackhi_epi64(b0, b1); /* AB1AB3AB5AB7 */ 263| | 264| 0| int32x8_MINMAX(c0, c1); ------------------ | | 15| 0| do { \ | | 16| 0| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 0|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 0| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 0|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 0| (a) = c; \ | | 19| 0| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 0] | | ------------------ ------------------ 265| | 266| 0| b0 = _mm256_unpacklo_epi32(c0, c1); /* A01B01A45B45 */ 267| 0| b1 = _mm256_unpackhi_epi32(c0, c1); /* A23B23A67B67 */ 268| | 269| 0| b0 ^= mask; 270| 0| b1 ^= mask; 271| | 272| 0| c0 = _mm256_permute2x128_si256(b0, b1, 0x20); /* A01B01A23B23 */ 273| 0| c1 = _mm256_permute2x128_si256(b0, b1, 0x31); /* A45B45A67B67 */ 274| | 275| 0| int32x8_MINMAX(c0, c1); ------------------ | | 15| 0| do { \ | | 16| 0| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 0|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 0| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 0|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 0| (a) = c; \ | | 19| 0| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 0] | | ------------------ ------------------ 276| | 277| 0| b0 = _mm256_permute2x128_si256(c0, c1, 0x20); /* A01B01A45B45 */ 278| 0| b1 = _mm256_permute2x128_si256(c0, c1, 0x31); /* A23B23A67B67 */ 279| | 280| 0| int32x8_MINMAX(b0, b1); ------------------ | | 15| 0| do { \ | | 16| 0| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 0|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 0| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 0|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 0| (a) = c; \ | | 19| 0| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 0] | | ------------------ ------------------ 281| | 282| 0| x0 = _mm256_unpacklo_epi64(b0, b1); /* A01234567 */ 283| 0| x1 = _mm256_unpackhi_epi64(b0, b1); /* B01234567 */ 284| | 285| 0| b0 = _mm256_unpacklo_epi32(x0, x1); /* AB0AB1AB4AB5 */ 286| 0| b1 = _mm256_unpackhi_epi32(x0, x1); /* AB2AB3AB6AB7 */ 287| | 288| 0| c0 = _mm256_unpacklo_epi64(b0, b1); /* AB0AB2AB4AB6 */ 289| 0| c1 = _mm256_unpackhi_epi64(b0, b1); /* AB1AB3AB5AB7 */ 290| | 291| 0| int32x8_MINMAX(c0, c1); ------------------ | | 15| 0| do { \ | | 16| 0| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 0|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 0| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 0|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 0| (a) = c; \ | | 19| 0| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 0] | | ------------------ ------------------ 292| | 293| 0| b0 = _mm256_unpacklo_epi32(c0, c1); /* A01B01A45B45 */ 294| 0| b1 = _mm256_unpackhi_epi32(c0, c1); /* A23B23A67B67 */ 295| | 296| 0| x0 = _mm256_unpacklo_epi64(b0, b1); /* A01234567 */ 297| 0| x1 = _mm256_unpackhi_epi64(b0, b1); /* B01234567 */ 298| | 299| 0| mask = _mm256_set1_epi32(-1); 300| 0| if (flagdown) { ------------------ | Branch (300:13): [True: 0, False: 0] ------------------ 301| 0| x1 ^= mask; 302| 0| } else { 303| 0| x0 ^= mask; 304| 0| } 305| | 306| 0| merge16_finish(x, x0, x1, flagdown); 307| 0| return; 308| 0| } 309| | 310| 1.31k| if (n == 32) { ------------------ | Branch (310:9): [True: 0, False: 1.31k] ------------------ 311| 0| int32x8 x0, x1, x2, x3; 312| | 313| 0| int32_sort_2power(x, 16, 1); 314| 0| int32_sort_2power(x + 16, 16, 0); 315| | 316| 0| x0 = int32x8_load(&x[0]); ------------------ | | 9| 0|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 317| 0| x1 = int32x8_load(&x[8]); ------------------ | | 9| 0|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 318| 0| x2 = int32x8_load(&x[16]); ------------------ | | 9| 0|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 319| 0| x3 = int32x8_load(&x[24]); ------------------ | | 9| 0|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 320| | 321| 0| if (flagdown) { ------------------ | Branch (321:13): [True: 0, False: 0] ------------------ 322| 0| mask = _mm256_set1_epi32(-1); 323| 0| x0 ^= mask; 324| 0| x1 ^= mask; 325| 0| x2 ^= mask; 326| 0| x3 ^= mask; 327| 0| } 328| | 329| 0| int32x8_MINMAX(x0, x2); ------------------ | | 15| 0| do { \ | | 16| 0| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 0|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 0| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 0|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 0| (a) = c; \ | | 19| 0| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 0] | | ------------------ ------------------ 330| 0| int32x8_MINMAX(x1, x3); ------------------ | | 15| 0| do { \ | | 16| 0| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 0|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 0| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 0|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 0| (a) = c; \ | | 19| 0| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 0] | | ------------------ ------------------ 331| | 332| 0| merge16_finish(x, x0, x1, flagdown); 333| 0| merge16_finish(x + 16, x2, x3, flagdown); 334| 0| return; 335| 0| } 336| | 337| 1.31k| p = n >> 3; 338| 6.88k| for (i = 0; i < p; i += 8) { ------------------ | Branch (338:17): [True: 5.56k, False: 1.31k] ------------------ 339| 5.56k| int32x8 x0 = int32x8_load(&x[i]); ------------------ | | 9| 5.56k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 340| 5.56k| int32x8 x2 = int32x8_load(&x[i + 2 * p]); ------------------ | | 9| 5.56k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 341| 5.56k| int32x8 x4 = int32x8_load(&x[i + 4 * p]); ------------------ | | 9| 5.56k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 342| 5.56k| int32x8 x6 = int32x8_load(&x[i + 6 * p]); ------------------ | | 9| 5.56k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 343| | 344| | /* odd-even stage instead of bitonic stage */ 345| | 346| 5.56k| int32x8_MINMAX(x4, x0); ------------------ | | 15| 5.56k| do { \ | | 16| 5.56k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 5.56k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 5.56k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 5.56k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 5.56k| (a) = c; \ | | 19| 5.56k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 5.56k] | | ------------------ ------------------ 347| 5.56k| int32x8_MINMAX(x6, x2); ------------------ | | 15| 5.56k| do { \ | | 16| 5.56k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 5.56k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 5.56k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 5.56k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 5.56k| (a) = c; \ | | 19| 5.56k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 5.56k] | | ------------------ ------------------ 348| 5.56k| int32x8_MINMAX(x2, x0); ------------------ | | 15| 5.56k| do { \ | | 16| 5.56k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 5.56k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 5.56k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 5.56k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 5.56k| (a) = c; \ | | 19| 5.56k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 5.56k] | | ------------------ ------------------ 349| 5.56k| int32x8_MINMAX(x6, x4); ------------------ | | 15| 5.56k| do { \ | | 16| 5.56k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 5.56k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 5.56k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 5.56k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 5.56k| (a) = c; \ | | 19| 5.56k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 5.56k] | | ------------------ ------------------ 350| 5.56k| int32x8_MINMAX(x2, x4); ------------------ | | 15| 5.56k| do { \ | | 16| 5.56k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 5.56k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 5.56k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 5.56k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 5.56k| (a) = c; \ | | 19| 5.56k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 5.56k] | | ------------------ ------------------ 351| | 352| 5.56k| int32x8_store(&x[i], x0); ------------------ | | 10| 5.56k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 353| 5.56k| int32x8_store(&x[i + 2 * p], x2); ------------------ | | 10| 5.56k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 354| 5.56k| int32x8_store(&x[i + 4 * p], x4); ------------------ | | 10| 5.56k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 355| 5.56k| int32x8_store(&x[i + 6 * p], x6); ------------------ | | 10| 5.56k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 356| | 357| 5.56k| int32x8 x1 = int32x8_load(&x[i + p]); ------------------ | | 9| 5.56k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 358| 5.56k| int32x8 x3 = int32x8_load(&x[i + 3 * p]); ------------------ | | 9| 5.56k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 359| 5.56k| int32x8 x5 = int32x8_load(&x[i + 5 * p]); ------------------ | | 9| 5.56k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 360| 5.56k| int32x8 x7 = int32x8_load(&x[i + 7 * p]); ------------------ | | 9| 5.56k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 361| | 362| 5.56k| int32x8_MINMAX(x1, x5); ------------------ | | 15| 5.56k| do { \ | | 16| 5.56k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 5.56k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 5.56k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 5.56k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 5.56k| (a) = c; \ | | 19| 5.56k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 5.56k] | | ------------------ ------------------ 363| 5.56k| int32x8_MINMAX(x3, x7); ------------------ | | 15| 5.56k| do { \ | | 16| 5.56k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 5.56k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 5.56k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 5.56k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 5.56k| (a) = c; \ | | 19| 5.56k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 5.56k] | | ------------------ ------------------ 364| 5.56k| int32x8_MINMAX(x1, x3); ------------------ | | 15| 5.56k| do { \ | | 16| 5.56k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 5.56k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 5.56k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 5.56k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 5.56k| (a) = c; \ | | 19| 5.56k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 5.56k] | | ------------------ ------------------ 365| 5.56k| int32x8_MINMAX(x5, x7); ------------------ | | 15| 5.56k| do { \ | | 16| 5.56k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 5.56k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 5.56k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 5.56k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 5.56k| (a) = c; \ | | 19| 5.56k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 5.56k] | | ------------------ ------------------ 366| 5.56k| int32x8_MINMAX(x5, x3); ------------------ | | 15| 5.56k| do { \ | | 16| 5.56k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 5.56k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 5.56k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 5.56k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 5.56k| (a) = c; \ | | 19| 5.56k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 5.56k] | | ------------------ ------------------ 367| | 368| 5.56k| int32x8_store(&x[i + p], x1); ------------------ | | 10| 5.56k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 369| 5.56k| int32x8_store(&x[i + 3 * p], x3); ------------------ | | 10| 5.56k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 370| 5.56k| int32x8_store(&x[i + 5 * p], x5); ------------------ | | 10| 5.56k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 371| 5.56k| int32x8_store(&x[i + 7 * p], x7); ------------------ | | 10| 5.56k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 372| 5.56k| } 373| | 374| 1.31k| if (n >= 128) { ------------------ | Branch (374:9): [True: 1.14k, False: 178] ------------------ 375| 1.14k| int flip, flipflip; 376| | 377| 1.14k| mask = _mm256_set1_epi32(-1); 378| | 379| 11.9k| for (j = 0; j < n; j += 32) { ------------------ | Branch (379:21): [True: 10.7k, False: 1.14k] ------------------ 380| 10.7k| int32x8 x0 = int32x8_load(&x[j]); ------------------ | | 9| 10.7k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 381| 10.7k| int32x8 x1 = int32x8_load(&x[j + 16]); ------------------ | | 9| 10.7k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 382| 10.7k| x0 ^= mask; 383| 10.7k| x1 ^= mask; 384| 10.7k| int32x8_store(&x[j], x0); ------------------ | | 10| 10.7k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 385| 10.7k| int32x8_store(&x[j + 16], x1); ------------------ | | 10| 10.7k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 386| 10.7k| } 387| | 388| 1.14k| p = 8; 389| 2.48k| for (;;) { /* for p in [8, 16, ..., n/16] */ 390| 2.48k| q = p >> 1; 391| 2.48k| while (q >= 128) { ------------------ | Branch (391:20): [True: 0, False: 2.48k] ------------------ 392| 0| int32_threestages(x, n, q >> 2); 393| 0| q >>= 3; 394| 0| } 395| 2.48k| if (q == 64) { ------------------ | Branch (395:17): [True: 0, False: 2.48k] ------------------ 396| 0| int32_twostages_32(x, n); 397| 0| q = 16; 398| 0| } 399| 2.48k| if (q == 32) { ------------------ | Branch (399:17): [True: 0, False: 2.48k] ------------------ 400| 0| q = 8; 401| 0| for (k = 0; k < n; k += 8 * q) { ------------------ | Branch (401:29): [True: 0, False: 0] ------------------ 402| 0| for (i = k; i < k + q; i += 8) { ------------------ | Branch (402:33): [True: 0, False: 0] ------------------ 403| 0| int32x8 x0 = int32x8_load(&x[i]); ------------------ | | 9| 0|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 404| 0| int32x8 x1 = int32x8_load(&x[i + q]); ------------------ | | 9| 0|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 405| 0| int32x8 x2 = int32x8_load(&x[i + 2 * q]); ------------------ | | 9| 0|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 406| 0| int32x8 x3 = int32x8_load(&x[i + 3 * q]); ------------------ | | 9| 0|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 407| 0| int32x8 x4 = int32x8_load(&x[i + 4 * q]); ------------------ | | 9| 0|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 408| 0| int32x8 x5 = int32x8_load(&x[i + 5 * q]); ------------------ | | 9| 0|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 409| 0| int32x8 x6 = int32x8_load(&x[i + 6 * q]); ------------------ | | 9| 0|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 410| 0| int32x8 x7 = int32x8_load(&x[i + 7 * q]); ------------------ | | 9| 0|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 411| | 412| 0| int32x8_MINMAX(x0, x4); ------------------ | | 15| 0| do { \ | | 16| 0| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 0|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 0| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 0|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 0| (a) = c; \ | | 19| 0| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 0] | | ------------------ ------------------ 413| 0| int32x8_MINMAX(x1, x5); ------------------ | | 15| 0| do { \ | | 16| 0| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 0|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 0| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 0|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 0| (a) = c; \ | | 19| 0| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 0] | | ------------------ ------------------ 414| 0| int32x8_MINMAX(x2, x6); ------------------ | | 15| 0| do { \ | | 16| 0| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 0|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 0| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 0|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 0| (a) = c; \ | | 19| 0| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 0] | | ------------------ ------------------ 415| 0| int32x8_MINMAX(x3, x7); ------------------ | | 15| 0| do { \ | | 16| 0| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 0|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 0| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 0|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 0| (a) = c; \ | | 19| 0| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 0] | | ------------------ ------------------ 416| 0| int32x8_MINMAX(x0, x2); ------------------ | | 15| 0| do { \ | | 16| 0| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 0|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 0| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 0|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 0| (a) = c; \ | | 19| 0| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 0] | | ------------------ ------------------ 417| 0| int32x8_MINMAX(x1, x3); ------------------ | | 15| 0| do { \ | | 16| 0| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 0|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 0| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 0|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 0| (a) = c; \ | | 19| 0| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 0] | | ------------------ ------------------ 418| 0| int32x8_MINMAX(x4, x6); ------------------ | | 15| 0| do { \ | | 16| 0| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 0|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 0| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 0|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 0| (a) = c; \ | | 19| 0| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 0] | | ------------------ ------------------ 419| 0| int32x8_MINMAX(x5, x7); ------------------ | | 15| 0| do { \ | | 16| 0| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 0|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 0| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 0|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 0| (a) = c; \ | | 19| 0| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 0] | | ------------------ ------------------ 420| 0| int32x8_MINMAX(x0, x1); ------------------ | | 15| 0| do { \ | | 16| 0| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 0|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 0| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 0|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 0| (a) = c; \ | | 19| 0| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 0] | | ------------------ ------------------ 421| 0| int32x8_MINMAX(x2, x3); ------------------ | | 15| 0| do { \ | | 16| 0| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 0|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 0| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 0|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 0| (a) = c; \ | | 19| 0| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 0] | | ------------------ ------------------ 422| 0| int32x8_MINMAX(x4, x5); ------------------ | | 15| 0| do { \ | | 16| 0| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 0|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 0| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 0|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 0| (a) = c; \ | | 19| 0| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 0] | | ------------------ ------------------ 423| 0| int32x8_MINMAX(x6, x7); ------------------ | | 15| 0| do { \ | | 16| 0| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 0|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 0| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 0|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 0| (a) = c; \ | | 19| 0| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 0] | | ------------------ ------------------ 424| | 425| 0| int32x8_store(&x[i], x0); ------------------ | | 10| 0|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 426| 0| int32x8_store(&x[i + q], x1); ------------------ | | 10| 0|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 427| 0| int32x8_store(&x[i + 2 * q], x2); ------------------ | | 10| 0|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 428| 0| int32x8_store(&x[i + 3 * q], x3); ------------------ | | 10| 0|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 429| 0| int32x8_store(&x[i + 4 * q], x4); ------------------ | | 10| 0|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 430| 0| int32x8_store(&x[i + 5 * q], x5); ------------------ | | 10| 0|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 431| 0| int32x8_store(&x[i + 6 * q], x6); ------------------ | | 10| 0|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 432| 0| int32x8_store(&x[i + 7 * q], x7); ------------------ | | 10| 0|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 433| 0| } 434| 0| } 435| 0| q = 4; 436| 0| } 437| 2.48k| if (q == 16) { ------------------ | Branch (437:17): [True: 206, False: 2.28k] ------------------ 438| 206| q = 8; 439| 3.50k| for (k = 0; k < n; k += 4 * q) { ------------------ | Branch (439:29): [True: 3.29k, False: 206] ------------------ 440| 6.59k| for (i = k; i < k + q; i += 8) { ------------------ | Branch (440:33): [True: 3.29k, False: 3.29k] ------------------ 441| 3.29k| int32x8 x0 = int32x8_load(&x[i]); ------------------ | | 9| 3.29k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 442| 3.29k| int32x8 x1 = int32x8_load(&x[i + q]); ------------------ | | 9| 3.29k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 443| 3.29k| int32x8 x2 = int32x8_load(&x[i + 2 * q]); ------------------ | | 9| 3.29k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 444| 3.29k| int32x8 x3 = int32x8_load(&x[i + 3 * q]); ------------------ | | 9| 3.29k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 445| | 446| 3.29k| int32x8_MINMAX(x0, x2); ------------------ | | 15| 3.29k| do { \ | | 16| 3.29k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 3.29k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 3.29k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 3.29k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 3.29k| (a) = c; \ | | 19| 3.29k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 3.29k] | | ------------------ ------------------ 447| 3.29k| int32x8_MINMAX(x1, x3); ------------------ | | 15| 3.29k| do { \ | | 16| 3.29k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 3.29k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 3.29k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 3.29k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 3.29k| (a) = c; \ | | 19| 3.29k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 3.29k] | | ------------------ ------------------ 448| 3.29k| int32x8_MINMAX(x0, x1); ------------------ | | 15| 3.29k| do { \ | | 16| 3.29k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 3.29k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 3.29k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 3.29k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 3.29k| (a) = c; \ | | 19| 3.29k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 3.29k] | | ------------------ ------------------ 449| 3.29k| int32x8_MINMAX(x2, x3); ------------------ | | 15| 3.29k| do { \ | | 16| 3.29k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 3.29k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 3.29k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 3.29k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 3.29k| (a) = c; \ | | 19| 3.29k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 3.29k] | | ------------------ ------------------ 450| | 451| 3.29k| int32x8_store(&x[i], x0); ------------------ | | 10| 3.29k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 452| 3.29k| int32x8_store(&x[i + q], x1); ------------------ | | 10| 3.29k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 453| 3.29k| int32x8_store(&x[i + 2 * q], x2); ------------------ | | 10| 3.29k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 454| 3.29k| int32x8_store(&x[i + 3 * q], x3); ------------------ | | 10| 3.29k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 455| 3.29k| } 456| 3.29k| } 457| 206| q = 4; 458| 206| } 459| 2.48k| if (q == 8) { ------------------ | Branch (459:17): [True: 1.14k, False: 1.34k] ------------------ 460| 22.6k| for (k = 0; k < n; k += q + q) { ------------------ | Branch (460:29): [True: 21.5k, False: 1.14k] ------------------ 461| 21.5k| int32x8 x0 = int32x8_load(&x[k]); ------------------ | | 9| 21.5k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 462| 21.5k| int32x8 x1 = int32x8_load(&x[k + q]); ------------------ | | 9| 21.5k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 463| | 464| 21.5k| int32x8_MINMAX(x0, x1); ------------------ | | 15| 21.5k| do { \ | | 16| 21.5k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 21.5k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 21.5k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 21.5k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 21.5k| (a) = c; \ | | 19| 21.5k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 21.5k] | | ------------------ ------------------ 465| | 466| 21.5k| int32x8_store(&x[k], x0); ------------------ | | 10| 21.5k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 467| 21.5k| int32x8_store(&x[k + q], x1); ------------------ | | 10| 21.5k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 468| 21.5k| } 469| 1.14k| } 470| | 471| 2.48k| q = n >> 3; 472| 2.48k| flip = 0; 473| 2.48k| if (p << 1 == q) { ------------------ | Branch (473:17): [True: 1.14k, False: 1.34k] ------------------ 474| 1.14k| flip = 1; 475| 1.14k| } 476| 2.48k| flipflip = 1 - flip; 477| 6.73k| for (j = 0; j < q; j += p + p) { ------------------ | Branch (477:25): [True: 4.24k, False: 2.48k] ------------------ 478| 12.7k| for (k = j; k < j + p + p; k += p) { ------------------ | Branch (478:29): [True: 8.48k, False: 4.24k] ------------------ 479| 20.9k| for (i = k; i < k + p; i += 8) { ------------------ | Branch (479:33): [True: 12.4k, False: 8.48k] ------------------ 480| 12.4k| int32x8 x0 = int32x8_load(&x[i]); ------------------ | | 9| 12.4k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 481| 12.4k| int32x8 x1 = int32x8_load(&x[i + q]); ------------------ | | 9| 12.4k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 482| 12.4k| int32x8 x2 = int32x8_load(&x[i + 2 * q]); ------------------ | | 9| 12.4k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 483| 12.4k| int32x8 x3 = int32x8_load(&x[i + 3 * q]); ------------------ | | 9| 12.4k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 484| 12.4k| int32x8 x4 = int32x8_load(&x[i + 4 * q]); ------------------ | | 9| 12.4k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 485| 12.4k| int32x8 x5 = int32x8_load(&x[i + 5 * q]); ------------------ | | 9| 12.4k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 486| 12.4k| int32x8 x6 = int32x8_load(&x[i + 6 * q]); ------------------ | | 9| 12.4k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 487| 12.4k| int32x8 x7 = int32x8_load(&x[i + 7 * q]); ------------------ | | 9| 12.4k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 488| | 489| 12.4k| int32x8_MINMAX(x0, x1); ------------------ | | 15| 12.4k| do { \ | | 16| 12.4k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 12.4k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 12.4k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 12.4k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 12.4k| (a) = c; \ | | 19| 12.4k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 12.4k] | | ------------------ ------------------ 490| 12.4k| int32x8_MINMAX(x2, x3); ------------------ | | 15| 12.4k| do { \ | | 16| 12.4k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 12.4k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 12.4k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 12.4k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 12.4k| (a) = c; \ | | 19| 12.4k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 12.4k] | | ------------------ ------------------ 491| 12.4k| int32x8_MINMAX(x4, x5); ------------------ | | 15| 12.4k| do { \ | | 16| 12.4k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 12.4k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 12.4k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 12.4k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 12.4k| (a) = c; \ | | 19| 12.4k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 12.4k] | | ------------------ ------------------ 492| 12.4k| int32x8_MINMAX(x6, x7); ------------------ | | 15| 12.4k| do { \ | | 16| 12.4k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 12.4k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 12.4k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 12.4k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 12.4k| (a) = c; \ | | 19| 12.4k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 12.4k] | | ------------------ ------------------ 493| 12.4k| int32x8_MINMAX(x0, x2); ------------------ | | 15| 12.4k| do { \ | | 16| 12.4k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 12.4k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 12.4k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 12.4k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 12.4k| (a) = c; \ | | 19| 12.4k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 12.4k] | | ------------------ ------------------ 494| 12.4k| int32x8_MINMAX(x1, x3); ------------------ | | 15| 12.4k| do { \ | | 16| 12.4k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 12.4k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 12.4k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 12.4k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 12.4k| (a) = c; \ | | 19| 12.4k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 12.4k] | | ------------------ ------------------ 495| 12.4k| int32x8_MINMAX(x4, x6); ------------------ | | 15| 12.4k| do { \ | | 16| 12.4k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 12.4k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 12.4k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 12.4k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 12.4k| (a) = c; \ | | 19| 12.4k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 12.4k] | | ------------------ ------------------ 496| 12.4k| int32x8_MINMAX(x5, x7); ------------------ | | 15| 12.4k| do { \ | | 16| 12.4k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 12.4k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 12.4k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 12.4k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 12.4k| (a) = c; \ | | 19| 12.4k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 12.4k] | | ------------------ ------------------ 497| 12.4k| int32x8_MINMAX(x0, x4); ------------------ | | 15| 12.4k| do { \ | | 16| 12.4k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 12.4k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 12.4k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 12.4k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 12.4k| (a) = c; \ | | 19| 12.4k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 12.4k] | | ------------------ ------------------ 498| 12.4k| int32x8_MINMAX(x1, x5); ------------------ | | 15| 12.4k| do { \ | | 16| 12.4k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 12.4k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 12.4k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 12.4k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 12.4k| (a) = c; \ | | 19| 12.4k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 12.4k] | | ------------------ ------------------ 499| 12.4k| int32x8_MINMAX(x2, x6); ------------------ | | 15| 12.4k| do { \ | | 16| 12.4k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 12.4k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 12.4k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 12.4k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 12.4k| (a) = c; \ | | 19| 12.4k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 12.4k] | | ------------------ ------------------ 500| 12.4k| int32x8_MINMAX(x3, x7); ------------------ | | 15| 12.4k| do { \ | | 16| 12.4k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 12.4k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 12.4k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 12.4k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 12.4k| (a) = c; \ | | 19| 12.4k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 12.4k] | | ------------------ ------------------ 501| | 502| 12.4k| if (flip) { ------------------ | Branch (502:29): [True: 6.20k, False: 6.20k] ------------------ 503| 6.20k| x0 ^= mask; 504| 6.20k| x1 ^= mask; 505| 6.20k| x2 ^= mask; 506| 6.20k| x3 ^= mask; 507| 6.20k| x4 ^= mask; 508| 6.20k| x5 ^= mask; 509| 6.20k| x6 ^= mask; 510| 6.20k| x7 ^= mask; 511| 6.20k| } 512| | 513| 12.4k| int32x8_store(&x[i], x0); ------------------ | | 10| 12.4k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 514| 12.4k| int32x8_store(&x[i + q], x1); ------------------ | | 10| 12.4k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 515| 12.4k| int32x8_store(&x[i + 2 * q], x2); ------------------ | | 10| 12.4k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 516| 12.4k| int32x8_store(&x[i + 3 * q], x3); ------------------ | | 10| 12.4k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 517| 12.4k| int32x8_store(&x[i + 4 * q], x4); ------------------ | | 10| 12.4k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 518| 12.4k| int32x8_store(&x[i + 5 * q], x5); ------------------ | | 10| 12.4k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 519| 12.4k| int32x8_store(&x[i + 6 * q], x6); ------------------ | | 10| 12.4k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 520| 12.4k| int32x8_store(&x[i + 7 * q], x7); ------------------ | | 10| 12.4k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 521| 12.4k| } 522| 8.48k| flip ^= 1; 523| 8.48k| } 524| 4.24k| flip ^= flipflip; 525| 4.24k| } 526| | 527| 2.48k| if (p << 4 == n) { ------------------ | Branch (527:17): [True: 1.14k, False: 1.34k] ------------------ 528| 1.14k| break; 529| 1.14k| } 530| 1.34k| p <<= 1; 531| 1.34k| } 532| 1.14k| } 533| | 534| 5.27k| for (p = 4; p >= 1; p >>= 1) { ------------------ | Branch (534:17): [True: 3.95k, False: 1.31k] ------------------ 535| 3.95k| int32 *z = x; ------------------ | | 6| 3.95k|#define int32 int32_t ------------------ 536| 3.95k| int32 *target = x + n; ------------------ | | 6| 3.95k|#define int32 int32_t ------------------ 537| 3.95k| if (p == 4) { ------------------ | Branch (537:13): [True: 1.31k, False: 2.63k] ------------------ 538| 1.31k| mask = _mm256_set_epi32(0, 0, 0, 0, -1, -1, -1, -1); 539| 23.5k| while (z != target) { ------------------ | Branch (539:20): [True: 22.2k, False: 1.31k] ------------------ 540| 22.2k| int32x8 x0 = int32x8_load(&z[0]); ------------------ | | 9| 22.2k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 541| 22.2k| int32x8 x1 = int32x8_load(&z[8]); ------------------ | | 9| 22.2k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 542| 22.2k| x0 ^= mask; 543| 22.2k| x1 ^= mask; 544| 22.2k| int32x8_store(&z[0], x0); ------------------ | | 10| 22.2k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 545| 22.2k| int32x8_store(&z[8], x1); ------------------ | | 10| 22.2k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 546| 22.2k| z += 16; 547| 22.2k| } 548| 2.63k| } else if (p == 2) { ------------------ | Branch (548:20): [True: 1.31k, False: 1.31k] ------------------ 549| 1.31k| mask = _mm256_set_epi32(0, 0, -1, -1, -1, -1, 0, 0); 550| 23.5k| while (z != target) { ------------------ | Branch (550:20): [True: 22.2k, False: 1.31k] ------------------ 551| 22.2k| int32x8 x0 = int32x8_load(&z[0]); ------------------ | | 9| 22.2k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 552| 22.2k| int32x8 x1 = int32x8_load(&z[8]); ------------------ | | 9| 22.2k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 553| 22.2k| x0 ^= mask; 554| 22.2k| x1 ^= mask; 555| 22.2k| int32x8 b0 = _mm256_permute2x128_si256(x0, x1, 0x20); 556| 22.2k| int32x8 b1 = _mm256_permute2x128_si256(x0, x1, 0x31); 557| 22.2k| int32x8_MINMAX(b0, b1); ------------------ | | 15| 22.2k| do { \ | | 16| 22.2k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 22.2k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 22.2k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 22.2k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 22.2k| (a) = c; \ | | 19| 22.2k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 22.2k] | | ------------------ ------------------ 558| 22.2k| int32x8 c0 = _mm256_permute2x128_si256(b0, b1, 0x20); 559| 22.2k| int32x8 c1 = _mm256_permute2x128_si256(b0, b1, 0x31); 560| 22.2k| int32x8_store(&z[0], c0); ------------------ | | 10| 22.2k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 561| 22.2k| int32x8_store(&z[8], c1); ------------------ | | 10| 22.2k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 562| 22.2k| z += 16; 563| 22.2k| } 564| 1.31k| } else { /* p == 1 */ 565| 1.31k| mask = _mm256_set_epi32(0, -1, -1, 0, 0, -1, -1, 0); 566| 23.5k| while (z != target) { ------------------ | Branch (566:20): [True: 22.2k, False: 1.31k] ------------------ 567| 22.2k| int32x8 x0 = int32x8_load(&z[0]); ------------------ | | 9| 22.2k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 568| 22.2k| int32x8 x1 = int32x8_load(&z[8]); ------------------ | | 9| 22.2k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 569| 22.2k| x0 ^= mask; 570| 22.2k| x1 ^= mask; 571| 22.2k| int32x8 b0 = _mm256_permute2x128_si256(x0, x1, 0x20); /* A0123B0123 */ 572| 22.2k| int32x8 b1 = _mm256_permute2x128_si256(x0, x1, 0x31); /* A4567B4567 */ 573| 22.2k| int32x8 c0 = _mm256_unpacklo_epi64(b0, b1); /* A0145B0145 */ 574| 22.2k| int32x8 c1 = _mm256_unpackhi_epi64(b0, b1); /* A2367B2367 */ 575| 22.2k| int32x8_MINMAX(c0, c1); ------------------ | | 15| 22.2k| do { \ | | 16| 22.2k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 22.2k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 22.2k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 22.2k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 22.2k| (a) = c; \ | | 19| 22.2k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 22.2k] | | ------------------ ------------------ 576| 22.2k| int32x8 d0 = _mm256_unpacklo_epi64(c0, c1); /* A0123B0123 */ 577| 22.2k| int32x8 d1 = _mm256_unpackhi_epi64(c0, c1); /* A4567B4567 */ 578| 22.2k| int32x8_MINMAX(d0, d1); ------------------ | | 15| 22.2k| do { \ | | 16| 22.2k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 22.2k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 22.2k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 22.2k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 22.2k| (a) = c; \ | | 19| 22.2k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 22.2k] | | ------------------ ------------------ 579| 22.2k| int32x8 e0 = _mm256_permute2x128_si256(d0, d1, 0x20); 580| 22.2k| int32x8 e1 = _mm256_permute2x128_si256(d0, d1, 0x31); 581| 22.2k| int32x8_store(&z[0], e0); ------------------ | | 10| 22.2k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 582| 22.2k| int32x8_store(&z[8], e1); ------------------ | | 10| 22.2k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 583| 22.2k| z += 16; 584| 22.2k| } 585| 1.31k| } 586| | 587| 3.95k| q = n >> 4; 588| 4.57k| while (q >= 128 || q == 32) { ------------------ | Branch (588:16): [True: 0, False: 4.57k] | Branch (588:28): [True: 618, False: 3.95k] ------------------ 589| 618| int32_threestages(x, n, q >> 2); 590| 618| q >>= 3; 591| 618| } 592| 6.75k| while (q >= 16) { ------------------ | Branch (592:16): [True: 2.80k, False: 3.95k] ------------------ 593| 2.80k| q >>= 1; 594| 25.2k| for (j = 0; j < n; j += 4 * q) { ------------------ | Branch (594:25): [True: 22.4k, False: 2.80k] ------------------ 595| 44.8k| for (k = j; k < j + q; k += 8) { ------------------ | Branch (595:29): [True: 22.4k, False: 22.4k] ------------------ 596| 22.4k| int32x8 x0 = int32x8_load(&x[k]); ------------------ | | 9| 22.4k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 597| 22.4k| int32x8 x1 = int32x8_load(&x[k + q]); ------------------ | | 9| 22.4k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 598| 22.4k| int32x8 x2 = int32x8_load(&x[k + 2 * q]); ------------------ | | 9| 22.4k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 599| 22.4k| int32x8 x3 = int32x8_load(&x[k + 3 * q]); ------------------ | | 9| 22.4k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 600| | 601| 22.4k| int32x8_MINMAX(x0, x2); ------------------ | | 15| 22.4k| do { \ | | 16| 22.4k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 22.4k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 22.4k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 22.4k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 22.4k| (a) = c; \ | | 19| 22.4k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 22.4k] | | ------------------ ------------------ 602| 22.4k| int32x8_MINMAX(x1, x3); ------------------ | | 15| 22.4k| do { \ | | 16| 22.4k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 22.4k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 22.4k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 22.4k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 22.4k| (a) = c; \ | | 19| 22.4k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 22.4k] | | ------------------ ------------------ 603| 22.4k| int32x8_MINMAX(x0, x1); ------------------ | | 15| 22.4k| do { \ | | 16| 22.4k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 22.4k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 22.4k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 22.4k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 22.4k| (a) = c; \ | | 19| 22.4k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 22.4k] | | ------------------ ------------------ 604| 22.4k| int32x8_MINMAX(x2, x3); ------------------ | | 15| 22.4k| do { \ | | 16| 22.4k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 22.4k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 22.4k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 22.4k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 22.4k| (a) = c; \ | | 19| 22.4k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 22.4k] | | ------------------ ------------------ 605| | 606| 22.4k| int32x8_store(&x[k], x0); ------------------ | | 10| 22.4k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 607| 22.4k| int32x8_store(&x[k + q], x1); ------------------ | | 10| 22.4k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 608| 22.4k| int32x8_store(&x[k + 2 * q], x2); ------------------ | | 10| 22.4k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 609| 22.4k| int32x8_store(&x[k + 3 * q], x3); ------------------ | | 10| 22.4k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 610| 22.4k| } 611| 22.4k| } 612| 2.80k| q >>= 1; 613| 2.80k| } 614| 3.95k| if (q == 8) { ------------------ | Branch (614:13): [True: 0, False: 3.95k] ------------------ 615| 0| for (j = 0; j < n; j += 2 * q) { ------------------ | Branch (615:25): [True: 0, False: 0] ------------------ 616| 0| int32x8 x0 = int32x8_load(&x[j]); ------------------ | | 9| 0|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 617| 0| int32x8 x1 = int32x8_load(&x[j + q]); ------------------ | | 9| 0|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 618| | 619| 0| int32x8_MINMAX(x0, x1); ------------------ | | 15| 0| do { \ | | 16| 0| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 0|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 0| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 0|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 0| (a) = c; \ | | 19| 0| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 0] | | ------------------ ------------------ 620| | 621| 0| int32x8_store(&x[j], x0); ------------------ | | 10| 0|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 622| 0| int32x8_store(&x[j + q], x1); ------------------ | | 10| 0|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 623| 0| } 624| 0| } 625| | 626| 3.95k| q = n >> 3; 627| 20.6k| for (k = 0; k < q; k += 8) { ------------------ | Branch (627:21): [True: 16.6k, False: 3.95k] ------------------ 628| 16.6k| int32x8 x0 = int32x8_load(&x[k]); ------------------ | | 9| 16.6k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 629| 16.6k| int32x8 x1 = int32x8_load(&x[k + q]); ------------------ | | 9| 16.6k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 630| 16.6k| int32x8 x2 = int32x8_load(&x[k + 2 * q]); ------------------ | | 9| 16.6k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 631| 16.6k| int32x8 x3 = int32x8_load(&x[k + 3 * q]); ------------------ | | 9| 16.6k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 632| 16.6k| int32x8 x4 = int32x8_load(&x[k + 4 * q]); ------------------ | | 9| 16.6k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 633| 16.6k| int32x8 x5 = int32x8_load(&x[k + 5 * q]); ------------------ | | 9| 16.6k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 634| 16.6k| int32x8 x6 = int32x8_load(&x[k + 6 * q]); ------------------ | | 9| 16.6k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 635| 16.6k| int32x8 x7 = int32x8_load(&x[k + 7 * q]); ------------------ | | 9| 16.6k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 636| | 637| 16.6k| int32x8_MINMAX(x0, x1); ------------------ | | 15| 16.6k| do { \ | | 16| 16.6k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 16.6k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 16.6k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 16.6k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 16.6k| (a) = c; \ | | 19| 16.6k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 16.6k] | | ------------------ ------------------ 638| 16.6k| int32x8_MINMAX(x2, x3); ------------------ | | 15| 16.6k| do { \ | | 16| 16.6k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 16.6k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 16.6k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 16.6k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 16.6k| (a) = c; \ | | 19| 16.6k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 16.6k] | | ------------------ ------------------ 639| 16.6k| int32x8_MINMAX(x4, x5); ------------------ | | 15| 16.6k| do { \ | | 16| 16.6k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 16.6k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 16.6k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 16.6k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 16.6k| (a) = c; \ | | 19| 16.6k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 16.6k] | | ------------------ ------------------ 640| 16.6k| int32x8_MINMAX(x6, x7); ------------------ | | 15| 16.6k| do { \ | | 16| 16.6k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 16.6k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 16.6k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 16.6k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 16.6k| (a) = c; \ | | 19| 16.6k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 16.6k] | | ------------------ ------------------ 641| 16.6k| int32x8_MINMAX(x0, x2); ------------------ | | 15| 16.6k| do { \ | | 16| 16.6k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 16.6k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 16.6k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 16.6k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 16.6k| (a) = c; \ | | 19| 16.6k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 16.6k] | | ------------------ ------------------ 642| 16.6k| int32x8_MINMAX(x1, x3); ------------------ | | 15| 16.6k| do { \ | | 16| 16.6k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 16.6k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 16.6k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 16.6k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 16.6k| (a) = c; \ | | 19| 16.6k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 16.6k] | | ------------------ ------------------ 643| 16.6k| int32x8_MINMAX(x4, x6); ------------------ | | 15| 16.6k| do { \ | | 16| 16.6k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 16.6k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 16.6k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 16.6k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 16.6k| (a) = c; \ | | 19| 16.6k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 16.6k] | | ------------------ ------------------ 644| 16.6k| int32x8_MINMAX(x5, x7); ------------------ | | 15| 16.6k| do { \ | | 16| 16.6k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 16.6k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 16.6k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 16.6k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 16.6k| (a) = c; \ | | 19| 16.6k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 16.6k] | | ------------------ ------------------ 645| 16.6k| int32x8_MINMAX(x0, x4); ------------------ | | 15| 16.6k| do { \ | | 16| 16.6k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 16.6k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 16.6k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 16.6k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 16.6k| (a) = c; \ | | 19| 16.6k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 16.6k] | | ------------------ ------------------ 646| 16.6k| int32x8_MINMAX(x1, x5); ------------------ | | 15| 16.6k| do { \ | | 16| 16.6k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 16.6k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 16.6k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 16.6k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 16.6k| (a) = c; \ | | 19| 16.6k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 16.6k] | | ------------------ ------------------ 647| 16.6k| int32x8_MINMAX(x2, x6); ------------------ | | 15| 16.6k| do { \ | | 16| 16.6k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 16.6k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 16.6k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 16.6k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 16.6k| (a) = c; \ | | 19| 16.6k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 16.6k] | | ------------------ ------------------ 648| 16.6k| int32x8_MINMAX(x3, x7); ------------------ | | 15| 16.6k| do { \ | | 16| 16.6k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 16.6k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 16.6k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 16.6k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 16.6k| (a) = c; \ | | 19| 16.6k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 16.6k] | | ------------------ ------------------ 649| | 650| 16.6k| int32x8_store(&x[k], x0); ------------------ | | 10| 16.6k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 651| 16.6k| int32x8_store(&x[k + q], x1); ------------------ | | 10| 16.6k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 652| 16.6k| int32x8_store(&x[k + 2 * q], x2); ------------------ | | 10| 16.6k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 653| 16.6k| int32x8_store(&x[k + 3 * q], x3); ------------------ | | 10| 16.6k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 654| 16.6k| int32x8_store(&x[k + 4 * q], x4); ------------------ | | 10| 16.6k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 655| 16.6k| int32x8_store(&x[k + 5 * q], x5); ------------------ | | 10| 16.6k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 656| 16.6k| int32x8_store(&x[k + 6 * q], x6); ------------------ | | 10| 16.6k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 657| 16.6k| int32x8_store(&x[k + 7 * q], x7); ------------------ | | 10| 16.6k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 658| 16.6k| } 659| 3.95k| } 660| | 661| | /* everything is still masked with _mm256_set_epi32(0,-1,0,-1,0,-1,0,-1); */ 662| 1.31k| mask = _mm256_set1_epi32(-1); 663| | 664| 6.88k| for (i = 0; i < n; i += 64) { ------------------ | Branch (664:17): [True: 5.56k, False: 1.31k] ------------------ 665| 5.56k| int32x8 a0 = int32x8_load(&x[i]); ------------------ | | 9| 5.56k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 666| 5.56k| int32x8 a1 = int32x8_load(&x[i + 8]); ------------------ | | 9| 5.56k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 667| 5.56k| int32x8 a2 = int32x8_load(&x[i + 16]); ------------------ | | 9| 5.56k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 668| 5.56k| int32x8 a3 = int32x8_load(&x[i + 24]); ------------------ | | 9| 5.56k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 669| 5.56k| int32x8 a4 = int32x8_load(&x[i + 32]); ------------------ | | 9| 5.56k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 670| 5.56k| int32x8 a5 = int32x8_load(&x[i + 40]); ------------------ | | 9| 5.56k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 671| 5.56k| int32x8 a6 = int32x8_load(&x[i + 48]); ------------------ | | 9| 5.56k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 672| 5.56k| int32x8 a7 = int32x8_load(&x[i + 56]); ------------------ | | 9| 5.56k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 673| | 674| 5.56k| int32x8 b0 = _mm256_unpacklo_epi32(a0, a1); /* AB0AB1AB4AB5 */ 675| 5.56k| int32x8 b1 = _mm256_unpackhi_epi32(a0, a1); /* AB2AB3AB6AB7 */ 676| 5.56k| int32x8 b2 = _mm256_unpacklo_epi32(a2, a3); /* CD0CD1CD4CD5 */ 677| 5.56k| int32x8 b3 = _mm256_unpackhi_epi32(a2, a3); /* CD2CD3CD6CD7 */ 678| 5.56k| int32x8 b4 = _mm256_unpacklo_epi32(a4, a5); /* EF0EF1EF4EF5 */ 679| 5.56k| int32x8 b5 = _mm256_unpackhi_epi32(a4, a5); /* EF2EF3EF6EF7 */ 680| 5.56k| int32x8 b6 = _mm256_unpacklo_epi32(a6, a7); /* GH0GH1GH4GH5 */ 681| 5.56k| int32x8 b7 = _mm256_unpackhi_epi32(a6, a7); /* GH2GH3GH6GH7 */ 682| | 683| 5.56k| int32x8 c0 = _mm256_unpacklo_epi64(b0, b2); /* ABCD0ABCD4 */ 684| 5.56k| int32x8 c1 = _mm256_unpacklo_epi64(b1, b3); /* ABCD2ABCD6 */ 685| 5.56k| int32x8 c2 = _mm256_unpackhi_epi64(b0, b2); /* ABCD1ABCD5 */ 686| 5.56k| int32x8 c3 = _mm256_unpackhi_epi64(b1, b3); /* ABCD3ABCD7 */ 687| 5.56k| int32x8 c4 = _mm256_unpacklo_epi64(b4, b6); /* EFGH0EFGH4 */ 688| 5.56k| int32x8 c5 = _mm256_unpacklo_epi64(b5, b7); /* EFGH2EFGH6 */ 689| 5.56k| int32x8 c6 = _mm256_unpackhi_epi64(b4, b6); /* EFGH1EFGH5 */ 690| 5.56k| int32x8 c7 = _mm256_unpackhi_epi64(b5, b7); /* EFGH3EFGH7 */ 691| | 692| 5.56k| if (flagdown) { ------------------ | Branch (692:13): [True: 3.81k, False: 1.74k] ------------------ 693| 3.81k| c2 ^= mask; 694| 3.81k| c3 ^= mask; 695| 3.81k| c6 ^= mask; 696| 3.81k| c7 ^= mask; 697| 3.81k| } else { 698| 1.74k| c0 ^= mask; 699| 1.74k| c1 ^= mask; 700| 1.74k| c4 ^= mask; 701| 1.74k| c5 ^= mask; 702| 1.74k| } 703| | 704| 5.56k| int32x8 d0 = _mm256_permute2x128_si256(c0, c4, 0x20); /* ABCDEFGH0 */ 705| 5.56k| int32x8 d1 = _mm256_permute2x128_si256(c2, c6, 0x20); /* ABCDEFGH1 */ 706| 5.56k| int32x8 d2 = _mm256_permute2x128_si256(c1, c5, 0x20); /* ABCDEFGH2 */ 707| 5.56k| int32x8 d3 = _mm256_permute2x128_si256(c3, c7, 0x20); /* ABCDEFGH5 */ 708| 5.56k| int32x8 d4 = _mm256_permute2x128_si256(c0, c4, 0x31); /* ABCDEFGH4 */ 709| 5.56k| int32x8 d5 = _mm256_permute2x128_si256(c2, c6, 0x31); /* ABCDEFGH3 */ 710| 5.56k| int32x8 d6 = _mm256_permute2x128_si256(c1, c5, 0x31); /* ABCDEFGH6 */ 711| 5.56k| int32x8 d7 = _mm256_permute2x128_si256(c3, c7, 0x31); /* ABCDEFGH7 */ 712| | 713| 5.56k| int32x8_MINMAX(d0, d1); ------------------ | | 15| 5.56k| do { \ | | 16| 5.56k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 5.56k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 5.56k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 5.56k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 5.56k| (a) = c; \ | | 19| 5.56k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 5.56k] | | ------------------ ------------------ 714| 5.56k| int32x8_MINMAX(d2, d3); ------------------ | | 15| 5.56k| do { \ | | 16| 5.56k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 5.56k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 5.56k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 5.56k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 5.56k| (a) = c; \ | | 19| 5.56k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 5.56k] | | ------------------ ------------------ 715| 5.56k| int32x8_MINMAX(d4, d5); ------------------ | | 15| 5.56k| do { \ | | 16| 5.56k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 5.56k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 5.56k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 5.56k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 5.56k| (a) = c; \ | | 19| 5.56k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 5.56k] | | ------------------ ------------------ 716| 5.56k| int32x8_MINMAX(d6, d7); ------------------ | | 15| 5.56k| do { \ | | 16| 5.56k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 5.56k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 5.56k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 5.56k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 5.56k| (a) = c; \ | | 19| 5.56k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 5.56k] | | ------------------ ------------------ 717| 5.56k| int32x8_MINMAX(d0, d2); ------------------ | | 15| 5.56k| do { \ | | 16| 5.56k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 5.56k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 5.56k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 5.56k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 5.56k| (a) = c; \ | | 19| 5.56k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 5.56k] | | ------------------ ------------------ 718| 5.56k| int32x8_MINMAX(d1, d3); ------------------ | | 15| 5.56k| do { \ | | 16| 5.56k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 5.56k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 5.56k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 5.56k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 5.56k| (a) = c; \ | | 19| 5.56k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 5.56k] | | ------------------ ------------------ 719| 5.56k| int32x8_MINMAX(d4, d6); ------------------ | | 15| 5.56k| do { \ | | 16| 5.56k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 5.56k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 5.56k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 5.56k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 5.56k| (a) = c; \ | | 19| 5.56k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 5.56k] | | ------------------ ------------------ 720| 5.56k| int32x8_MINMAX(d5, d7); ------------------ | | 15| 5.56k| do { \ | | 16| 5.56k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 5.56k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 5.56k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 5.56k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 5.56k| (a) = c; \ | | 19| 5.56k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 5.56k] | | ------------------ ------------------ 721| 5.56k| int32x8_MINMAX(d0, d4); ------------------ | | 15| 5.56k| do { \ | | 16| 5.56k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 5.56k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 5.56k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 5.56k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 5.56k| (a) = c; \ | | 19| 5.56k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 5.56k] | | ------------------ ------------------ 722| 5.56k| int32x8_MINMAX(d1, d5); ------------------ | | 15| 5.56k| do { \ | | 16| 5.56k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 5.56k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 5.56k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 5.56k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 5.56k| (a) = c; \ | | 19| 5.56k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 5.56k] | | ------------------ ------------------ 723| 5.56k| int32x8_MINMAX(d2, d6); ------------------ | | 15| 5.56k| do { \ | | 16| 5.56k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 5.56k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 5.56k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 5.56k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 5.56k| (a) = c; \ | | 19| 5.56k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 5.56k] | | ------------------ ------------------ 724| 5.56k| int32x8_MINMAX(d3, d7); ------------------ | | 15| 5.56k| do { \ | | 16| 5.56k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 5.56k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 5.56k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 5.56k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 5.56k| (a) = c; \ | | 19| 5.56k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 5.56k] | | ------------------ ------------------ 725| | 726| 5.56k| int32x8 e0 = _mm256_unpacklo_epi32(d0, d1); 727| 5.56k| int32x8 e1 = _mm256_unpackhi_epi32(d0, d1); 728| 5.56k| int32x8 e2 = _mm256_unpacklo_epi32(d2, d3); 729| 5.56k| int32x8 e3 = _mm256_unpackhi_epi32(d2, d3); 730| 5.56k| int32x8 e4 = _mm256_unpacklo_epi32(d4, d5); 731| 5.56k| int32x8 e5 = _mm256_unpackhi_epi32(d4, d5); 732| 5.56k| int32x8 e6 = _mm256_unpacklo_epi32(d6, d7); 733| 5.56k| int32x8 e7 = _mm256_unpackhi_epi32(d6, d7); 734| | 735| 5.56k| int32x8 f0 = _mm256_unpacklo_epi64(e0, e2); 736| 5.56k| int32x8 f1 = _mm256_unpacklo_epi64(e1, e3); 737| 5.56k| int32x8 f2 = _mm256_unpackhi_epi64(e0, e2); 738| 5.56k| int32x8 f3 = _mm256_unpackhi_epi64(e1, e3); 739| 5.56k| int32x8 f4 = _mm256_unpacklo_epi64(e4, e6); 740| 5.56k| int32x8 f5 = _mm256_unpacklo_epi64(e5, e7); 741| 5.56k| int32x8 f6 = _mm256_unpackhi_epi64(e4, e6); 742| 5.56k| int32x8 f7 = _mm256_unpackhi_epi64(e5, e7); 743| | 744| 5.56k| int32x8 g0 = _mm256_permute2x128_si256(f0, f4, 0x20); 745| 5.56k| int32x8 g1 = _mm256_permute2x128_si256(f2, f6, 0x20); 746| 5.56k| int32x8 g2 = _mm256_permute2x128_si256(f1, f5, 0x20); 747| 5.56k| int32x8 g3 = _mm256_permute2x128_si256(f3, f7, 0x20); 748| 5.56k| int32x8 g4 = _mm256_permute2x128_si256(f0, f4, 0x31); 749| 5.56k| int32x8 g5 = _mm256_permute2x128_si256(f2, f6, 0x31); 750| 5.56k| int32x8 g6 = _mm256_permute2x128_si256(f1, f5, 0x31); 751| 5.56k| int32x8 g7 = _mm256_permute2x128_si256(f3, f7, 0x31); 752| | 753| 5.56k| int32x8_store(&x[i], g0); ------------------ | | 10| 5.56k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 754| 5.56k| int32x8_store(&x[i + 8], g1); ------------------ | | 10| 5.56k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 755| 5.56k| int32x8_store(&x[i + 16], g2); ------------------ | | 10| 5.56k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 756| 5.56k| int32x8_store(&x[i + 24], g3); ------------------ | | 10| 5.56k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 757| 5.56k| int32x8_store(&x[i + 32], g4); ------------------ | | 10| 5.56k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 758| 5.56k| int32x8_store(&x[i + 40], g5); ------------------ | | 10| 5.56k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 759| 5.56k| int32x8_store(&x[i + 48], g6); ------------------ | | 10| 5.56k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 760| 5.56k| int32x8_store(&x[i + 56], g7); ------------------ | | 10| 5.56k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 761| 5.56k| } 762| | 763| 1.31k| q = n >> 4; 764| 1.52k| while (q >= 128 || q == 32) { ------------------ | Branch (764:12): [True: 0, False: 1.52k] | Branch (764:24): [True: 206, False: 1.31k] ------------------ 765| 206| q >>= 2; 766| 1.85k| for (j = 0; j < n; j += 8 * q) { ------------------ | Branch (766:21): [True: 1.64k, False: 206] ------------------ 767| 3.29k| for (i = j; i < j + q; i += 8) { ------------------ | Branch (767:25): [True: 1.64k, False: 1.64k] ------------------ 768| 1.64k| int32x8 x0 = int32x8_load(&x[i]); ------------------ | | 9| 1.64k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 769| 1.64k| int32x8 x1 = int32x8_load(&x[i + q]); ------------------ | | 9| 1.64k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 770| 1.64k| int32x8 x2 = int32x8_load(&x[i + 2 * q]); ------------------ | | 9| 1.64k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 771| 1.64k| int32x8 x3 = int32x8_load(&x[i + 3 * q]); ------------------ | | 9| 1.64k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 772| 1.64k| int32x8 x4 = int32x8_load(&x[i + 4 * q]); ------------------ | | 9| 1.64k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 773| 1.64k| int32x8 x5 = int32x8_load(&x[i + 5 * q]); ------------------ | | 9| 1.64k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 774| 1.64k| int32x8 x6 = int32x8_load(&x[i + 6 * q]); ------------------ | | 9| 1.64k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 775| 1.64k| int32x8 x7 = int32x8_load(&x[i + 7 * q]); ------------------ | | 9| 1.64k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 776| 1.64k| int32x8_MINMAX(x0, x4); ------------------ | | 15| 1.64k| do { \ | | 16| 1.64k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 1.64k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 1.64k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 1.64k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 1.64k| (a) = c; \ | | 19| 1.64k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 1.64k] | | ------------------ ------------------ 777| 1.64k| int32x8_MINMAX(x1, x5); ------------------ | | 15| 1.64k| do { \ | | 16| 1.64k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 1.64k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 1.64k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 1.64k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 1.64k| (a) = c; \ | | 19| 1.64k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 1.64k] | | ------------------ ------------------ 778| 1.64k| int32x8_MINMAX(x2, x6); ------------------ | | 15| 1.64k| do { \ | | 16| 1.64k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 1.64k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 1.64k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 1.64k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 1.64k| (a) = c; \ | | 19| 1.64k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 1.64k] | | ------------------ ------------------ 779| 1.64k| int32x8_MINMAX(x3, x7); ------------------ | | 15| 1.64k| do { \ | | 16| 1.64k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 1.64k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 1.64k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 1.64k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 1.64k| (a) = c; \ | | 19| 1.64k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 1.64k] | | ------------------ ------------------ 780| 1.64k| int32x8_MINMAX(x0, x2); ------------------ | | 15| 1.64k| do { \ | | 16| 1.64k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 1.64k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 1.64k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 1.64k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 1.64k| (a) = c; \ | | 19| 1.64k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 1.64k] | | ------------------ ------------------ 781| 1.64k| int32x8_MINMAX(x1, x3); ------------------ | | 15| 1.64k| do { \ | | 16| 1.64k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 1.64k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 1.64k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 1.64k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 1.64k| (a) = c; \ | | 19| 1.64k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 1.64k] | | ------------------ ------------------ 782| 1.64k| int32x8_MINMAX(x4, x6); ------------------ | | 15| 1.64k| do { \ | | 16| 1.64k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 1.64k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 1.64k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 1.64k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 1.64k| (a) = c; \ | | 19| 1.64k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 1.64k] | | ------------------ ------------------ 783| 1.64k| int32x8_MINMAX(x5, x7); ------------------ | | 15| 1.64k| do { \ | | 16| 1.64k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 1.64k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 1.64k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 1.64k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 1.64k| (a) = c; \ | | 19| 1.64k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 1.64k] | | ------------------ ------------------ 784| 1.64k| int32x8_MINMAX(x0, x1); ------------------ | | 15| 1.64k| do { \ | | 16| 1.64k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 1.64k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 1.64k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 1.64k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 1.64k| (a) = c; \ | | 19| 1.64k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 1.64k] | | ------------------ ------------------ 785| 1.64k| int32x8_MINMAX(x2, x3); ------------------ | | 15| 1.64k| do { \ | | 16| 1.64k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 1.64k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 1.64k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 1.64k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 1.64k| (a) = c; \ | | 19| 1.64k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 1.64k] | | ------------------ ------------------ 786| 1.64k| int32x8_MINMAX(x4, x5); ------------------ | | 15| 1.64k| do { \ | | 16| 1.64k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 1.64k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 1.64k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 1.64k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 1.64k| (a) = c; \ | | 19| 1.64k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 1.64k] | | ------------------ ------------------ 787| 1.64k| int32x8_MINMAX(x6, x7); ------------------ | | 15| 1.64k| do { \ | | 16| 1.64k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 1.64k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 1.64k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 1.64k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 1.64k| (a) = c; \ | | 19| 1.64k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 1.64k] | | ------------------ ------------------ 788| 1.64k| int32x8_store(&x[i], x0); ------------------ | | 10| 1.64k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 789| 1.64k| int32x8_store(&x[i + q], x1); ------------------ | | 10| 1.64k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 790| 1.64k| int32x8_store(&x[i + 2 * q], x2); ------------------ | | 10| 1.64k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 791| 1.64k| int32x8_store(&x[i + 3 * q], x3); ------------------ | | 10| 1.64k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 792| 1.64k| int32x8_store(&x[i + 4 * q], x4); ------------------ | | 10| 1.64k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 793| 1.64k| int32x8_store(&x[i + 5 * q], x5); ------------------ | | 10| 1.64k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 794| 1.64k| int32x8_store(&x[i + 6 * q], x6); ------------------ | | 10| 1.64k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 795| 1.64k| int32x8_store(&x[i + 7 * q], x7); ------------------ | | 10| 1.64k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 796| 1.64k| } 797| 1.64k| } 798| 206| q >>= 1; 799| 206| } 800| 2.25k| while (q >= 16) { ------------------ | Branch (800:12): [True: 934, False: 1.31k] ------------------ 801| 934| q >>= 1; 802| 8.40k| for (j = 0; j < n; j += 4 * q) { ------------------ | Branch (802:21): [True: 7.47k, False: 934] ------------------ 803| 14.9k| for (i = j; i < j + q; i += 8) { ------------------ | Branch (803:25): [True: 7.47k, False: 7.47k] ------------------ 804| 7.47k| int32x8 x0 = int32x8_load(&x[i]); ------------------ | | 9| 7.47k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 805| 7.47k| int32x8 x1 = int32x8_load(&x[i + q]); ------------------ | | 9| 7.47k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 806| 7.47k| int32x8 x2 = int32x8_load(&x[i + 2 * q]); ------------------ | | 9| 7.47k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 807| 7.47k| int32x8 x3 = int32x8_load(&x[i + 3 * q]); ------------------ | | 9| 7.47k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 808| 7.47k| int32x8_MINMAX(x0, x2); ------------------ | | 15| 7.47k| do { \ | | 16| 7.47k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 7.47k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 7.47k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 7.47k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 7.47k| (a) = c; \ | | 19| 7.47k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 7.47k] | | ------------------ ------------------ 809| 7.47k| int32x8_MINMAX(x1, x3); ------------------ | | 15| 7.47k| do { \ | | 16| 7.47k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 7.47k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 7.47k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 7.47k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 7.47k| (a) = c; \ | | 19| 7.47k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 7.47k] | | ------------------ ------------------ 810| 7.47k| int32x8_MINMAX(x0, x1); ------------------ | | 15| 7.47k| do { \ | | 16| 7.47k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 7.47k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 7.47k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 7.47k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 7.47k| (a) = c; \ | | 19| 7.47k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 7.47k] | | ------------------ ------------------ 811| 7.47k| int32x8_MINMAX(x2, x3); ------------------ | | 15| 7.47k| do { \ | | 16| 7.47k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 7.47k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 7.47k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 7.47k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 7.47k| (a) = c; \ | | 19| 7.47k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 7.47k] | | ------------------ ------------------ 812| 7.47k| int32x8_store(&x[i], x0); ------------------ | | 10| 7.47k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 813| 7.47k| int32x8_store(&x[i + q], x1); ------------------ | | 10| 7.47k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 814| 7.47k| int32x8_store(&x[i + 2 * q], x2); ------------------ | | 10| 7.47k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 815| 7.47k| int32x8_store(&x[i + 3 * q], x3); ------------------ | | 10| 7.47k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 816| 7.47k| } 817| 7.47k| } 818| 934| q >>= 1; 819| 934| } 820| 1.31k| if (q == 8) { ------------------ | Branch (820:9): [True: 0, False: 1.31k] ------------------ 821| 0| for (j = 0; j < n; j += q + q) { ------------------ | Branch (821:21): [True: 0, False: 0] ------------------ 822| 0| int32x8 x0 = int32x8_load(&x[j]); ------------------ | | 9| 0|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 823| 0| int32x8 x1 = int32x8_load(&x[j + q]); ------------------ | | 9| 0|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 824| 0| int32x8_MINMAX(x0, x1); ------------------ | | 15| 0| do { \ | | 16| 0| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 0|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 0| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 0|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 0| (a) = c; \ | | 19| 0| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 0] | | ------------------ ------------------ 825| 0| int32x8_store(&x[j], x0); ------------------ | | 10| 0|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 826| 0| int32x8_store(&x[j + q], x1); ------------------ | | 10| 0|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 827| 0| } 828| 0| } 829| | 830| 1.31k| q = n >> 3; 831| 6.88k| for (i = 0; i < q; i += 8) { ------------------ | Branch (831:17): [True: 5.56k, False: 1.31k] ------------------ 832| 5.56k| int32x8 x0 = int32x8_load(&x[i]); ------------------ | | 9| 5.56k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 833| 5.56k| int32x8 x1 = int32x8_load(&x[i + q]); ------------------ | | 9| 5.56k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 834| 5.56k| int32x8 x2 = int32x8_load(&x[i + 2 * q]); ------------------ | | 9| 5.56k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 835| 5.56k| int32x8 x3 = int32x8_load(&x[i + 3 * q]); ------------------ | | 9| 5.56k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 836| 5.56k| int32x8 x4 = int32x8_load(&x[i + 4 * q]); ------------------ | | 9| 5.56k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 837| 5.56k| int32x8 x5 = int32x8_load(&x[i + 5 * q]); ------------------ | | 9| 5.56k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 838| 5.56k| int32x8 x6 = int32x8_load(&x[i + 6 * q]); ------------------ | | 9| 5.56k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 839| 5.56k| int32x8 x7 = int32x8_load(&x[i + 7 * q]); ------------------ | | 9| 5.56k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 840| | 841| 5.56k| int32x8_MINMAX(x0, x1); ------------------ | | 15| 5.56k| do { \ | | 16| 5.56k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 5.56k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 5.56k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 5.56k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 5.56k| (a) = c; \ | | 19| 5.56k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 5.56k] | | ------------------ ------------------ 842| 5.56k| int32x8_MINMAX(x2, x3); ------------------ | | 15| 5.56k| do { \ | | 16| 5.56k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 5.56k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 5.56k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 5.56k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 5.56k| (a) = c; \ | | 19| 5.56k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 5.56k] | | ------------------ ------------------ 843| 5.56k| int32x8_MINMAX(x4, x5); ------------------ | | 15| 5.56k| do { \ | | 16| 5.56k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 5.56k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 5.56k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 5.56k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 5.56k| (a) = c; \ | | 19| 5.56k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 5.56k] | | ------------------ ------------------ 844| 5.56k| int32x8_MINMAX(x6, x7); ------------------ | | 15| 5.56k| do { \ | | 16| 5.56k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 5.56k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 5.56k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 5.56k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 5.56k| (a) = c; \ | | 19| 5.56k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 5.56k] | | ------------------ ------------------ 845| 5.56k| int32x8_MINMAX(x0, x2); ------------------ | | 15| 5.56k| do { \ | | 16| 5.56k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 5.56k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 5.56k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 5.56k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 5.56k| (a) = c; \ | | 19| 5.56k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 5.56k] | | ------------------ ------------------ 846| 5.56k| int32x8_MINMAX(x1, x3); ------------------ | | 15| 5.56k| do { \ | | 16| 5.56k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 5.56k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 5.56k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 5.56k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 5.56k| (a) = c; \ | | 19| 5.56k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 5.56k] | | ------------------ ------------------ 847| 5.56k| int32x8_MINMAX(x4, x6); ------------------ | | 15| 5.56k| do { \ | | 16| 5.56k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 5.56k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 5.56k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 5.56k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 5.56k| (a) = c; \ | | 19| 5.56k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 5.56k] | | ------------------ ------------------ 848| 5.56k| int32x8_MINMAX(x5, x7); ------------------ | | 15| 5.56k| do { \ | | 16| 5.56k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 5.56k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 5.56k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 5.56k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 5.56k| (a) = c; \ | | 19| 5.56k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 5.56k] | | ------------------ ------------------ 849| 5.56k| int32x8_MINMAX(x0, x4); ------------------ | | 15| 5.56k| do { \ | | 16| 5.56k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 5.56k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 5.56k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 5.56k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 5.56k| (a) = c; \ | | 19| 5.56k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 5.56k] | | ------------------ ------------------ 850| 5.56k| int32x8_MINMAX(x1, x5); ------------------ | | 15| 5.56k| do { \ | | 16| 5.56k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 5.56k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 5.56k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 5.56k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 5.56k| (a) = c; \ | | 19| 5.56k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 5.56k] | | ------------------ ------------------ 851| 5.56k| int32x8_MINMAX(x2, x6); ------------------ | | 15| 5.56k| do { \ | | 16| 5.56k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 5.56k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 5.56k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 5.56k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 5.56k| (a) = c; \ | | 19| 5.56k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 5.56k] | | ------------------ ------------------ 852| 5.56k| int32x8_MINMAX(x3, x7); ------------------ | | 15| 5.56k| do { \ | | 16| 5.56k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 5.56k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 5.56k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 5.56k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 5.56k| (a) = c; \ | | 19| 5.56k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 5.56k] | | ------------------ ------------------ 853| | 854| 5.56k| int32x8 b0 = _mm256_unpacklo_epi32(x0, x4); /* AE0AE1AE4AE5 */ 855| 5.56k| int32x8 b1 = _mm256_unpackhi_epi32(x0, x4); /* AE2AE3AE6AE7 */ 856| 5.56k| int32x8 b2 = _mm256_unpacklo_epi32(x1, x5); /* BF0BF1BF4BF5 */ 857| 5.56k| int32x8 b3 = _mm256_unpackhi_epi32(x1, x5); /* BF2BF3BF6BF7 */ 858| 5.56k| int32x8 b4 = _mm256_unpacklo_epi32(x2, x6); /* CG0CG1CG4CG5 */ 859| 5.56k| int32x8 b5 = _mm256_unpackhi_epi32(x2, x6); /* CG2CG3CG6CG7 */ 860| 5.56k| int32x8 b6 = _mm256_unpacklo_epi32(x3, x7); /* DH0DH1DH4DH5 */ 861| 5.56k| int32x8 b7 = _mm256_unpackhi_epi32(x3, x7); /* DH2DH3DH6DH7 */ 862| | 863| 5.56k| int32x8 c0 = _mm256_unpacklo_epi64(b0, b4); /* AECG0AECG4 */ 864| 5.56k| int32x8 c1 = _mm256_unpacklo_epi64(b1, b5); /* AECG2AECG6 */ 865| 5.56k| int32x8 c2 = _mm256_unpackhi_epi64(b0, b4); /* AECG1AECG5 */ 866| 5.56k| int32x8 c3 = _mm256_unpackhi_epi64(b1, b5); /* AECG3AECG7 */ 867| 5.56k| int32x8 c4 = _mm256_unpacklo_epi64(b2, b6); /* BFDH0BFDH4 */ 868| 5.56k| int32x8 c5 = _mm256_unpacklo_epi64(b3, b7); /* BFDH2BFDH6 */ 869| 5.56k| int32x8 c6 = _mm256_unpackhi_epi64(b2, b6); /* BFDH1BFDH5 */ 870| 5.56k| int32x8 c7 = _mm256_unpackhi_epi64(b3, b7); /* BFDH3BFDH7 */ 871| | 872| 5.56k| int32x8 d0 = _mm256_permute2x128_si256(c0, c4, 0x20); /* AECGBFDH0 */ 873| 5.56k| int32x8 d1 = _mm256_permute2x128_si256(c1, c5, 0x20); /* AECGBFDH2 */ 874| 5.56k| int32x8 d2 = _mm256_permute2x128_si256(c2, c6, 0x20); /* AECGBFDH1 */ 875| 5.56k| int32x8 d3 = _mm256_permute2x128_si256(c3, c7, 0x20); /* AECGBFDH3 */ 876| 5.56k| int32x8 d4 = _mm256_permute2x128_si256(c0, c4, 0x31); /* AECGBFDH4 */ 877| 5.56k| int32x8 d5 = _mm256_permute2x128_si256(c1, c5, 0x31); /* AECGBFDH6 */ 878| 5.56k| int32x8 d6 = _mm256_permute2x128_si256(c2, c6, 0x31); /* AECGBFDH5 */ 879| 5.56k| int32x8 d7 = _mm256_permute2x128_si256(c3, c7, 0x31); /* AECGBFDH7 */ 880| | 881| 5.56k| if (flagdown) { ------------------ | Branch (881:13): [True: 3.81k, False: 1.74k] ------------------ 882| 3.81k| d0 ^= mask; 883| 3.81k| d1 ^= mask; 884| 3.81k| d2 ^= mask; 885| 3.81k| d3 ^= mask; 886| 3.81k| d4 ^= mask; 887| 3.81k| d5 ^= mask; 888| 3.81k| d6 ^= mask; 889| 3.81k| d7 ^= mask; 890| 3.81k| } 891| | 892| 5.56k| int32x8_store(&x[i], d0); ------------------ | | 10| 5.56k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 893| 5.56k| int32x8_store(&x[i + q], d4); ------------------ | | 10| 5.56k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 894| 5.56k| int32x8_store(&x[i + 2 * q], d1); ------------------ | | 10| 5.56k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 895| 5.56k| int32x8_store(&x[i + 3 * q], d5); ------------------ | | 10| 5.56k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 896| 5.56k| int32x8_store(&x[i + 4 * q], d2); ------------------ | | 10| 5.56k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 897| 5.56k| int32x8_store(&x[i + 5 * q], d6); ------------------ | | 10| 5.56k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 898| 5.56k| int32x8_store(&x[i + 6 * q], d3); ------------------ | | 10| 5.56k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 899| 5.56k| int32x8_store(&x[i + 7 * q], d7); ------------------ | | 10| 5.56k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 900| 5.56k| } 901| 1.31k|} crypto_sort_int32.c:int32_threestages: 132| 1.57k|static size_t int32_threestages(int32 *x, size_t n, size_t q) { 133| 1.57k| size_t k, i; 134| | 135| 7.72k| for (k = 0; k + 8 * q <= n; k += 8 * q) { ------------------ | Branch (135:17): [True: 6.15k, False: 1.57k] ------------------ 136| 13.5k| for (i = k; i < k + q; i += 8) { ------------------ | Branch (136:21): [True: 7.36k, False: 6.15k] ------------------ 137| 7.36k| int32x8 x0 = int32x8_load(&x[i]); ------------------ | | 9| 7.36k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 138| 7.36k| int32x8 x1 = int32x8_load(&x[i + q]); ------------------ | | 9| 7.36k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 139| 7.36k| int32x8 x2 = int32x8_load(&x[i + 2 * q]); ------------------ | | 9| 7.36k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 140| 7.36k| int32x8 x3 = int32x8_load(&x[i + 3 * q]); ------------------ | | 9| 7.36k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 141| 7.36k| int32x8 x4 = int32x8_load(&x[i + 4 * q]); ------------------ | | 9| 7.36k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 142| 7.36k| int32x8 x5 = int32x8_load(&x[i + 5 * q]); ------------------ | | 9| 7.36k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 143| 7.36k| int32x8 x6 = int32x8_load(&x[i + 6 * q]); ------------------ | | 9| 7.36k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 144| 7.36k| int32x8 x7 = int32x8_load(&x[i + 7 * q]); ------------------ | | 9| 7.36k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 145| | 146| 7.36k| int32x8_MINMAX(x0, x4); ------------------ | | 15| 7.36k| do { \ | | 16| 7.36k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 7.36k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 7.36k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 7.36k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 7.36k| (a) = c; \ | | 19| 7.36k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 7.36k] | | ------------------ ------------------ 147| 7.36k| int32x8_MINMAX(x1, x5); ------------------ | | 15| 7.36k| do { \ | | 16| 7.36k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 7.36k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 7.36k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 7.36k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 7.36k| (a) = c; \ | | 19| 7.36k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 7.36k] | | ------------------ ------------------ 148| 7.36k| int32x8_MINMAX(x2, x6); ------------------ | | 15| 7.36k| do { \ | | 16| 7.36k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 7.36k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 7.36k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 7.36k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 7.36k| (a) = c; \ | | 19| 7.36k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 7.36k] | | ------------------ ------------------ 149| 7.36k| int32x8_MINMAX(x3, x7); ------------------ | | 15| 7.36k| do { \ | | 16| 7.36k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 7.36k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 7.36k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 7.36k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 7.36k| (a) = c; \ | | 19| 7.36k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 7.36k] | | ------------------ ------------------ 150| 7.36k| int32x8_MINMAX(x0, x2); ------------------ | | 15| 7.36k| do { \ | | 16| 7.36k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 7.36k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 7.36k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 7.36k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 7.36k| (a) = c; \ | | 19| 7.36k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 7.36k] | | ------------------ ------------------ 151| 7.36k| int32x8_MINMAX(x1, x3); ------------------ | | 15| 7.36k| do { \ | | 16| 7.36k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 7.36k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 7.36k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 7.36k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 7.36k| (a) = c; \ | | 19| 7.36k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 7.36k] | | ------------------ ------------------ 152| 7.36k| int32x8_MINMAX(x4, x6); ------------------ | | 15| 7.36k| do { \ | | 16| 7.36k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 7.36k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 7.36k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 7.36k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 7.36k| (a) = c; \ | | 19| 7.36k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 7.36k] | | ------------------ ------------------ 153| 7.36k| int32x8_MINMAX(x5, x7); ------------------ | | 15| 7.36k| do { \ | | 16| 7.36k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 7.36k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 7.36k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 7.36k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 7.36k| (a) = c; \ | | 19| 7.36k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 7.36k] | | ------------------ ------------------ 154| 7.36k| int32x8_MINMAX(x0, x1); ------------------ | | 15| 7.36k| do { \ | | 16| 7.36k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 7.36k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 7.36k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 7.36k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 7.36k| (a) = c; \ | | 19| 7.36k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 7.36k] | | ------------------ ------------------ 155| 7.36k| int32x8_MINMAX(x2, x3); ------------------ | | 15| 7.36k| do { \ | | 16| 7.36k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 7.36k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 7.36k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 7.36k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 7.36k| (a) = c; \ | | 19| 7.36k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 7.36k] | | ------------------ ------------------ 156| 7.36k| int32x8_MINMAX(x4, x5); ------------------ | | 15| 7.36k| do { \ | | 16| 7.36k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 7.36k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 7.36k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 7.36k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 7.36k| (a) = c; \ | | 19| 7.36k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 7.36k] | | ------------------ ------------------ 157| 7.36k| int32x8_MINMAX(x6, x7); ------------------ | | 15| 7.36k| do { \ | | 16| 7.36k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 7.36k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 7.36k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 7.36k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 7.36k| (a) = c; \ | | 19| 7.36k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 7.36k] | | ------------------ ------------------ 158| | 159| 7.36k| int32x8_store(&x[i], x0); ------------------ | | 10| 7.36k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 160| 7.36k| int32x8_store(&x[i + q], x1); ------------------ | | 10| 7.36k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 161| 7.36k| int32x8_store(&x[i + 2 * q], x2); ------------------ | | 10| 7.36k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 162| 7.36k| int32x8_store(&x[i + 3 * q], x3); ------------------ | | 10| 7.36k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 163| 7.36k| int32x8_store(&x[i + 4 * q], x4); ------------------ | | 10| 7.36k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 164| 7.36k| int32x8_store(&x[i + 5 * q], x5); ------------------ | | 10| 7.36k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 165| 7.36k| int32x8_store(&x[i + 6 * q], x6); ------------------ | | 10| 7.36k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 166| 7.36k| int32x8_store(&x[i + 7 * q], x7); ------------------ | | 10| 7.36k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 167| 7.36k| } 168| 6.15k| } 169| | 170| 1.57k| return k; 171| 1.57k|} crypto_sort_int32.c:minmax_vector: 32| 5.44k|static void minmax_vector(int32 *x, int32 *y, size_t n) { 33| 5.44k| if ((long long) n < 8) { ------------------ | Branch (33:9): [True: 2.67k, False: 2.76k] ------------------ 34| 5.66k| while ((long long) n > 0) { ------------------ | Branch (34:16): [True: 2.99k, False: 2.67k] ------------------ 35| 2.99k| int32_MINMAX(x, y); 36| 2.99k| ++x; 37| 2.99k| ++y; 38| 2.99k| --n; 39| 2.99k| } 40| 2.67k| return; 41| 2.67k| } 42| 2.76k| if (n & 7) { ------------------ | Branch (42:9): [True: 2.76k, False: 0] ------------------ 43| 2.76k| int32x8 x0 = int32x8_load(x + n - 8); ------------------ | | 9| 2.76k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 44| 2.76k| int32x8 y0 = int32x8_load(y + n - 8); ------------------ | | 9| 2.76k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 45| 2.76k| int32x8_MINMAX(x0, y0); ------------------ | | 15| 2.76k| do { \ | | 16| 2.76k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 2.76k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 2.76k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 2.76k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 2.76k| (a) = c; \ | | 19| 2.76k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 2.76k] | | ------------------ ------------------ 46| 2.76k| int32x8_store(x + n - 8, x0); ------------------ | | 10| 2.76k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 47| 2.76k| int32x8_store(y + n - 8, y0); ------------------ | | 10| 2.76k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 48| 2.76k| n &= ~7; 49| 2.76k| } 50| 31.0k| do { 51| 31.0k| int32x8 x0 = int32x8_load(x); ------------------ | | 9| 31.0k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 52| 31.0k| int32x8 y0 = int32x8_load(y); ------------------ | | 9| 31.0k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 53| 31.0k| int32x8_MINMAX(x0, y0); ------------------ | | 15| 31.0k| do { \ | | 16| 31.0k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 31.0k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 31.0k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 31.0k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 31.0k| (a) = c; \ | | 19| 31.0k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 31.0k] | | ------------------ ------------------ 54| 31.0k| int32x8_store(x, x0); ------------------ | | 10| 31.0k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 55| 31.0k| int32x8_store(y, y0); ------------------ | | 10| 31.0k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 56| 31.0k| x += 8; 57| 31.0k| y += 8; 58| 31.0k| n -= 8; 59| 31.0k| } while (n); ------------------ | Branch (59:14): [True: 28.2k, False: 2.76k] ------------------ 60| 2.76k|} PQCLEAN_NTRUHPS2048509_AVX2_crypto_kem_keypair: 10| 182|int PQCLEAN_NTRUHPS2048509_AVX2_crypto_kem_keypair(uint8_t *pk, uint8_t *sk) { 11| 182| uint8_t seed[NTRU_SAMPLE_FG_BYTES]; 12| | 13| 182| randombytes(seed, NTRU_SAMPLE_FG_BYTES); ------------------ | | 8| 182|#define randombytes OQS_randombytes ------------------ randombytes(seed, NTRU_SAMPLE_FG_BYTES); ------------------ | | 22| 182|#define NTRU_SAMPLE_FG_BYTES (NTRU_SAMPLE_IID_BYTES+NTRU_SAMPLE_FT_BYTES) | | ------------------ | | | | 20| 182|#define NTRU_SAMPLE_IID_BYTES (NTRU_N-1) | | | | ------------------ | | | | | | 5| 182|#define NTRU_N 509 | | | | ------------------ | | ------------------ | | #define NTRU_SAMPLE_FG_BYTES (NTRU_SAMPLE_IID_BYTES+NTRU_SAMPLE_FT_BYTES) | | ------------------ | | | | 21| 182|#define NTRU_SAMPLE_FT_BYTES ((30*(NTRU_N-1)+7)/8) | | | | ------------------ | | | | | | 5| 182|#define NTRU_N 509 | | | | ------------------ | | ------------------ ------------------ 14| 182| PQCLEAN_NTRUHPS2048509_AVX2_owcpa_keypair(pk, sk, seed); 15| | 16| 182| randombytes(sk + NTRU_OWCPA_SECRETKEYBYTES, NTRU_PRFKEYBYTES); ------------------ | | 8| 182|#define randombytes OQS_randombytes ------------------ randombytes(sk + NTRU_OWCPA_SECRETKEYBYTES, NTRU_PRFKEYBYTES); ------------------ | | 30| 182|#define NTRU_OWCPA_SECRETKEYBYTES (2*NTRU_PACK_TRINARY_BYTES + NTRU_OWCPA_PUBLICKEYBYTES) | | ------------------ | | | | 26| 182|#define NTRU_PACK_TRINARY_BYTES ((NTRU_PACK_DEG+4)/5) | | | | ------------------ | | | | | | 25| 182|#define NTRU_PACK_DEG (NTRU_N-1) | | | | | | ------------------ | | | | | | | | 5| 182|#define NTRU_N 509 | | | | | | ------------------ | | | | ------------------ | | ------------------ | | #define NTRU_OWCPA_SECRETKEYBYTES (2*NTRU_PACK_TRINARY_BYTES + NTRU_OWCPA_PUBLICKEYBYTES) | | ------------------ | | | | 29| 182|#define NTRU_OWCPA_PUBLICKEYBYTES ((NTRU_LOGQ*NTRU_PACK_DEG+7)/8) | | | | ------------------ | | | | | | 6| 182|#define NTRU_LOGQ 11 | | | | ------------------ | | | | #define NTRU_OWCPA_PUBLICKEYBYTES ((NTRU_LOGQ*NTRU_PACK_DEG+7)/8) | | | | ------------------ | | | | | | 25| 182|#define NTRU_PACK_DEG (NTRU_N-1) | | | | | | ------------------ | | | | | | | | 5| 182|#define NTRU_N 509 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ randombytes(sk + NTRU_OWCPA_SECRETKEYBYTES, NTRU_PRFKEYBYTES); ------------------ | | 17| 182|#define NTRU_PRFKEYBYTES 32 ------------------ 17| | 18| 182| return 0; 19| 182|} PQCLEAN_NTRUHPS2048509_AVX2_crypto_kem_enc: 21| 182|int PQCLEAN_NTRUHPS2048509_AVX2_crypto_kem_enc(uint8_t *c, uint8_t *k, const uint8_t *pk) { 22| 182| poly r, m; 23| 182| uint8_t rm[NTRU_OWCPA_MSGBYTES]; 24| 182| uint8_t rm_seed[NTRU_SAMPLE_RM_BYTES]; 25| | 26| 182| randombytes(rm_seed, NTRU_SAMPLE_RM_BYTES); ------------------ | | 8| 182|#define randombytes OQS_randombytes ------------------ randombytes(rm_seed, NTRU_SAMPLE_RM_BYTES); ------------------ | | 23| 182|#define NTRU_SAMPLE_RM_BYTES (NTRU_SAMPLE_IID_BYTES+NTRU_SAMPLE_FT_BYTES) | | ------------------ | | | | 20| 182|#define NTRU_SAMPLE_IID_BYTES (NTRU_N-1) | | | | ------------------ | | | | | | 5| 182|#define NTRU_N 509 | | | | ------------------ | | ------------------ | | #define NTRU_SAMPLE_RM_BYTES (NTRU_SAMPLE_IID_BYTES+NTRU_SAMPLE_FT_BYTES) | | ------------------ | | | | 21| 182|#define NTRU_SAMPLE_FT_BYTES ((30*(NTRU_N-1)+7)/8) | | | | ------------------ | | | | | | 5| 182|#define NTRU_N 509 | | | | ------------------ | | ------------------ ------------------ 27| | 28| 182| PQCLEAN_NTRUHPS2048509_AVX2_sample_rm(&r, &m, rm_seed); 29| | 30| 182| PQCLEAN_NTRUHPS2048509_AVX2_poly_S3_tobytes(rm, &r); 31| 182| PQCLEAN_NTRUHPS2048509_AVX2_poly_S3_tobytes(rm + NTRU_PACK_TRINARY_BYTES, &m); ------------------ | | 26| 182|#define NTRU_PACK_TRINARY_BYTES ((NTRU_PACK_DEG+4)/5) | | ------------------ | | | | 25| 182|#define NTRU_PACK_DEG (NTRU_N-1) | | | | ------------------ | | | | | | 5| 182|#define NTRU_N 509 | | | | ------------------ | | ------------------ ------------------ 32| 182| sha3_256(k, rm, NTRU_OWCPA_MSGBYTES); ------------------ | | 15| 182|#define sha3_256 OQS_SHA3_sha3_256 ------------------ sha3_256(k, rm, NTRU_OWCPA_MSGBYTES); ------------------ | | 28| 182|#define NTRU_OWCPA_MSGBYTES (2*NTRU_PACK_TRINARY_BYTES) | | ------------------ | | | | 26| 182|#define NTRU_PACK_TRINARY_BYTES ((NTRU_PACK_DEG+4)/5) | | | | ------------------ | | | | | | 25| 182|#define NTRU_PACK_DEG (NTRU_N-1) | | | | | | ------------------ | | | | | | | | 5| 182|#define NTRU_N 509 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 33| | 34| 182| PQCLEAN_NTRUHPS2048509_AVX2_poly_Z3_to_Zq(&r); 35| 182| PQCLEAN_NTRUHPS2048509_AVX2_owcpa_enc(c, &r, &m, pk); 36| | 37| 182| return 0; 38| 182|} PQCLEAN_NTRUHPS2048509_AVX2_crypto_kem_dec: 40| 182|int PQCLEAN_NTRUHPS2048509_AVX2_crypto_kem_dec(uint8_t *k, const uint8_t *c, const uint8_t *sk) { 41| 182| int i, fail; 42| 182| uint8_t rm[NTRU_OWCPA_MSGBYTES]; 43| 182| uint8_t buf[NTRU_PRFKEYBYTES + NTRU_CIPHERTEXTBYTES]; 44| | 45| 182| fail = PQCLEAN_NTRUHPS2048509_AVX2_owcpa_dec(rm, c, sk); 46| | /* If fail = 0 then c = Enc(h, rm). There is no need to re-encapsulate. */ 47| | /* See comment in PQCLEAN_NTRUHPS2048509_AVX2_owcpa_dec for details. */ 48| | 49| 182| sha3_256(k, rm, NTRU_OWCPA_MSGBYTES); ------------------ | | 15| 182|#define sha3_256 OQS_SHA3_sha3_256 ------------------ sha3_256(k, rm, NTRU_OWCPA_MSGBYTES); ------------------ | | 28| 182|#define NTRU_OWCPA_MSGBYTES (2*NTRU_PACK_TRINARY_BYTES) | | ------------------ | | | | 26| 182|#define NTRU_PACK_TRINARY_BYTES ((NTRU_PACK_DEG+4)/5) | | | | ------------------ | | | | | | 25| 182|#define NTRU_PACK_DEG (NTRU_N-1) | | | | | | ------------------ | | | | | | | | 5| 182|#define NTRU_N 509 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 50| | 51| | /* shake(secret PRF key || input ciphertext) */ 52| 6.00k| for (i = 0; i < NTRU_PRFKEYBYTES; i++) { ------------------ | | 17| 6.00k|#define NTRU_PRFKEYBYTES 32 ------------------ | Branch (52:17): [True: 5.82k, False: 182] ------------------ 53| 5.82k| buf[i] = sk[i + NTRU_OWCPA_SECRETKEYBYTES]; ------------------ | | 30| 5.82k|#define NTRU_OWCPA_SECRETKEYBYTES (2*NTRU_PACK_TRINARY_BYTES + NTRU_OWCPA_PUBLICKEYBYTES) | | ------------------ | | | | 26| 5.82k|#define NTRU_PACK_TRINARY_BYTES ((NTRU_PACK_DEG+4)/5) | | | | ------------------ | | | | | | 25| 5.82k|#define NTRU_PACK_DEG (NTRU_N-1) | | | | | | ------------------ | | | | | | | | 5| 5.82k|#define NTRU_N 509 | | | | | | ------------------ | | | | ------------------ | | ------------------ | | #define NTRU_OWCPA_SECRETKEYBYTES (2*NTRU_PACK_TRINARY_BYTES + NTRU_OWCPA_PUBLICKEYBYTES) | | ------------------ | | | | 29| 5.82k|#define NTRU_OWCPA_PUBLICKEYBYTES ((NTRU_LOGQ*NTRU_PACK_DEG+7)/8) | | | | ------------------ | | | | | | 6| 5.82k|#define NTRU_LOGQ 11 | | | | ------------------ | | | | #define NTRU_OWCPA_PUBLICKEYBYTES ((NTRU_LOGQ*NTRU_PACK_DEG+7)/8) | | | | ------------------ | | | | | | 25| 5.82k|#define NTRU_PACK_DEG (NTRU_N-1) | | | | | | ------------------ | | | | | | | | 5| 5.82k|#define NTRU_N 509 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 54| 5.82k| } 55| 127k| for (i = 0; i < NTRU_CIPHERTEXTBYTES; i++) { ------------------ | | 35| 127k|#define NTRU_CIPHERTEXTBYTES (NTRU_OWCPA_BYTES) | | ------------------ | | | | 31| 127k|#define NTRU_OWCPA_BYTES ((NTRU_LOGQ*NTRU_PACK_DEG+7)/8) | | | | ------------------ | | | | | | 6| 127k|#define NTRU_LOGQ 11 | | | | ------------------ | | | | #define NTRU_OWCPA_BYTES ((NTRU_LOGQ*NTRU_PACK_DEG+7)/8) | | | | ------------------ | | | | | | 25| 127k|#define NTRU_PACK_DEG (NTRU_N-1) | | | | | | ------------------ | | | | | | | | 5| 127k|#define NTRU_N 509 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ | Branch (55:17): [True: 127k, False: 182] ------------------ 56| 127k| buf[NTRU_PRFKEYBYTES + i] = c[i]; ------------------ | | 17| 127k|#define NTRU_PRFKEYBYTES 32 ------------------ 57| 127k| } 58| 182| sha3_256(rm, buf, NTRU_PRFKEYBYTES + NTRU_CIPHERTEXTBYTES); ------------------ | | 15| 182|#define sha3_256 OQS_SHA3_sha3_256 ------------------ sha3_256(rm, buf, NTRU_PRFKEYBYTES + NTRU_CIPHERTEXTBYTES); ------------------ | | 17| 182|#define NTRU_PRFKEYBYTES 32 ------------------ sha3_256(rm, buf, NTRU_PRFKEYBYTES + NTRU_CIPHERTEXTBYTES); ------------------ | | 35| 182|#define NTRU_CIPHERTEXTBYTES (NTRU_OWCPA_BYTES) | | ------------------ | | | | 31| 182|#define NTRU_OWCPA_BYTES ((NTRU_LOGQ*NTRU_PACK_DEG+7)/8) | | | | ------------------ | | | | | | 6| 182|#define NTRU_LOGQ 11 | | | | ------------------ | | | | #define NTRU_OWCPA_BYTES ((NTRU_LOGQ*NTRU_PACK_DEG+7)/8) | | | | ------------------ | | | | | | 25| 182|#define NTRU_PACK_DEG (NTRU_N-1) | | | | | | ------------------ | | | | | | | | 5| 182|#define NTRU_N 509 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 59| | 60| 182| PQCLEAN_NTRUHPS2048509_AVX2_cmov(k, rm, NTRU_SHAREDKEYBYTES, (unsigned char) fail); ------------------ | | 18| 182|#define NTRU_SHAREDKEYBYTES 32 ------------------ 61| | 62| 182| return 0; 63| 182|} PQCLEAN_NTRUHPS2048509_AVX2_owcpa_keypair: 62| 182| const unsigned char seed[NTRU_SAMPLE_FG_BYTES]) { 63| 182| int i; 64| | 65| 182| poly x1, x2, x3, x4, x5; 66| | 67| 182| poly *f = &x1, *g = &x2, *invf_mod3 = &x3; 68| 182| poly *gf = &x3, *invgf = &x4, *tmp = &x5; 69| 182| poly *invh = &x3, *h = &x3; 70| | 71| 182| PQCLEAN_NTRUHPS2048509_AVX2_sample_fg(f, g, seed); 72| | 73| 182| PQCLEAN_NTRUHPS2048509_AVX2_poly_S3_inv(invf_mod3, f); 74| 182| PQCLEAN_NTRUHPS2048509_AVX2_poly_S3_tobytes(sk, f); 75| 182| PQCLEAN_NTRUHPS2048509_AVX2_poly_S3_tobytes(sk + NTRU_PACK_TRINARY_BYTES, invf_mod3); ------------------ | | 26| 182|#define NTRU_PACK_TRINARY_BYTES ((NTRU_PACK_DEG+4)/5) | | ------------------ | | | | 25| 182|#define NTRU_PACK_DEG (NTRU_N-1) | | | | ------------------ | | | | | | 5| 182|#define NTRU_N 509 | | | | ------------------ | | ------------------ ------------------ 76| | 77| | /* Lift coeffs of f and g from Z_p to Z_q */ 78| 182| PQCLEAN_NTRUHPS2048509_AVX2_poly_Z3_to_Zq(f); 79| 182| PQCLEAN_NTRUHPS2048509_AVX2_poly_Z3_to_Zq(g); 80| | 81| | 82| | /* g = 3*g */ 83| 92.8k| for (i = 0; i < NTRU_N; i++) { ------------------ | | 5| 92.8k|#define NTRU_N 509 ------------------ | Branch (83:17): [True: 92.6k, False: 182] ------------------ 84| 92.6k| g->coeffs[i] = 3 * g->coeffs[i]; 85| 92.6k| } 86| | 87| 182| PQCLEAN_NTRUHPS2048509_AVX2_poly_Rq_mul(gf, g, f); 88| | 89| 182| PQCLEAN_NTRUHPS2048509_AVX2_poly_Rq_inv(invgf, gf); 90| | 91| 182| PQCLEAN_NTRUHPS2048509_AVX2_poly_Rq_mul(tmp, invgf, f); 92| 182| PQCLEAN_NTRUHPS2048509_AVX2_poly_Sq_mul(invh, tmp, f); 93| 182| PQCLEAN_NTRUHPS2048509_AVX2_poly_Sq_tobytes(sk + 2 * NTRU_PACK_TRINARY_BYTES, invh); ------------------ | | 26| 182|#define NTRU_PACK_TRINARY_BYTES ((NTRU_PACK_DEG+4)/5) | | ------------------ | | | | 25| 182|#define NTRU_PACK_DEG (NTRU_N-1) | | | | ------------------ | | | | | | 5| 182|#define NTRU_N 509 | | | | ------------------ | | ------------------ ------------------ 94| | 95| 182| PQCLEAN_NTRUHPS2048509_AVX2_poly_Rq_mul(tmp, invgf, g); 96| 182| PQCLEAN_NTRUHPS2048509_AVX2_poly_Rq_mul(h, tmp, g); 97| 182| PQCLEAN_NTRUHPS2048509_AVX2_poly_Rq_sum_zero_tobytes(pk, h); 98| 182|} PQCLEAN_NTRUHPS2048509_AVX2_owcpa_enc: 104| 182| const unsigned char *pk) { 105| 182| int i; 106| 182| poly x1, x2; 107| 182| poly *h = &x1, *liftm = &x1; 108| 182| poly *ct = &x2; 109| | 110| 182| PQCLEAN_NTRUHPS2048509_AVX2_poly_Rq_sum_zero_frombytes(h, pk); 111| | 112| 182| PQCLEAN_NTRUHPS2048509_AVX2_poly_Rq_mul(ct, r, h); 113| | 114| 182| PQCLEAN_NTRUHPS2048509_AVX2_poly_lift(liftm, m); 115| 92.8k| for (i = 0; i < NTRU_N; i++) { ------------------ | | 5| 92.8k|#define NTRU_N 509 ------------------ | Branch (115:17): [True: 92.6k, False: 182] ------------------ 116| 92.6k| ct->coeffs[i] = ct->coeffs[i] + liftm->coeffs[i]; 117| 92.6k| } 118| | 119| 182| PQCLEAN_NTRUHPS2048509_AVX2_poly_Rq_sum_zero_tobytes(c, ct); 120| 182|} PQCLEAN_NTRUHPS2048509_AVX2_owcpa_dec: 124| 182| const unsigned char *secretkey) { 125| 182| int i; 126| 182| int fail; 127| 182| poly x1, x2, x3, x4; 128| | 129| 182| poly *c = &x1, *f = &x2, *cf = &x3; 130| 182| poly *mf = &x2, *finv3 = &x3, *m = &x4; 131| 182| poly *liftm = &x2, *invh = &x3, *r = &x4; 132| 182| poly *b = &x1; 133| | 134| 182| PQCLEAN_NTRUHPS2048509_AVX2_poly_Rq_sum_zero_frombytes(c, ciphertext); 135| 182| PQCLEAN_NTRUHPS2048509_AVX2_poly_S3_frombytes(f, secretkey); 136| 182| PQCLEAN_NTRUHPS2048509_AVX2_poly_Z3_to_Zq(f); 137| | 138| 182| PQCLEAN_NTRUHPS2048509_AVX2_poly_Rq_mul(cf, c, f); 139| 182| PQCLEAN_NTRUHPS2048509_AVX2_poly_Rq_to_S3(mf, cf); 140| | 141| 182| PQCLEAN_NTRUHPS2048509_AVX2_poly_S3_frombytes(finv3, secretkey + NTRU_PACK_TRINARY_BYTES); ------------------ | | 26| 182|#define NTRU_PACK_TRINARY_BYTES ((NTRU_PACK_DEG+4)/5) | | ------------------ | | | | 25| 182|#define NTRU_PACK_DEG (NTRU_N-1) | | | | ------------------ | | | | | | 5| 182|#define NTRU_N 509 | | | | ------------------ | | ------------------ ------------------ 142| 182| PQCLEAN_NTRUHPS2048509_AVX2_poly_S3_mul(m, mf, finv3); 143| 182| PQCLEAN_NTRUHPS2048509_AVX2_poly_S3_tobytes(rm + NTRU_PACK_TRINARY_BYTES, m); ------------------ | | 26| 182|#define NTRU_PACK_TRINARY_BYTES ((NTRU_PACK_DEG+4)/5) | | ------------------ | | | | 25| 182|#define NTRU_PACK_DEG (NTRU_N-1) | | | | ------------------ | | | | | | 5| 182|#define NTRU_N 509 | | | | ------------------ | | ------------------ ------------------ 144| | 145| 182| fail = 0; 146| | 147| | /* Check that the unused bits of the last byte of the ciphertext are zero */ 148| 182| fail |= owcpa_check_ciphertext(ciphertext); 149| | 150| | /* For the IND-CCA2 KEM we must ensure that c = Enc(h, (r,m)). */ 151| | /* We can avoid re-computing r*h + Lift(m) as long as we check that */ 152| | /* r (defined as b/h mod (q, Phi_n)) and m are in the message space. */ 153| | /* (m can take any value in S3 in NTRU_HRSS) */ 154| 182| fail |= owcpa_check_m(m); 155| | 156| | /* b = c - Lift(m) mod (q, x^n - 1) */ 157| 182| PQCLEAN_NTRUHPS2048509_AVX2_poly_lift(liftm, m); 158| 92.8k| for (i = 0; i < NTRU_N; i++) { ------------------ | | 5| 92.8k|#define NTRU_N 509 ------------------ | Branch (158:17): [True: 92.6k, False: 182] ------------------ 159| 92.6k| b->coeffs[i] = c->coeffs[i] - liftm->coeffs[i]; 160| 92.6k| } 161| | 162| | /* r = b / h mod (q, Phi_n) */ 163| 182| PQCLEAN_NTRUHPS2048509_AVX2_poly_Sq_frombytes(invh, secretkey + 2 * NTRU_PACK_TRINARY_BYTES); ------------------ | | 26| 182|#define NTRU_PACK_TRINARY_BYTES ((NTRU_PACK_DEG+4)/5) | | ------------------ | | | | 25| 182|#define NTRU_PACK_DEG (NTRU_N-1) | | | | ------------------ | | | | | | 5| 182|#define NTRU_N 509 | | | | ------------------ | | ------------------ ------------------ 164| 182| PQCLEAN_NTRUHPS2048509_AVX2_poly_Sq_mul(r, b, invh); 165| | 166| | /* NOTE: Our definition of r as b/h mod (q, Phi_n) follows Figure 4 of */ 167| | /* [Sch18] https://eprint.iacr.org/2018/1174/20181203:032458. */ 168| | /* This differs from Figure 10 of Saito--Xagawa--Yamakawa */ 169| | /* [SXY17] https://eprint.iacr.org/2017/1005/20180516:055500 */ 170| | /* where r gets a final reduction modulo p. */ 171| | /* We need this change to use Proposition 1 of [Sch18]. */ 172| | 173| | /* Proposition 1 of [Sch18] shows that re-encryption with (r,m) yields c. */ 174| | /* if and only if fail==0 after the following call to owcpa_check_r */ 175| | /* The procedure given in Fig. 8 of [Sch18] can be skipped because we have */ 176| | /* c(1) = 0 due to the use of poly_Rq_sum_zero_{to,from}bytes. */ 177| 182| fail |= owcpa_check_r(r); 178| | 179| 182| PQCLEAN_NTRUHPS2048509_AVX2_poly_trinary_Zq_to_Z3(r); 180| 182| PQCLEAN_NTRUHPS2048509_AVX2_poly_S3_tobytes(rm, r); 181| | 182| 182| return fail; 183| 182|} PQCLEAN_NTRUHPS2048509_AVX2_poly_S3_tobytes: 3| 1.09k|void PQCLEAN_NTRUHPS2048509_AVX2_poly_S3_tobytes(unsigned char msg[NTRU_PACK_TRINARY_BYTES], const poly *a) { 4| 1.09k| int i; 5| 1.09k| unsigned char c; 6| 1.09k| int j; 7| | 8| 111k| for (i = 0; i < NTRU_PACK_DEG / 5; i++) { ------------------ | | 25| 111k|#define NTRU_PACK_DEG (NTRU_N-1) | | ------------------ | | | | 5| 111k|#define NTRU_N 509 | | ------------------ ------------------ | Branch (8:17): [True: 110k, False: 1.09k] ------------------ 9| 110k| c = a->coeffs[5 * i + 4] & 255; 10| 110k| c = (3 * c + a->coeffs[5 * i + 3]) & 255; 11| 110k| c = (3 * c + a->coeffs[5 * i + 2]) & 255; 12| 110k| c = (3 * c + a->coeffs[5 * i + 1]) & 255; 13| 110k| c = (3 * c + a->coeffs[5 * i + 0]) & 255; 14| 110k| msg[i] = c; 15| 110k| } 16| 1.09k| i = NTRU_PACK_DEG / 5; ------------------ | | 25| 1.09k|#define NTRU_PACK_DEG (NTRU_N-1) | | ------------------ | | | | 5| 1.09k|#define NTRU_N 509 | | ------------------ ------------------ 17| 1.09k| c = 0; 18| 4.36k| for (j = NTRU_PACK_DEG - (5 * i) - 1; j >= 0; j--) { ------------------ | | 25| 1.09k|#define NTRU_PACK_DEG (NTRU_N-1) | | ------------------ | | | | 5| 1.09k|#define NTRU_N 509 | | ------------------ ------------------ | Branch (18:43): [True: 3.27k, False: 1.09k] ------------------ 19| 3.27k| c = (3 * c + a->coeffs[5 * i + j]) & 255; 20| 3.27k| } 21| 1.09k| msg[i] = c; 22| 1.09k|} PQCLEAN_NTRUHPS2048509_AVX2_poly_S3_frombytes: 24| 364|void PQCLEAN_NTRUHPS2048509_AVX2_poly_S3_frombytes(poly *r, const unsigned char msg[NTRU_PACK_TRINARY_BYTES]) { 25| 364| int i; 26| 364| unsigned char c; 27| 364| int j; 28| | 29| 37.1k| for (i = 0; i < NTRU_PACK_DEG / 5; i++) { ------------------ | | 25| 37.1k|#define NTRU_PACK_DEG (NTRU_N-1) | | ------------------ | | | | 5| 37.1k|#define NTRU_N 509 | | ------------------ ------------------ | Branch (29:17): [True: 36.7k, False: 364] ------------------ 30| 36.7k| c = msg[i]; 31| 36.7k| r->coeffs[5 * i + 0] = c; 32| 36.7k| r->coeffs[5 * i + 1] = c * 171 >> 9; // this is division by 3 33| 36.7k| r->coeffs[5 * i + 2] = c * 57 >> 9; // division by 3^2 34| 36.7k| r->coeffs[5 * i + 3] = c * 19 >> 9; // division by 3^3 35| 36.7k| r->coeffs[5 * i + 4] = c * 203 >> 14; // etc. 36| 36.7k| } 37| 364| i = NTRU_PACK_DEG / 5; ------------------ | | 25| 364|#define NTRU_PACK_DEG (NTRU_N-1) | | ------------------ | | | | 5| 364|#define NTRU_N 509 | | ------------------ ------------------ 38| 364| c = msg[i]; 39| 1.45k| for (j = 0; (5 * i + j) < NTRU_PACK_DEG; j++) { ------------------ | | 25| 1.45k|#define NTRU_PACK_DEG (NTRU_N-1) | | ------------------ | | | | 5| 1.45k|#define NTRU_N 509 | | ------------------ ------------------ | Branch (39:17): [True: 1.09k, False: 364] ------------------ 40| 1.09k| r->coeffs[5 * i + j] = c; 41| 1.09k| c = c * 171 >> 9; 42| 1.09k| } 43| 364| r->coeffs[NTRU_N - 1] = 0; ------------------ | | 5| 364|#define NTRU_N 509 ------------------ 44| 364| PQCLEAN_NTRUHPS2048509_AVX2_poly_mod_3_Phi_n(r); 45| 364|} PQCLEAN_NTRUHPS2048509_AVX2_poly_Sq_tobytes: 3| 546|void PQCLEAN_NTRUHPS2048509_AVX2_poly_Sq_tobytes(unsigned char *r, const poly *a) { 4| 546| int i, j; 5| 546| uint16_t t[8]; 6| | 7| 34.9k| for (i = 0; i < NTRU_PACK_DEG / 8; i++) { ------------------ | | 25| 34.9k|#define NTRU_PACK_DEG (NTRU_N-1) | | ------------------ | | | | 5| 34.9k|#define NTRU_N 509 | | ------------------ ------------------ | Branch (7:17): [True: 34.3k, False: 546] ------------------ 8| 309k| for (j = 0; j < 8; j++) { ------------------ | Branch (8:21): [True: 275k, False: 34.3k] ------------------ 9| 275k| t[j] = MODQ(a->coeffs[8 * i + j]); ------------------ | | 9| 275k|#define MODQ(X) ((X) & (NTRU_Q-1)) | | ------------------ | | | | 13| 275k|#define NTRU_Q (1 << NTRU_LOGQ) | | | | ------------------ | | | | | | 6| 275k|#define NTRU_LOGQ 11 | | | | ------------------ | | ------------------ ------------------ 10| 275k| } 11| | 12| 34.3k| r[11 * i + 0] = (unsigned char) ( t[0] & 0xff); 13| 34.3k| r[11 * i + 1] = (unsigned char) ((t[0] >> 8) | ((t[1] & 0x1f) << 3)); 14| 34.3k| r[11 * i + 2] = (unsigned char) ((t[1] >> 5) | ((t[2] & 0x03) << 6)); 15| 34.3k| r[11 * i + 3] = (unsigned char) ((t[2] >> 2) & 0xff); 16| 34.3k| r[11 * i + 4] = (unsigned char) ((t[2] >> 10) | ((t[3] & 0x7f) << 1)); 17| 34.3k| r[11 * i + 5] = (unsigned char) ((t[3] >> 7) | ((t[4] & 0x0f) << 4)); 18| 34.3k| r[11 * i + 6] = (unsigned char) ((t[4] >> 4) | ((t[5] & 0x01) << 7)); 19| 34.3k| r[11 * i + 7] = (unsigned char) ((t[5] >> 1) & 0xff); 20| 34.3k| r[11 * i + 8] = (unsigned char) ((t[5] >> 9) | ((t[6] & 0x3f) << 2)); 21| 34.3k| r[11 * i + 9] = (unsigned char) ((t[6] >> 6) | ((t[7] & 0x07) << 5)); 22| 34.3k| r[11 * i + 10] = (unsigned char) ((t[7] >> 3)); 23| 34.3k| } 24| | 25| 2.73k| for (j = 0; j < NTRU_PACK_DEG - 8 * i; j++) { ------------------ | | 25| 2.73k|#define NTRU_PACK_DEG (NTRU_N-1) | | ------------------ | | | | 5| 2.73k|#define NTRU_N 509 | | ------------------ ------------------ | Branch (25:17): [True: 2.18k, False: 546] ------------------ 26| 2.18k| t[j] = MODQ(a->coeffs[8 * i + j]); ------------------ | | 9| 2.18k|#define MODQ(X) ((X) & (NTRU_Q-1)) | | ------------------ | | | | 13| 2.18k|#define NTRU_Q (1 << NTRU_LOGQ) | | | | ------------------ | | | | | | 6| 2.18k|#define NTRU_LOGQ 11 | | | | ------------------ | | ------------------ ------------------ 27| 2.18k| } 28| 2.73k| for (; j < 8; j++) { ------------------ | Branch (28:12): [True: 2.18k, False: 546] ------------------ 29| 2.18k| t[j] = 0; 30| 2.18k| } 31| | 32| 546| switch (NTRU_PACK_DEG & 0x07) { ------------------ | | 25| 546|#define NTRU_PACK_DEG (NTRU_N-1) | | ------------------ | | | | 5| 546|#define NTRU_N 509 | | ------------------ ------------------ | Branch (32:13): [True: 546, Folded] ------------------ 33| | // cases 0 and 6 are impossible since 2 generates (Z/n)* and 34| | // p mod 8 in {1, 7} implies that 2 is a quadratic residue. 35| 546| case 4: ------------------ | Branch (35:5): [True: 546, False: 0] ------------------ 36| 546| r[11 * i + 0] = (unsigned char) (t[0] & 0xff); 37| 546| r[11 * i + 1] = (unsigned char) (t[0] >> 8) | ((t[1] & 0x1f) << 3); 38| 546| r[11 * i + 2] = (unsigned char) (t[1] >> 5) | ((t[2] & 0x03) << 6); 39| 546| r[11 * i + 3] = (unsigned char) (t[2] >> 2) & 0xff; 40| 546| r[11 * i + 4] = (unsigned char) (t[2] >> 10) | ((t[3] & 0x7f) << 1); 41| 546| r[11 * i + 5] = (unsigned char) (t[3] >> 7) | ((t[4] & 0x0f) << 4); 42| 546| break; 43| 0| case 2: ------------------ | Branch (43:5): [True: 0, False: 546] ------------------ 44| 0| r[11 * i + 0] = (unsigned char) (t[0] & 0xff); 45| 0| r[11 * i + 1] = (unsigned char) (t[0] >> 8) | ((t[1] & 0x1f) << 3); 46| 0| r[11 * i + 2] = (unsigned char) (t[1] >> 5) | ((t[2] & 0x03) << 6); 47| 0| break; 48| 546| } 49| 546|} PQCLEAN_NTRUHPS2048509_AVX2_poly_Sq_frombytes: 51| 546|void PQCLEAN_NTRUHPS2048509_AVX2_poly_Sq_frombytes(poly *r, const unsigned char *a) { 52| 546| int i; 53| 34.9k| for (i = 0; i < NTRU_PACK_DEG / 8; i++) { ------------------ | | 25| 34.9k|#define NTRU_PACK_DEG (NTRU_N-1) | | ------------------ | | | | 5| 34.9k|#define NTRU_N 509 | | ------------------ ------------------ | Branch (53:17): [True: 34.3k, False: 546] ------------------ 54| 34.3k| r->coeffs[8 * i + 0] = (a[11 * i + 0] >> 0) | (((uint16_t)a[11 * i + 1] & 0x07) << 8); 55| 34.3k| r->coeffs[8 * i + 1] = (a[11 * i + 1] >> 3) | (((uint16_t)a[11 * i + 2] & 0x3f) << 5); 56| 34.3k| r->coeffs[8 * i + 2] = (a[11 * i + 2] >> 6) | (((uint16_t)a[11 * i + 3] & 0xff) << 2) | (((uint16_t)a[11 * i + 4] & 0x01) << 10); 57| 34.3k| r->coeffs[8 * i + 3] = (a[11 * i + 4] >> 1) | (((uint16_t)a[11 * i + 5] & 0x0f) << 7); 58| 34.3k| r->coeffs[8 * i + 4] = (a[11 * i + 5] >> 4) | (((uint16_t)a[11 * i + 6] & 0x7f) << 4); 59| 34.3k| r->coeffs[8 * i + 5] = (a[11 * i + 6] >> 7) | (((uint16_t)a[11 * i + 7] & 0xff) << 1) | (((uint16_t)a[11 * i + 8] & 0x03) << 9); 60| 34.3k| r->coeffs[8 * i + 6] = (a[11 * i + 8] >> 2) | (((uint16_t)a[11 * i + 9] & 0x1f) << 6); 61| 34.3k| r->coeffs[8 * i + 7] = (a[11 * i + 9] >> 5) | (((uint16_t)a[11 * i + 10] & 0xff) << 3); 62| 34.3k| } 63| 546| switch (NTRU_PACK_DEG & 0x07) { ------------------ | | 25| 546|#define NTRU_PACK_DEG (NTRU_N-1) | | ------------------ | | | | 5| 546|#define NTRU_N 509 | | ------------------ ------------------ | Branch (63:13): [True: 546, Folded] ------------------ 64| | // cases 0 and 6 are impossible since 2 generates (Z/n)* and 65| | // p mod 8 in {1, 7} implies that 2 is a quadratic residue. 66| 546| case 4: ------------------ | Branch (66:5): [True: 546, False: 0] ------------------ 67| 546| r->coeffs[8 * i + 0] = (a[11 * i + 0] >> 0) | (((uint16_t)a[11 * i + 1] & 0x07) << 8); 68| 546| r->coeffs[8 * i + 1] = (a[11 * i + 1] >> 3) | (((uint16_t)a[11 * i + 2] & 0x3f) << 5); 69| 546| r->coeffs[8 * i + 2] = (a[11 * i + 2] >> 6) | (((uint16_t)a[11 * i + 3] & 0xff) << 2) | (((uint16_t)a[11 * i + 4] & 0x01) << 10); 70| 546| r->coeffs[8 * i + 3] = (a[11 * i + 4] >> 1) | (((uint16_t)a[11 * i + 5] & 0x0f) << 7); 71| 546| break; 72| 0| case 2: ------------------ | Branch (72:5): [True: 0, False: 546] ------------------ 73| 0| r->coeffs[8 * i + 0] = (a[11 * i + 0] >> 0) | (((uint16_t)a[11 * i + 1] & 0x07) << 8); 74| 0| r->coeffs[8 * i + 1] = (a[11 * i + 1] >> 3) | (((uint16_t)a[11 * i + 2] & 0x3f) << 5); 75| 0| break; 76| 546| } 77| 546| r->coeffs[NTRU_N - 1] = 0; ------------------ | | 5| 546|#define NTRU_N 509 ------------------ 78| 546|} PQCLEAN_NTRUHPS2048509_AVX2_poly_Rq_sum_zero_tobytes: 80| 364|void PQCLEAN_NTRUHPS2048509_AVX2_poly_Rq_sum_zero_tobytes(unsigned char *r, const poly *a) { 81| 364| PQCLEAN_NTRUHPS2048509_AVX2_poly_Sq_tobytes(r, a); 82| 364|} PQCLEAN_NTRUHPS2048509_AVX2_poly_Rq_sum_zero_frombytes: 84| 364|void PQCLEAN_NTRUHPS2048509_AVX2_poly_Rq_sum_zero_frombytes(poly *r, const unsigned char *a) { 85| 364| int i; 86| 364| PQCLEAN_NTRUHPS2048509_AVX2_poly_Sq_frombytes(r, a); 87| | 88| | /* Set r[n-1] so that the sum of coefficients is zero mod q */ 89| 364| r->coeffs[NTRU_N - 1] = 0; ------------------ | | 5| 364|#define NTRU_N 509 ------------------ 90| 185k| for (i = 0; i < NTRU_PACK_DEG; i++) { ------------------ | | 25| 185k|#define NTRU_PACK_DEG (NTRU_N-1) | | ------------------ | | | | 5| 185k|#define NTRU_N 509 | | ------------------ ------------------ | Branch (90:17): [True: 184k, False: 364] ------------------ 91| 184k| r->coeffs[NTRU_N - 1] -= r->coeffs[i]; ------------------ | | 5| 184k|#define NTRU_N 509 ------------------ 92| 184k| } 93| 364|} PQCLEAN_NTRUHPS2048509_AVX2_poly_Z3_to_Zq: 4| 1.09k|void PQCLEAN_NTRUHPS2048509_AVX2_poly_Z3_to_Zq(poly *r) { 5| 1.09k| int i; 6| 556k| for (i = 0; i < NTRU_N; i++) { ------------------ | | 5| 556k|#define NTRU_N 509 ------------------ | Branch (6:17): [True: 555k, False: 1.09k] ------------------ 7| 555k| r->coeffs[i] = r->coeffs[i] | ((-(r->coeffs[i] >> 1)) & (NTRU_Q - 1)); ------------------ | | 13| 555k|#define NTRU_Q (1 << NTRU_LOGQ) | | ------------------ | | | | 6| 555k|#define NTRU_LOGQ 11 | | ------------------ ------------------ 8| 555k| } 9| 1.09k|} PQCLEAN_NTRUHPS2048509_AVX2_poly_trinary_Zq_to_Z3: 12| 182|void PQCLEAN_NTRUHPS2048509_AVX2_poly_trinary_Zq_to_Z3(poly *r) { 13| 182| int i; 14| 92.8k| for (i = 0; i < NTRU_N; i++) { ------------------ | | 5| 92.8k|#define NTRU_N 509 ------------------ | Branch (14:17): [True: 92.6k, False: 182] ------------------ 15| 92.6k| r->coeffs[i] = MODQ(r->coeffs[i]); ------------------ | | 9| 92.6k|#define MODQ(X) ((X) & (NTRU_Q-1)) | | ------------------ | | | | 13| 92.6k|#define NTRU_Q (1 << NTRU_LOGQ) | | | | ------------------ | | | | | | 6| 92.6k|#define NTRU_LOGQ 11 | | | | ------------------ | | ------------------ ------------------ 16| 92.6k| r->coeffs[i] = 3 & (r->coeffs[i] ^ (r->coeffs[i] >> (NTRU_LOGQ - 1))); ------------------ | | 6| 92.6k|#define NTRU_LOGQ 11 ------------------ 17| 92.6k| } 18| 182|} PQCLEAN_NTRUHPS2048509_AVX2_poly_Sq_mul: 20| 364|void PQCLEAN_NTRUHPS2048509_AVX2_poly_Sq_mul(poly *r, const poly *a, const poly *b) { 21| 364| PQCLEAN_NTRUHPS2048509_AVX2_poly_Rq_mul(r, a, b); 22| 364| PQCLEAN_NTRUHPS2048509_AVX2_poly_mod_q_Phi_n(r); 23| 364|} PQCLEAN_NTRUHPS2048509_AVX2_poly_S3_mul: 25| 182|void PQCLEAN_NTRUHPS2048509_AVX2_poly_S3_mul(poly *r, const poly *a, const poly *b) { 26| 182| int i; 27| | 28| | /* Our S3 multiplications do not overflow mod q, */ 29| | /* so we can re-purpose PQCLEAN_NTRUHPS2048509_AVX2_poly_Rq_mul, as long as we */ 30| | /* follow with an explicit reduction mod q. */ 31| 182| PQCLEAN_NTRUHPS2048509_AVX2_poly_Rq_mul(r, a, b); 32| 92.8k| for (i = 0; i < NTRU_N; i++) { ------------------ | | 5| 92.8k|#define NTRU_N 509 ------------------ | Branch (32:17): [True: 92.6k, False: 182] ------------------ 33| 92.6k| r->coeffs[i] = MODQ(r->coeffs[i]); ------------------ | | 9| 92.6k|#define MODQ(X) ((X) & (NTRU_Q-1)) | | ------------------ | | | | 13| 92.6k|#define NTRU_Q (1 << NTRU_LOGQ) | | | | ------------------ | | | | | | 6| 92.6k|#define NTRU_LOGQ 11 | | | | ------------------ | | ------------------ ------------------ 34| 92.6k| } 35| 182| PQCLEAN_NTRUHPS2048509_AVX2_poly_mod_3_Phi_n(r); 36| 182|} PQCLEAN_NTRUHPS2048509_AVX2_poly_Rq_inv: 71| 182|void PQCLEAN_NTRUHPS2048509_AVX2_poly_Rq_inv(poly *r, const poly *a) { 72| 182| poly ai2; 73| 182| PQCLEAN_NTRUHPS2048509_AVX2_poly_R2_inv(&ai2, a); 74| 182| PQCLEAN_NTRUHPS2048509_AVX2_poly_R2_inv_to_Rq_inv(r, &ai2, a); 75| 182|} poly.c:PQCLEAN_NTRUHPS2048509_AVX2_poly_R2_inv_to_Rq_inv: 38| 182|static void PQCLEAN_NTRUHPS2048509_AVX2_poly_R2_inv_to_Rq_inv(poly *r, const poly *ai, const poly *a) { 39| | 40| 182| int i; 41| 182| poly b, c; 42| 182| poly s; 43| | 44| | // for 0..4 45| | // ai = ai * (2 - a*ai) mod q 46| 92.8k| for (i = 0; i < NTRU_N; i++) { ------------------ | | 5| 92.8k|#define NTRU_N 509 ------------------ | Branch (46:17): [True: 92.6k, False: 182] ------------------ 47| 92.6k| b.coeffs[i] = -(a->coeffs[i]); 48| 92.6k| } 49| | 50| 92.8k| for (i = 0; i < NTRU_N; i++) { ------------------ | | 5| 92.8k|#define NTRU_N 509 ------------------ | Branch (50:17): [True: 92.6k, False: 182] ------------------ 51| 92.6k| r->coeffs[i] = ai->coeffs[i]; 52| 92.6k| } 53| | 54| 182| PQCLEAN_NTRUHPS2048509_AVX2_poly_Rq_mul(&c, r, &b); 55| 182| c.coeffs[0] += 2; // c = 2 - a*ai 56| 182| PQCLEAN_NTRUHPS2048509_AVX2_poly_Rq_mul(&s, &c, r); // s = ai*c 57| | 58| 182| PQCLEAN_NTRUHPS2048509_AVX2_poly_Rq_mul(&c, &s, &b); 59| 182| c.coeffs[0] += 2; // c = 2 - a*s 60| 182| PQCLEAN_NTRUHPS2048509_AVX2_poly_Rq_mul(r, &c, &s); // r = s*c 61| | 62| 182| PQCLEAN_NTRUHPS2048509_AVX2_poly_Rq_mul(&c, r, &b); 63| 182| c.coeffs[0] += 2; // c = 2 - a*r 64| 182| PQCLEAN_NTRUHPS2048509_AVX2_poly_Rq_mul(&s, &c, r); // s = r*c 65| | 66| 182| PQCLEAN_NTRUHPS2048509_AVX2_poly_Rq_mul(&c, &s, &b); 67| 182| c.coeffs[0] += 2; // c = 2 - a*s 68| 182| PQCLEAN_NTRUHPS2048509_AVX2_poly_Rq_mul(r, &c, &s); // r = s*c 69| 182|} PQCLEAN_NTRUHPS2048509_AVX2_poly_lift: 3| 364|void PQCLEAN_NTRUHPS2048509_AVX2_poly_lift(poly *r, const poly *a) { 4| 364| int i; 5| 185k| for (i = 0; i < NTRU_N; i++) { ------------------ | | 5| 185k|#define NTRU_N 509 ------------------ | Branch (5:17): [True: 185k, False: 364] ------------------ 6| 185k| r->coeffs[i] = a->coeffs[i]; 7| 185k| } 8| 364| PQCLEAN_NTRUHPS2048509_AVX2_poly_Z3_to_Zq(r); 9| 364|} PQCLEAN_NTRUHPS2048509_AVX2_poly_R2_tobytes: 11| 182|void PQCLEAN_NTRUHPS2048509_AVX2_poly_R2_tobytes(unsigned char *out, const poly *a) { 12| | // Since pext works on a uint64_t we view the coefficient pointer as a 64-bit pointer 13| | // so that we can extract 4 coefficient at a time. It also makes arithmetic a little easier. 14| 182| uint64_t *coeff_pointer = (void *) a->coeffs; 15| | 16| 182| int i; 17| 11.6k| for (i = 0; i < 63; i++) { ------------------ | Branch (17:17): [True: 11.4k, False: 182] ------------------ 18| 11.4k| out[i] = _pext_u64(coeff_pointer[2 * i], 0x1000100010001); 19| 11.4k| out[i] |= _pext_u64(coeff_pointer[2 * i + 1], 0x1000100010001) << 4; 20| 11.4k| } 21| 182| out[i] = _pext_u64(coeff_pointer[2 * 63], 0x1000100010001); 22| 182| out[i] |= _pext_u64(coeff_pointer[2 * 63 + 1], 0x1) << 4; 23| 182|} PQCLEAN_NTRUHPS2048509_AVX2_poly_R2_frombytes: 25| 182|void PQCLEAN_NTRUHPS2048509_AVX2_poly_R2_frombytes(poly *a, const unsigned char *in) { 26| | // Since pdep results in a uint64_t we view the coefficient pointer as a 64-bit pointer 27| | // so that we can store 4 coefficient at a time. It also makes arithmetic a little easier. 28| 182| uint64_t *coeff_pointer = (void *) a->coeffs; 29| | 30| 182| int i; 31| 11.6k| for (i = 0; i < 63; i++) { ------------------ | Branch (31:17): [True: 11.4k, False: 182] ------------------ 32| 11.4k| coeff_pointer[2 * i] = _pdep_u64(in[i], 0x1000100010001); 33| 11.4k| coeff_pointer[2 * i + 1] = _pdep_u64(in[i] >> 4, 0x1000100010001); 34| 11.4k| } 35| | // From the last byte we only want 5 bits (since we have 509 total, not 512). 36| 182| coeff_pointer[2 * 63] = _pdep_u64(in[i], 0x1000100010001); 37| 182| coeff_pointer[2 * 63 + 1] = _pdep_u64(in[i] >> 4, 0x1); 38| 182|} PQCLEAN_NTRUHPS2048509_AVX2_poly_R2_inv: 40| 182|void PQCLEAN_NTRUHPS2048509_AVX2_poly_R2_inv(poly *r, const poly *a) { 41| 182| union { 42| 182| unsigned char s[64]; 43| 182| __m256i s_x32[2]; 44| 182| } squares[13]; 45| 182|#define s(x) squares[(x)].s 46| | 47| | // This relies on the following addition chain: 48| | // 1, 2, 3, 6, 12, 15, 30, 60, 63, 126, 252, 504, 507 49| | 50| 182| PQCLEAN_NTRUHPS2048509_AVX2_poly_R2_tobytes(s(0), a); // TODO alignment ------------------ | | 45| 182|#define s(x) squares[(x)].s ------------------ 51| | 52| 182| PQCLEAN_NTRUHPS2048509_AVX2_square_1_509(s(1), s(0)); ------------------ | | 45| 182|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS2048509_AVX2_square_1_509(s(1), s(0)); ------------------ | | 45| 182|#define s(x) squares[(x)].s ------------------ 53| 182| PQCLEAN_NTRUHPS2048509_AVX2_poly_R2_mul(s(1), s(1), s(0)); ------------------ | | 45| 182|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS2048509_AVX2_poly_R2_mul(s(1), s(1), s(0)); ------------------ | | 45| 182|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS2048509_AVX2_poly_R2_mul(s(1), s(1), s(0)); ------------------ | | 45| 182|#define s(x) squares[(x)].s ------------------ 54| 182| PQCLEAN_NTRUHPS2048509_AVX2_square_1_509(s(2), s(1)); ------------------ | | 45| 182|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS2048509_AVX2_square_1_509(s(2), s(1)); ------------------ | | 45| 182|#define s(x) squares[(x)].s ------------------ 55| 182| PQCLEAN_NTRUHPS2048509_AVX2_poly_R2_mul(s(2), s(2), s(0)); ------------------ | | 45| 182|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS2048509_AVX2_poly_R2_mul(s(2), s(2), s(0)); ------------------ | | 45| 182|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS2048509_AVX2_poly_R2_mul(s(2), s(2), s(0)); ------------------ | | 45| 182|#define s(x) squares[(x)].s ------------------ 56| 182| PQCLEAN_NTRUHPS2048509_AVX2_square_3_509(s(3), s(2)); ------------------ | | 45| 182|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS2048509_AVX2_square_3_509(s(3), s(2)); ------------------ | | 45| 182|#define s(x) squares[(x)].s ------------------ 57| 182| PQCLEAN_NTRUHPS2048509_AVX2_poly_R2_mul(s(3), s(3), s(2)); ------------------ | | 45| 182|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS2048509_AVX2_poly_R2_mul(s(3), s(3), s(2)); ------------------ | | 45| 182|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS2048509_AVX2_poly_R2_mul(s(3), s(3), s(2)); ------------------ | | 45| 182|#define s(x) squares[(x)].s ------------------ 58| 182| PQCLEAN_NTRUHPS2048509_AVX2_square_6_509(s(4), s(3)); ------------------ | | 45| 182|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS2048509_AVX2_square_6_509(s(4), s(3)); ------------------ | | 45| 182|#define s(x) squares[(x)].s ------------------ 59| 182| PQCLEAN_NTRUHPS2048509_AVX2_poly_R2_mul(s(4), s(4), s(3)); ------------------ | | 45| 182|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS2048509_AVX2_poly_R2_mul(s(4), s(4), s(3)); ------------------ | | 45| 182|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS2048509_AVX2_poly_R2_mul(s(4), s(4), s(3)); ------------------ | | 45| 182|#define s(x) squares[(x)].s ------------------ 60| 182| PQCLEAN_NTRUHPS2048509_AVX2_square_3_509(s(5), s(4)); ------------------ | | 45| 182|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS2048509_AVX2_square_3_509(s(5), s(4)); ------------------ | | 45| 182|#define s(x) squares[(x)].s ------------------ 61| 182| PQCLEAN_NTRUHPS2048509_AVX2_poly_R2_mul(s(5), s(5), s(2)); ------------------ | | 45| 182|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS2048509_AVX2_poly_R2_mul(s(5), s(5), s(2)); ------------------ | | 45| 182|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS2048509_AVX2_poly_R2_mul(s(5), s(5), s(2)); ------------------ | | 45| 182|#define s(x) squares[(x)].s ------------------ 62| 182| PQCLEAN_NTRUHPS2048509_AVX2_square_15_509(s(6), s(5)); ------------------ | | 45| 182|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS2048509_AVX2_square_15_509(s(6), s(5)); ------------------ | | 45| 182|#define s(x) squares[(x)].s ------------------ 63| 182| PQCLEAN_NTRUHPS2048509_AVX2_poly_R2_mul(s(6), s(6), s(5)); ------------------ | | 45| 182|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS2048509_AVX2_poly_R2_mul(s(6), s(6), s(5)); ------------------ | | 45| 182|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS2048509_AVX2_poly_R2_mul(s(6), s(6), s(5)); ------------------ | | 45| 182|#define s(x) squares[(x)].s ------------------ 64| 182| PQCLEAN_NTRUHPS2048509_AVX2_square_30_509(s(7), s(6)); ------------------ | | 45| 182|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS2048509_AVX2_square_30_509(s(7), s(6)); ------------------ | | 45| 182|#define s(x) squares[(x)].s ------------------ 65| 182| PQCLEAN_NTRUHPS2048509_AVX2_poly_R2_mul(s(7), s(7), s(6)); ------------------ | | 45| 182|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS2048509_AVX2_poly_R2_mul(s(7), s(7), s(6)); ------------------ | | 45| 182|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS2048509_AVX2_poly_R2_mul(s(7), s(7), s(6)); ------------------ | | 45| 182|#define s(x) squares[(x)].s ------------------ 66| 182| PQCLEAN_NTRUHPS2048509_AVX2_square_3_509(s(8), s(7)); ------------------ | | 45| 182|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS2048509_AVX2_square_3_509(s(8), s(7)); ------------------ | | 45| 182|#define s(x) squares[(x)].s ------------------ 67| 182| PQCLEAN_NTRUHPS2048509_AVX2_poly_R2_mul(s(8), s(8), s(2)); ------------------ | | 45| 182|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS2048509_AVX2_poly_R2_mul(s(8), s(8), s(2)); ------------------ | | 45| 182|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS2048509_AVX2_poly_R2_mul(s(8), s(8), s(2)); ------------------ | | 45| 182|#define s(x) squares[(x)].s ------------------ 68| 182| PQCLEAN_NTRUHPS2048509_AVX2_square_63_509(s(9), s(8)); ------------------ | | 45| 182|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS2048509_AVX2_square_63_509(s(9), s(8)); ------------------ | | 45| 182|#define s(x) squares[(x)].s ------------------ 69| 182| PQCLEAN_NTRUHPS2048509_AVX2_poly_R2_mul(s(9), s(9), s(8)); ------------------ | | 45| 182|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS2048509_AVX2_poly_R2_mul(s(9), s(9), s(8)); ------------------ | | 45| 182|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS2048509_AVX2_poly_R2_mul(s(9), s(9), s(8)); ------------------ | | 45| 182|#define s(x) squares[(x)].s ------------------ 70| 182| PQCLEAN_NTRUHPS2048509_AVX2_square_126_509(s(10), s(9)); ------------------ | | 45| 182|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS2048509_AVX2_square_126_509(s(10), s(9)); ------------------ | | 45| 182|#define s(x) squares[(x)].s ------------------ 71| 182| PQCLEAN_NTRUHPS2048509_AVX2_poly_R2_mul(s(10), s(10), s(9)); ------------------ | | 45| 182|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS2048509_AVX2_poly_R2_mul(s(10), s(10), s(9)); ------------------ | | 45| 182|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS2048509_AVX2_poly_R2_mul(s(10), s(10), s(9)); ------------------ | | 45| 182|#define s(x) squares[(x)].s ------------------ 72| 182| PQCLEAN_NTRUHPS2048509_AVX2_square_252_509(s(11), s(10)); ------------------ | | 45| 182|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS2048509_AVX2_square_252_509(s(11), s(10)); ------------------ | | 45| 182|#define s(x) squares[(x)].s ------------------ 73| 182| PQCLEAN_NTRUHPS2048509_AVX2_poly_R2_mul(s(11), s(11), s(10)); ------------------ | | 45| 182|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS2048509_AVX2_poly_R2_mul(s(11), s(11), s(10)); ------------------ | | 45| 182|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS2048509_AVX2_poly_R2_mul(s(11), s(11), s(10)); ------------------ | | 45| 182|#define s(x) squares[(x)].s ------------------ 74| 182| PQCLEAN_NTRUHPS2048509_AVX2_square_3_509(s(12), s(11)); ------------------ | | 45| 182|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS2048509_AVX2_square_3_509(s(12), s(11)); ------------------ | | 45| 182|#define s(x) squares[(x)].s ------------------ 75| 182| PQCLEAN_NTRUHPS2048509_AVX2_poly_R2_mul(s(12), s(12), s(2)); ------------------ | | 45| 182|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS2048509_AVX2_poly_R2_mul(s(12), s(12), s(2)); ------------------ | | 45| 182|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS2048509_AVX2_poly_R2_mul(s(12), s(12), s(2)); ------------------ | | 45| 182|#define s(x) squares[(x)].s ------------------ 76| 182| PQCLEAN_NTRUHPS2048509_AVX2_square_1_509(s(0), s(12)); ------------------ | | 45| 182|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS2048509_AVX2_square_1_509(s(0), s(12)); ------------------ | | 45| 182|#define s(x) squares[(x)].s ------------------ 77| | 78| 182| PQCLEAN_NTRUHPS2048509_AVX2_poly_R2_frombytes(r, s(0)); ------------------ | | 45| 182|#define s(x) squares[(x)].s ------------------ 79| 182|#undef s 80| 182|} PQCLEAN_NTRUHPS2048509_AVX2_poly_S3_inv: 439| 182|void PQCLEAN_NTRUHPS2048509_AVX2_poly_S3_inv(poly *r_out, const poly *a) { 440| 182| const unsigned char *in = (void *) a; 441| 182| unsigned char *out = (void *) r_out; 442| | 443| 182| small input[ppad]; 444| 182| small output[ppad]; 445| 182| int i; 446| | 447| | /* XXX: obviously input/output format should be packed into bytes */ 448| | 449| 92.6k| for (i = 0; i < p; ++i) { ------------------ | | 7| 92.6k|#define p 508 ------------------ | Branch (449:17): [True: 92.4k, False: 182] ------------------ 450| 92.4k| small x = in[2 * i] & 3; /* 0 1 2 3 */ 451| 92.4k| x += 1; /* 0 1 2 3 4 5 6, offset by 1 */ 452| 92.4k| x &= (x - 3) >> 5; /* 0 1 2, offset by 1 */ 453| 92.4k| input[i] = x - 1; 454| 92.4k| } 455| | /* XXX: merge with vec256_init */ 456| | 457| 182| __poly_S3_inv((unsigned char *)output, (unsigned char *)input); 458| | 459| 92.6k| for (i = 0; i < p; ++i) { ------------------ | | 7| 92.6k|#define p 508 ------------------ | Branch (459:17): [True: 92.4k, False: 182] ------------------ 460| 92.4k| out[2 * i] = (3 & output[i]) ^ ((3 & output[i]) >> 1); 461| 92.4k| out[2 * i + 1] = 0; 462| 92.4k| } 463| 182|} poly_s3_inv.c:__poly_S3_inv: 310| 182|static int __poly_S3_inv(unsigned char *outbytes, const unsigned char *inbytes) { 311| 182| small *out = (void *) outbytes; 312| 182| small *in = (void *) inbytes; 313| 182| vec256 F0[numvec]; 314| 182| vec256 F1[numvec]; 315| 182| vec256 G0[numvec]; 316| 182| vec256 G1[numvec]; 317| 182| vec256 V0[numvec]; 318| 182| vec256 V1[numvec]; 319| 182| vec256 R0[numvec]; 320| 182| vec256 R1[numvec]; 321| 182| vec256 c0vec, c1vec; 322| 182| int loop; 323| 182| int c0, c1; 324| 182| int minusdelta = -1; 325| 182| int swapmask; 326| 182| vec256 swapvec; 327| | 328| 182| vec256_init(G0, G1, in); 329| 182| F0[0] = _mm256_set_epi32(-1, -1, -1, -1, -1, -1, -1, -1); 330| 182| F0[1] = _mm256_set_epi32(2147483647, -1, 2147483647, -1, 2147483647, -1, -1, -1); 331| 182| F1[0] = _mm256_set1_epi32(0); 332| 182| F1[1] = _mm256_set1_epi32(0); 333| | 334| 182| V0[0] = _mm256_set1_epi32(0); 335| 182| V1[0] = _mm256_set1_epi32(0); 336| 182| V0[1] = _mm256_set1_epi32(0); 337| 182| V1[1] = _mm256_set1_epi32(0); 338| | 339| 182| R0[0] = _mm256_set_epi32(0, 0, 0, 0, 0, 0, 0, 1); 340| 182| R1[0] = _mm256_set1_epi32(0); 341| 182| R0[1] = _mm256_set1_epi32(0); 342| 182| R1[1] = _mm256_set1_epi32(0); 343| | 344| 46.7k| for (loop = 256; loop > 0; --loop) { ------------------ | Branch (344:22): [True: 46.5k, False: 182] ------------------ 345| 46.5k| vec256_timesx_1(V0); 346| 46.5k| vec256_timesx_1(V1); 347| 46.5k| swapmask = negative_mask(minusdelta) & vec256_bit0mask(G0); 348| | 349| 46.5k| c0 = vec256_bit0mask(F0) & vec256_bit0mask(G0); 350| 46.5k| c1 = vec256_bit0mask(F1) ^ vec256_bit0mask(G1); 351| 46.5k| c1 &= c0; 352| | 353| 46.5k| minusdelta ^= swapmask & (minusdelta ^ -minusdelta); 354| 46.5k| minusdelta -= 1; 355| | 356| 46.5k| swapvec = _mm256_set1_epi32(swapmask); 357| 46.5k| vec256_swap(F0, G0, 2, swapvec); 358| 46.5k| vec256_swap(F1, G1, 2, swapvec); 359| | 360| 46.5k| c0vec = _mm256_set1_epi32(c0); 361| 46.5k| c1vec = _mm256_set1_epi32(c1); 362| | 363| 46.5k| vec256_eliminate(F0, F1, G0, G1, 2, c0vec, c1vec); 364| 46.5k| vec256_divx_2(G0); 365| 46.5k| vec256_divx_2(G1); 366| | 367| 46.5k| vec256_swap(V0, R0, 1, swapvec); 368| 46.5k| vec256_swap(V1, R1, 1, swapvec); 369| 46.5k| vec256_eliminate(V0, V1, R0, R1, 1, c0vec, c1vec); 370| 46.5k| } 371| | 372| 91.7k| for (loop = 503; loop > 0; --loop) { ------------------ | Branch (372:22): [True: 91.5k, False: 182] ------------------ 373| 91.5k| vec256_timesx_2(V0); 374| 91.5k| vec256_timesx_2(V1); 375| 91.5k| swapmask = negative_mask(minusdelta) & vec256_bit0mask(G0); 376| | 377| 91.5k| c0 = vec256_bit0mask(F0) & vec256_bit0mask(G0); 378| 91.5k| c1 = vec256_bit0mask(F1) ^ vec256_bit0mask(G1); 379| 91.5k| c1 &= c0; 380| | 381| 91.5k| minusdelta ^= swapmask & (minusdelta ^ -minusdelta); 382| 91.5k| minusdelta -= 1; 383| | 384| 91.5k| swapvec = _mm256_set1_epi32(swapmask); 385| 91.5k| vec256_swap(F0, G0, 2, swapvec); 386| 91.5k| vec256_swap(F1, G1, 2, swapvec); 387| | 388| 91.5k| c0vec = _mm256_set1_epi32(c0); 389| 91.5k| c1vec = _mm256_set1_epi32(c1); 390| | 391| 91.5k| vec256_eliminate(F0, F1, G0, G1, 2, c0vec, c1vec); 392| 91.5k| vec256_divx_2(G0); 393| 91.5k| vec256_divx_2(G1); 394| | 395| 91.5k| vec256_swap(V0, R0, 2, swapvec); 396| 91.5k| vec256_swap(V1, R1, 2, swapvec); 397| 91.5k| vec256_eliminate(V0, V1, R0, R1, 2, c0vec, c1vec); 398| 91.5k| } 399| | 400| 46.7k| for (loop = 256; loop > 0; --loop) { ------------------ | Branch (400:22): [True: 46.5k, False: 182] ------------------ 401| 46.5k| vec256_timesx_2(V0); 402| 46.5k| vec256_timesx_2(V1); 403| 46.5k| swapmask = negative_mask(minusdelta) & vec256_bit0mask(G0); 404| | 405| 46.5k| c0 = vec256_bit0mask(F0) & vec256_bit0mask(G0); 406| 46.5k| c1 = vec256_bit0mask(F1) ^ vec256_bit0mask(G1); 407| 46.5k| c1 &= c0; 408| | 409| 46.5k| minusdelta ^= swapmask & (minusdelta ^ -minusdelta); 410| 46.5k| minusdelta -= 1; 411| | 412| 46.5k| swapvec = _mm256_set1_epi32(swapmask); 413| 46.5k| vec256_swap(F0, G0, 1, swapvec); 414| 46.5k| vec256_swap(F1, G1, 1, swapvec); 415| | 416| 46.5k| c0vec = _mm256_set1_epi32(c0); 417| 46.5k| c1vec = _mm256_set1_epi32(c1); 418| | 419| 46.5k| vec256_eliminate(F0, F1, G0, G1, 1, c0vec, c1vec); 420| 46.5k| vec256_divx_1(G0); 421| 46.5k| vec256_divx_1(G1); 422| | 423| 46.5k| vec256_swap(V0, R0, 2, swapvec); 424| 46.5k| vec256_swap(V1, R1, 2, swapvec); 425| 46.5k| vec256_eliminate(V0, V1, R0, R1, 2, c0vec, c1vec); 426| 46.5k| } 427| | 428| 182| c0vec = _mm256_set1_epi32(vec256_bit0mask(F0)); 429| 182| c1vec = _mm256_set1_epi32(vec256_bit0mask(F1)); 430| 182| vec256_scale(V0, V1, c0vec, c1vec); 431| | 432| 182| vec256_final(out, V0, V1); 433| 182| out[p] = negative_mask(minusdelta); ------------------ | | 7| 182|#define p 508 ------------------ 434| 182| return 0; 435| 182|} poly_s3_inv.c:vec256_init: 143| 291|static void vec256_init(vec256 *G0, vec256 *G1, const small *s) { 144| 291| int i; 145| 291| small srev[ppad + (ppad - p)]; 146| 291| small si; 147| 291| small g0[ppad]; 148| 291| small g1[ppad]; 149| | 150| 179k| for (i = 0; i < p; ++i) { ------------------ | | 7| 179k|#define p 508 ------------------ | Branch (150:17): [True: 179k, False: 291] ------------------ 151| 179k| srev[ppad - 1 - i] = s[i]; ------------------ | | 8| 179k|#define ppad 512 ------------------ 152| 179k| } 153| 20.8k| for (i = 0; i < ppad - p; ++i) { ------------------ | | 8| 20.8k|#define ppad 512 ------------------ for (i = 0; i < ppad - p; ++i) { ------------------ | | 7| 20.8k|#define p 508 ------------------ | Branch (153:17): [True: 20.5k, False: 291] ------------------ 154| 20.5k| srev[i] = 0; 155| 20.5k| } 156| 20.8k| for (i = p; i < ppad; ++i) { ------------------ | | 7| 291|#define p 508 ------------------ for (i = p; i < ppad; ++i) { ------------------ | | 8| 20.8k|#define ppad 512 ------------------ | Branch (156:17): [True: 20.5k, False: 291] ------------------ 157| 20.5k| srev[i + ppad - p] = 0; ------------------ | | 8| 20.5k|#define ppad 512 ------------------ srev[i + ppad - p] = 0; ------------------ | | 7| 20.5k|#define p 508 ------------------ 158| 20.5k| } 159| | 160| 199k| for (i = 0; i < ppad; ++i) { ------------------ | | 8| 199k|#define ppad 512 ------------------ | Branch (160:17): [True: 199k, False: 291] ------------------ 161| 199k| si = srev[i + ppad - p]; ------------------ | | 8| 199k|#define ppad 512 ------------------ si = srev[i + ppad - p]; ------------------ | | 7| 199k|#define p 508 ------------------ 162| 199k| g0[i] = si & 1; 163| 199k| g1[i] = (si >> 1) & g0[i]; 164| 199k| } 165| | 166| 291| vec256_frombits(G0, g0); 167| 291| vec256_frombits(G1, g1); 168| 291|} poly_s3_inv.c:vec256_frombits: 23| 582|static inline void vec256_frombits(vec256 *v, const small *b) { 24| 582| int i; 25| | 26| 2.14k| for (i = 0; i < numvec; ++i) { ------------------ | | 9| 2.14k|#define numvec 2 ------------------ | Branch (26:17): [True: 1.56k, False: 582] ------------------ 27| 1.56k| vec256 b0 = _mm256_loadu_si256((vec256 *) b); 28| 1.56k| b += 32; /* 0,1,...,31 */ 29| 1.56k| vec256 b1 = _mm256_loadu_si256((vec256 *) b); 30| 1.56k| b += 32; /* 32,33,... */ 31| 1.56k| vec256 b2 = _mm256_loadu_si256((vec256 *) b); 32| 1.56k| b += 32; 33| 1.56k| vec256 b3 = _mm256_loadu_si256((vec256 *) b); 34| 1.56k| b += 32; 35| 1.56k| vec256 b4 = _mm256_loadu_si256((vec256 *) b); 36| 1.56k| b += 32; 37| 1.56k| vec256 b5 = _mm256_loadu_si256((vec256 *) b); 38| 1.56k| b += 32; 39| 1.56k| vec256 b6 = _mm256_loadu_si256((vec256 *) b); 40| 1.56k| b += 32; 41| 1.56k| vec256 b7 = _mm256_loadu_si256((vec256 *) b); 42| 1.56k| b += 32; 43| | 44| 1.56k| vec256 c0 = _mm256_unpacklo_epi32(b0, b1); /* 0 1 2 3 32 33 34 35 4 5 6 7 36 37 38 39 ... 55 */ 45| 1.56k| vec256 c1 = _mm256_unpackhi_epi32(b0, b1); /* 8 9 10 11 40 41 42 43 ... 63 */ 46| 1.56k| vec256 c2 = _mm256_unpacklo_epi32(b2, b3); 47| 1.56k| vec256 c3 = _mm256_unpackhi_epi32(b2, b3); 48| 1.56k| vec256 c4 = _mm256_unpacklo_epi32(b4, b5); 49| 1.56k| vec256 c5 = _mm256_unpackhi_epi32(b4, b5); 50| 1.56k| vec256 c6 = _mm256_unpacklo_epi32(b6, b7); 51| 1.56k| vec256 c7 = _mm256_unpackhi_epi32(b6, b7); 52| | 53| 1.56k| vec256 d0 = c0 | _mm256_slli_epi32(c1, 2); /* 0 8, 1 9, 2 10, 3 11, 32 40, 33 41, ..., 55 63 */ 54| 1.56k| vec256 d2 = c2 | _mm256_slli_epi32(c3, 2); 55| 1.56k| vec256 d4 = c4 | _mm256_slli_epi32(c5, 2); 56| 1.56k| vec256 d6 = c6 | _mm256_slli_epi32(c7, 2); 57| | 58| 1.56k| vec256 e0 = _mm256_unpacklo_epi64(d0, d2); 59| 1.56k| vec256 e2 = _mm256_unpackhi_epi64(d0, d2); 60| 1.56k| vec256 e4 = _mm256_unpacklo_epi64(d4, d6); 61| 1.56k| vec256 e6 = _mm256_unpackhi_epi64(d4, d6); 62| | 63| 1.56k| vec256 f0 = e0 | _mm256_slli_epi32(e2, 1); 64| 1.56k| vec256 f4 = e4 | _mm256_slli_epi32(e6, 1); 65| | 66| 1.56k| vec256 g0 = _mm256_permute2x128_si256(f0, f4, 0x20); 67| 1.56k| vec256 g4 = _mm256_permute2x128_si256(f0, f4, 0x31); 68| | 69| 1.56k| vec256 h = g0 | _mm256_slli_epi32(g4, 4); 70| | 71| 1.56k|#define TRANSPOSE _mm256_set_epi8( 31,27,23,19, 30,26,22,18, 29,25,21,17, 28,24,20,16, 15,11,7,3, 14,10,6,2, 13,9,5,1, 12,8,4,0 ) 72| 1.56k| h = _mm256_shuffle_epi8(h, TRANSPOSE); ------------------ | | 71| 1.56k|#define TRANSPOSE _mm256_set_epi8( 31,27,23,19, 30,26,22,18, 29,25,21,17, 28,24,20,16, 15,11,7,3, 14,10,6,2, 13,9,5,1, 12,8,4,0 ) ------------------ 73| 1.56k| h = _mm256_permute4x64_epi64(h, 0xd8); 74| 1.56k| h = _mm256_shuffle_epi32(h, 0xd8); 75| | 76| 1.56k| *v++ = h; 77| 1.56k| } 78| 582|} poly_s3_inv.c:vec256_timesx_1: 280| 148k|static inline void vec256_timesx_1(vec256 *f) { 281| 148k| vec256 f0 = _mm256_permute4x64_epi64(f[0], 0x93); 282| | 283| 148k| unsigned long long low0 = _mm_cvtsi128_si64(_mm256_castsi256_si128(f0)); 284| | 285| 148k| low0 = low0 << 1; 286| | 287| 148k| f0 = _mm256_blend_epi32(f0, _mm256_set_epi64x(0, 0, 0, low0), 0x3); 288| | 289| 148k| f[0] = f0; 290| 148k|} poly_s3_inv.c:negative_mask: 196| 358k|static inline int negative_mask(int x) { 197| 358k| return x >> 31; 198| 358k|} poly_s3_inv.c:vec256_bit0mask: 247| 1.79M|static inline int vec256_bit0mask(vec256 *f) { 248| 1.79M| return -(_mm_cvtsi128_si32(_mm256_castsi256_si128(f[0])) & 1); 249| 1.79M|} poly_s3_inv.c:vec256_swap: 200| 1.43M|static inline void vec256_swap(vec256 *f, vec256 *g, int len, vec256 mask) { 201| 1.43M| vec256 flip; 202| 1.43M| int i; 203| | 204| 4.77M| for (i = 0; i < len; ++i) { ------------------ | Branch (204:17): [True: 3.34M, False: 1.43M] ------------------ 205| 3.34M| flip = mask & (f[i] ^ g[i]); 206| 3.34M| f[i] ^= flip; 207| 3.34M| g[i] ^= flip; 208| 3.34M| } 209| 1.43M|} poly_s3_inv.c:vec256_eliminate: 227| 715k|static inline void vec256_eliminate(vec256 *f0, vec256 *f1, vec256 *g0, vec256 *g1, int len, const vec256 c0, const vec256 c1) { 228| 715k| int i; 229| | 230| 2.38M| for (i = 0; i < len; ++i) { ------------------ | Branch (230:17): [True: 1.67M, False: 715k] ------------------ 231| 1.67M| vec256 f0i = f0[i]; 232| 1.67M| vec256 f1i = f1[i]; 233| 1.67M| vec256 g0i = g0[i]; 234| 1.67M| vec256 g1i = g1[i]; 235| 1.67M| vec256 t; 236| | 237| 1.67M| f0i &= c0; 238| 1.67M| f1i ^= c1; 239| 1.67M| f1i &= f0i; 240| | 241| 1.67M| t = g0i ^ f0i; 242| 1.67M| g0[i] = t | (g1i ^ f1i); 243| 1.67M| g1[i] = (g1i ^ f0i) & (f1i ^ t); 244| 1.67M| } 245| 715k|} poly_s3_inv.c:vec256_divx_2: 263| 332k|static inline void vec256_divx_2(vec256 *f) { 264| 332k| vec256 f0 = f[0]; 265| 332k| vec256 f1 = f[1]; 266| | 267| 332k| unsigned long long low0 = _mm_cvtsi128_si64(_mm256_castsi256_si128(f0)); 268| 332k| unsigned long long low1 = _mm_cvtsi128_si64(_mm256_castsi256_si128(f1)); 269| | 270| 332k| low0 = (low0 >> 1) | (low1 << 63); 271| 332k| low1 = low1 >> 1; 272| | 273| 332k| f0 = _mm256_blend_epi32(f0, _mm256_set_epi64x(0, 0, 0, low0), 0x3); 274| 332k| f1 = _mm256_blend_epi32(f1, _mm256_set_epi64x(0, 0, 0, low1), 0x3); 275| | 276| 332k| f[0] = _mm256_permute4x64_epi64(f0, 0x39); 277| | f[1] = _mm256_permute4x64_epi64(f1, 0x39); 278| 332k|} poly_s3_inv.c:vec256_timesx_2: 292| 332k|static inline void vec256_timesx_2(vec256 *f) { 293| 332k| vec256 f0 = _mm256_permute4x64_epi64(f[0], 0x93); 294| 332k| vec256 f1 = _mm256_permute4x64_epi64(f[1], 0x93); 295| | 296| 332k| unsigned long long low0 = _mm_cvtsi128_si64(_mm256_castsi256_si128(f0)); 297| 332k| unsigned long long low1 = _mm_cvtsi128_si64(_mm256_castsi256_si128(f1)); 298| | 299| 332k| low1 = (low1 << 1) | (low0 >> 63); 300| 332k| low0 = low0 << 1; 301| | 302| 332k| f0 = _mm256_blend_epi32(f0, _mm256_set_epi64x(0, 0, 0, low0), 0x3); 303| 332k| f1 = _mm256_blend_epi32(f1, _mm256_set_epi64x(0, 0, 0, low1), 0x3); 304| | 305| 332k| f[0] = f0; 306| 332k| f[1] = f1; 307| 332k|} poly_s3_inv.c:vec256_divx_1: 251| 148k|static inline void vec256_divx_1(vec256 *f) { 252| 148k| vec256 f0 = f[0]; 253| | 254| 148k| unsigned long long low0 = _mm_cvtsi128_si64(_mm256_castsi256_si128(f0)); 255| | 256| 148k| low0 = low0 >> 1; 257| | 258| 148k| f0 = _mm256_blend_epi32(f0, _mm256_set_epi64x(0, 0, 0, low0), 0x3); 259| | 260| | f[0] = _mm256_permute4x64_epi64(f0, 0x39); 261| 148k|} poly_s3_inv.c:vec256_scale: 211| 291|static inline void vec256_scale(vec256 *f0, vec256 *f1, const vec256 c0, const vec256 c1) { 212| 291| int i; 213| | 214| 1.07k| for (i = 0; i < numvec; ++i) { ------------------ | | 9| 1.07k|#define numvec 2 ------------------ | Branch (214:17): [True: 780, False: 291] ------------------ 215| 780| vec256 f0i = f0[i]; 216| 780| vec256 f1i = f1[i]; 217| | 218| 780| f0i &= c0; 219| 780| f1i ^= c1; 220| 780| f1i &= f0i; 221| | 222| 780| f0[i] = f0i; 223| 780| f1[i] = f1i; 224| 780| } 225| 291|} poly_s3_inv.c:vec256_final: 170| 291|static void vec256_final(small *out, const vec256 *V0, const vec256 *V1) { 171| 291| int i; 172| 291| small v0[ppad]; 173| 291| small v1[ppad]; 174| 291| small v[ppad]; 175| 291| small vrev[ppad + (ppad - p)]; 176| | 177| 291| vec256_tobits(V0, v0); 178| 291| vec256_tobits(V1, v1); 179| | 180| 199k| for (i = 0; i < ppad; ++i) { ------------------ | | 8| 199k|#define ppad 512 ------------------ | Branch (180:17): [True: 199k, False: 291] ------------------ 181| 199k| v[i] = v0[i] + 2 * v1[i] - 4 * (v0[i] & v1[i]); 182| 199k| } 183| | 184| 199k| for (i = 0; i < ppad; ++i) { ------------------ | | 8| 199k|#define ppad 512 ------------------ | Branch (184:17): [True: 199k, False: 291] ------------------ 185| 199k| vrev[i] = v[ppad - 1 - i]; ------------------ | | 8| 199k|#define ppad 512 ------------------ 186| 199k| } 187| 20.8k| for (i = ppad; i < ppad + (ppad - p); ++i) { ------------------ | | 8| 291|#define ppad 512 ------------------ for (i = ppad; i < ppad + (ppad - p); ++i) { ------------------ | | 8| 20.8k|#define ppad 512 ------------------ for (i = ppad; i < ppad + (ppad - p); ++i) { ------------------ | | 8| 20.8k|#define ppad 512 ------------------ for (i = ppad; i < ppad + (ppad - p); ++i) { ------------------ | | 7| 20.8k|#define p 508 ------------------ | Branch (187:20): [True: 20.5k, False: 291] ------------------ 188| 20.5k| vrev[i] = 0; 189| 20.5k| } 190| | 191| 179k| for (i = 0; i < p; ++i) { ------------------ | | 7| 179k|#define p 508 ------------------ | Branch (191:17): [True: 179k, False: 291] ------------------ 192| 179k| out[i] = vrev[i + ppad - p]; ------------------ | | 8| 179k|#define ppad 512 ------------------ out[i] = vrev[i + ppad - p]; ------------------ | | 7| 179k|#define p 508 ------------------ 193| 179k| } 194| 291|} poly_s3_inv.c:vec256_tobits: 80| 582|static inline void vec256_tobits(const vec256 *v, small *b) { 81| 582| int i; 82| | 83| 2.14k| for (i = 0; i < numvec; ++i) { ------------------ | | 9| 2.14k|#define numvec 2 ------------------ | Branch (83:17): [True: 1.56k, False: 582] ------------------ 84| 1.56k| vec256 h = *v++; 85| | 86| 1.56k| h = _mm256_shuffle_epi32(h, 0xd8); 87| 1.56k| h = _mm256_permute4x64_epi64(h, 0xd8); 88| 1.56k| h = _mm256_shuffle_epi8(h, TRANSPOSE); ------------------ | | 71| 1.56k|#define TRANSPOSE _mm256_set_epi8( 31,27,23,19, 30,26,22,18, 29,25,21,17, 28,24,20,16, 15,11,7,3, 14,10,6,2, 13,9,5,1, 12,8,4,0 ) ------------------ 89| | 90| 1.56k| vec256 g0 = h & _mm256_set1_epi8(15); 91| 1.56k| vec256 g4 = _mm256_srli_epi32(h, 4) & _mm256_set1_epi8(15); 92| | 93| 1.56k| vec256 f0 = _mm256_permute2x128_si256(g0, g4, 0x20); 94| 1.56k| vec256 f4 = _mm256_permute2x128_si256(g0, g4, 0x31); 95| | 96| 1.56k| vec256 e0 = f0 & _mm256_set1_epi8(5); 97| 1.56k| vec256 e2 = _mm256_srli_epi32(f0, 1) & _mm256_set1_epi8(5); 98| 1.56k| vec256 e4 = f4 & _mm256_set1_epi8(5); 99| 1.56k| vec256 e6 = _mm256_srli_epi32(f4, 1) & _mm256_set1_epi8(5); 100| | 101| 1.56k| vec256 d0 = _mm256_unpacklo_epi32(e0, e2); 102| 1.56k| vec256 d2 = _mm256_unpackhi_epi32(e0, e2); 103| 1.56k| vec256 d4 = _mm256_unpacklo_epi32(e4, e6); 104| 1.56k| vec256 d6 = _mm256_unpackhi_epi32(e4, e6); 105| | 106| 1.56k| vec256 c0 = d0 & _mm256_set1_epi8(1); 107| 1.56k| vec256 c1 = _mm256_srli_epi32(d0, 2) & _mm256_set1_epi8(1); 108| 1.56k| vec256 c2 = d2 & _mm256_set1_epi8(1); 109| 1.56k| vec256 c3 = _mm256_srli_epi32(d2, 2) & _mm256_set1_epi8(1); 110| 1.56k| vec256 c4 = d4 & _mm256_set1_epi8(1); 111| 1.56k| vec256 c5 = _mm256_srli_epi32(d4, 2) & _mm256_set1_epi8(1); 112| 1.56k| vec256 c6 = d6 & _mm256_set1_epi8(1); 113| 1.56k| vec256 c7 = _mm256_srli_epi32(d6, 2) & _mm256_set1_epi8(1); 114| | 115| 1.56k| vec256 b0 = _mm256_unpacklo_epi64(c0, c1); 116| 1.56k| vec256 b1 = _mm256_unpackhi_epi64(c0, c1); 117| 1.56k| vec256 b2 = _mm256_unpacklo_epi64(c2, c3); 118| 1.56k| vec256 b3 = _mm256_unpackhi_epi64(c2, c3); 119| 1.56k| vec256 b4 = _mm256_unpacklo_epi64(c4, c5); 120| 1.56k| vec256 b5 = _mm256_unpackhi_epi64(c4, c5); 121| 1.56k| vec256 b6 = _mm256_unpacklo_epi64(c6, c7); 122| 1.56k| vec256 b7 = _mm256_unpackhi_epi64(c6, c7); 123| | 124| 1.56k| _mm256_storeu_si256((vec256 *) b, b0); 125| 1.56k| b += 32; 126| 1.56k| _mm256_storeu_si256((vec256 *) b, b1); 127| 1.56k| b += 32; 128| 1.56k| _mm256_storeu_si256((vec256 *) b, b2); 129| 1.56k| b += 32; 130| 1.56k| _mm256_storeu_si256((vec256 *) b, b3); 131| 1.56k| b += 32; 132| 1.56k| _mm256_storeu_si256((vec256 *) b, b4); 133| 1.56k| b += 32; 134| 1.56k| _mm256_storeu_si256((vec256 *) b, b5); 135| 1.56k| b += 32; 136| 1.56k| _mm256_storeu_si256((vec256 *) b, b6); 137| 1.56k| b += 32; 138| 1.56k| _mm256_storeu_si256((vec256 *) b, b7); 139| 1.56k| b += 32; 140| 1.56k| } 141| 582|} PQCLEAN_NTRUHPS2048509_AVX2_sample_fg: 3| 182|void PQCLEAN_NTRUHPS2048509_AVX2_sample_fg(poly *f, poly *g, const unsigned char uniformbytes[NTRU_SAMPLE_FG_BYTES]) { 4| | 5| 182| PQCLEAN_NTRUHPS2048509_AVX2_sample_iid(f, uniformbytes); 6| 182| PQCLEAN_NTRUHPS2048509_AVX2_sample_fixed_type(g, uniformbytes + NTRU_SAMPLE_IID_BYTES); ------------------ | | 20| 182|#define NTRU_SAMPLE_IID_BYTES (NTRU_N-1) | | ------------------ | | | | 5| 182|#define NTRU_N 509 | | ------------------ ------------------ 7| 182|} PQCLEAN_NTRUHPS2048509_AVX2_sample_rm: 9| 182|void PQCLEAN_NTRUHPS2048509_AVX2_sample_rm(poly *r, poly *m, const unsigned char uniformbytes[NTRU_SAMPLE_RM_BYTES]) { 10| | 11| 182| PQCLEAN_NTRUHPS2048509_AVX2_sample_iid(r, uniformbytes); 12| 182| PQCLEAN_NTRUHPS2048509_AVX2_sample_fixed_type(m, uniformbytes + NTRU_SAMPLE_IID_BYTES); ------------------ | | 20| 182|#define NTRU_SAMPLE_IID_BYTES (NTRU_N-1) | | ------------------ | | | | 5| 182|#define NTRU_N 509 | | ------------------ ------------------ 13| 182|} PQCLEAN_NTRUHPS2048509_AVX2_sample_fixed_type: 16| 364|void PQCLEAN_NTRUHPS2048509_AVX2_sample_fixed_type(poly *r, const unsigned char u[NTRU_SAMPLE_FT_BYTES]) { 17| | // Assumes NTRU_SAMPLE_FT_BYTES = ceil(30*(n-1)/8) 18| | 19| 364| int32_t s[NTRU_N - 1]; 20| 364| int i; 21| | 22| | // Use 30 bits of u per word 23| 46.5k| for (i = 0; i < (NTRU_N - 1) / 4; i++) { ------------------ | | 5| 46.5k|#define NTRU_N 509 ------------------ | Branch (23:17): [True: 46.2k, False: 364] ------------------ 24| 46.2k| s[4 * i + 0] = (u[15 * i + 0] << 2) + (u[15 * i + 1] << 10) + (u[15 * i + 2] << 18) + ((uint32_t) u[15 * i + 3] << 26); 25| 46.2k| s[4 * i + 1] = ((u[15 * i + 3] & 0xc0) >> 4) + (u[15 * i + 4] << 4) + (u[15 * i + 5] << 12) + (u[15 * i + 6] << 20) + ((uint32_t) u[15 * i + 7] << 28); 26| 46.2k| s[4 * i + 2] = ((u[15 * i + 7] & 0xf0) >> 2) + (u[15 * i + 8] << 6) + (u[15 * i + 9] << 14) + (u[15 * i + 10] << 22) + ((uint32_t) u[15 * i + 11] << 30); 27| 46.2k| s[4 * i + 3] = (u[15 * i + 11] & 0xfc) + (u[15 * i + 12] << 8) + (u[15 * i + 13] << 16) + ((uint32_t) u[15 * i + 14] << 24); 28| 46.2k| } 29| | 30| 46.5k| for (i = 0; i < NTRU_WEIGHT / 2; i++) { ------------------ | | 14| 46.5k|#define NTRU_WEIGHT (NTRU_Q/8 - 2) | | ------------------ | | | | 13| 46.5k|#define NTRU_Q (1 << NTRU_LOGQ) | | | | ------------------ | | | | | | 6| 46.5k|#define NTRU_LOGQ 11 | | | | ------------------ | | ------------------ ------------------ | Branch (30:17): [True: 46.2k, False: 364] ------------------ 31| 46.2k| s[i] |= 1; 32| 46.2k| } 33| | 34| 46.5k| for (i = NTRU_WEIGHT / 2; i < NTRU_WEIGHT; i++) { ------------------ | | 14| 364|#define NTRU_WEIGHT (NTRU_Q/8 - 2) | | ------------------ | | | | 13| 364|#define NTRU_Q (1 << NTRU_LOGQ) | | | | ------------------ | | | | | | 6| 364|#define NTRU_LOGQ 11 | | | | ------------------ | | ------------------ ------------------ for (i = NTRU_WEIGHT / 2; i < NTRU_WEIGHT; i++) { ------------------ | | 14| 46.5k|#define NTRU_WEIGHT (NTRU_Q/8 - 2) | | ------------------ | | | | 13| 46.5k|#define NTRU_Q (1 << NTRU_LOGQ) | | | | ------------------ | | | | | | 6| 46.5k|#define NTRU_LOGQ 11 | | | | ------------------ | | ------------------ ------------------ | Branch (34:31): [True: 46.2k, False: 364] ------------------ 35| 46.2k| s[i] |= 2; 36| 46.2k| } 37| | 38| 364| PQCLEAN_NTRUHPS2048509_AVX2_crypto_sort_int32(s, NTRU_N - 1); ------------------ | | 5| 364|#define NTRU_N 509 ------------------ 39| | 40| 185k| for (i = 0; i < NTRU_N - 1; i++) { ------------------ | | 5| 185k|#define NTRU_N 509 ------------------ | Branch (40:17): [True: 184k, False: 364] ------------------ 41| 184k| r->coeffs[i] = ((uint16_t) (s[i] & 3)); 42| 184k| } 43| | 44| 364| r->coeffs[NTRU_N - 1] = 0; ------------------ | | 5| 364|#define NTRU_N 509 ------------------ 45| 364|} PQCLEAN_NTRUHPS2048509_AVX2_sample_iid: 7| 364|void PQCLEAN_NTRUHPS2048509_AVX2_sample_iid(poly *r, const unsigned char uniformbytes[NTRU_SAMPLE_IID_BYTES]) { 8| 364| int i; 9| 364| union { /* align to 32 byte boundary for vmovdqa */ 10| 364| unsigned char b[PAD32(NTRU_SAMPLE_IID_BYTES)]; 11| 364| __m256i b_x32[PAD32(NTRU_SAMPLE_IID_BYTES) / 32]; 12| 364| } buffer; 13| | 14| 185k| for (i = 0; i < NTRU_SAMPLE_IID_BYTES; i++) { ------------------ | | 20| 185k|#define NTRU_SAMPLE_IID_BYTES (NTRU_N-1) | | ------------------ | | | | 5| 185k|#define NTRU_N 509 | | ------------------ ------------------ | Branch (14:17): [True: 184k, False: 364] ------------------ 15| 184k| buffer.b[i] = uniformbytes[i]; 16| 184k| } 17| 1.82k| for (i = NTRU_SAMPLE_IID_BYTES; i < PAD32(NTRU_SAMPLE_IID_BYTES); i++) { ------------------ | | 20| 364|#define NTRU_SAMPLE_IID_BYTES (NTRU_N-1) | | ------------------ | | | | 5| 364|#define NTRU_N 509 | | ------------------ ------------------ for (i = NTRU_SAMPLE_IID_BYTES; i < PAD32(NTRU_SAMPLE_IID_BYTES); i++) { ------------------ | | 11| 1.82k|#define PAD32(X) ((((X) + 31)/32)*32) ------------------ | Branch (17:37): [True: 1.45k, False: 364] ------------------ 18| 1.45k| buffer.b[i] = 0; 19| 1.45k| } 20| 364| PQCLEAN_NTRUHPS2048509_AVX2_vec32_sample_iid(r, buffer.b); 21| 364|} owcpa.c:owcpa_check_ciphertext: 5| 336|static int owcpa_check_ciphertext(const unsigned char *ciphertext) { 6| | /* A ciphertext is log2(q)*(n-1) bits packed into bytes. */ 7| | /* Check that any unused bits of the final byte are zero. */ 8| | 9| 336| uint16_t t = 0; 10| | 11| 336| t = ciphertext[NTRU_CIPHERTEXTBYTES - 1]; ------------------ | | 35| 336|#define NTRU_CIPHERTEXTBYTES (NTRU_OWCPA_BYTES) | | ------------------ | | | | 31| 336|#define NTRU_OWCPA_BYTES ((NTRU_LOGQ*NTRU_PACK_DEG+7)/8) | | | | ------------------ | | | | | | 6| 336|#define NTRU_LOGQ 11 | | | | ------------------ | | | | #define NTRU_OWCPA_BYTES ((NTRU_LOGQ*NTRU_PACK_DEG+7)/8) | | | | ------------------ | | | | | | 25| 336|#define NTRU_PACK_DEG (NTRU_N-1) | | | | | | ------------------ | | | | | | | | 5| 336|#define NTRU_N 509 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 12| 336| t &= 0xff << (8 - (7 & (NTRU_LOGQ * NTRU_PACK_DEG))); ------------------ | | 6| 336|#define NTRU_LOGQ 11 ------------------ t &= 0xff << (8 - (7 & (NTRU_LOGQ * NTRU_PACK_DEG))); ------------------ | | 25| 336|#define NTRU_PACK_DEG (NTRU_N-1) | | ------------------ | | | | 5| 336|#define NTRU_N 509 | | ------------------ ------------------ 13| | 14| | /* We have 0 <= t < 256 */ 15| | /* Return 0 on success (t=0), 1 on failure */ 16| 336| return (int) (1 & ((~t + 1) >> 15)); 17| 336|} owcpa.c:owcpa_check_m: 38| 327|static int owcpa_check_m(const poly *m) { 39| | /* Check that m is in message space, i.e. */ 40| | /* (1) |{i : m[i] = 1}| = |{i : m[i] = 2}|, and */ 41| | /* (2) |{i : m[i] != 0}| = NTRU_WEIGHT. */ 42| | /* Note: We may assume that m has coefficients in {0,1,2}. */ 43| | 44| 327| int i; 45| 327| uint32_t t = 0; 46| 327| uint16_t ps = 0; 47| 327| uint16_t ms = 0; 48| 227k| for (i = 0; i < NTRU_N; i++) { ------------------ | | 5| 227k|#define NTRU_N 509 ------------------ | Branch (48:17): [True: 226k, False: 327] ------------------ 49| 226k| ps += m->coeffs[i] & 1; 50| 226k| ms += m->coeffs[i] & 2; 51| 226k| } 52| 327| t |= ps ^ (ms >> 1); /* 0 if (1) holds */ 53| 327| t |= ms ^ NTRU_WEIGHT; /* 0 if (1) and (2) hold */ ------------------ | | 14| 327|#define NTRU_WEIGHT (NTRU_Q/8 - 2) | | ------------------ | | | | 13| 327|#define NTRU_Q (1 << NTRU_LOGQ) | | | | ------------------ | | | | | | 6| 327|#define NTRU_LOGQ 11 | | | | ------------------ | | ------------------ ------------------ 54| | 55| | /* We have 0 <= t < 2^16. */ 56| | /* Return 0 on success (t=0), 1 on failure */ 57| 327| return (int) (1 & ((~t + 1) >> 31)); 58| 327|} owcpa.c:owcpa_check_r: 19| 336|static int owcpa_check_r(const poly *r) { 20| | /* A valid r has coefficients in {0,1,q-1} and has r[N-1] = 0 */ 21| | /* Note: We may assume that 0 <= r[i] <= q-1 for all i */ 22| | 23| 336| int i; 24| 336| uint32_t t = 0; 25| 336| uint16_t c; 26| 235k| for (i = 0; i < NTRU_N - 1; i++) { ------------------ | | 5| 235k|#define NTRU_N 509 ------------------ | Branch (26:17): [True: 234k, False: 336] ------------------ 27| 234k| c = r->coeffs[i]; 28| 234k| t |= (c + 1) & (NTRU_Q - 4); /* 0 iff c is in {-1,0,1,2} */ ------------------ | | 13| 234k|#define NTRU_Q (1 << NTRU_LOGQ) | | ------------------ | | | | 6| 234k|#define NTRU_LOGQ 11 | | ------------------ ------------------ 29| 234k| t |= (c + 2) & 4; /* 1 if c = 2, 0 if c is in {-1,0,1} */ 30| 234k| } 31| 336| t |= r->coeffs[NTRU_N - 1]; /* Coefficient n-1 must be zero */ ------------------ | | 5| 336|#define NTRU_N 509 ------------------ 32| | 33| | /* We have 0 <= t < 2^16. */ 34| | /* Return 0 on success (t=0), 1 on failure */ 35| 336| return (int) (1 & ((~t + 1) >> 31)); 36| 336|} poly_mod.c:mod3: 3| 231k|static uint16_t mod3(uint16_t a) { 4| 231k| uint16_t r; 5| 231k| int16_t t, c; 6| | 7| 231k| r = (a >> 8) + (a & 0xff); // r mod 255 == a mod 255 8| 231k| r = (r >> 4) + (r & 0xf); // r' mod 15 == r mod 15 9| 231k| r = (r >> 2) + (r & 0x3); // r' mod 3 == r mod 3 10| 231k| r = (r >> 2) + (r & 0x3); // r' mod 3 == r mod 3 11| | 12| 231k| t = r - 3; 13| 231k| c = t >> 15; 14| | 15| 231k| return (c & r) ^ (~c & t); 16| 231k|} poly_r2_inv.c:both_negative_mask: 6| 111k|static inline int16_t both_negative_mask(int16_t x, int16_t y) { 7| 111k| return (x & y) >> 15; 8| 111k|} poly_rq_mul.c:toom4_k2x2_mul: 47| 714|static void toom4_k2x2_mul(uint16_t ab[2 * L], const uint16_t a[L], const uint16_t b[L]) { 48| 714| uint16_t tmpA[9 * K]; 49| 714| uint16_t tmpB[9 * K]; 50| 714| uint16_t eC[63 * 2 * K]; 51| | 52| 714| toom4_k2x2_eval_0(tmpA, a); 53| 714| toom4_k2x2_eval_0(tmpB, b); 54| 714| toom4_k2x2_basemul(eC + 0 * 9 * 2 * K, tmpA, tmpB); ------------------ | | 8| 714|#define K (L/16) | | ------------------ | | | | 6| 714|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 714|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 55| | 56| 714| toom4_k2x2_eval_p1(tmpA, a); 57| 714| toom4_k2x2_eval_p1(tmpB, b); 58| 714| toom4_k2x2_basemul(eC + 1 * 9 * 2 * K, tmpA, tmpB); ------------------ | | 8| 714|#define K (L/16) | | ------------------ | | | | 6| 714|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 714|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 59| | 60| 714| toom4_k2x2_eval_m1(tmpA, a); 61| 714| toom4_k2x2_eval_m1(tmpB, b); 62| 714| toom4_k2x2_basemul(eC + 2 * 9 * 2 * K, tmpA, tmpB); ------------------ | | 8| 714|#define K (L/16) | | ------------------ | | | | 6| 714|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 714|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 63| | 64| 714| toom4_k2x2_eval_p2(tmpA, a); 65| 714| toom4_k2x2_eval_p2(tmpB, b); 66| 714| toom4_k2x2_basemul(eC + 3 * 9 * 2 * K, tmpA, tmpB); ------------------ | | 8| 714|#define K (L/16) | | ------------------ | | | | 6| 714|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 714|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 67| | 68| 714| toom4_k2x2_eval_m2(tmpA, a); 69| 714| toom4_k2x2_eval_m2(tmpB, b); 70| 714| toom4_k2x2_basemul(eC + 4 * 9 * 2 * K, tmpA, tmpB); ------------------ | | 8| 714|#define K (L/16) | | ------------------ | | | | 6| 714|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 714|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 71| | 72| 714| toom4_k2x2_eval_p3(tmpA, a); 73| 714| toom4_k2x2_eval_p3(tmpB, b); 74| 714| toom4_k2x2_basemul(eC + 5 * 9 * 2 * K, tmpA, tmpB); ------------------ | | 8| 714|#define K (L/16) | | ------------------ | | | | 6| 714|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 714|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 75| | 76| 714| toom4_k2x2_eval_inf(tmpA, a); 77| 714| toom4_k2x2_eval_inf(tmpB, b); 78| 714| toom4_k2x2_basemul(eC + 6 * 9 * 2 * K, tmpA, tmpB); ------------------ | | 8| 714|#define K (L/16) | | ------------------ | | | | 6| 714|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 714|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 79| | 80| 714| toom4_k2x2_interpolate(ab, eC); 81| 714|} poly_rq_mul.c:toom4_k2x2_eval_0: 84| 1.42k|static void toom4_k2x2_eval_0(uint16_t r[9 * K], const uint16_t a[L]) { 85| 446k| for (size_t i = 0; i < M; i++) { ------------------ | | 7| 446k|#define M (L/4) | | ------------------ | | | | 6| 446k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 446k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ | Branch (85:24): [True: 445k, False: 1.42k] ------------------ 86| 445k| r[i] = a[i]; 87| 445k| } 88| 1.42k| k2x2_eval(r); 89| 1.42k|} poly_rq_mul.c:k2x2_eval: 148| 10.9k|static inline void k2x2_eval(uint16_t r[9 * K]) { 149| | /* Input: e + f.Y + g.Y^2 + h.Y^3 */ 150| | /* Output: [ e | f | g | h | e+f | f+h | g+e | h+g | e+f+g+h ] */ 151| | 152| 10.9k| size_t i; 153| 3.44M| for (i = 0; i < 4 * K; i++) { ------------------ | | 8| 3.44M|#define K (L/16) | | ------------------ | | | | 6| 3.44M|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 3.44M|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ | Branch (153:17): [True: 3.43M, False: 10.9k] ------------------ 154| 3.43M| r[4 * K + i] = r[i]; ------------------ | | 8| 3.43M|#define K (L/16) | | ------------------ | | | | 6| 3.43M|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 3.43M|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 155| 3.43M| } 156| 869k| for (i = 0; i < K; i++) { ------------------ | | 8| 869k|#define K (L/16) | | ------------------ | | | | 6| 869k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 869k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ | Branch (156:17): [True: 858k, False: 10.9k] ------------------ 157| 858k| r[4 * K + i] += r[1 * K + i]; ------------------ | | 8| 858k|#define K (L/16) | | ------------------ | | | | 6| 858k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 858k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ r[4 * K + i] += r[1 * K + i]; ------------------ | | 8| 858k|#define K (L/16) | | ------------------ | | | | 6| 858k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 858k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 158| 858k| r[5 * K + i] += r[3 * K + i]; ------------------ | | 8| 858k|#define K (L/16) | | ------------------ | | | | 6| 858k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 858k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ r[5 * K + i] += r[3 * K + i]; ------------------ | | 8| 858k|#define K (L/16) | | ------------------ | | | | 6| 858k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 858k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 159| 858k| r[6 * K + i] += r[0 * K + i]; ------------------ | | 8| 858k|#define K (L/16) | | ------------------ | | | | 6| 858k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 858k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ r[6 * K + i] += r[0 * K + i]; ------------------ | | 8| 858k|#define K (L/16) | | ------------------ | | | | 6| 858k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 858k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 160| 858k| r[7 * K + i] += r[2 * K + i]; ------------------ | | 8| 858k|#define K (L/16) | | ------------------ | | | | 6| 858k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 858k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ r[7 * K + i] += r[2 * K + i]; ------------------ | | 8| 858k|#define K (L/16) | | ------------------ | | | | 6| 858k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 858k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 161| 858k| r[8 * K + i] = r[5 * K + i]; ------------------ | | 8| 858k|#define K (L/16) | | ------------------ | | | | 6| 858k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 858k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ r[8 * K + i] = r[5 * K + i]; ------------------ | | 8| 858k|#define K (L/16) | | ------------------ | | | | 6| 858k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 858k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 162| 858k| r[8 * K + i] += r[6 * K + i]; ------------------ | | 8| 858k|#define K (L/16) | | ------------------ | | | | 6| 858k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 858k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ r[8 * K + i] += r[6 * K + i]; ------------------ | | 8| 858k|#define K (L/16) | | ------------------ | | | | 6| 858k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 858k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 163| 858k| } 164| 10.9k|} poly_rq_mul.c:toom4_k2x2_basemul: 166| 4.99k|static void toom4_k2x2_basemul(uint16_t r[18 * K], const uint16_t a[9 * K], const uint16_t b[9 * K]) { 167| 4.99k| schoolbook_KxK(r + 0 * 2 * K, a + 0 * K, b + 0 * K); ------------------ | | 8| 4.99k|#define K (L/16) | | ------------------ | | | | 6| 4.99k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 4.99k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ schoolbook_KxK(r + 0 * 2 * K, a + 0 * K, b + 0 * K); ------------------ | | 8| 4.99k|#define K (L/16) | | ------------------ | | | | 6| 4.99k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 4.99k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ schoolbook_KxK(r + 0 * 2 * K, a + 0 * K, b + 0 * K); ------------------ | | 8| 4.99k|#define K (L/16) | | ------------------ | | | | 6| 4.99k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 4.99k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 168| 4.99k| schoolbook_KxK(r + 1 * 2 * K, a + 1 * K, b + 1 * K); ------------------ | | 8| 4.99k|#define K (L/16) | | ------------------ | | | | 6| 4.99k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 4.99k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ schoolbook_KxK(r + 1 * 2 * K, a + 1 * K, b + 1 * K); ------------------ | | 8| 4.99k|#define K (L/16) | | ------------------ | | | | 6| 4.99k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 4.99k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ schoolbook_KxK(r + 1 * 2 * K, a + 1 * K, b + 1 * K); ------------------ | | 8| 4.99k|#define K (L/16) | | ------------------ | | | | 6| 4.99k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 4.99k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 169| 4.99k| schoolbook_KxK(r + 2 * 2 * K, a + 2 * K, b + 2 * K); ------------------ | | 8| 4.99k|#define K (L/16) | | ------------------ | | | | 6| 4.99k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 4.99k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ schoolbook_KxK(r + 2 * 2 * K, a + 2 * K, b + 2 * K); ------------------ | | 8| 4.99k|#define K (L/16) | | ------------------ | | | | 6| 4.99k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 4.99k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ schoolbook_KxK(r + 2 * 2 * K, a + 2 * K, b + 2 * K); ------------------ | | 8| 4.99k|#define K (L/16) | | ------------------ | | | | 6| 4.99k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 4.99k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 170| 4.99k| schoolbook_KxK(r + 3 * 2 * K, a + 3 * K, b + 3 * K); ------------------ | | 8| 4.99k|#define K (L/16) | | ------------------ | | | | 6| 4.99k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 4.99k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ schoolbook_KxK(r + 3 * 2 * K, a + 3 * K, b + 3 * K); ------------------ | | 8| 4.99k|#define K (L/16) | | ------------------ | | | | 6| 4.99k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 4.99k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ schoolbook_KxK(r + 3 * 2 * K, a + 3 * K, b + 3 * K); ------------------ | | 8| 4.99k|#define K (L/16) | | ------------------ | | | | 6| 4.99k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 4.99k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 171| 4.99k| schoolbook_KxK(r + 4 * 2 * K, a + 4 * K, b + 4 * K); ------------------ | | 8| 4.99k|#define K (L/16) | | ------------------ | | | | 6| 4.99k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 4.99k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ schoolbook_KxK(r + 4 * 2 * K, a + 4 * K, b + 4 * K); ------------------ | | 8| 4.99k|#define K (L/16) | | ------------------ | | | | 6| 4.99k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 4.99k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ schoolbook_KxK(r + 4 * 2 * K, a + 4 * K, b + 4 * K); ------------------ | | 8| 4.99k|#define K (L/16) | | ------------------ | | | | 6| 4.99k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 4.99k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 172| 4.99k| schoolbook_KxK(r + 5 * 2 * K, a + 5 * K, b + 5 * K); ------------------ | | 8| 4.99k|#define K (L/16) | | ------------------ | | | | 6| 4.99k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 4.99k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ schoolbook_KxK(r + 5 * 2 * K, a + 5 * K, b + 5 * K); ------------------ | | 8| 4.99k|#define K (L/16) | | ------------------ | | | | 6| 4.99k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 4.99k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ schoolbook_KxK(r + 5 * 2 * K, a + 5 * K, b + 5 * K); ------------------ | | 8| 4.99k|#define K (L/16) | | ------------------ | | | | 6| 4.99k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 4.99k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 173| 4.99k| schoolbook_KxK(r + 6 * 2 * K, a + 6 * K, b + 6 * K); ------------------ | | 8| 4.99k|#define K (L/16) | | ------------------ | | | | 6| 4.99k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 4.99k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ schoolbook_KxK(r + 6 * 2 * K, a + 6 * K, b + 6 * K); ------------------ | | 8| 4.99k|#define K (L/16) | | ------------------ | | | | 6| 4.99k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 4.99k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ schoolbook_KxK(r + 6 * 2 * K, a + 6 * K, b + 6 * K); ------------------ | | 8| 4.99k|#define K (L/16) | | ------------------ | | | | 6| 4.99k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 4.99k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 174| 4.99k| schoolbook_KxK(r + 7 * 2 * K, a + 7 * K, b + 7 * K); ------------------ | | 8| 4.99k|#define K (L/16) | | ------------------ | | | | 6| 4.99k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 4.99k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ schoolbook_KxK(r + 7 * 2 * K, a + 7 * K, b + 7 * K); ------------------ | | 8| 4.99k|#define K (L/16) | | ------------------ | | | | 6| 4.99k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 4.99k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ schoolbook_KxK(r + 7 * 2 * K, a + 7 * K, b + 7 * K); ------------------ | | 8| 4.99k|#define K (L/16) | | ------------------ | | | | 6| 4.99k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 4.99k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 175| 4.99k| schoolbook_KxK(r + 8 * 2 * K, a + 8 * K, b + 8 * K); ------------------ | | 8| 4.99k|#define K (L/16) | | ------------------ | | | | 6| 4.99k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 4.99k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ schoolbook_KxK(r + 8 * 2 * K, a + 8 * K, b + 8 * K); ------------------ | | 8| 4.99k|#define K (L/16) | | ------------------ | | | | 6| 4.99k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 4.99k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ schoolbook_KxK(r + 8 * 2 * K, a + 8 * K, b + 8 * K); ------------------ | | 8| 4.99k|#define K (L/16) | | ------------------ | | | | 6| 4.99k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 4.99k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 176| 4.99k|} poly_rq_mul.c:schoolbook_KxK: 178| 49.1k|static inline void schoolbook_KxK(uint16_t r[2 * K], const uint16_t a[K], const uint16_t b[K]) { 179| 49.1k| size_t i, j; 180| 3.91M| for (j = 0; j < K; j++) { ------------------ | | 8| 3.91M|#define K (L/16) | | ------------------ | | | | 6| 3.91M|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 3.91M|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ | Branch (180:17): [True: 3.86M, False: 49.1k] ------------------ 181| 3.86M| r[j] = a[0] * (uint32_t)b[j]; 182| 3.86M| } 183| 3.86M| for (i = 1; i < K; i++) { ------------------ | | 8| 3.86M|#define K (L/16) | | ------------------ | | | | 6| 3.86M|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 3.86M|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ | Branch (183:17): [True: 3.81M, False: 49.1k] ------------------ 184| 300M| for (j = 0; j < K - 1; j++) { ------------------ | | 8| 300M|#define K (L/16) | | ------------------ | | | | 6| 300M|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 300M|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ | Branch (184:21): [True: 296M, False: 3.81M] ------------------ 185| 296M| r[i + j] += a[i] * (uint32_t)b[j]; 186| 296M| } 187| 3.81M| r[i + K - 1] = a[i] * (uint32_t)b[K - 1]; ------------------ | | 8| 3.81M|#define K (L/16) | | ------------------ | | | | 6| 3.81M|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 3.81M|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ r[i + K - 1] = a[i] * (uint32_t)b[K - 1]; ------------------ | | 8| 3.81M|#define K (L/16) | | ------------------ | | | | 6| 3.81M|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 3.81M|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 188| 3.81M| } 189| 49.1k| r[2 * K - 1] = 0; ------------------ | | 8| 49.1k|#define K (L/16) | | ------------------ | | | | 6| 49.1k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 49.1k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 190| 49.1k|} poly_rq_mul.c:toom4_k2x2_eval_p1: 91| 1.42k|static void toom4_k2x2_eval_p1(uint16_t r[9 * K], const uint16_t a[L]) { 92| 446k| for (size_t i = 0; i < M; i++) { ------------------ | | 7| 446k|#define M (L/4) | | ------------------ | | | | 6| 446k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 446k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ | Branch (92:24): [True: 445k, False: 1.42k] ------------------ 93| 445k| r[i] = a[0 * M + i]; ------------------ | | 7| 445k|#define M (L/4) | | ------------------ | | | | 6| 445k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 445k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 94| 445k| r[i] += a[1 * M + i]; ------------------ | | 7| 445k|#define M (L/4) | | ------------------ | | | | 6| 445k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 445k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 95| 445k| r[i] += a[2 * M + i]; ------------------ | | 7| 445k|#define M (L/4) | | ------------------ | | | | 6| 445k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 445k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 96| 445k| r[i] += a[3 * M + i]; ------------------ | | 7| 445k|#define M (L/4) | | ------------------ | | | | 6| 445k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 445k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 97| 445k| } 98| 1.42k| k2x2_eval(r); 99| 1.42k|} poly_rq_mul.c:toom4_k2x2_eval_m1: 101| 1.42k|static void toom4_k2x2_eval_m1(uint16_t r[9 * K], const uint16_t a[L]) { 102| 446k| for (size_t i = 0; i < M; i++) { ------------------ | | 7| 446k|#define M (L/4) | | ------------------ | | | | 6| 446k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 446k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ | Branch (102:24): [True: 445k, False: 1.42k] ------------------ 103| 445k| r[i] = a[0 * M + i]; ------------------ | | 7| 445k|#define M (L/4) | | ------------------ | | | | 6| 445k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 445k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 104| 445k| r[i] -= a[1 * M + i]; ------------------ | | 7| 445k|#define M (L/4) | | ------------------ | | | | 6| 445k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 445k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 105| 445k| r[i] += a[2 * M + i]; ------------------ | | 7| 445k|#define M (L/4) | | ------------------ | | | | 6| 445k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 445k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 106| 445k| r[i] -= a[3 * M + i]; ------------------ | | 7| 445k|#define M (L/4) | | ------------------ | | | | 6| 445k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 445k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 107| 445k| } 108| 1.42k| k2x2_eval(r); 109| 1.42k|} poly_rq_mul.c:toom4_k2x2_eval_p2: 111| 1.42k|static void toom4_k2x2_eval_p2(uint16_t r[9 * K], const uint16_t a[L]) { 112| 446k| for (size_t i = 0; i < M; i++) { ------------------ | | 7| 446k|#define M (L/4) | | ------------------ | | | | 6| 446k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 446k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ | Branch (112:24): [True: 445k, False: 1.42k] ------------------ 113| 445k| r[i] = a[0 * M + i]; ------------------ | | 7| 445k|#define M (L/4) | | ------------------ | | | | 6| 445k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 445k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 114| 445k| r[i] += 2 * a[1 * M + i]; ------------------ | | 7| 445k|#define M (L/4) | | ------------------ | | | | 6| 445k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 445k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 115| 445k| r[i] += 4 * a[2 * M + i]; ------------------ | | 7| 445k|#define M (L/4) | | ------------------ | | | | 6| 445k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 445k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 116| 445k| r[i] += 8 * a[3 * M + i]; ------------------ | | 7| 445k|#define M (L/4) | | ------------------ | | | | 6| 445k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 445k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 117| 445k| } 118| 1.42k| k2x2_eval(r); 119| 1.42k|} poly_rq_mul.c:toom4_k2x2_eval_m2: 121| 1.42k|static void toom4_k2x2_eval_m2(uint16_t r[9 * K], const uint16_t a[L]) { 122| 446k| for (size_t i = 0; i < M; i++) { ------------------ | | 7| 446k|#define M (L/4) | | ------------------ | | | | 6| 446k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 446k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ | Branch (122:24): [True: 445k, False: 1.42k] ------------------ 123| 445k| r[i] = a[0 * M + i]; ------------------ | | 7| 445k|#define M (L/4) | | ------------------ | | | | 6| 445k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 445k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 124| 445k| r[i] -= 2 * a[1 * M + i]; ------------------ | | 7| 445k|#define M (L/4) | | ------------------ | | | | 6| 445k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 445k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 125| 445k| r[i] += 4 * a[2 * M + i]; ------------------ | | 7| 445k|#define M (L/4) | | ------------------ | | | | 6| 445k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 445k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 126| 445k| r[i] -= 8 * a[3 * M + i]; ------------------ | | 7| 445k|#define M (L/4) | | ------------------ | | | | 6| 445k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 445k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 127| 445k| } 128| 1.42k| k2x2_eval(r); 129| 1.42k|} poly_rq_mul.c:toom4_k2x2_eval_p3: 131| 1.42k|static void toom4_k2x2_eval_p3(uint16_t r[9 * K], const uint16_t a[L]) { 132| 446k| for (size_t i = 0; i < M; i++) { ------------------ | | 7| 446k|#define M (L/4) | | ------------------ | | | | 6| 446k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 446k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ | Branch (132:24): [True: 445k, False: 1.42k] ------------------ 133| 445k| r[i] = a[0 * M + i]; ------------------ | | 7| 445k|#define M (L/4) | | ------------------ | | | | 6| 445k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 445k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 134| 445k| r[i] += 3 * a[1 * M + i]; ------------------ | | 7| 445k|#define M (L/4) | | ------------------ | | | | 6| 445k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 445k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 135| 445k| r[i] += 9 * a[2 * M + i]; ------------------ | | 7| 445k|#define M (L/4) | | ------------------ | | | | 6| 445k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 445k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 136| 445k| r[i] += 27 * a[3 * M + i]; ------------------ | | 7| 445k|#define M (L/4) | | ------------------ | | | | 6| 445k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 445k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 137| 445k| } 138| 1.42k| k2x2_eval(r); 139| 1.42k|} poly_rq_mul.c:toom4_k2x2_eval_inf: 141| 1.42k|static void toom4_k2x2_eval_inf(uint16_t r[9 * K], const uint16_t a[L]) { 142| 446k| for (size_t i = 0; i < M; i++) { ------------------ | | 7| 446k|#define M (L/4) | | ------------------ | | | | 6| 446k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 446k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ | Branch (142:24): [True: 445k, False: 1.42k] ------------------ 143| 445k| r[i] = a[3 * M + i]; ------------------ | | 7| 445k|#define M (L/4) | | ------------------ | | | | 6| 445k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 445k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 144| 445k| } 145| 1.42k| k2x2_eval(r); 146| 1.42k|} poly_rq_mul.c:toom4_k2x2_interpolate: 192| 714|static void toom4_k2x2_interpolate(uint16_t r[2 * L], const uint16_t a[7 * 18 * K]) { 193| 714| size_t i; 194| | 195| 714| uint16_t P1[2 * M]; 196| 714| uint16_t Pm1[2 * M]; 197| 714| uint16_t P2[2 * M]; 198| 714| uint16_t Pm2[2 * M]; 199| | 200| 714| uint16_t *C0 = r; 201| 714| uint16_t *C2 = r + 2 * M; ------------------ | | 7| 714|#define M (L/4) | | ------------------ | | | | 6| 714|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 714|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 202| 714| uint16_t *C4 = r + 4 * M; ------------------ | | 7| 714|#define M (L/4) | | ------------------ | | | | 6| 714|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 714|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 203| 714| uint16_t *C6 = r + 6 * M; ------------------ | | 7| 714|#define M (L/4) | | ------------------ | | | | 6| 714|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 714|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 204| | 205| 714| uint16_t V0, V1, V2; 206| | 207| 714| k2x2_interpolate(C0, a + 0 * 9 * 2 * K); ------------------ | | 8| 714|#define K (L/16) | | ------------------ | | | | 6| 714|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 714|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 208| 714| k2x2_interpolate(P1, a + 1 * 9 * 2 * K); ------------------ | | 8| 714|#define K (L/16) | | ------------------ | | | | 6| 714|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 714|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 209| 714| k2x2_interpolate(Pm1, a + 2 * 9 * 2 * K); ------------------ | | 8| 714|#define K (L/16) | | ------------------ | | | | 6| 714|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 714|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 210| 714| k2x2_interpolate(P2, a + 3 * 9 * 2 * K); ------------------ | | 8| 714|#define K (L/16) | | ------------------ | | | | 6| 714|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 714|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 211| 714| k2x2_interpolate(Pm2, a + 4 * 9 * 2 * K); ------------------ | | 8| 714|#define K (L/16) | | ------------------ | | | | 6| 714|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 714|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 212| 714| k2x2_interpolate(C6, a + 6 * 9 * 2 * K); ------------------ | | 8| 714|#define K (L/16) | | ------------------ | | | | 6| 714|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 714|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 213| | 214| 446k| for (i = 0; i < 2 * M; i++) { ------------------ | | 7| 446k|#define M (L/4) | | ------------------ | | | | 6| 446k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 446k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ | Branch (214:17): [True: 445k, False: 714] ------------------ 215| 445k| V0 = ((uint32_t)(P1[i] + Pm1[i])) >> 1; 216| 445k| V0 = V0 - C0[i] - C6[i]; 217| 445k| V1 = ((uint32_t)(P2[i] + Pm2[i] - 2 * C0[i] - 128 * C6[i])) >> 3; 218| 445k| C4[i] = 43691 * (uint32_t)(V1 - V0); 219| 445k| C2[i] = V0 - C4[i]; 220| 445k| P1[i] = ((uint32_t)(P1[i] - Pm1[i])) >> 1; 221| 445k| } 222| | 223| | /* reuse Pm1 for P3 */ 224| 714|#define P3 Pm1 225| 714| k2x2_interpolate(P3, a + 5 * 9 * 2 * K); ------------------ | | 224| 714|#define P3 Pm1 ------------------ k2x2_interpolate(P3, a + 5 * 9 * 2 * K); ------------------ | | 8| 714|#define K (L/16) | | ------------------ | | | | 6| 714|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 714|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 226| | 227| 446k| for (i = 0; i < 2 * M; i++) { ------------------ | | 7| 446k|#define M (L/4) | | ------------------ | | | | 6| 446k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 446k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ | Branch (227:17): [True: 445k, False: 714] ------------------ 228| 445k| V0 = P1[i]; 229| 445k| V1 = 43691 * (((uint32_t)(P2[i] - Pm2[i]) >> 2) - V0); 230| 445k| V2 = 43691 * (uint32_t)(P3[i] - C0[i] - 9 * (C2[i] + 9 * (C4[i] + 9 * C6[i]))); ------------------ | | 224| 445k|#define P3 Pm1 ------------------ 231| 445k| V2 = ((uint32_t)(V2 - V0)) >> 3; 232| 445k| V2 -= V1; 233| 445k| P3[i] = 52429 * (uint32_t)V2; ------------------ | | 224| 445k|#define P3 Pm1 ------------------ 234| 445k| P2[i] = V1 - V2; 235| 445k| P1[i] = V0 - P2[i] - P3[i]; ------------------ | | 224| 445k|#define P3 Pm1 ------------------ 236| 445k| } 237| | 238| 446k| for (i = 0; i < 2 * M; i++) { ------------------ | | 7| 446k|#define M (L/4) | | ------------------ | | | | 6| 446k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 446k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ | Branch (238:17): [True: 445k, False: 714] ------------------ 239| 445k| r[1 * M + i] += P1[i]; ------------------ | | 7| 445k|#define M (L/4) | | ------------------ | | | | 6| 445k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 445k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 240| 445k| r[3 * M + i] += P2[i]; ------------------ | | 7| 445k|#define M (L/4) | | ------------------ | | | | 6| 445k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 445k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 241| 445k| r[5 * M + i] += P3[i]; ------------------ | | 7| 445k|#define M (L/4) | | ------------------ | | | | 6| 445k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 445k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ r[5 * M + i] += P3[i]; ------------------ | | 224| 445k|#define P3 Pm1 ------------------ 242| 445k| } 243| 714|} poly_rq_mul.c:k2x2_interpolate: 245| 5.45k|static inline void k2x2_interpolate(uint16_t r[2 * M], const uint16_t a[18 * K]) { 246| 5.45k| size_t i; 247| 5.45k| uint16_t tmp[4 * K]; 248| | 249| 864k| for (i = 0; i < 2 * K; i++) { ------------------ | | 8| 864k|#define K (L/16) | | ------------------ | | | | 6| 864k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 864k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ | Branch (249:17): [True: 858k, False: 5.45k] ------------------ 250| 858k| r[0 * K + i] = a[0 * K + i]; ------------------ | | 8| 858k|#define K (L/16) | | ------------------ | | | | 6| 858k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 858k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ r[0 * K + i] = a[0 * K + i]; ------------------ | | 8| 858k|#define K (L/16) | | ------------------ | | | | 6| 858k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 858k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 251| 858k| r[2 * K + i] = a[2 * K + i]; ------------------ | | 8| 858k|#define K (L/16) | | ------------------ | | | | 6| 858k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 858k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ r[2 * K + i] = a[2 * K + i]; ------------------ | | 8| 858k|#define K (L/16) | | ------------------ | | | | 6| 858k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 858k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 252| 858k| } 253| | 254| 864k| for (i = 0; i < 2 * K; i++) { ------------------ | | 8| 864k|#define K (L/16) | | ------------------ | | | | 6| 864k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 864k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ | Branch (254:17): [True: 858k, False: 5.45k] ------------------ 255| 858k| r[1 * K + i] += a[8 * K + i] - a[0 * K + i] - a[2 * K + i]; ------------------ | | 8| 858k|#define K (L/16) | | ------------------ | | | | 6| 858k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 858k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ r[1 * K + i] += a[8 * K + i] - a[0 * K + i] - a[2 * K + i]; ------------------ | | 8| 858k|#define K (L/16) | | ------------------ | | | | 6| 858k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 858k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ r[1 * K + i] += a[8 * K + i] - a[0 * K + i] - a[2 * K + i]; ------------------ | | 8| 858k|#define K (L/16) | | ------------------ | | | | 6| 858k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 858k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ r[1 * K + i] += a[8 * K + i] - a[0 * K + i] - a[2 * K + i]; ------------------ | | 8| 858k|#define K (L/16) | | ------------------ | | | | 6| 858k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 858k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 256| 858k| } 257| | 258| 864k| for (i = 0; i < 2 * K; i++) { ------------------ | | 8| 864k|#define K (L/16) | | ------------------ | | | | 6| 864k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 864k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ | Branch (258:17): [True: 858k, False: 5.45k] ------------------ 259| 858k| r[4 * K + i] = a[4 * K + i]; ------------------ | | 8| 858k|#define K (L/16) | | ------------------ | | | | 6| 858k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 858k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ r[4 * K + i] = a[4 * K + i]; ------------------ | | 8| 858k|#define K (L/16) | | ------------------ | | | | 6| 858k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 858k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 260| 858k| r[6 * K + i] = a[6 * K + i]; ------------------ | | 8| 858k|#define K (L/16) | | ------------------ | | | | 6| 858k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 858k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ r[6 * K + i] = a[6 * K + i]; ------------------ | | 8| 858k|#define K (L/16) | | ------------------ | | | | 6| 858k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 858k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 261| 858k| } 262| | 263| 864k| for (i = 0; i < 2 * K; i++) { ------------------ | | 8| 864k|#define K (L/16) | | ------------------ | | | | 6| 864k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 864k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ | Branch (263:17): [True: 858k, False: 5.45k] ------------------ 264| 858k| r[5 * K + i] += a[14 * K + i] - a[4 * K + i] - a[6 * K + i]; ------------------ | | 8| 858k|#define K (L/16) | | ------------------ | | | | 6| 858k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 858k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ r[5 * K + i] += a[14 * K + i] - a[4 * K + i] - a[6 * K + i]; ------------------ | | 8| 858k|#define K (L/16) | | ------------------ | | | | 6| 858k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 858k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ r[5 * K + i] += a[14 * K + i] - a[4 * K + i] - a[6 * K + i]; ------------------ | | 8| 858k|#define K (L/16) | | ------------------ | | | | 6| 858k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 858k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ r[5 * K + i] += a[14 * K + i] - a[4 * K + i] - a[6 * K + i]; ------------------ | | 8| 858k|#define K (L/16) | | ------------------ | | | | 6| 858k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 858k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 265| 858k| } 266| | 267| 864k| for (i = 0; i < 2 * K; i++) { ------------------ | | 8| 864k|#define K (L/16) | | ------------------ | | | | 6| 864k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 864k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ | Branch (267:17): [True: 858k, False: 5.45k] ------------------ 268| 858k| tmp[0 * K + i] = a[12 * K + i]; ------------------ | | 8| 858k|#define K (L/16) | | ------------------ | | | | 6| 858k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 858k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ tmp[0 * K + i] = a[12 * K + i]; ------------------ | | 8| 858k|#define K (L/16) | | ------------------ | | | | 6| 858k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 858k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 269| 858k| tmp[2 * K + i] = a[10 * K + i]; ------------------ | | 8| 858k|#define K (L/16) | | ------------------ | | | | 6| 858k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 858k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ tmp[2 * K + i] = a[10 * K + i]; ------------------ | | 8| 858k|#define K (L/16) | | ------------------ | | | | 6| 858k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 858k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 270| 858k| } 271| | 272| 864k| for (i = 0; i < 2 * K; i++) { ------------------ | | 8| 864k|#define K (L/16) | | ------------------ | | | | 6| 864k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 864k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ | Branch (272:17): [True: 858k, False: 5.45k] ------------------ 273| 858k| tmp[K + i] += a[16 * K + i] - a[12 * K + i] - a[10 * K + i]; ------------------ | | 8| 858k|#define K (L/16) | | ------------------ | | | | 6| 858k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 858k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ tmp[K + i] += a[16 * K + i] - a[12 * K + i] - a[10 * K + i]; ------------------ | | 8| 858k|#define K (L/16) | | ------------------ | | | | 6| 858k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 858k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ tmp[K + i] += a[16 * K + i] - a[12 * K + i] - a[10 * K + i]; ------------------ | | 8| 858k|#define K (L/16) | | ------------------ | | | | 6| 858k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 858k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ tmp[K + i] += a[16 * K + i] - a[12 * K + i] - a[10 * K + i]; ------------------ | | 8| 858k|#define K (L/16) | | ------------------ | | | | 6| 858k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 858k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 274| 858k| } 275| | 276| 1.72M| for (i = 0; i < 4 * K; i++) { ------------------ | | 8| 1.72M|#define K (L/16) | | ------------------ | | | | 6| 1.72M|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 1.72M|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ | Branch (276:17): [True: 1.71M, False: 5.45k] ------------------ 277| 1.71M| tmp[0 * K + i] = tmp[0 * K + i] - r[0 * K + i] - r[4 * K + i]; ------------------ | | 8| 1.71M|#define K (L/16) | | ------------------ | | | | 6| 1.71M|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 1.71M|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ tmp[0 * K + i] = tmp[0 * K + i] - r[0 * K + i] - r[4 * K + i]; ------------------ | | 8| 1.71M|#define K (L/16) | | ------------------ | | | | 6| 1.71M|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 1.71M|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ tmp[0 * K + i] = tmp[0 * K + i] - r[0 * K + i] - r[4 * K + i]; ------------------ | | 8| 1.71M|#define K (L/16) | | ------------------ | | | | 6| 1.71M|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 1.71M|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ tmp[0 * K + i] = tmp[0 * K + i] - r[0 * K + i] - r[4 * K + i]; ------------------ | | 8| 1.71M|#define K (L/16) | | ------------------ | | | | 6| 1.71M|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 1.71M|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 278| 1.71M| } 279| | 280| 1.72M| for (i = 0; i < 4 * K; i++) { ------------------ | | 8| 1.72M|#define K (L/16) | | ------------------ | | | | 6| 1.72M|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 1.72M|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ | Branch (280:17): [True: 1.71M, False: 5.45k] ------------------ 281| 1.71M| r[2 * K + i] += tmp[0 * K + i]; ------------------ | | 8| 1.71M|#define K (L/16) | | ------------------ | | | | 6| 1.71M|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 1.71M|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ r[2 * K + i] += tmp[0 * K + i]; ------------------ | | 8| 1.71M|#define K (L/16) | | ------------------ | | | | 6| 1.71M|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 1.71M|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 282| 1.71M| } 283| 5.45k|} poly_s3_inv.c:mod3: 5| 276M|static inline uint8_t mod3(uint8_t a) { /* a between 0 and 9 */ 6| 276M| int16_t t, c; 7| 276M| a = (a >> 2) + (a & 3); /* between 0 and 4 */ 8| 276M| t = a - 3; 9| 276M| c = t >> 5; 10| 276M| return (uint8_t) (t ^ (c & (a ^ t))); 11| 276M|} poly_s3_inv.c:both_negative_mask: 14| 111k|static inline int16_t both_negative_mask(int16_t x, int16_t y) { 15| 111k| return (x & y) >> 15; 16| 111k|} sample_iid.c:mod3: 3| 119k|static uint16_t mod3(uint16_t a) { 4| 119k| uint16_t r; 5| 119k| int16_t t, c; 6| | 7| 119k| r = (a >> 8) + (a & 0xff); // r mod 255 == a mod 255 8| 119k| r = (r >> 4) + (r & 0xf); // r' mod 15 == r mod 15 9| 119k| r = (r >> 2) + (r & 0x3); // r' mod 3 == r mod 3 10| 119k| r = (r >> 2) + (r & 0x3); // r' mod 3 == r mod 3 11| | 12| 119k| t = r - 3; 13| 119k| c = t >> 15; 14| | 15| 119k| return (c & r) ^ (~c & t); 16| 119k|} PQCLEAN_NTRUHPS2048677_AVX2_cmov: 4| 14|void PQCLEAN_NTRUHPS2048677_AVX2_cmov(unsigned char *r, const unsigned char *x, size_t len, unsigned char b) { 5| 14| size_t i; 6| | 7| 14| b = (~b + 1); 8| 462| for (i = 0; i < len; i++) { ------------------ | Branch (8:17): [True: 448, False: 14] ------------------ 9| 448| r[i] ^= b & (x[i] ^ r[i]); 10| 448| } 11| 14|} PQCLEAN_NTRUHPS2048677_AVX2_crypto_sort_int32: 903| 56|void PQCLEAN_NTRUHPS2048677_AVX2_crypto_sort_int32(int32 *x, size_t n) { 904| 56| size_t q, i, j; 905| | 906| 56| if (n <= 8) { ------------------ | Branch (906:9): [True: 0, False: 56] ------------------ 907| 0| if (n == 8) { ------------------ | Branch (907:13): [True: 0, False: 0] ------------------ 908| 0| int32_MINMAX(&x[0], &x[1]); 909| 0| int32_MINMAX(&x[1], &x[2]); 910| 0| int32_MINMAX(&x[2], &x[3]); 911| 0| int32_MINMAX(&x[3], &x[4]); 912| 0| int32_MINMAX(&x[4], &x[5]); 913| 0| int32_MINMAX(&x[5], &x[6]); 914| 0| int32_MINMAX(&x[6], &x[7]); 915| 0| } 916| 0| if (n >= 7) { ------------------ | Branch (916:13): [True: 0, False: 0] ------------------ 917| 0| int32_MINMAX(&x[0], &x[1]); 918| 0| int32_MINMAX(&x[1], &x[2]); 919| 0| int32_MINMAX(&x[2], &x[3]); 920| 0| int32_MINMAX(&x[3], &x[4]); 921| 0| int32_MINMAX(&x[4], &x[5]); 922| 0| int32_MINMAX(&x[5], &x[6]); 923| 0| } 924| 0| if (n >= 6) { ------------------ | Branch (924:13): [True: 0, False: 0] ------------------ 925| 0| int32_MINMAX(&x[0], &x[1]); 926| 0| int32_MINMAX(&x[1], &x[2]); 927| 0| int32_MINMAX(&x[2], &x[3]); 928| 0| int32_MINMAX(&x[3], &x[4]); 929| 0| int32_MINMAX(&x[4], &x[5]); 930| 0| } 931| 0| if (n >= 5) { ------------------ | Branch (931:13): [True: 0, False: 0] ------------------ 932| 0| int32_MINMAX(&x[0], &x[1]); 933| 0| int32_MINMAX(&x[1], &x[2]); 934| 0| int32_MINMAX(&x[2], &x[3]); 935| 0| int32_MINMAX(&x[3], &x[4]); 936| 0| } 937| 0| if (n >= 4) { ------------------ | Branch (937:13): [True: 0, False: 0] ------------------ 938| 0| int32_MINMAX(&x[0], &x[1]); 939| 0| int32_MINMAX(&x[1], &x[2]); 940| 0| int32_MINMAX(&x[2], &x[3]); 941| 0| } 942| 0| if (n >= 3) { ------------------ | Branch (942:13): [True: 0, False: 0] ------------------ 943| 0| int32_MINMAX(&x[0], &x[1]); 944| 0| int32_MINMAX(&x[1], &x[2]); 945| 0| } 946| 0| if (n >= 2) { ------------------ | Branch (946:13): [True: 0, False: 0] ------------------ 947| 0| int32_MINMAX(&x[0], &x[1]); 948| 0| } 949| 0| return; 950| 0| } 951| | 952| 56| if (!(n & (n - 1))) { ------------------ | Branch (952:9): [True: 0, False: 56] ------------------ 953| 0| int32_sort_2power(x, n, 0); 954| 0| return; 955| 0| } 956| | 957| 56| q = 8; 958| 336| while (q < n - q) { ------------------ | Branch (958:12): [True: 280, False: 56] ------------------ 959| 280| q += q; 960| 280| } 961| | /* n > q >= 8 */ 962| | 963| 56| if (q <= 128) { /* n <= 256 */ ------------------ | Branch (963:9): [True: 28, False: 28] ------------------ 964| 28| int32x8 y[32]; 965| 476| for (i = q >> 3; i < q >> 2; ++i) { ------------------ | Branch (965:26): [True: 448, False: 28] ------------------ 966| 448| y[i] = _mm256_set1_epi32(0x7fffffff); 967| 448| } 968| 4.62k| for (i = 0; i < n; ++i) { ------------------ | Branch (968:21): [True: 4.59k, False: 28] ------------------ 969| 4.59k| ((int32 *) y)[i] = x[i]; 970| 4.59k| } 971| 28| int32_sort_2power((int32 *) y, 2 * q, 0); 972| 4.62k| for (i = 0; i < n; ++i) { ------------------ | Branch (972:21): [True: 4.59k, False: 28] ------------------ 973| 4.59k| x[i] = ((int32 *) y)[i]; 974| 4.59k| } 975| 28| return; 976| 28| } 977| | 978| 28| int32_sort_2power(x, q, 1); 979| 28| PQCLEAN_NTRUHPS2048677_AVX2_crypto_sort_int32(x + q, n - q); 980| | 981| 84| while (q >= 64) { ------------------ | Branch (981:12): [True: 56, False: 28] ------------------ 982| 56| q >>= 2; 983| 56| j = int32_threestages(x, n, q); 984| 56| minmax_vector(x + j, x + j + 4 * q, n - 4 * q - j); 985| 56| if (j + 4 * q <= n) { ------------------ | Branch (985:13): [True: 28, False: 28] ------------------ 986| 476| for (i = j; i < j + q; i += 8) { ------------------ | Branch (986:25): [True: 448, False: 28] ------------------ 987| 448| int32x8 x0 = int32x8_load(&x[i]); ------------------ | | 9| 448|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 988| 448| int32x8 x1 = int32x8_load(&x[i + q]); ------------------ | | 9| 448|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 989| 448| int32x8 x2 = int32x8_load(&x[i + 2 * q]); ------------------ | | 9| 448|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 990| 448| int32x8 x3 = int32x8_load(&x[i + 3 * q]); ------------------ | | 9| 448|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 991| 448| int32x8_MINMAX(x0, x2); ------------------ | | 15| 448| do { \ | | 16| 448| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 448|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 448| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 448|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 448| (a) = c; \ | | 19| 448| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 448] | | ------------------ ------------------ 992| 448| int32x8_MINMAX(x1, x3); ------------------ | | 15| 448| do { \ | | 16| 448| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 448|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 448| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 448|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 448| (a) = c; \ | | 19| 448| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 448] | | ------------------ ------------------ 993| 448| int32x8_MINMAX(x0, x1); ------------------ | | 15| 448| do { \ | | 16| 448| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 448|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 448| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 448|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 448| (a) = c; \ | | 19| 448| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 448] | | ------------------ ------------------ 994| 448| int32x8_MINMAX(x2, x3); ------------------ | | 15| 448| do { \ | | 16| 448| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 448|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 448| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 448|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 448| (a) = c; \ | | 19| 448| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 448] | | ------------------ ------------------ 995| 448| int32x8_store(&x[i], x0); ------------------ | | 10| 448|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 996| 448| int32x8_store(&x[i + q], x1); ------------------ | | 10| 448|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 997| 448| int32x8_store(&x[i + 2 * q], x2); ------------------ | | 10| 448|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 998| 448| int32x8_store(&x[i + 3 * q], x3); ------------------ | | 10| 448|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 999| 448| } 1000| 28| j += 4 * q; 1001| 28| } 1002| 56| minmax_vector(x + j, x + j + 2 * q, n - 2 * q - j); 1003| 56| if (j + 2 * q <= n) { ------------------ | Branch (1003:13): [True: 28, False: 28] ------------------ 1004| 84| for (i = j; i < j + q; i += 8) { ------------------ | Branch (1004:25): [True: 56, False: 28] ------------------ 1005| 56| int32x8 x0 = int32x8_load(&x[i]); ------------------ | | 9| 56|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 1006| 56| int32x8 x1 = int32x8_load(&x[i + q]); ------------------ | | 9| 56|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 1007| 56| int32x8_MINMAX(x0, x1); ------------------ | | 15| 56| do { \ | | 16| 56| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 56|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 56| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 56|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 56| (a) = c; \ | | 19| 56| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 56] | | ------------------ ------------------ 1008| 56| int32x8_store(&x[i], x0); ------------------ | | 10| 56|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 1009| 56| int32x8_store(&x[i + q], x1); ------------------ | | 10| 56|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 1010| 56| } 1011| 28| j += 2 * q; 1012| 28| } 1013| 56| minmax_vector(x + j, x + j + q, n - q - j); 1014| 56| q >>= 1; 1015| 56| } 1016| 28| if (q == 32) { ------------------ | Branch (1016:9): [True: 0, False: 28] ------------------ 1017| 0| j = 0; 1018| 0| for (; j + 64 <= n; j += 64) { ------------------ | Branch (1018:16): [True: 0, False: 0] ------------------ 1019| 0| int32x8 x0 = int32x8_load(&x[j]); ------------------ | | 9| 0|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 1020| 0| int32x8 x1 = int32x8_load(&x[j + 8]); ------------------ | | 9| 0|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 1021| 0| int32x8 x2 = int32x8_load(&x[j + 16]); ------------------ | | 9| 0|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 1022| 0| int32x8 x3 = int32x8_load(&x[j + 24]); ------------------ | | 9| 0|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 1023| 0| int32x8 x4 = int32x8_load(&x[j + 32]); ------------------ | | 9| 0|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 1024| 0| int32x8 x5 = int32x8_load(&x[j + 40]); ------------------ | | 9| 0|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 1025| 0| int32x8 x6 = int32x8_load(&x[j + 48]); ------------------ | | 9| 0|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 1026| 0| int32x8 x7 = int32x8_load(&x[j + 56]); ------------------ | | 9| 0|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 1027| 0| int32x8_MINMAX(x0, x4); ------------------ | | 15| 0| do { \ | | 16| 0| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 0|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 0| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 0|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 0| (a) = c; \ | | 19| 0| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 0] | | ------------------ ------------------ 1028| 0| int32x8_MINMAX(x1, x5); ------------------ | | 15| 0| do { \ | | 16| 0| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 0|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 0| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 0|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 0| (a) = c; \ | | 19| 0| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 0] | | ------------------ ------------------ 1029| 0| int32x8_MINMAX(x2, x6); ------------------ | | 15| 0| do { \ | | 16| 0| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 0|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 0| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 0|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 0| (a) = c; \ | | 19| 0| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 0] | | ------------------ ------------------ 1030| 0| int32x8_MINMAX(x3, x7); ------------------ | | 15| 0| do { \ | | 16| 0| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 0|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 0| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 0|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 0| (a) = c; \ | | 19| 0| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 0] | | ------------------ ------------------ 1031| 0| int32x8_MINMAX(x0, x2); ------------------ | | 15| 0| do { \ | | 16| 0| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 0|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 0| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 0|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 0| (a) = c; \ | | 19| 0| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 0] | | ------------------ ------------------ 1032| 0| int32x8_MINMAX(x1, x3); ------------------ | | 15| 0| do { \ | | 16| 0| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 0|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 0| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 0|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 0| (a) = c; \ | | 19| 0| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 0] | | ------------------ ------------------ 1033| 0| int32x8_MINMAX(x4, x6); ------------------ | | 15| 0| do { \ | | 16| 0| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 0|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 0| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 0|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 0| (a) = c; \ | | 19| 0| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 0] | | ------------------ ------------------ 1034| 0| int32x8_MINMAX(x5, x7); ------------------ | | 15| 0| do { \ | | 16| 0| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 0|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 0| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 0|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 0| (a) = c; \ | | 19| 0| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 0] | | ------------------ ------------------ 1035| 0| int32x8_MINMAX(x0, x1); ------------------ | | 15| 0| do { \ | | 16| 0| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 0|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 0| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 0|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 0| (a) = c; \ | | 19| 0| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 0] | | ------------------ ------------------ 1036| 0| int32x8_MINMAX(x2, x3); ------------------ | | 15| 0| do { \ | | 16| 0| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 0|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 0| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 0|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 0| (a) = c; \ | | 19| 0| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 0] | | ------------------ ------------------ 1037| 0| int32x8_MINMAX(x4, x5); ------------------ | | 15| 0| do { \ | | 16| 0| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 0|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 0| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 0|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 0| (a) = c; \ | | 19| 0| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 0] | | ------------------ ------------------ 1038| 0| int32x8_MINMAX(x6, x7); ------------------ | | 15| 0| do { \ | | 16| 0| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 0|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 0| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 0|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 0| (a) = c; \ | | 19| 0| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 0] | | ------------------ ------------------ 1039| 0| int32x8 a0 = _mm256_permute2x128_si256(x0, x1, 0x20); 1040| 0| int32x8 a1 = _mm256_permute2x128_si256(x0, x1, 0x31); 1041| 0| int32x8 a2 = _mm256_permute2x128_si256(x2, x3, 0x20); 1042| 0| int32x8 a3 = _mm256_permute2x128_si256(x2, x3, 0x31); 1043| 0| int32x8 a4 = _mm256_permute2x128_si256(x4, x5, 0x20); 1044| 0| int32x8 a5 = _mm256_permute2x128_si256(x4, x5, 0x31); 1045| 0| int32x8 a6 = _mm256_permute2x128_si256(x6, x7, 0x20); 1046| 0| int32x8 a7 = _mm256_permute2x128_si256(x6, x7, 0x31); 1047| 0| int32x8_MINMAX(a0, a1); ------------------ | | 15| 0| do { \ | | 16| 0| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 0|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 0| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 0|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 0| (a) = c; \ | | 19| 0| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 0] | | ------------------ ------------------ 1048| 0| int32x8_MINMAX(a2, a3); ------------------ | | 15| 0| do { \ | | 16| 0| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 0|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 0| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 0|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 0| (a) = c; \ | | 19| 0| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 0] | | ------------------ ------------------ 1049| 0| int32x8_MINMAX(a4, a5); ------------------ | | 15| 0| do { \ | | 16| 0| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 0|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 0| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 0|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 0| (a) = c; \ | | 19| 0| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 0] | | ------------------ ------------------ 1050| 0| int32x8_MINMAX(a6, a7); ------------------ | | 15| 0| do { \ | | 16| 0| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 0|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 0| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 0|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 0| (a) = c; \ | | 19| 0| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 0] | | ------------------ ------------------ 1051| 0| int32x8 b0 = _mm256_permute2x128_si256(a0, a1, 0x20); 1052| 0| int32x8 b1 = _mm256_permute2x128_si256(a0, a1, 0x31); 1053| 0| int32x8 b2 = _mm256_permute2x128_si256(a2, a3, 0x20); 1054| 0| int32x8 b3 = _mm256_permute2x128_si256(a2, a3, 0x31); 1055| 0| int32x8 b4 = _mm256_permute2x128_si256(a4, a5, 0x20); 1056| 0| int32x8 b5 = _mm256_permute2x128_si256(a4, a5, 0x31); 1057| 0| int32x8 b6 = _mm256_permute2x128_si256(a6, a7, 0x20); 1058| 0| int32x8 b7 = _mm256_permute2x128_si256(a6, a7, 0x31); 1059| 0| int32x8 c0 = _mm256_unpacklo_epi64(b0, b1); 1060| 0| int32x8 c1 = _mm256_unpackhi_epi64(b0, b1); 1061| 0| int32x8 c2 = _mm256_unpacklo_epi64(b2, b3); 1062| 0| int32x8 c3 = _mm256_unpackhi_epi64(b2, b3); 1063| 0| int32x8 c4 = _mm256_unpacklo_epi64(b4, b5); 1064| 0| int32x8 c5 = _mm256_unpackhi_epi64(b4, b5); 1065| 0| int32x8 c6 = _mm256_unpacklo_epi64(b6, b7); 1066| 0| int32x8 c7 = _mm256_unpackhi_epi64(b6, b7); 1067| 0| int32x8_MINMAX(c0, c1); ------------------ | | 15| 0| do { \ | | 16| 0| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 0|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 0| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 0|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 0| (a) = c; \ | | 19| 0| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 0] | | ------------------ ------------------ 1068| 0| int32x8_MINMAX(c2, c3); ------------------ | | 15| 0| do { \ | | 16| 0| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 0|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 0| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 0|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 0| (a) = c; \ | | 19| 0| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 0] | | ------------------ ------------------ 1069| 0| int32x8_MINMAX(c4, c5); ------------------ | | 15| 0| do { \ | | 16| 0| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 0|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 0| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 0|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 0| (a) = c; \ | | 19| 0| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 0] | | ------------------ ------------------ 1070| 0| int32x8_MINMAX(c6, c7); ------------------ | | 15| 0| do { \ | | 16| 0| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 0|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 0| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 0|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 0| (a) = c; \ | | 19| 0| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 0] | | ------------------ ------------------ 1071| 0| int32x8 d0 = _mm256_unpacklo_epi32(c0, c1); 1072| 0| int32x8 d1 = _mm256_unpackhi_epi32(c0, c1); 1073| 0| int32x8 d2 = _mm256_unpacklo_epi32(c2, c3); 1074| 0| int32x8 d3 = _mm256_unpackhi_epi32(c2, c3); 1075| 0| int32x8 d4 = _mm256_unpacklo_epi32(c4, c5); 1076| 0| int32x8 d5 = _mm256_unpackhi_epi32(c4, c5); 1077| 0| int32x8 d6 = _mm256_unpacklo_epi32(c6, c7); 1078| 0| int32x8 d7 = _mm256_unpackhi_epi32(c6, c7); 1079| 0| int32x8 e0 = _mm256_unpacklo_epi64(d0, d1); 1080| 0| int32x8 e1 = _mm256_unpackhi_epi64(d0, d1); 1081| 0| int32x8 e2 = _mm256_unpacklo_epi64(d2, d3); 1082| 0| int32x8 e3 = _mm256_unpackhi_epi64(d2, d3); 1083| 0| int32x8 e4 = _mm256_unpacklo_epi64(d4, d5); 1084| 0| int32x8 e5 = _mm256_unpackhi_epi64(d4, d5); 1085| 0| int32x8 e6 = _mm256_unpacklo_epi64(d6, d7); 1086| 0| int32x8 e7 = _mm256_unpackhi_epi64(d6, d7); 1087| 0| int32x8_MINMAX(e0, e1); ------------------ | | 15| 0| do { \ | | 16| 0| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 0|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 0| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 0|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 0| (a) = c; \ | | 19| 0| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 0] | | ------------------ ------------------ 1088| 0| int32x8_MINMAX(e2, e3); ------------------ | | 15| 0| do { \ | | 16| 0| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 0|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 0| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 0|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 0| (a) = c; \ | | 19| 0| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 0] | | ------------------ ------------------ 1089| 0| int32x8_MINMAX(e4, e5); ------------------ | | 15| 0| do { \ | | 16| 0| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 0|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 0| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 0|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 0| (a) = c; \ | | 19| 0| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 0] | | ------------------ ------------------ 1090| 0| int32x8_MINMAX(e6, e7); ------------------ | | 15| 0| do { \ | | 16| 0| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 0|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 0| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 0|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 0| (a) = c; \ | | 19| 0| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 0] | | ------------------ ------------------ 1091| 0| int32x8 f0 = _mm256_unpacklo_epi32(e0, e1); 1092| 0| int32x8 f1 = _mm256_unpackhi_epi32(e0, e1); 1093| 0| int32x8 f2 = _mm256_unpacklo_epi32(e2, e3); 1094| 0| int32x8 f3 = _mm256_unpackhi_epi32(e2, e3); 1095| 0| int32x8 f4 = _mm256_unpacklo_epi32(e4, e5); 1096| 0| int32x8 f5 = _mm256_unpackhi_epi32(e4, e5); 1097| 0| int32x8 f6 = _mm256_unpacklo_epi32(e6, e7); 1098| 0| int32x8 f7 = _mm256_unpackhi_epi32(e6, e7); 1099| 0| int32x8_store(&x[j], f0); ------------------ | | 10| 0|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 1100| 0| int32x8_store(&x[j + 8], f1); ------------------ | | 10| 0|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 1101| 0| int32x8_store(&x[j + 16], f2); ------------------ | | 10| 0|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 1102| 0| int32x8_store(&x[j + 24], f3); ------------------ | | 10| 0|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 1103| 0| int32x8_store(&x[j + 32], f4); ------------------ | | 10| 0|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 1104| 0| int32x8_store(&x[j + 40], f5); ------------------ | | 10| 0|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 1105| 0| int32x8_store(&x[j + 48], f6); ------------------ | | 10| 0|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 1106| 0| int32x8_store(&x[j + 56], f7); ------------------ | | 10| 0|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 1107| 0| } 1108| 0| minmax_vector(x + j, x + j + 32, n - 32 - j); 1109| 0| goto continue16; 1110| 0| } 1111| 28| if (q == 16) { ------------------ | Branch (1111:9): [True: 0, False: 28] ------------------ 1112| 0| j = 0; 1113| 0|continue16: 1114| 0| for (; j + 32 <= n; j += 32) { ------------------ | Branch (1114:16): [True: 0, False: 0] ------------------ 1115| 0| int32x8 x0 = int32x8_load(&x[j]); ------------------ | | 9| 0|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 1116| 0| int32x8 x1 = int32x8_load(&x[j + 8]); ------------------ | | 9| 0|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 1117| 0| int32x8 x2 = int32x8_load(&x[j + 16]); ------------------ | | 9| 0|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 1118| 0| int32x8 x3 = int32x8_load(&x[j + 24]); ------------------ | | 9| 0|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 1119| 0| int32x8_MINMAX(x0, x2); ------------------ | | 15| 0| do { \ | | 16| 0| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 0|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 0| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 0|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 0| (a) = c; \ | | 19| 0| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 0] | | ------------------ ------------------ 1120| 0| int32x8_MINMAX(x1, x3); ------------------ | | 15| 0| do { \ | | 16| 0| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 0|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 0| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 0|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 0| (a) = c; \ | | 19| 0| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 0] | | ------------------ ------------------ 1121| 0| int32x8_MINMAX(x0, x1); ------------------ | | 15| 0| do { \ | | 16| 0| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 0|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 0| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 0|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 0| (a) = c; \ | | 19| 0| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 0] | | ------------------ ------------------ 1122| 0| int32x8_MINMAX(x2, x3); ------------------ | | 15| 0| do { \ | | 16| 0| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 0|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 0| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 0|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 0| (a) = c; \ | | 19| 0| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 0] | | ------------------ ------------------ 1123| 0| int32x8 a0 = _mm256_permute2x128_si256(x0, x1, 0x20); 1124| 0| int32x8 a1 = _mm256_permute2x128_si256(x0, x1, 0x31); 1125| 0| int32x8 a2 = _mm256_permute2x128_si256(x2, x3, 0x20); 1126| 0| int32x8 a3 = _mm256_permute2x128_si256(x2, x3, 0x31); 1127| 0| int32x8_MINMAX(a0, a1); ------------------ | | 15| 0| do { \ | | 16| 0| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 0|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 0| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 0|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 0| (a) = c; \ | | 19| 0| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 0] | | ------------------ ------------------ 1128| 0| int32x8_MINMAX(a2, a3); ------------------ | | 15| 0| do { \ | | 16| 0| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 0|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 0| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 0|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 0| (a) = c; \ | | 19| 0| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 0] | | ------------------ ------------------ 1129| 0| int32x8 b0 = _mm256_permute2x128_si256(a0, a1, 0x20); 1130| 0| int32x8 b1 = _mm256_permute2x128_si256(a0, a1, 0x31); 1131| 0| int32x8 b2 = _mm256_permute2x128_si256(a2, a3, 0x20); 1132| 0| int32x8 b3 = _mm256_permute2x128_si256(a2, a3, 0x31); 1133| 0| int32x8 c0 = _mm256_unpacklo_epi64(b0, b1); 1134| 0| int32x8 c1 = _mm256_unpackhi_epi64(b0, b1); 1135| 0| int32x8 c2 = _mm256_unpacklo_epi64(b2, b3); 1136| 0| int32x8 c3 = _mm256_unpackhi_epi64(b2, b3); 1137| 0| int32x8_MINMAX(c0, c1); ------------------ | | 15| 0| do { \ | | 16| 0| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 0|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 0| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 0|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 0| (a) = c; \ | | 19| 0| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 0] | | ------------------ ------------------ 1138| 0| int32x8_MINMAX(c2, c3); ------------------ | | 15| 0| do { \ | | 16| 0| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 0|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 0| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 0|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 0| (a) = c; \ | | 19| 0| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 0] | | ------------------ ------------------ 1139| 0| int32x8 d0 = _mm256_unpacklo_epi32(c0, c1); 1140| 0| int32x8 d1 = _mm256_unpackhi_epi32(c0, c1); 1141| 0| int32x8 d2 = _mm256_unpacklo_epi32(c2, c3); 1142| 0| int32x8 d3 = _mm256_unpackhi_epi32(c2, c3); 1143| 0| int32x8 e0 = _mm256_unpacklo_epi64(d0, d1); 1144| 0| int32x8 e1 = _mm256_unpackhi_epi64(d0, d1); 1145| 0| int32x8 e2 = _mm256_unpacklo_epi64(d2, d3); 1146| 0| int32x8 e3 = _mm256_unpackhi_epi64(d2, d3); 1147| 0| int32x8_MINMAX(e0, e1); ------------------ | | 15| 0| do { \ | | 16| 0| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 0|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 0| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 0|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 0| (a) = c; \ | | 19| 0| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 0] | | ------------------ ------------------ 1148| 0| int32x8_MINMAX(e2, e3); ------------------ | | 15| 0| do { \ | | 16| 0| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 0|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 0| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 0|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 0| (a) = c; \ | | 19| 0| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 0] | | ------------------ ------------------ 1149| 0| int32x8 f0 = _mm256_unpacklo_epi32(e0, e1); 1150| 0| int32x8 f1 = _mm256_unpackhi_epi32(e0, e1); 1151| 0| int32x8 f2 = _mm256_unpacklo_epi32(e2, e3); 1152| 0| int32x8 f3 = _mm256_unpackhi_epi32(e2, e3); 1153| 0| int32x8_store(&x[j], f0); ------------------ | | 10| 0|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 1154| 0| int32x8_store(&x[j + 8], f1); ------------------ | | 10| 0|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 1155| 0| int32x8_store(&x[j + 16], f2); ------------------ | | 10| 0|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 1156| 0| int32x8_store(&x[j + 24], f3); ------------------ | | 10| 0|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 1157| 0| } 1158| 0| minmax_vector(x + j, x + j + 16, n - 16 - j); 1159| 0| goto continue8; 1160| 0| } 1161| | /* q == 8 */ 1162| 28| j = 0; 1163| 28|continue8: 1164| 1.20k| for (; j + 16 <= n; j += 16) { ------------------ | Branch (1164:12): [True: 1.17k, False: 28] ------------------ 1165| 1.17k| int32x8 x0 = int32x8_load(&x[j]); ------------------ | | 9| 1.17k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 1166| 1.17k| int32x8 x1 = int32x8_load(&x[j + 8]); ------------------ | | 9| 1.17k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 1167| 1.17k| int32x8_MINMAX(x0, x1); ------------------ | | 15| 1.17k| do { \ | | 16| 1.17k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 1.17k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 1.17k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 1.17k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 1.17k| (a) = c; \ | | 19| 1.17k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 1.17k] | | ------------------ ------------------ 1168| 1.17k| int32x8_store(&x[j], x0); ------------------ | | 10| 1.17k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 1169| 1.17k| int32x8_store(&x[j + 8], x1); ------------------ | | 10| 1.17k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 1170| 1.17k| int32x8 a0 = _mm256_permute2x128_si256(x0, x1, 0x20); /* x0123y0123 */ 1171| 1.17k| int32x8 a1 = _mm256_permute2x128_si256(x0, x1, 0x31); /* x4567y4567 */ 1172| 1.17k| int32x8_MINMAX(a0, a1); ------------------ | | 15| 1.17k| do { \ | | 16| 1.17k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 1.17k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 1.17k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 1.17k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 1.17k| (a) = c; \ | | 19| 1.17k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 1.17k] | | ------------------ ------------------ 1173| 1.17k| int32x8 b0 = _mm256_permute2x128_si256(a0, a1, 0x20); /* x01234567 */ 1174| 1.17k| int32x8 b1 = _mm256_permute2x128_si256(a0, a1, 0x31); /* y01234567 */ 1175| 1.17k| int32x8 c0 = _mm256_unpacklo_epi64(b0, b1); /* x01y01x45y45 */ 1176| 1.17k| int32x8 c1 = _mm256_unpackhi_epi64(b0, b1); /* x23y23x67y67 */ 1177| 1.17k| int32x8_MINMAX(c0, c1); ------------------ | | 15| 1.17k| do { \ | | 16| 1.17k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 1.17k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 1.17k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 1.17k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 1.17k| (a) = c; \ | | 19| 1.17k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 1.17k] | | ------------------ ------------------ 1178| 1.17k| int32x8 d0 = _mm256_unpacklo_epi32(c0, c1); /* x02x13x46x57 */ 1179| 1.17k| int32x8 d1 = _mm256_unpackhi_epi32(c0, c1); /* y02y13y46y57 */ 1180| 1.17k| int32x8 e0 = _mm256_unpacklo_epi64(d0, d1); /* x02y02x46y46 */ 1181| 1.17k| int32x8 e1 = _mm256_unpackhi_epi64(d0, d1); /* x13y13x57y57 */ 1182| 1.17k| int32x8_MINMAX(e0, e1); ------------------ | | 15| 1.17k| do { \ | | 16| 1.17k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 1.17k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 1.17k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 1.17k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 1.17k| (a) = c; \ | | 19| 1.17k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 1.17k] | | ------------------ ------------------ 1183| 1.17k| int32x8 f0 = _mm256_unpacklo_epi32(e0, e1); /* x01234567 */ 1184| 1.17k| int32x8 f1 = _mm256_unpackhi_epi32(e0, e1); /* y01234567 */ 1185| 1.17k| int32x8_store(&x[j], f0); ------------------ | | 10| 1.17k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 1186| 1.17k| int32x8_store(&x[j + 8], f1); ------------------ | | 10| 1.17k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 1187| 1.17k| } 1188| 28| minmax_vector(x + j, x + j + 8, n - 8 - j); 1189| 28| if (j + 8 <= n) { ------------------ | Branch (1189:9): [True: 0, False: 28] ------------------ 1190| 0| int32_MINMAX(&x[j], &x[j + 4]); 1191| 0| int32_MINMAX(&x[j + 1], &x[j + 5]); 1192| 0| int32_MINMAX(&x[j + 2], &x[j + 6]); 1193| 0| int32_MINMAX(&x[j + 3], &x[j + 7]); 1194| 0| int32_MINMAX(&x[j], &x[j + 2]); 1195| 0| int32_MINMAX(&x[j + 1], &x[j + 3]); 1196| 0| int32_MINMAX(&x[j], &x[j + 1]); 1197| 0| int32_MINMAX(&x[j + 2], &x[j + 3]); 1198| 0| int32_MINMAX(&x[j + 4], &x[j + 6]); 1199| 0| int32_MINMAX(&x[j + 5], &x[j + 7]); 1200| 0| int32_MINMAX(&x[j + 4], &x[j + 5]); 1201| 0| int32_MINMAX(&x[j + 6], &x[j + 7]); 1202| 0| j += 8; 1203| 0| } 1204| 28| minmax_vector(x + j, x + j + 4, n - 4 - j); 1205| 28| if (j + 4 <= n) { ------------------ | Branch (1205:9): [True: 28, False: 0] ------------------ 1206| 28| int32_MINMAX(&x[j], &x[j + 2]); 1207| 28| int32_MINMAX(&x[j + 1], &x[j + 3]); 1208| 28| int32_MINMAX(&x[j], &x[j + 1]); 1209| 28| int32_MINMAX(&x[j + 2], &x[j + 3]); 1210| 28| j += 4; 1211| 28| } 1212| 28| if (j + 3 <= n) { ------------------ | Branch (1212:9): [True: 0, False: 28] ------------------ 1213| 0| int32_MINMAX(&x[j], &x[j + 2]); 1214| 0| } 1215| 28| if (j + 2 <= n) { ------------------ | Branch (1215:9): [True: 0, False: 28] ------------------ 1216| 0| int32_MINMAX(&x[j], &x[j + 1]); 1217| 0| } 1218| 28|} PQCLEAN_NTRUHPS2048677_AVX2_crypto_kem_keypair: 10| 14|int PQCLEAN_NTRUHPS2048677_AVX2_crypto_kem_keypair(uint8_t *pk, uint8_t *sk) { 11| 14| uint8_t seed[NTRU_SAMPLE_FG_BYTES]; 12| | 13| 14| randombytes(seed, NTRU_SAMPLE_FG_BYTES); ------------------ | | 8| 14|#define randombytes OQS_randombytes ------------------ randombytes(seed, NTRU_SAMPLE_FG_BYTES); ------------------ | | 22| 14|#define NTRU_SAMPLE_FG_BYTES (NTRU_SAMPLE_IID_BYTES+NTRU_SAMPLE_FT_BYTES) | | ------------------ | | | | 20| 14|#define NTRU_SAMPLE_IID_BYTES (NTRU_N-1) | | | | ------------------ | | | | | | 5| 14|#define NTRU_N 677 | | | | ------------------ | | ------------------ | | #define NTRU_SAMPLE_FG_BYTES (NTRU_SAMPLE_IID_BYTES+NTRU_SAMPLE_FT_BYTES) | | ------------------ | | | | 21| 14|#define NTRU_SAMPLE_FT_BYTES ((30*(NTRU_N-1)+7)/8) | | | | ------------------ | | | | | | 5| 14|#define NTRU_N 677 | | | | ------------------ | | ------------------ ------------------ 14| 14| PQCLEAN_NTRUHPS2048677_AVX2_owcpa_keypair(pk, sk, seed); 15| | 16| 14| randombytes(sk + NTRU_OWCPA_SECRETKEYBYTES, NTRU_PRFKEYBYTES); ------------------ | | 8| 14|#define randombytes OQS_randombytes ------------------ randombytes(sk + NTRU_OWCPA_SECRETKEYBYTES, NTRU_PRFKEYBYTES); ------------------ | | 30| 14|#define NTRU_OWCPA_SECRETKEYBYTES (2*NTRU_PACK_TRINARY_BYTES + NTRU_OWCPA_PUBLICKEYBYTES) | | ------------------ | | | | 26| 14|#define NTRU_PACK_TRINARY_BYTES ((NTRU_PACK_DEG+4)/5) | | | | ------------------ | | | | | | 25| 14|#define NTRU_PACK_DEG (NTRU_N-1) | | | | | | ------------------ | | | | | | | | 5| 14|#define NTRU_N 677 | | | | | | ------------------ | | | | ------------------ | | ------------------ | | #define NTRU_OWCPA_SECRETKEYBYTES (2*NTRU_PACK_TRINARY_BYTES + NTRU_OWCPA_PUBLICKEYBYTES) | | ------------------ | | | | 29| 14|#define NTRU_OWCPA_PUBLICKEYBYTES ((NTRU_LOGQ*NTRU_PACK_DEG+7)/8) | | | | ------------------ | | | | | | 6| 14|#define NTRU_LOGQ 11 | | | | ------------------ | | | | #define NTRU_OWCPA_PUBLICKEYBYTES ((NTRU_LOGQ*NTRU_PACK_DEG+7)/8) | | | | ------------------ | | | | | | 25| 14|#define NTRU_PACK_DEG (NTRU_N-1) | | | | | | ------------------ | | | | | | | | 5| 14|#define NTRU_N 677 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ randombytes(sk + NTRU_OWCPA_SECRETKEYBYTES, NTRU_PRFKEYBYTES); ------------------ | | 17| 14|#define NTRU_PRFKEYBYTES 32 ------------------ 17| | 18| 14| return 0; 19| 14|} PQCLEAN_NTRUHPS2048677_AVX2_crypto_kem_enc: 21| 14|int PQCLEAN_NTRUHPS2048677_AVX2_crypto_kem_enc(uint8_t *c, uint8_t *k, const uint8_t *pk) { 22| 14| poly r, m; 23| 14| uint8_t rm[NTRU_OWCPA_MSGBYTES]; 24| 14| uint8_t rm_seed[NTRU_SAMPLE_RM_BYTES]; 25| | 26| 14| randombytes(rm_seed, NTRU_SAMPLE_RM_BYTES); ------------------ | | 8| 14|#define randombytes OQS_randombytes ------------------ randombytes(rm_seed, NTRU_SAMPLE_RM_BYTES); ------------------ | | 23| 14|#define NTRU_SAMPLE_RM_BYTES (NTRU_SAMPLE_IID_BYTES+NTRU_SAMPLE_FT_BYTES) | | ------------------ | | | | 20| 14|#define NTRU_SAMPLE_IID_BYTES (NTRU_N-1) | | | | ------------------ | | | | | | 5| 14|#define NTRU_N 677 | | | | ------------------ | | ------------------ | | #define NTRU_SAMPLE_RM_BYTES (NTRU_SAMPLE_IID_BYTES+NTRU_SAMPLE_FT_BYTES) | | ------------------ | | | | 21| 14|#define NTRU_SAMPLE_FT_BYTES ((30*(NTRU_N-1)+7)/8) | | | | ------------------ | | | | | | 5| 14|#define NTRU_N 677 | | | | ------------------ | | ------------------ ------------------ 27| | 28| 14| PQCLEAN_NTRUHPS2048677_AVX2_sample_rm(&r, &m, rm_seed); 29| | 30| 14| PQCLEAN_NTRUHPS2048677_AVX2_poly_S3_tobytes(rm, &r); 31| 14| PQCLEAN_NTRUHPS2048677_AVX2_poly_S3_tobytes(rm + NTRU_PACK_TRINARY_BYTES, &m); ------------------ | | 26| 14|#define NTRU_PACK_TRINARY_BYTES ((NTRU_PACK_DEG+4)/5) | | ------------------ | | | | 25| 14|#define NTRU_PACK_DEG (NTRU_N-1) | | | | ------------------ | | | | | | 5| 14|#define NTRU_N 677 | | | | ------------------ | | ------------------ ------------------ 32| 14| sha3_256(k, rm, NTRU_OWCPA_MSGBYTES); ------------------ | | 15| 14|#define sha3_256 OQS_SHA3_sha3_256 ------------------ sha3_256(k, rm, NTRU_OWCPA_MSGBYTES); ------------------ | | 28| 14|#define NTRU_OWCPA_MSGBYTES (2*NTRU_PACK_TRINARY_BYTES) | | ------------------ | | | | 26| 14|#define NTRU_PACK_TRINARY_BYTES ((NTRU_PACK_DEG+4)/5) | | | | ------------------ | | | | | | 25| 14|#define NTRU_PACK_DEG (NTRU_N-1) | | | | | | ------------------ | | | | | | | | 5| 14|#define NTRU_N 677 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 33| | 34| 14| PQCLEAN_NTRUHPS2048677_AVX2_poly_Z3_to_Zq(&r); 35| 14| PQCLEAN_NTRUHPS2048677_AVX2_owcpa_enc(c, &r, &m, pk); 36| | 37| 14| return 0; 38| 14|} PQCLEAN_NTRUHPS2048677_AVX2_crypto_kem_dec: 40| 14|int PQCLEAN_NTRUHPS2048677_AVX2_crypto_kem_dec(uint8_t *k, const uint8_t *c, const uint8_t *sk) { 41| 14| int i, fail; 42| 14| uint8_t rm[NTRU_OWCPA_MSGBYTES]; 43| 14| uint8_t buf[NTRU_PRFKEYBYTES + NTRU_CIPHERTEXTBYTES]; 44| | 45| 14| fail = PQCLEAN_NTRUHPS2048677_AVX2_owcpa_dec(rm, c, sk); 46| | /* If fail = 0 then c = Enc(h, rm). There is no need to re-encapsulate. */ 47| | /* See comment in PQCLEAN_NTRUHPS2048677_AVX2_owcpa_dec for details. */ 48| | 49| 14| sha3_256(k, rm, NTRU_OWCPA_MSGBYTES); ------------------ | | 15| 14|#define sha3_256 OQS_SHA3_sha3_256 ------------------ sha3_256(k, rm, NTRU_OWCPA_MSGBYTES); ------------------ | | 28| 14|#define NTRU_OWCPA_MSGBYTES (2*NTRU_PACK_TRINARY_BYTES) | | ------------------ | | | | 26| 14|#define NTRU_PACK_TRINARY_BYTES ((NTRU_PACK_DEG+4)/5) | | | | ------------------ | | | | | | 25| 14|#define NTRU_PACK_DEG (NTRU_N-1) | | | | | | ------------------ | | | | | | | | 5| 14|#define NTRU_N 677 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 50| | 51| | /* shake(secret PRF key || input ciphertext) */ 52| 462| for (i = 0; i < NTRU_PRFKEYBYTES; i++) { ------------------ | | 17| 462|#define NTRU_PRFKEYBYTES 32 ------------------ | Branch (52:17): [True: 448, False: 14] ------------------ 53| 448| buf[i] = sk[i + NTRU_OWCPA_SECRETKEYBYTES]; ------------------ | | 30| 448|#define NTRU_OWCPA_SECRETKEYBYTES (2*NTRU_PACK_TRINARY_BYTES + NTRU_OWCPA_PUBLICKEYBYTES) | | ------------------ | | | | 26| 448|#define NTRU_PACK_TRINARY_BYTES ((NTRU_PACK_DEG+4)/5) | | | | ------------------ | | | | | | 25| 448|#define NTRU_PACK_DEG (NTRU_N-1) | | | | | | ------------------ | | | | | | | | 5| 448|#define NTRU_N 677 | | | | | | ------------------ | | | | ------------------ | | ------------------ | | #define NTRU_OWCPA_SECRETKEYBYTES (2*NTRU_PACK_TRINARY_BYTES + NTRU_OWCPA_PUBLICKEYBYTES) | | ------------------ | | | | 29| 448|#define NTRU_OWCPA_PUBLICKEYBYTES ((NTRU_LOGQ*NTRU_PACK_DEG+7)/8) | | | | ------------------ | | | | | | 6| 448|#define NTRU_LOGQ 11 | | | | ------------------ | | | | #define NTRU_OWCPA_PUBLICKEYBYTES ((NTRU_LOGQ*NTRU_PACK_DEG+7)/8) | | | | ------------------ | | | | | | 25| 448|#define NTRU_PACK_DEG (NTRU_N-1) | | | | | | ------------------ | | | | | | | | 5| 448|#define NTRU_N 677 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 54| 448| } 55| 13.0k| for (i = 0; i < NTRU_CIPHERTEXTBYTES; i++) { ------------------ | | 35| 13.0k|#define NTRU_CIPHERTEXTBYTES (NTRU_OWCPA_BYTES) | | ------------------ | | | | 31| 13.0k|#define NTRU_OWCPA_BYTES ((NTRU_LOGQ*NTRU_PACK_DEG+7)/8) | | | | ------------------ | | | | | | 6| 13.0k|#define NTRU_LOGQ 11 | | | | ------------------ | | | | #define NTRU_OWCPA_BYTES ((NTRU_LOGQ*NTRU_PACK_DEG+7)/8) | | | | ------------------ | | | | | | 25| 13.0k|#define NTRU_PACK_DEG (NTRU_N-1) | | | | | | ------------------ | | | | | | | | 5| 13.0k|#define NTRU_N 677 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ | Branch (55:17): [True: 13.0k, False: 14] ------------------ 56| 13.0k| buf[NTRU_PRFKEYBYTES + i] = c[i]; ------------------ | | 17| 13.0k|#define NTRU_PRFKEYBYTES 32 ------------------ 57| 13.0k| } 58| 14| sha3_256(rm, buf, NTRU_PRFKEYBYTES + NTRU_CIPHERTEXTBYTES); ------------------ | | 15| 14|#define sha3_256 OQS_SHA3_sha3_256 ------------------ sha3_256(rm, buf, NTRU_PRFKEYBYTES + NTRU_CIPHERTEXTBYTES); ------------------ | | 17| 14|#define NTRU_PRFKEYBYTES 32 ------------------ sha3_256(rm, buf, NTRU_PRFKEYBYTES + NTRU_CIPHERTEXTBYTES); ------------------ | | 35| 14|#define NTRU_CIPHERTEXTBYTES (NTRU_OWCPA_BYTES) | | ------------------ | | | | 31| 14|#define NTRU_OWCPA_BYTES ((NTRU_LOGQ*NTRU_PACK_DEG+7)/8) | | | | ------------------ | | | | | | 6| 14|#define NTRU_LOGQ 11 | | | | ------------------ | | | | #define NTRU_OWCPA_BYTES ((NTRU_LOGQ*NTRU_PACK_DEG+7)/8) | | | | ------------------ | | | | | | 25| 14|#define NTRU_PACK_DEG (NTRU_N-1) | | | | | | ------------------ | | | | | | | | 5| 14|#define NTRU_N 677 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 59| | 60| 14| PQCLEAN_NTRUHPS2048677_AVX2_cmov(k, rm, NTRU_SHAREDKEYBYTES, (unsigned char) fail); ------------------ | | 18| 14|#define NTRU_SHAREDKEYBYTES 32 ------------------ 61| | 62| 14| return 0; 63| 14|} PQCLEAN_NTRUHPS2048677_AVX2_owcpa_keypair: 62| 14| const unsigned char seed[NTRU_SAMPLE_FG_BYTES]) { 63| 14| int i; 64| | 65| 14| poly x1, x2, x3, x4, x5; 66| | 67| 14| poly *f = &x1, *g = &x2, *invf_mod3 = &x3; 68| 14| poly *gf = &x3, *invgf = &x4, *tmp = &x5; 69| 14| poly *invh = &x3, *h = &x3; 70| | 71| 14| PQCLEAN_NTRUHPS2048677_AVX2_sample_fg(f, g, seed); 72| | 73| 14| PQCLEAN_NTRUHPS2048677_AVX2_poly_S3_inv(invf_mod3, f); 74| 14| PQCLEAN_NTRUHPS2048677_AVX2_poly_S3_tobytes(sk, f); 75| 14| PQCLEAN_NTRUHPS2048677_AVX2_poly_S3_tobytes(sk + NTRU_PACK_TRINARY_BYTES, invf_mod3); ------------------ | | 26| 14|#define NTRU_PACK_TRINARY_BYTES ((NTRU_PACK_DEG+4)/5) | | ------------------ | | | | 25| 14|#define NTRU_PACK_DEG (NTRU_N-1) | | | | ------------------ | | | | | | 5| 14|#define NTRU_N 677 | | | | ------------------ | | ------------------ ------------------ 76| | 77| | /* Lift coeffs of f and g from Z_p to Z_q */ 78| 14| PQCLEAN_NTRUHPS2048677_AVX2_poly_Z3_to_Zq(f); 79| 14| PQCLEAN_NTRUHPS2048677_AVX2_poly_Z3_to_Zq(g); 80| | 81| | 82| | /* g = 3*g */ 83| 9.49k| for (i = 0; i < NTRU_N; i++) { ------------------ | | 5| 9.49k|#define NTRU_N 677 ------------------ | Branch (83:17): [True: 9.47k, False: 14] ------------------ 84| 9.47k| g->coeffs[i] = 3 * g->coeffs[i]; 85| 9.47k| } 86| | 87| 14| PQCLEAN_NTRUHPS2048677_AVX2_poly_Rq_mul(gf, g, f); 88| | 89| 14| PQCLEAN_NTRUHPS2048677_AVX2_poly_Rq_inv(invgf, gf); 90| | 91| 14| PQCLEAN_NTRUHPS2048677_AVX2_poly_Rq_mul(tmp, invgf, f); 92| 14| PQCLEAN_NTRUHPS2048677_AVX2_poly_Sq_mul(invh, tmp, f); 93| 14| PQCLEAN_NTRUHPS2048677_AVX2_poly_Sq_tobytes(sk + 2 * NTRU_PACK_TRINARY_BYTES, invh); ------------------ | | 26| 14|#define NTRU_PACK_TRINARY_BYTES ((NTRU_PACK_DEG+4)/5) | | ------------------ | | | | 25| 14|#define NTRU_PACK_DEG (NTRU_N-1) | | | | ------------------ | | | | | | 5| 14|#define NTRU_N 677 | | | | ------------------ | | ------------------ ------------------ 94| | 95| 14| PQCLEAN_NTRUHPS2048677_AVX2_poly_Rq_mul(tmp, invgf, g); 96| 14| PQCLEAN_NTRUHPS2048677_AVX2_poly_Rq_mul(h, tmp, g); 97| 14| PQCLEAN_NTRUHPS2048677_AVX2_poly_Rq_sum_zero_tobytes(pk, h); 98| 14|} PQCLEAN_NTRUHPS2048677_AVX2_owcpa_enc: 104| 14| const unsigned char *pk) { 105| 14| int i; 106| 14| poly x1, x2; 107| 14| poly *h = &x1, *liftm = &x1; 108| 14| poly *ct = &x2; 109| | 110| 14| PQCLEAN_NTRUHPS2048677_AVX2_poly_Rq_sum_zero_frombytes(h, pk); 111| | 112| 14| PQCLEAN_NTRUHPS2048677_AVX2_poly_Rq_mul(ct, r, h); 113| | 114| 14| PQCLEAN_NTRUHPS2048677_AVX2_poly_lift(liftm, m); 115| 9.49k| for (i = 0; i < NTRU_N; i++) { ------------------ | | 5| 9.49k|#define NTRU_N 677 ------------------ | Branch (115:17): [True: 9.47k, False: 14] ------------------ 116| 9.47k| ct->coeffs[i] = ct->coeffs[i] + liftm->coeffs[i]; 117| 9.47k| } 118| | 119| 14| PQCLEAN_NTRUHPS2048677_AVX2_poly_Rq_sum_zero_tobytes(c, ct); 120| 14|} PQCLEAN_NTRUHPS2048677_AVX2_owcpa_dec: 124| 14| const unsigned char *secretkey) { 125| 14| int i; 126| 14| int fail; 127| 14| poly x1, x2, x3, x4; 128| | 129| 14| poly *c = &x1, *f = &x2, *cf = &x3; 130| 14| poly *mf = &x2, *finv3 = &x3, *m = &x4; 131| 14| poly *liftm = &x2, *invh = &x3, *r = &x4; 132| 14| poly *b = &x1; 133| | 134| 14| PQCLEAN_NTRUHPS2048677_AVX2_poly_Rq_sum_zero_frombytes(c, ciphertext); 135| 14| PQCLEAN_NTRUHPS2048677_AVX2_poly_S3_frombytes(f, secretkey); 136| 14| PQCLEAN_NTRUHPS2048677_AVX2_poly_Z3_to_Zq(f); 137| | 138| 14| PQCLEAN_NTRUHPS2048677_AVX2_poly_Rq_mul(cf, c, f); 139| 14| PQCLEAN_NTRUHPS2048677_AVX2_poly_Rq_to_S3(mf, cf); 140| | 141| 14| PQCLEAN_NTRUHPS2048677_AVX2_poly_S3_frombytes(finv3, secretkey + NTRU_PACK_TRINARY_BYTES); ------------------ | | 26| 14|#define NTRU_PACK_TRINARY_BYTES ((NTRU_PACK_DEG+4)/5) | | ------------------ | | | | 25| 14|#define NTRU_PACK_DEG (NTRU_N-1) | | | | ------------------ | | | | | | 5| 14|#define NTRU_N 677 | | | | ------------------ | | ------------------ ------------------ 142| 14| PQCLEAN_NTRUHPS2048677_AVX2_poly_S3_mul(m, mf, finv3); 143| 14| PQCLEAN_NTRUHPS2048677_AVX2_poly_S3_tobytes(rm + NTRU_PACK_TRINARY_BYTES, m); ------------------ | | 26| 14|#define NTRU_PACK_TRINARY_BYTES ((NTRU_PACK_DEG+4)/5) | | ------------------ | | | | 25| 14|#define NTRU_PACK_DEG (NTRU_N-1) | | | | ------------------ | | | | | | 5| 14|#define NTRU_N 677 | | | | ------------------ | | ------------------ ------------------ 144| | 145| 14| fail = 0; 146| | 147| | /* Check that the unused bits of the last byte of the ciphertext are zero */ 148| 14| fail |= owcpa_check_ciphertext(ciphertext); 149| | 150| | /* For the IND-CCA2 KEM we must ensure that c = Enc(h, (r,m)). */ 151| | /* We can avoid re-computing r*h + Lift(m) as long as we check that */ 152| | /* r (defined as b/h mod (q, Phi_n)) and m are in the message space. */ 153| | /* (m can take any value in S3 in NTRU_HRSS) */ 154| 14| fail |= owcpa_check_m(m); 155| | 156| | /* b = c - Lift(m) mod (q, x^n - 1) */ 157| 14| PQCLEAN_NTRUHPS2048677_AVX2_poly_lift(liftm, m); 158| 9.49k| for (i = 0; i < NTRU_N; i++) { ------------------ | | 5| 9.49k|#define NTRU_N 677 ------------------ | Branch (158:17): [True: 9.47k, False: 14] ------------------ 159| 9.47k| b->coeffs[i] = c->coeffs[i] - liftm->coeffs[i]; 160| 9.47k| } 161| | 162| | /* r = b / h mod (q, Phi_n) */ 163| 14| PQCLEAN_NTRUHPS2048677_AVX2_poly_Sq_frombytes(invh, secretkey + 2 * NTRU_PACK_TRINARY_BYTES); ------------------ | | 26| 14|#define NTRU_PACK_TRINARY_BYTES ((NTRU_PACK_DEG+4)/5) | | ------------------ | | | | 25| 14|#define NTRU_PACK_DEG (NTRU_N-1) | | | | ------------------ | | | | | | 5| 14|#define NTRU_N 677 | | | | ------------------ | | ------------------ ------------------ 164| 14| PQCLEAN_NTRUHPS2048677_AVX2_poly_Sq_mul(r, b, invh); 165| | 166| | /* NOTE: Our definition of r as b/h mod (q, Phi_n) follows Figure 4 of */ 167| | /* [Sch18] https://eprint.iacr.org/2018/1174/20181203:032458. */ 168| | /* This differs from Figure 10 of Saito--Xagawa--Yamakawa */ 169| | /* [SXY17] https://eprint.iacr.org/2017/1005/20180516:055500 */ 170| | /* where r gets a final reduction modulo p. */ 171| | /* We need this change to use Proposition 1 of [Sch18]. */ 172| | 173| | /* Proposition 1 of [Sch18] shows that re-encryption with (r,m) yields c. */ 174| | /* if and only if fail==0 after the following call to owcpa_check_r */ 175| | /* The procedure given in Fig. 8 of [Sch18] can be skipped because we have */ 176| | /* c(1) = 0 due to the use of poly_Rq_sum_zero_{to,from}bytes. */ 177| 14| fail |= owcpa_check_r(r); 178| | 179| 14| PQCLEAN_NTRUHPS2048677_AVX2_poly_trinary_Zq_to_Z3(r); 180| 14| PQCLEAN_NTRUHPS2048677_AVX2_poly_S3_tobytes(rm, r); 181| | 182| 14| return fail; 183| 14|} PQCLEAN_NTRUHPS2048677_AVX2_poly_S3_tobytes: 3| 84|void PQCLEAN_NTRUHPS2048677_AVX2_poly_S3_tobytes(unsigned char msg[NTRU_PACK_TRINARY_BYTES], const poly *a) { 4| 84| int i; 5| 84| unsigned char c; 6| 84| int j; 7| | 8| 11.4k| for (i = 0; i < NTRU_PACK_DEG / 5; i++) { ------------------ | | 25| 11.4k|#define NTRU_PACK_DEG (NTRU_N-1) | | ------------------ | | | | 5| 11.4k|#define NTRU_N 677 | | ------------------ ------------------ | Branch (8:17): [True: 11.3k, False: 84] ------------------ 9| 11.3k| c = a->coeffs[5 * i + 4] & 255; 10| 11.3k| c = (3 * c + a->coeffs[5 * i + 3]) & 255; 11| 11.3k| c = (3 * c + a->coeffs[5 * i + 2]) & 255; 12| 11.3k| c = (3 * c + a->coeffs[5 * i + 1]) & 255; 13| 11.3k| c = (3 * c + a->coeffs[5 * i + 0]) & 255; 14| 11.3k| msg[i] = c; 15| 11.3k| } 16| 84| i = NTRU_PACK_DEG / 5; ------------------ | | 25| 84|#define NTRU_PACK_DEG (NTRU_N-1) | | ------------------ | | | | 5| 84|#define NTRU_N 677 | | ------------------ ------------------ 17| 84| c = 0; 18| 168| for (j = NTRU_PACK_DEG - (5 * i) - 1; j >= 0; j--) { ------------------ | | 25| 84|#define NTRU_PACK_DEG (NTRU_N-1) | | ------------------ | | | | 5| 84|#define NTRU_N 677 | | ------------------ ------------------ | Branch (18:43): [True: 84, False: 84] ------------------ 19| 84| c = (3 * c + a->coeffs[5 * i + j]) & 255; 20| 84| } 21| 84| msg[i] = c; 22| 84|} PQCLEAN_NTRUHPS2048677_AVX2_poly_S3_frombytes: 24| 28|void PQCLEAN_NTRUHPS2048677_AVX2_poly_S3_frombytes(poly *r, const unsigned char msg[NTRU_PACK_TRINARY_BYTES]) { 25| 28| int i; 26| 28| unsigned char c; 27| 28| int j; 28| | 29| 3.80k| for (i = 0; i < NTRU_PACK_DEG / 5; i++) { ------------------ | | 25| 3.80k|#define NTRU_PACK_DEG (NTRU_N-1) | | ------------------ | | | | 5| 3.80k|#define NTRU_N 677 | | ------------------ ------------------ | Branch (29:17): [True: 3.78k, False: 28] ------------------ 30| 3.78k| c = msg[i]; 31| 3.78k| r->coeffs[5 * i + 0] = c; 32| 3.78k| r->coeffs[5 * i + 1] = c * 171 >> 9; // this is division by 3 33| 3.78k| r->coeffs[5 * i + 2] = c * 57 >> 9; // division by 3^2 34| 3.78k| r->coeffs[5 * i + 3] = c * 19 >> 9; // division by 3^3 35| 3.78k| r->coeffs[5 * i + 4] = c * 203 >> 14; // etc. 36| 3.78k| } 37| 28| i = NTRU_PACK_DEG / 5; ------------------ | | 25| 28|#define NTRU_PACK_DEG (NTRU_N-1) | | ------------------ | | | | 5| 28|#define NTRU_N 677 | | ------------------ ------------------ 38| 28| c = msg[i]; 39| 56| for (j = 0; (5 * i + j) < NTRU_PACK_DEG; j++) { ------------------ | | 25| 56|#define NTRU_PACK_DEG (NTRU_N-1) | | ------------------ | | | | 5| 56|#define NTRU_N 677 | | ------------------ ------------------ | Branch (39:17): [True: 28, False: 28] ------------------ 40| 28| r->coeffs[5 * i + j] = c; 41| 28| c = c * 171 >> 9; 42| 28| } 43| 28| r->coeffs[NTRU_N - 1] = 0; ------------------ | | 5| 28|#define NTRU_N 677 ------------------ 44| 28| PQCLEAN_NTRUHPS2048677_AVX2_poly_mod_3_Phi_n(r); 45| 28|} PQCLEAN_NTRUHPS2048677_AVX2_poly_Sq_tobytes: 3| 42|void PQCLEAN_NTRUHPS2048677_AVX2_poly_Sq_tobytes(unsigned char *r, const poly *a) { 4| 42| int i, j; 5| 42| uint16_t t[8]; 6| | 7| 3.57k| for (i = 0; i < NTRU_PACK_DEG / 8; i++) { ------------------ | | 25| 3.57k|#define NTRU_PACK_DEG (NTRU_N-1) | | ------------------ | | | | 5| 3.57k|#define NTRU_N 677 | | ------------------ ------------------ | Branch (7:17): [True: 3.52k, False: 42] ------------------ 8| 31.7k| for (j = 0; j < 8; j++) { ------------------ | Branch (8:21): [True: 28.2k, False: 3.52k] ------------------ 9| 28.2k| t[j] = MODQ(a->coeffs[8 * i + j]); ------------------ | | 9| 28.2k|#define MODQ(X) ((X) & (NTRU_Q-1)) | | ------------------ | | | | 13| 28.2k|#define NTRU_Q (1 << NTRU_LOGQ) | | | | ------------------ | | | | | | 6| 28.2k|#define NTRU_LOGQ 11 | | | | ------------------ | | ------------------ ------------------ 10| 28.2k| } 11| | 12| 3.52k| r[11 * i + 0] = (unsigned char) ( t[0] & 0xff); 13| 3.52k| r[11 * i + 1] = (unsigned char) ((t[0] >> 8) | ((t[1] & 0x1f) << 3)); 14| 3.52k| r[11 * i + 2] = (unsigned char) ((t[1] >> 5) | ((t[2] & 0x03) << 6)); 15| 3.52k| r[11 * i + 3] = (unsigned char) ((t[2] >> 2) & 0xff); 16| 3.52k| r[11 * i + 4] = (unsigned char) ((t[2] >> 10) | ((t[3] & 0x7f) << 1)); 17| 3.52k| r[11 * i + 5] = (unsigned char) ((t[3] >> 7) | ((t[4] & 0x0f) << 4)); 18| 3.52k| r[11 * i + 6] = (unsigned char) ((t[4] >> 4) | ((t[5] & 0x01) << 7)); 19| 3.52k| r[11 * i + 7] = (unsigned char) ((t[5] >> 1) & 0xff); 20| 3.52k| r[11 * i + 8] = (unsigned char) ((t[5] >> 9) | ((t[6] & 0x3f) << 2)); 21| 3.52k| r[11 * i + 9] = (unsigned char) ((t[6] >> 6) | ((t[7] & 0x07) << 5)); 22| 3.52k| r[11 * i + 10] = (unsigned char) ((t[7] >> 3)); 23| 3.52k| } 24| | 25| 210| for (j = 0; j < NTRU_PACK_DEG - 8 * i; j++) { ------------------ | | 25| 210|#define NTRU_PACK_DEG (NTRU_N-1) | | ------------------ | | | | 5| 210|#define NTRU_N 677 | | ------------------ ------------------ | Branch (25:17): [True: 168, False: 42] ------------------ 26| 168| t[j] = MODQ(a->coeffs[8 * i + j]); ------------------ | | 9| 168|#define MODQ(X) ((X) & (NTRU_Q-1)) | | ------------------ | | | | 13| 168|#define NTRU_Q (1 << NTRU_LOGQ) | | | | ------------------ | | | | | | 6| 168|#define NTRU_LOGQ 11 | | | | ------------------ | | ------------------ ------------------ 27| 168| } 28| 210| for (; j < 8; j++) { ------------------ | Branch (28:12): [True: 168, False: 42] ------------------ 29| 168| t[j] = 0; 30| 168| } 31| | 32| 42| switch (NTRU_PACK_DEG & 0x07) { ------------------ | | 25| 42|#define NTRU_PACK_DEG (NTRU_N-1) | | ------------------ | | | | 5| 42|#define NTRU_N 677 | | ------------------ ------------------ | Branch (32:13): [True: 42, Folded] ------------------ 33| | // cases 0 and 6 are impossible since 2 generates (Z/n)* and 34| | // p mod 8 in {1, 7} implies that 2 is a quadratic residue. 35| 42| case 4: ------------------ | Branch (35:5): [True: 42, False: 0] ------------------ 36| 42| r[11 * i + 0] = (unsigned char) (t[0] & 0xff); 37| 42| r[11 * i + 1] = (unsigned char) (t[0] >> 8) | ((t[1] & 0x1f) << 3); 38| 42| r[11 * i + 2] = (unsigned char) (t[1] >> 5) | ((t[2] & 0x03) << 6); 39| 42| r[11 * i + 3] = (unsigned char) (t[2] >> 2) & 0xff; 40| 42| r[11 * i + 4] = (unsigned char) (t[2] >> 10) | ((t[3] & 0x7f) << 1); 41| 42| r[11 * i + 5] = (unsigned char) (t[3] >> 7) | ((t[4] & 0x0f) << 4); 42| 42| break; 43| 0| case 2: ------------------ | Branch (43:5): [True: 0, False: 42] ------------------ 44| 0| r[11 * i + 0] = (unsigned char) (t[0] & 0xff); 45| 0| r[11 * i + 1] = (unsigned char) (t[0] >> 8) | ((t[1] & 0x1f) << 3); 46| 0| r[11 * i + 2] = (unsigned char) (t[1] >> 5) | ((t[2] & 0x03) << 6); 47| 0| break; 48| 42| } 49| 42|} PQCLEAN_NTRUHPS2048677_AVX2_poly_Sq_frombytes: 51| 42|void PQCLEAN_NTRUHPS2048677_AVX2_poly_Sq_frombytes(poly *r, const unsigned char *a) { 52| 42| int i; 53| 3.57k| for (i = 0; i < NTRU_PACK_DEG / 8; i++) { ------------------ | | 25| 3.57k|#define NTRU_PACK_DEG (NTRU_N-1) | | ------------------ | | | | 5| 3.57k|#define NTRU_N 677 | | ------------------ ------------------ | Branch (53:17): [True: 3.52k, False: 42] ------------------ 54| 3.52k| r->coeffs[8 * i + 0] = (a[11 * i + 0] >> 0) | (((uint16_t)a[11 * i + 1] & 0x07) << 8); 55| 3.52k| r->coeffs[8 * i + 1] = (a[11 * i + 1] >> 3) | (((uint16_t)a[11 * i + 2] & 0x3f) << 5); 56| 3.52k| r->coeffs[8 * i + 2] = (a[11 * i + 2] >> 6) | (((uint16_t)a[11 * i + 3] & 0xff) << 2) | (((uint16_t)a[11 * i + 4] & 0x01) << 10); 57| 3.52k| r->coeffs[8 * i + 3] = (a[11 * i + 4] >> 1) | (((uint16_t)a[11 * i + 5] & 0x0f) << 7); 58| 3.52k| r->coeffs[8 * i + 4] = (a[11 * i + 5] >> 4) | (((uint16_t)a[11 * i + 6] & 0x7f) << 4); 59| 3.52k| r->coeffs[8 * i + 5] = (a[11 * i + 6] >> 7) | (((uint16_t)a[11 * i + 7] & 0xff) << 1) | (((uint16_t)a[11 * i + 8] & 0x03) << 9); 60| 3.52k| r->coeffs[8 * i + 6] = (a[11 * i + 8] >> 2) | (((uint16_t)a[11 * i + 9] & 0x1f) << 6); 61| 3.52k| r->coeffs[8 * i + 7] = (a[11 * i + 9] >> 5) | (((uint16_t)a[11 * i + 10] & 0xff) << 3); 62| 3.52k| } 63| 42| switch (NTRU_PACK_DEG & 0x07) { ------------------ | | 25| 42|#define NTRU_PACK_DEG (NTRU_N-1) | | ------------------ | | | | 5| 42|#define NTRU_N 677 | | ------------------ ------------------ | Branch (63:13): [True: 42, Folded] ------------------ 64| | // cases 0 and 6 are impossible since 2 generates (Z/n)* and 65| | // p mod 8 in {1, 7} implies that 2 is a quadratic residue. 66| 42| case 4: ------------------ | Branch (66:5): [True: 42, False: 0] ------------------ 67| 42| r->coeffs[8 * i + 0] = (a[11 * i + 0] >> 0) | (((uint16_t)a[11 * i + 1] & 0x07) << 8); 68| 42| r->coeffs[8 * i + 1] = (a[11 * i + 1] >> 3) | (((uint16_t)a[11 * i + 2] & 0x3f) << 5); 69| 42| r->coeffs[8 * i + 2] = (a[11 * i + 2] >> 6) | (((uint16_t)a[11 * i + 3] & 0xff) << 2) | (((uint16_t)a[11 * i + 4] & 0x01) << 10); 70| 42| r->coeffs[8 * i + 3] = (a[11 * i + 4] >> 1) | (((uint16_t)a[11 * i + 5] & 0x0f) << 7); 71| 42| break; 72| 0| case 2: ------------------ | Branch (72:5): [True: 0, False: 42] ------------------ 73| 0| r->coeffs[8 * i + 0] = (a[11 * i + 0] >> 0) | (((uint16_t)a[11 * i + 1] & 0x07) << 8); 74| 0| r->coeffs[8 * i + 1] = (a[11 * i + 1] >> 3) | (((uint16_t)a[11 * i + 2] & 0x3f) << 5); 75| 0| break; 76| 42| } 77| 42| r->coeffs[NTRU_N - 1] = 0; ------------------ | | 5| 42|#define NTRU_N 677 ------------------ 78| 42|} PQCLEAN_NTRUHPS2048677_AVX2_poly_Rq_sum_zero_tobytes: 80| 28|void PQCLEAN_NTRUHPS2048677_AVX2_poly_Rq_sum_zero_tobytes(unsigned char *r, const poly *a) { 81| 28| PQCLEAN_NTRUHPS2048677_AVX2_poly_Sq_tobytes(r, a); 82| 28|} PQCLEAN_NTRUHPS2048677_AVX2_poly_Rq_sum_zero_frombytes: 84| 28|void PQCLEAN_NTRUHPS2048677_AVX2_poly_Rq_sum_zero_frombytes(poly *r, const unsigned char *a) { 85| 28| int i; 86| 28| PQCLEAN_NTRUHPS2048677_AVX2_poly_Sq_frombytes(r, a); 87| | 88| | /* Set r[n-1] so that the sum of coefficients is zero mod q */ 89| 28| r->coeffs[NTRU_N - 1] = 0; ------------------ | | 5| 28|#define NTRU_N 677 ------------------ 90| 18.9k| for (i = 0; i < NTRU_PACK_DEG; i++) { ------------------ | | 25| 18.9k|#define NTRU_PACK_DEG (NTRU_N-1) | | ------------------ | | | | 5| 18.9k|#define NTRU_N 677 | | ------------------ ------------------ | Branch (90:17): [True: 18.9k, False: 28] ------------------ 91| 18.9k| r->coeffs[NTRU_N - 1] -= r->coeffs[i]; ------------------ | | 5| 18.9k|#define NTRU_N 677 ------------------ 92| 18.9k| } 93| 28|} PQCLEAN_NTRUHPS2048677_AVX2_poly_Z3_to_Zq: 4| 84|void PQCLEAN_NTRUHPS2048677_AVX2_poly_Z3_to_Zq(poly *r) { 5| 84| int i; 6| 56.9k| for (i = 0; i < NTRU_N; i++) { ------------------ | | 5| 56.9k|#define NTRU_N 677 ------------------ | Branch (6:17): [True: 56.8k, False: 84] ------------------ 7| 56.8k| r->coeffs[i] = r->coeffs[i] | ((-(r->coeffs[i] >> 1)) & (NTRU_Q - 1)); ------------------ | | 13| 56.8k|#define NTRU_Q (1 << NTRU_LOGQ) | | ------------------ | | | | 6| 56.8k|#define NTRU_LOGQ 11 | | ------------------ ------------------ 8| 56.8k| } 9| 84|} PQCLEAN_NTRUHPS2048677_AVX2_poly_trinary_Zq_to_Z3: 12| 14|void PQCLEAN_NTRUHPS2048677_AVX2_poly_trinary_Zq_to_Z3(poly *r) { 13| 14| int i; 14| 9.49k| for (i = 0; i < NTRU_N; i++) { ------------------ | | 5| 9.49k|#define NTRU_N 677 ------------------ | Branch (14:17): [True: 9.47k, False: 14] ------------------ 15| 9.47k| r->coeffs[i] = MODQ(r->coeffs[i]); ------------------ | | 9| 9.47k|#define MODQ(X) ((X) & (NTRU_Q-1)) | | ------------------ | | | | 13| 9.47k|#define NTRU_Q (1 << NTRU_LOGQ) | | | | ------------------ | | | | | | 6| 9.47k|#define NTRU_LOGQ 11 | | | | ------------------ | | ------------------ ------------------ 16| 9.47k| r->coeffs[i] = 3 & (r->coeffs[i] ^ (r->coeffs[i] >> (NTRU_LOGQ - 1))); ------------------ | | 6| 9.47k|#define NTRU_LOGQ 11 ------------------ 17| 9.47k| } 18| 14|} PQCLEAN_NTRUHPS2048677_AVX2_poly_Sq_mul: 20| 28|void PQCLEAN_NTRUHPS2048677_AVX2_poly_Sq_mul(poly *r, const poly *a, const poly *b) { 21| 28| PQCLEAN_NTRUHPS2048677_AVX2_poly_Rq_mul(r, a, b); 22| 28| PQCLEAN_NTRUHPS2048677_AVX2_poly_mod_q_Phi_n(r); 23| 28|} PQCLEAN_NTRUHPS2048677_AVX2_poly_S3_mul: 25| 14|void PQCLEAN_NTRUHPS2048677_AVX2_poly_S3_mul(poly *r, const poly *a, const poly *b) { 26| 14| int i; 27| | 28| | /* Our S3 multiplications do not overflow mod q, */ 29| | /* so we can re-purpose PQCLEAN_NTRUHPS2048677_AVX2_poly_Rq_mul, as long as we */ 30| | /* follow with an explicit reduction mod q. */ 31| 14| PQCLEAN_NTRUHPS2048677_AVX2_poly_Rq_mul(r, a, b); 32| 9.49k| for (i = 0; i < NTRU_N; i++) { ------------------ | | 5| 9.49k|#define NTRU_N 677 ------------------ | Branch (32:17): [True: 9.47k, False: 14] ------------------ 33| 9.47k| r->coeffs[i] = MODQ(r->coeffs[i]); ------------------ | | 9| 9.47k|#define MODQ(X) ((X) & (NTRU_Q-1)) | | ------------------ | | | | 13| 9.47k|#define NTRU_Q (1 << NTRU_LOGQ) | | | | ------------------ | | | | | | 6| 9.47k|#define NTRU_LOGQ 11 | | | | ------------------ | | ------------------ ------------------ 34| 9.47k| } 35| 14| PQCLEAN_NTRUHPS2048677_AVX2_poly_mod_3_Phi_n(r); 36| 14|} PQCLEAN_NTRUHPS2048677_AVX2_poly_Rq_inv: 71| 14|void PQCLEAN_NTRUHPS2048677_AVX2_poly_Rq_inv(poly *r, const poly *a) { 72| 14| poly ai2; 73| 14| PQCLEAN_NTRUHPS2048677_AVX2_poly_R2_inv(&ai2, a); 74| 14| PQCLEAN_NTRUHPS2048677_AVX2_poly_R2_inv_to_Rq_inv(r, &ai2, a); 75| 14|} poly.c:PQCLEAN_NTRUHPS2048677_AVX2_poly_R2_inv_to_Rq_inv: 38| 14|static void PQCLEAN_NTRUHPS2048677_AVX2_poly_R2_inv_to_Rq_inv(poly *r, const poly *ai, const poly *a) { 39| | 40| 14| int i; 41| 14| poly b, c; 42| 14| poly s; 43| | 44| | // for 0..4 45| | // ai = ai * (2 - a*ai) mod q 46| 9.49k| for (i = 0; i < NTRU_N; i++) { ------------------ | | 5| 9.49k|#define NTRU_N 677 ------------------ | Branch (46:17): [True: 9.47k, False: 14] ------------------ 47| 9.47k| b.coeffs[i] = -(a->coeffs[i]); 48| 9.47k| } 49| | 50| 9.49k| for (i = 0; i < NTRU_N; i++) { ------------------ | | 5| 9.49k|#define NTRU_N 677 ------------------ | Branch (50:17): [True: 9.47k, False: 14] ------------------ 51| 9.47k| r->coeffs[i] = ai->coeffs[i]; 52| 9.47k| } 53| | 54| 14| PQCLEAN_NTRUHPS2048677_AVX2_poly_Rq_mul(&c, r, &b); 55| 14| c.coeffs[0] += 2; // c = 2 - a*ai 56| 14| PQCLEAN_NTRUHPS2048677_AVX2_poly_Rq_mul(&s, &c, r); // s = ai*c 57| | 58| 14| PQCLEAN_NTRUHPS2048677_AVX2_poly_Rq_mul(&c, &s, &b); 59| 14| c.coeffs[0] += 2; // c = 2 - a*s 60| 14| PQCLEAN_NTRUHPS2048677_AVX2_poly_Rq_mul(r, &c, &s); // r = s*c 61| | 62| 14| PQCLEAN_NTRUHPS2048677_AVX2_poly_Rq_mul(&c, r, &b); 63| 14| c.coeffs[0] += 2; // c = 2 - a*r 64| 14| PQCLEAN_NTRUHPS2048677_AVX2_poly_Rq_mul(&s, &c, r); // s = r*c 65| | 66| 14| PQCLEAN_NTRUHPS2048677_AVX2_poly_Rq_mul(&c, &s, &b); 67| 14| c.coeffs[0] += 2; // c = 2 - a*s 68| 14| PQCLEAN_NTRUHPS2048677_AVX2_poly_Rq_mul(r, &c, &s); // r = s*c 69| 14|} PQCLEAN_NTRUHPS2048677_AVX2_poly_lift: 3| 28|void PQCLEAN_NTRUHPS2048677_AVX2_poly_lift(poly *r, const poly *a) { 4| 28| int i; 5| 18.9k| for (i = 0; i < NTRU_N; i++) { ------------------ | | 5| 18.9k|#define NTRU_N 677 ------------------ | Branch (5:17): [True: 18.9k, False: 28] ------------------ 6| 18.9k| r->coeffs[i] = a->coeffs[i]; 7| 18.9k| } 8| 28| PQCLEAN_NTRUHPS2048677_AVX2_poly_Z3_to_Zq(r); 9| 28|} PQCLEAN_NTRUHPS2048677_AVX2_poly_R2_tobytes: 6| 14|void PQCLEAN_NTRUHPS2048677_AVX2_poly_R2_tobytes(unsigned char *out, const poly *a) { 7| 14| int i, j, k; 8| 182| for (i = 0; i < 12; i++) { ------------------ | Branch (8:17): [True: 168, False: 14] ------------------ 9| 1.51k| for (k = 0; k < 8; k++) { ------------------ | Branch (9:21): [True: 1.34k, False: 168] ------------------ 10| 1.34k| out[i * 8 + k] = 0; 11| 12.0k| for (j = 0; j < 8; j++) { ------------------ | Branch (11:25): [True: 10.7k, False: 1.34k] ------------------ 12| 10.7k| if ((i * 8 + k) * 8 + j < NTRU_N) { ------------------ | | 5| 10.7k|#define NTRU_N 677 ------------------ | Branch (12:21): [True: 9.47k, False: 1.27k] ------------------ 13| 9.47k| out[i * 8 + k] |= (a->coeffs[(i * 8 + k) * 8 + j] & 1) << j; 14| 9.47k| } 15| 10.7k| } 16| 1.34k| } 17| 168| } 18| 14|} PQCLEAN_NTRUHPS2048677_AVX2_poly_R2_frombytes: 20| 14|void PQCLEAN_NTRUHPS2048677_AVX2_poly_R2_frombytes(poly *a, const unsigned char *in) { 21| 14| int i, j, k; 22| 182| for (i = 0; i < 12; i++) { ------------------ | Branch (22:17): [True: 168, False: 14] ------------------ 23| 1.51k| for (k = 0; k < 8; k++) { ------------------ | Branch (23:21): [True: 1.34k, False: 168] ------------------ 24| 12.0k| for (j = 0; j < 8; j++) { ------------------ | Branch (24:25): [True: 10.7k, False: 1.34k] ------------------ 25| 10.7k| if ((i * 8 + k) * 8 + j < NTRU_N) { ------------------ | | 5| 10.7k|#define NTRU_N 677 ------------------ | Branch (25:21): [True: 9.47k, False: 1.27k] ------------------ 26| 9.47k| a->coeffs[(i * 8 + k) * 8 + j] = (in[i * 8 + k] >> j) & 1; 27| 9.47k| } 28| 10.7k| } 29| 1.34k| } 30| 168| } 31| 14|} PQCLEAN_NTRUHPS2048677_AVX2_poly_R2_inv: 33| 14|void PQCLEAN_NTRUHPS2048677_AVX2_poly_R2_inv(poly *r, const poly *a) { 34| 14| union { 35| 14| unsigned char s[96]; 36| 14| __m256i s_x32[3]; 37| 14| } squares[13]; 38| 14|#define s(x) squares[(x)].s 39| | 40| | // This relies on the following addition chain: 41| | // 1, 2, 3, 5, 10, 20, 21, 42, 84, 168, 336, 672, 675 42| | 43| 14| PQCLEAN_NTRUHPS2048677_AVX2_poly_R2_tobytes(s(0), a); // TODO alignment ------------------ | | 38| 14|#define s(x) squares[(x)].s ------------------ 44| | 45| 14| PQCLEAN_NTRUHPS2048677_AVX2_square_1_677(s(1), s(0)); ------------------ | | 38| 14|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS2048677_AVX2_square_1_677(s(1), s(0)); ------------------ | | 38| 14|#define s(x) squares[(x)].s ------------------ 46| 14| PQCLEAN_NTRUHPS2048677_AVX2_poly_R2_mul(s(1), s(1), s(0)); ------------------ | | 38| 14|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS2048677_AVX2_poly_R2_mul(s(1), s(1), s(0)); ------------------ | | 38| 14|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS2048677_AVX2_poly_R2_mul(s(1), s(1), s(0)); ------------------ | | 38| 14|#define s(x) squares[(x)].s ------------------ 47| 14| PQCLEAN_NTRUHPS2048677_AVX2_square_1_677(s(2), s(1)); ------------------ | | 38| 14|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS2048677_AVX2_square_1_677(s(2), s(1)); ------------------ | | 38| 14|#define s(x) squares[(x)].s ------------------ 48| 14| PQCLEAN_NTRUHPS2048677_AVX2_poly_R2_mul(s(2), s(2), s(0)); ------------------ | | 38| 14|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS2048677_AVX2_poly_R2_mul(s(2), s(2), s(0)); ------------------ | | 38| 14|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS2048677_AVX2_poly_R2_mul(s(2), s(2), s(0)); ------------------ | | 38| 14|#define s(x) squares[(x)].s ------------------ 49| 14| PQCLEAN_NTRUHPS2048677_AVX2_square_2_677(s(3), s(2)); ------------------ | | 38| 14|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS2048677_AVX2_square_2_677(s(3), s(2)); ------------------ | | 38| 14|#define s(x) squares[(x)].s ------------------ 50| 14| PQCLEAN_NTRUHPS2048677_AVX2_poly_R2_mul(s(3), s(3), s(1)); ------------------ | | 38| 14|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS2048677_AVX2_poly_R2_mul(s(3), s(3), s(1)); ------------------ | | 38| 14|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS2048677_AVX2_poly_R2_mul(s(3), s(3), s(1)); ------------------ | | 38| 14|#define s(x) squares[(x)].s ------------------ 51| 14| PQCLEAN_NTRUHPS2048677_AVX2_square_5_677(s(4), s(3)); ------------------ | | 38| 14|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS2048677_AVX2_square_5_677(s(4), s(3)); ------------------ | | 38| 14|#define s(x) squares[(x)].s ------------------ 52| 14| PQCLEAN_NTRUHPS2048677_AVX2_poly_R2_mul(s(4), s(4), s(3)); ------------------ | | 38| 14|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS2048677_AVX2_poly_R2_mul(s(4), s(4), s(3)); ------------------ | | 38| 14|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS2048677_AVX2_poly_R2_mul(s(4), s(4), s(3)); ------------------ | | 38| 14|#define s(x) squares[(x)].s ------------------ 53| 14| PQCLEAN_NTRUHPS2048677_AVX2_square_10_677(s(5), s(4)); ------------------ | | 38| 14|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS2048677_AVX2_square_10_677(s(5), s(4)); ------------------ | | 38| 14|#define s(x) squares[(x)].s ------------------ 54| 14| PQCLEAN_NTRUHPS2048677_AVX2_poly_R2_mul(s(5), s(5), s(4)); ------------------ | | 38| 14|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS2048677_AVX2_poly_R2_mul(s(5), s(5), s(4)); ------------------ | | 38| 14|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS2048677_AVX2_poly_R2_mul(s(5), s(5), s(4)); ------------------ | | 38| 14|#define s(x) squares[(x)].s ------------------ 55| 14| PQCLEAN_NTRUHPS2048677_AVX2_square_1_677(s(6), s(5)); ------------------ | | 38| 14|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS2048677_AVX2_square_1_677(s(6), s(5)); ------------------ | | 38| 14|#define s(x) squares[(x)].s ------------------ 56| 14| PQCLEAN_NTRUHPS2048677_AVX2_poly_R2_mul(s(6), s(6), s(0)); ------------------ | | 38| 14|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS2048677_AVX2_poly_R2_mul(s(6), s(6), s(0)); ------------------ | | 38| 14|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS2048677_AVX2_poly_R2_mul(s(6), s(6), s(0)); ------------------ | | 38| 14|#define s(x) squares[(x)].s ------------------ 57| 14| PQCLEAN_NTRUHPS2048677_AVX2_square_21_677(s(7), s(6)); ------------------ | | 38| 14|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS2048677_AVX2_square_21_677(s(7), s(6)); ------------------ | | 38| 14|#define s(x) squares[(x)].s ------------------ 58| 14| PQCLEAN_NTRUHPS2048677_AVX2_poly_R2_mul(s(7), s(7), s(6)); ------------------ | | 38| 14|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS2048677_AVX2_poly_R2_mul(s(7), s(7), s(6)); ------------------ | | 38| 14|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS2048677_AVX2_poly_R2_mul(s(7), s(7), s(6)); ------------------ | | 38| 14|#define s(x) squares[(x)].s ------------------ 59| 14| PQCLEAN_NTRUHPS2048677_AVX2_square_42_677(s(8), s(7)); ------------------ | | 38| 14|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS2048677_AVX2_square_42_677(s(8), s(7)); ------------------ | | 38| 14|#define s(x) squares[(x)].s ------------------ 60| 14| PQCLEAN_NTRUHPS2048677_AVX2_poly_R2_mul(s(8), s(8), s(7)); ------------------ | | 38| 14|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS2048677_AVX2_poly_R2_mul(s(8), s(8), s(7)); ------------------ | | 38| 14|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS2048677_AVX2_poly_R2_mul(s(8), s(8), s(7)); ------------------ | | 38| 14|#define s(x) squares[(x)].s ------------------ 61| 14| PQCLEAN_NTRUHPS2048677_AVX2_square_84_677(s(9), s(8)); ------------------ | | 38| 14|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS2048677_AVX2_square_84_677(s(9), s(8)); ------------------ | | 38| 14|#define s(x) squares[(x)].s ------------------ 62| 14| PQCLEAN_NTRUHPS2048677_AVX2_poly_R2_mul(s(9), s(9), s(8)); ------------------ | | 38| 14|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS2048677_AVX2_poly_R2_mul(s(9), s(9), s(8)); ------------------ | | 38| 14|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS2048677_AVX2_poly_R2_mul(s(9), s(9), s(8)); ------------------ | | 38| 14|#define s(x) squares[(x)].s ------------------ 63| 14| PQCLEAN_NTRUHPS2048677_AVX2_square_168_677(s(10), s(9)); ------------------ | | 38| 14|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS2048677_AVX2_square_168_677(s(10), s(9)); ------------------ | | 38| 14|#define s(x) squares[(x)].s ------------------ 64| 14| PQCLEAN_NTRUHPS2048677_AVX2_poly_R2_mul(s(10), s(10), s(9)); ------------------ | | 38| 14|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS2048677_AVX2_poly_R2_mul(s(10), s(10), s(9)); ------------------ | | 38| 14|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS2048677_AVX2_poly_R2_mul(s(10), s(10), s(9)); ------------------ | | 38| 14|#define s(x) squares[(x)].s ------------------ 65| 14| PQCLEAN_NTRUHPS2048677_AVX2_square_336_677(s(11), s(10)); ------------------ | | 38| 14|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS2048677_AVX2_square_336_677(s(11), s(10)); ------------------ | | 38| 14|#define s(x) squares[(x)].s ------------------ 66| 14| PQCLEAN_NTRUHPS2048677_AVX2_poly_R2_mul(s(11), s(11), s(10)); ------------------ | | 38| 14|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS2048677_AVX2_poly_R2_mul(s(11), s(11), s(10)); ------------------ | | 38| 14|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS2048677_AVX2_poly_R2_mul(s(11), s(11), s(10)); ------------------ | | 38| 14|#define s(x) squares[(x)].s ------------------ 67| 14| PQCLEAN_NTRUHPS2048677_AVX2_square_3_677(s(12), s(11)); ------------------ | | 38| 14|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS2048677_AVX2_square_3_677(s(12), s(11)); ------------------ | | 38| 14|#define s(x) squares[(x)].s ------------------ 68| 14| PQCLEAN_NTRUHPS2048677_AVX2_poly_R2_mul(s(12), s(12), s(2)); ------------------ | | 38| 14|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS2048677_AVX2_poly_R2_mul(s(12), s(12), s(2)); ------------------ | | 38| 14|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS2048677_AVX2_poly_R2_mul(s(12), s(12), s(2)); ------------------ | | 38| 14|#define s(x) squares[(x)].s ------------------ 69| 14| PQCLEAN_NTRUHPS2048677_AVX2_square_1_677(s(0), s(12)); ------------------ | | 38| 14|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS2048677_AVX2_square_1_677(s(0), s(12)); ------------------ | | 38| 14|#define s(x) squares[(x)].s ------------------ 70| | 71| 14| PQCLEAN_NTRUHPS2048677_AVX2_poly_R2_frombytes(r, s(0)); ------------------ | | 38| 14|#define s(x) squares[(x)].s ------------------ 72| 14|#undef s 73| 14|} PQCLEAN_NTRUHPS2048677_AVX2_poly_S3_inv: 545| 14|void PQCLEAN_NTRUHPS2048677_AVX2_poly_S3_inv(poly *r_out, const poly *a) { 546| 14| const unsigned char *in = (void *) a; 547| 14| unsigned char *out = (void *) r_out; 548| | 549| 14| small input[ppad]; 550| 14| small output[ppad]; 551| 14| int i; 552| | 553| | /* XXX: obviously input/output format should be packed into bytes */ 554| | 555| 9.47k| for (i = 0; i < p; ++i) { ------------------ | | 7| 9.47k|#define p 676 ------------------ | Branch (555:17): [True: 9.46k, False: 14] ------------------ 556| 9.46k| small x = in[2 * i] & 3; /* 0 1 2 3 */ 557| 9.46k| x += 1; /* 0 1 2 3 4 5 6, offset by 1 */ 558| 9.46k| x &= (x - 3) >> 5; /* 0 1 2, offset by 1 */ 559| 9.46k| input[i] = x - 1; 560| 9.46k| } 561| | /* XXX: merge with vec256_init */ 562| | 563| 14| __poly_S3_inv((unsigned char *)output, (unsigned char *)input); 564| | 565| 9.47k| for (i = 0; i < p; ++i) { ------------------ | | 7| 9.47k|#define p 676 ------------------ | Branch (565:17): [True: 9.46k, False: 14] ------------------ 566| 9.46k| out[2 * i] = (3 & output[i]) ^ ((3 & output[i]) >> 1); 567| 9.46k| out[2 * i + 1] = 0; 568| 9.46k| } 569| 14|} poly_s3_inv.c:vec256_divx_3: 280| 79.7k|static inline void vec256_divx_3(vec256 *f) { 281| 79.7k| vec256 f0 = f[0]; 282| 79.7k| vec256 f1 = f[1]; 283| 79.7k| vec256 f2 = f[2]; 284| | 285| 79.7k| unsigned long long low0 = _mm_cvtsi128_si64(_mm256_castsi256_si128(f0)); 286| 79.7k| unsigned long long low1 = _mm_cvtsi128_si64(_mm256_castsi256_si128(f1)); 287| 79.7k| unsigned long long low2 = _mm_cvtsi128_si64(_mm256_castsi256_si128(f2)); 288| | 289| 79.7k| low0 = (low0 >> 1) | (low1 << 63); 290| 79.7k| low1 = (low1 >> 1) | (low2 << 63); 291| 79.7k| low2 = low2 >> 1; 292| | 293| 79.7k| f0 = _mm256_blend_epi32(f0, _mm256_set_epi64x(0, 0, 0, low0), 0x3); 294| 79.7k| f1 = _mm256_blend_epi32(f1, _mm256_set_epi64x(0, 0, 0, low1), 0x3); 295| 79.7k| f2 = _mm256_blend_epi32(f2, _mm256_set_epi64x(0, 0, 0, low2), 0x3); 296| | 297| 79.7k| f[0] = _mm256_permute4x64_epi64(f0, 0x39); 298| 79.7k| f[1] = _mm256_permute4x64_epi64(f1, 0x39); 299| | f[2] = _mm256_permute4x64_epi64(f2, 0x39); 300| 79.7k|} poly_s3_inv.c:vec256_timesx_3: 331| 79.7k|static inline void vec256_timesx_3(vec256 *f) { 332| 79.7k| vec256 f0 = _mm256_permute4x64_epi64(f[0], 0x93); 333| 79.7k| vec256 f1 = _mm256_permute4x64_epi64(f[1], 0x93); 334| 79.7k| vec256 f2 = _mm256_permute4x64_epi64(f[2], 0x93); 335| | 336| 79.7k| unsigned long long low0 = *(unsigned long long *) &f0; 337| 79.7k| unsigned long long low1 = *(unsigned long long *) &f1; 338| 79.7k| unsigned long long low2 = _mm_cvtsi128_si64(_mm256_castsi256_si128(f2)); 339| | 340| 79.7k| low2 = (low2 << 1) | (low1 >> 63); 341| 79.7k| low1 = (low1 << 1) | (low0 >> 63); 342| 79.7k| low0 = low0 << 1; 343| | 344| 79.7k| *(unsigned long long *) &f0 = low0; 345| 79.7k| *(unsigned long long *) &f1 = low1; 346| 79.7k| f2 = _mm256_blend_epi32(f2, _mm256_set_epi64x(0, 0, 0, low2), 0x3); 347| | 348| 79.7k| f[0] = f0; 349| 79.7k| f[1] = f1; 350| 79.7k| f[2] = f2; 351| 79.7k|} PQCLEAN_NTRUHPS2048677_AVX2_sample_fg: 3| 14|void PQCLEAN_NTRUHPS2048677_AVX2_sample_fg(poly *f, poly *g, const unsigned char uniformbytes[NTRU_SAMPLE_FG_BYTES]) { 4| | 5| 14| PQCLEAN_NTRUHPS2048677_AVX2_sample_iid(f, uniformbytes); 6| 14| PQCLEAN_NTRUHPS2048677_AVX2_sample_fixed_type(g, uniformbytes + NTRU_SAMPLE_IID_BYTES); ------------------ | | 20| 14|#define NTRU_SAMPLE_IID_BYTES (NTRU_N-1) | | ------------------ | | | | 5| 14|#define NTRU_N 677 | | ------------------ ------------------ 7| 14|} PQCLEAN_NTRUHPS2048677_AVX2_sample_rm: 9| 14|void PQCLEAN_NTRUHPS2048677_AVX2_sample_rm(poly *r, poly *m, const unsigned char uniformbytes[NTRU_SAMPLE_RM_BYTES]) { 10| | 11| 14| PQCLEAN_NTRUHPS2048677_AVX2_sample_iid(r, uniformbytes); 12| 14| PQCLEAN_NTRUHPS2048677_AVX2_sample_fixed_type(m, uniformbytes + NTRU_SAMPLE_IID_BYTES); ------------------ | | 20| 14|#define NTRU_SAMPLE_IID_BYTES (NTRU_N-1) | | ------------------ | | | | 5| 14|#define NTRU_N 677 | | ------------------ ------------------ 13| 14|} PQCLEAN_NTRUHPS2048677_AVX2_sample_fixed_type: 16| 28|void PQCLEAN_NTRUHPS2048677_AVX2_sample_fixed_type(poly *r, const unsigned char u[NTRU_SAMPLE_FT_BYTES]) { 17| | // Assumes NTRU_SAMPLE_FT_BYTES = ceil(30*(n-1)/8) 18| | 19| 28| int32_t s[NTRU_N - 1]; 20| 28| int i; 21| | 22| | // Use 30 bits of u per word 23| 4.76k| for (i = 0; i < (NTRU_N - 1) / 4; i++) { ------------------ | | 5| 4.76k|#define NTRU_N 677 ------------------ | Branch (23:17): [True: 4.73k, False: 28] ------------------ 24| 4.73k| s[4 * i + 0] = (u[15 * i + 0] << 2) + (u[15 * i + 1] << 10) + (u[15 * i + 2] << 18) + ((uint32_t) u[15 * i + 3] << 26); 25| 4.73k| s[4 * i + 1] = ((u[15 * i + 3] & 0xc0) >> 4) + (u[15 * i + 4] << 4) + (u[15 * i + 5] << 12) + (u[15 * i + 6] << 20) + ((uint32_t) u[15 * i + 7] << 28); 26| 4.73k| s[4 * i + 2] = ((u[15 * i + 7] & 0xf0) >> 2) + (u[15 * i + 8] << 6) + (u[15 * i + 9] << 14) + (u[15 * i + 10] << 22) + ((uint32_t) u[15 * i + 11] << 30); 27| 4.73k| s[4 * i + 3] = (u[15 * i + 11] & 0xfc) + (u[15 * i + 12] << 8) + (u[15 * i + 13] << 16) + ((uint32_t) u[15 * i + 14] << 24); 28| 4.73k| } 29| | 30| 3.58k| for (i = 0; i < NTRU_WEIGHT / 2; i++) { ------------------ | | 14| 3.58k|#define NTRU_WEIGHT (NTRU_Q/8 - 2) | | ------------------ | | | | 13| 3.58k|#define NTRU_Q (1 << NTRU_LOGQ) | | | | ------------------ | | | | | | 6| 3.58k|#define NTRU_LOGQ 11 | | | | ------------------ | | ------------------ ------------------ | Branch (30:17): [True: 3.55k, False: 28] ------------------ 31| 3.55k| s[i] |= 1; 32| 3.55k| } 33| | 34| 3.58k| for (i = NTRU_WEIGHT / 2; i < NTRU_WEIGHT; i++) { ------------------ | | 14| 28|#define NTRU_WEIGHT (NTRU_Q/8 - 2) | | ------------------ | | | | 13| 28|#define NTRU_Q (1 << NTRU_LOGQ) | | | | ------------------ | | | | | | 6| 28|#define NTRU_LOGQ 11 | | | | ------------------ | | ------------------ ------------------ for (i = NTRU_WEIGHT / 2; i < NTRU_WEIGHT; i++) { ------------------ | | 14| 3.58k|#define NTRU_WEIGHT (NTRU_Q/8 - 2) | | ------------------ | | | | 13| 3.58k|#define NTRU_Q (1 << NTRU_LOGQ) | | | | ------------------ | | | | | | 6| 3.58k|#define NTRU_LOGQ 11 | | | | ------------------ | | ------------------ ------------------ | Branch (34:31): [True: 3.55k, False: 28] ------------------ 35| 3.55k| s[i] |= 2; 36| 3.55k| } 37| | 38| 28| PQCLEAN_NTRUHPS2048677_AVX2_crypto_sort_int32(s, NTRU_N - 1); ------------------ | | 5| 28|#define NTRU_N 677 ------------------ 39| | 40| 18.9k| for (i = 0; i < NTRU_N - 1; i++) { ------------------ | | 5| 18.9k|#define NTRU_N 677 ------------------ | Branch (40:17): [True: 18.9k, False: 28] ------------------ 41| 18.9k| r->coeffs[i] = ((uint16_t) (s[i] & 3)); 42| 18.9k| } 43| | 44| 28| r->coeffs[NTRU_N - 1] = 0; ------------------ | | 5| 28|#define NTRU_N 677 ------------------ 45| 28|} PQCLEAN_NTRUHPS2048677_AVX2_sample_iid: 7| 28|void PQCLEAN_NTRUHPS2048677_AVX2_sample_iid(poly *r, const unsigned char uniformbytes[NTRU_SAMPLE_IID_BYTES]) { 8| 28| int i; 9| 28| union { /* align to 32 byte boundary for vmovdqa */ 10| 28| unsigned char b[PAD32(NTRU_SAMPLE_IID_BYTES)]; 11| 28| __m256i b_x32[PAD32(NTRU_SAMPLE_IID_BYTES) / 32]; 12| 28| } buffer; 13| | 14| 18.9k| for (i = 0; i < NTRU_SAMPLE_IID_BYTES; i++) { ------------------ | | 20| 18.9k|#define NTRU_SAMPLE_IID_BYTES (NTRU_N-1) | | ------------------ | | | | 5| 18.9k|#define NTRU_N 677 | | ------------------ ------------------ | Branch (14:17): [True: 18.9k, False: 28] ------------------ 15| 18.9k| buffer.b[i] = uniformbytes[i]; 16| 18.9k| } 17| 812| for (i = NTRU_SAMPLE_IID_BYTES; i < PAD32(NTRU_SAMPLE_IID_BYTES); i++) { ------------------ | | 20| 28|#define NTRU_SAMPLE_IID_BYTES (NTRU_N-1) | | ------------------ | | | | 5| 28|#define NTRU_N 677 | | ------------------ ------------------ for (i = NTRU_SAMPLE_IID_BYTES; i < PAD32(NTRU_SAMPLE_IID_BYTES); i++) { ------------------ | | 11| 812|#define PAD32(X) ((((X) + 31)/32)*32) ------------------ | Branch (17:37): [True: 784, False: 28] ------------------ 18| 784| buffer.b[i] = 0; 19| 784| } 20| 28| PQCLEAN_NTRUHPS2048677_AVX2_vec32_sample_iid(r, buffer.b); 21| 28|} PQCLEAN_NTRUHPS40961229_CLEAN_cmov: 4| 42|void PQCLEAN_NTRUHPS40961229_CLEAN_cmov(unsigned char *r, const unsigned char *x, size_t len, unsigned char b) { 5| 42| size_t i; 6| | 7| 42| b = (~b + 1); 8| 1.38k| for (i = 0; i < len; i++) { ------------------ | Branch (8:17): [True: 1.34k, False: 42] ------------------ 9| 1.34k| r[i] ^= b & (x[i] ^ r[i]); 10| 1.34k| } 11| 42|} PQCLEAN_NTRUHPS40961229_CLEAN_crypto_sort_int32: 20| 84|void PQCLEAN_NTRUHPS40961229_CLEAN_crypto_sort_int32(int32 *array, size_t n) { 21| 84| size_t top, p, q, r, i, j; 22| 84| int32 *x = array; ------------------ | | 6| 84|#define int32 int32_t ------------------ 23| | 24| 84| top = 1; 25| 924| while (top < n - top) { ------------------ | Branch (25:12): [True: 840, False: 84] ------------------ 26| 840| top += top; 27| 840| } 28| | 29| 1.00k| for (p = top; p >= 1; p >>= 1) { ------------------ | Branch (29:19): [True: 924, False: 84] ------------------ 30| 924| i = 0; 31| 103k| while (i + 2 * p <= n) { ------------------ | Branch (31:16): [True: 102k, False: 924] ------------------ 32| 587k| for (j = i; j < i + p; ++j) { ------------------ | Branch (32:25): [True: 485k, False: 102k] ------------------ 33| 485k| int32_MINMAX(x[j], x[j + p]); ------------------ | | 9| 485k| do { \ | | 10| 485k| int32_t ab = (b) ^ (a); \ | | 11| 485k| int32_t c = (int32_t)((int64_t)(b) - (int64_t)(a)); \ | | 12| 485k| c ^= ab & (c ^ (b)); \ | | 13| 485k| c >>= 31; \ | | 14| 485k| c &= ab; \ | | 15| 485k| (a) ^= c; \ | | 16| 485k| (b) ^= c; \ | | 17| 485k| } while(0) | | ------------------ | | | Branch (17:13): [Folded, False: 485k] | | ------------------ ------------------ 34| 485k| } 35| 102k| i += 2 * p; 36| 102k| } 37| 25.7k| for (j = i; j < n - p; ++j) { ------------------ | Branch (37:21): [True: 24.8k, False: 924] ------------------ 38| 24.8k| int32_MINMAX(x[j], x[j + p]); ------------------ | | 9| 24.8k| do { \ | | 10| 24.8k| int32_t ab = (b) ^ (a); \ | | 11| 24.8k| int32_t c = (int32_t)((int64_t)(b) - (int64_t)(a)); \ | | 12| 24.8k| c ^= ab & (c ^ (b)); \ | | 13| 24.8k| c >>= 31; \ | | 14| 24.8k| c &= ab; \ | | 15| 24.8k| (a) ^= c; \ | | 16| 24.8k| (b) ^= c; \ | | 17| 24.8k| } while(0) | | ------------------ | | | Branch (17:13): [Folded, False: 24.8k] | | ------------------ ------------------ 39| 24.8k| } 40| | 41| 924| i = 0; 42| 924| j = 0; 43| 5.54k| for (q = top; q > p; q >>= 1) { ------------------ | Branch (43:23): [True: 4.62k, False: 924] ------------------ 44| 4.62k| if (j != i) { ------------------ | Branch (44:17): [True: 840, False: 3.78k] ------------------ 45| 12.7k| for (;;) { 46| 12.7k| if (j == n - q) { ------------------ | Branch (46:25): [True: 0, False: 12.7k] ------------------ 47| 0| goto done; 48| 0| } 49| 12.7k| int32 a = x[j + p]; ------------------ | | 6| 12.7k|#define int32 int32_t ------------------ 50| 38.9k| for (r = q; r > p; r >>= 1) { ------------------ | Branch (50:33): [True: 26.2k, False: 12.7k] ------------------ 51| 26.2k| int32_MINMAX(a, x[j + r]); ------------------ | | 9| 26.2k| do { \ | | 10| 26.2k| int32_t ab = (b) ^ (a); \ | | 11| 26.2k| int32_t c = (int32_t)((int64_t)(b) - (int64_t)(a)); \ | | 12| 26.2k| c ^= ab & (c ^ (b)); \ | | 13| 26.2k| c >>= 31; \ | | 14| 26.2k| c &= ab; \ | | 15| 26.2k| (a) ^= c; \ | | 16| 26.2k| (b) ^= c; \ | | 17| 26.2k| } while(0) | | ------------------ | | | Branch (17:13): [Folded, False: 26.2k] | | ------------------ ------------------ 52| 26.2k| } 53| 12.7k| x[j + p] = a; 54| 12.7k| ++j; 55| 12.7k| if (j == i + p) { ------------------ | Branch (55:25): [True: 840, False: 11.9k] ------------------ 56| 840| i += 2 * p; 57| 840| break; 58| 840| } 59| 12.7k| } 60| 840| } 61| 106k| while (i + p <= n - q) { ------------------ | Branch (61:20): [True: 101k, False: 4.62k] ------------------ 62| 478k| for (j = i; j < i + p; ++j) { ------------------ | Branch (62:29): [True: 377k, False: 101k] ------------------ 63| 377k| int32 a = x[j + p]; ------------------ | | 6| 377k|#define int32 int32_t ------------------ 64| 2.35M| for (r = q; r > p; r >>= 1) { ------------------ | Branch (64:33): [True: 1.98M, False: 377k] ------------------ 65| 1.98M| int32_MINMAX(a, x[j + r]); ------------------ | | 9| 1.98M| do { \ | | 10| 1.98M| int32_t ab = (b) ^ (a); \ | | 11| 1.98M| int32_t c = (int32_t)((int64_t)(b) - (int64_t)(a)); \ | | 12| 1.98M| c ^= ab & (c ^ (b)); \ | | 13| 1.98M| c >>= 31; \ | | 14| 1.98M| c &= ab; \ | | 15| 1.98M| (a) ^= c; \ | | 16| 1.98M| (b) ^= c; \ | | 17| 1.98M| } while(0) | | ------------------ | | | Branch (17:13): [Folded, False: 1.98M] | | ------------------ ------------------ 66| 1.98M| } 67| 377k| x[j + p] = a; 68| 377k| } 69| 101k| i += 2 * p; 70| 101k| } 71| | /* now i + p > n - q */ 72| 4.62k| j = i; 73| 67.1k| while (j < n - q) { ------------------ | Branch (73:20): [True: 62.4k, False: 4.62k] ------------------ 74| 62.4k| int32 a = x[j + p]; ------------------ | | 6| 62.4k|#define int32 int32_t ------------------ 75| 167k| for (r = q; r > p; r >>= 1) { ------------------ | Branch (75:29): [True: 104k, False: 62.4k] ------------------ 76| 104k| int32_MINMAX(a, x[j + r]); ------------------ | | 9| 104k| do { \ | | 10| 104k| int32_t ab = (b) ^ (a); \ | | 11| 104k| int32_t c = (int32_t)((int64_t)(b) - (int64_t)(a)); \ | | 12| 104k| c ^= ab & (c ^ (b)); \ | | 13| 104k| c >>= 31; \ | | 14| 104k| c &= ab; \ | | 15| 104k| (a) ^= c; \ | | 16| 104k| (b) ^= c; \ | | 17| 104k| } while(0) | | ------------------ | | | Branch (17:13): [Folded, False: 104k] | | ------------------ ------------------ 77| 104k| } 78| 62.4k| x[j + p] = a; 79| 62.4k| ++j; 80| 62.4k| } 81| | 82| 4.62k|done: 83| 4.62k| ; 84| 4.62k| } 85| 924| } 86| 84|} PQCLEAN_NTRUHPS40961229_CLEAN_crypto_kem_keypair: 10| 42|int PQCLEAN_NTRUHPS40961229_CLEAN_crypto_kem_keypair(uint8_t *pk, uint8_t *sk) { 11| 42| uint8_t seed[NTRU_SAMPLE_FG_BYTES]; 12| | 13| 42| randombytes(seed, NTRU_SAMPLE_FG_BYTES); ------------------ | | 8| 42|#define randombytes OQS_randombytes ------------------ randombytes(seed, NTRU_SAMPLE_FG_BYTES); ------------------ | | 22| 42|#define NTRU_SAMPLE_FG_BYTES (NTRU_SAMPLE_IID_BYTES+NTRU_SAMPLE_FT_BYTES) | | ------------------ | | | | 20| 42|#define NTRU_SAMPLE_IID_BYTES (NTRU_N-1) | | | | ------------------ | | | | | | 5| 42|#define NTRU_N 1229 | | | | ------------------ | | ------------------ | | #define NTRU_SAMPLE_FG_BYTES (NTRU_SAMPLE_IID_BYTES+NTRU_SAMPLE_FT_BYTES) | | ------------------ | | | | 21| 42|#define NTRU_SAMPLE_FT_BYTES ((30*(NTRU_N-1)+7)/8) | | | | ------------------ | | | | | | 5| 42|#define NTRU_N 1229 | | | | ------------------ | | ------------------ ------------------ 14| 42| PQCLEAN_NTRUHPS40961229_CLEAN_owcpa_keypair(pk, sk, seed); 15| | 16| 42| randombytes(sk + NTRU_OWCPA_SECRETKEYBYTES, NTRU_PRFKEYBYTES); ------------------ | | 8| 42|#define randombytes OQS_randombytes ------------------ randombytes(sk + NTRU_OWCPA_SECRETKEYBYTES, NTRU_PRFKEYBYTES); ------------------ | | 30| 42|#define NTRU_OWCPA_SECRETKEYBYTES (2*NTRU_PACK_TRINARY_BYTES + NTRU_OWCPA_PUBLICKEYBYTES) | | ------------------ | | | | 26| 42|#define NTRU_PACK_TRINARY_BYTES ((NTRU_PACK_DEG+4)/5) | | | | ------------------ | | | | | | 25| 42|#define NTRU_PACK_DEG (NTRU_N-1) | | | | | | ------------------ | | | | | | | | 5| 42|#define NTRU_N 1229 | | | | | | ------------------ | | | | ------------------ | | ------------------ | | #define NTRU_OWCPA_SECRETKEYBYTES (2*NTRU_PACK_TRINARY_BYTES + NTRU_OWCPA_PUBLICKEYBYTES) | | ------------------ | | | | 29| 42|#define NTRU_OWCPA_PUBLICKEYBYTES ((NTRU_LOGQ*NTRU_PACK_DEG+7)/8) | | | | ------------------ | | | | | | 6| 42|#define NTRU_LOGQ 12 | | | | ------------------ | | | | #define NTRU_OWCPA_PUBLICKEYBYTES ((NTRU_LOGQ*NTRU_PACK_DEG+7)/8) | | | | ------------------ | | | | | | 25| 42|#define NTRU_PACK_DEG (NTRU_N-1) | | | | | | ------------------ | | | | | | | | 5| 42|#define NTRU_N 1229 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ randombytes(sk + NTRU_OWCPA_SECRETKEYBYTES, NTRU_PRFKEYBYTES); ------------------ | | 17| 42|#define NTRU_PRFKEYBYTES 32 ------------------ 17| | 18| 42| return 0; 19| 42|} PQCLEAN_NTRUHPS40961229_CLEAN_crypto_kem_enc: 21| 42|int PQCLEAN_NTRUHPS40961229_CLEAN_crypto_kem_enc(uint8_t *c, uint8_t *k, const uint8_t *pk) { 22| 42| poly r, m; 23| 42| uint8_t rm[NTRU_OWCPA_MSGBYTES]; 24| 42| uint8_t rm_seed[NTRU_SAMPLE_RM_BYTES]; 25| | 26| 42| randombytes(rm_seed, NTRU_SAMPLE_RM_BYTES); ------------------ | | 8| 42|#define randombytes OQS_randombytes ------------------ randombytes(rm_seed, NTRU_SAMPLE_RM_BYTES); ------------------ | | 23| 42|#define NTRU_SAMPLE_RM_BYTES (NTRU_SAMPLE_IID_BYTES+NTRU_SAMPLE_FT_BYTES) | | ------------------ | | | | 20| 42|#define NTRU_SAMPLE_IID_BYTES (NTRU_N-1) | | | | ------------------ | | | | | | 5| 42|#define NTRU_N 1229 | | | | ------------------ | | ------------------ | | #define NTRU_SAMPLE_RM_BYTES (NTRU_SAMPLE_IID_BYTES+NTRU_SAMPLE_FT_BYTES) | | ------------------ | | | | 21| 42|#define NTRU_SAMPLE_FT_BYTES ((30*(NTRU_N-1)+7)/8) | | | | ------------------ | | | | | | 5| 42|#define NTRU_N 1229 | | | | ------------------ | | ------------------ ------------------ 27| | 28| 42| PQCLEAN_NTRUHPS40961229_CLEAN_sample_rm(&r, &m, rm_seed); 29| | 30| 42| PQCLEAN_NTRUHPS40961229_CLEAN_poly_S3_tobytes(rm, &r); 31| 42| PQCLEAN_NTRUHPS40961229_CLEAN_poly_S3_tobytes(rm + NTRU_PACK_TRINARY_BYTES, &m); ------------------ | | 26| 42|#define NTRU_PACK_TRINARY_BYTES ((NTRU_PACK_DEG+4)/5) | | ------------------ | | | | 25| 42|#define NTRU_PACK_DEG (NTRU_N-1) | | | | ------------------ | | | | | | 5| 42|#define NTRU_N 1229 | | | | ------------------ | | ------------------ ------------------ 32| 42| sha3_256(k, rm, NTRU_OWCPA_MSGBYTES); ------------------ | | 15| 42|#define sha3_256 OQS_SHA3_sha3_256 ------------------ sha3_256(k, rm, NTRU_OWCPA_MSGBYTES); ------------------ | | 28| 42|#define NTRU_OWCPA_MSGBYTES (2*NTRU_PACK_TRINARY_BYTES) | | ------------------ | | | | 26| 42|#define NTRU_PACK_TRINARY_BYTES ((NTRU_PACK_DEG+4)/5) | | | | ------------------ | | | | | | 25| 42|#define NTRU_PACK_DEG (NTRU_N-1) | | | | | | ------------------ | | | | | | | | 5| 42|#define NTRU_N 1229 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 33| | 34| 42| PQCLEAN_NTRUHPS40961229_CLEAN_poly_Z3_to_Zq(&r); 35| 42| PQCLEAN_NTRUHPS40961229_CLEAN_owcpa_enc(c, &r, &m, pk); 36| | 37| 42| return 0; 38| 42|} PQCLEAN_NTRUHPS40961229_CLEAN_crypto_kem_dec: 40| 42|int PQCLEAN_NTRUHPS40961229_CLEAN_crypto_kem_dec(uint8_t *k, const uint8_t *c, const uint8_t *sk) { 41| 42| int i, fail; 42| 42| uint8_t rm[NTRU_OWCPA_MSGBYTES]; 43| 42| uint8_t buf[NTRU_PRFKEYBYTES + NTRU_CIPHERTEXTBYTES]; 44| | 45| 42| fail = PQCLEAN_NTRUHPS40961229_CLEAN_owcpa_dec(rm, c, sk); 46| | /* If fail = 0 then c = Enc(h, rm). There is no need to re-encapsulate. */ 47| | /* See comment in PQCLEAN_NTRUHPS40961229_CLEAN_owcpa_dec for details. */ 48| | 49| 42| sha3_256(k, rm, NTRU_OWCPA_MSGBYTES); ------------------ | | 15| 42|#define sha3_256 OQS_SHA3_sha3_256 ------------------ sha3_256(k, rm, NTRU_OWCPA_MSGBYTES); ------------------ | | 28| 42|#define NTRU_OWCPA_MSGBYTES (2*NTRU_PACK_TRINARY_BYTES) | | ------------------ | | | | 26| 42|#define NTRU_PACK_TRINARY_BYTES ((NTRU_PACK_DEG+4)/5) | | | | ------------------ | | | | | | 25| 42|#define NTRU_PACK_DEG (NTRU_N-1) | | | | | | ------------------ | | | | | | | | 5| 42|#define NTRU_N 1229 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 50| | 51| | /* shake(secret PRF key || input ciphertext) */ 52| 1.38k| for (i = 0; i < NTRU_PRFKEYBYTES; i++) { ------------------ | | 17| 1.38k|#define NTRU_PRFKEYBYTES 32 ------------------ | Branch (52:17): [True: 1.34k, False: 42] ------------------ 53| 1.34k| buf[i] = sk[i + NTRU_OWCPA_SECRETKEYBYTES]; ------------------ | | 30| 1.34k|#define NTRU_OWCPA_SECRETKEYBYTES (2*NTRU_PACK_TRINARY_BYTES + NTRU_OWCPA_PUBLICKEYBYTES) | | ------------------ | | | | 26| 1.34k|#define NTRU_PACK_TRINARY_BYTES ((NTRU_PACK_DEG+4)/5) | | | | ------------------ | | | | | | 25| 1.34k|#define NTRU_PACK_DEG (NTRU_N-1) | | | | | | ------------------ | | | | | | | | 5| 1.34k|#define NTRU_N 1229 | | | | | | ------------------ | | | | ------------------ | | ------------------ | | #define NTRU_OWCPA_SECRETKEYBYTES (2*NTRU_PACK_TRINARY_BYTES + NTRU_OWCPA_PUBLICKEYBYTES) | | ------------------ | | | | 29| 1.34k|#define NTRU_OWCPA_PUBLICKEYBYTES ((NTRU_LOGQ*NTRU_PACK_DEG+7)/8) | | | | ------------------ | | | | | | 6| 1.34k|#define NTRU_LOGQ 12 | | | | ------------------ | | | | #define NTRU_OWCPA_PUBLICKEYBYTES ((NTRU_LOGQ*NTRU_PACK_DEG+7)/8) | | | | ------------------ | | | | | | 25| 1.34k|#define NTRU_PACK_DEG (NTRU_N-1) | | | | | | ------------------ | | | | | | | | 5| 1.34k|#define NTRU_N 1229 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 54| 1.34k| } 55| 77.4k| for (i = 0; i < NTRU_CIPHERTEXTBYTES; i++) { ------------------ | | 35| 77.4k|#define NTRU_CIPHERTEXTBYTES (NTRU_OWCPA_BYTES) | | ------------------ | | | | 31| 77.4k|#define NTRU_OWCPA_BYTES ((NTRU_LOGQ*NTRU_PACK_DEG+7)/8) | | | | ------------------ | | | | | | 6| 77.4k|#define NTRU_LOGQ 12 | | | | ------------------ | | | | #define NTRU_OWCPA_BYTES ((NTRU_LOGQ*NTRU_PACK_DEG+7)/8) | | | | ------------------ | | | | | | 25| 77.4k|#define NTRU_PACK_DEG (NTRU_N-1) | | | | | | ------------------ | | | | | | | | 5| 77.4k|#define NTRU_N 1229 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ | Branch (55:17): [True: 77.3k, False: 42] ------------------ 56| 77.3k| buf[NTRU_PRFKEYBYTES + i] = c[i]; ------------------ | | 17| 77.3k|#define NTRU_PRFKEYBYTES 32 ------------------ 57| 77.3k| } 58| 42| sha3_256(rm, buf, NTRU_PRFKEYBYTES + NTRU_CIPHERTEXTBYTES); ------------------ | | 15| 42|#define sha3_256 OQS_SHA3_sha3_256 ------------------ sha3_256(rm, buf, NTRU_PRFKEYBYTES + NTRU_CIPHERTEXTBYTES); ------------------ | | 17| 42|#define NTRU_PRFKEYBYTES 32 ------------------ sha3_256(rm, buf, NTRU_PRFKEYBYTES + NTRU_CIPHERTEXTBYTES); ------------------ | | 35| 42|#define NTRU_CIPHERTEXTBYTES (NTRU_OWCPA_BYTES) | | ------------------ | | | | 31| 42|#define NTRU_OWCPA_BYTES ((NTRU_LOGQ*NTRU_PACK_DEG+7)/8) | | | | ------------------ | | | | | | 6| 42|#define NTRU_LOGQ 12 | | | | ------------------ | | | | #define NTRU_OWCPA_BYTES ((NTRU_LOGQ*NTRU_PACK_DEG+7)/8) | | | | ------------------ | | | | | | 25| 42|#define NTRU_PACK_DEG (NTRU_N-1) | | | | | | ------------------ | | | | | | | | 5| 42|#define NTRU_N 1229 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 59| | 60| 42| PQCLEAN_NTRUHPS40961229_CLEAN_cmov(k, rm, NTRU_SHAREDKEYBYTES, (unsigned char) fail); ------------------ | | 18| 42|#define NTRU_SHAREDKEYBYTES 32 ------------------ 61| | 62| 42| return 0; 63| 42|} PQCLEAN_NTRUHPS40961229_CLEAN_owcpa_keypair: 62| 42| const unsigned char seed[NTRU_SAMPLE_FG_BYTES]) { 63| 42| int i; 64| | 65| 42| poly x1, x2, x3, x4, x5; 66| | 67| 42| poly *f = &x1, *g = &x2, *invf_mod3 = &x3; 68| 42| poly *gf = &x3, *invgf = &x4, *tmp = &x5; 69| 42| poly *invh = &x3, *h = &x3; 70| | 71| 42| PQCLEAN_NTRUHPS40961229_CLEAN_sample_fg(f, g, seed); 72| | 73| 42| PQCLEAN_NTRUHPS40961229_CLEAN_poly_S3_inv(invf_mod3, f); 74| 42| PQCLEAN_NTRUHPS40961229_CLEAN_poly_S3_tobytes(sk, f); 75| 42| PQCLEAN_NTRUHPS40961229_CLEAN_poly_S3_tobytes(sk + NTRU_PACK_TRINARY_BYTES, invf_mod3); ------------------ | | 26| 42|#define NTRU_PACK_TRINARY_BYTES ((NTRU_PACK_DEG+4)/5) | | ------------------ | | | | 25| 42|#define NTRU_PACK_DEG (NTRU_N-1) | | | | ------------------ | | | | | | 5| 42|#define NTRU_N 1229 | | | | ------------------ | | ------------------ ------------------ 76| | 77| | /* Lift coeffs of f and g from Z_p to Z_q */ 78| 42| PQCLEAN_NTRUHPS40961229_CLEAN_poly_Z3_to_Zq(f); 79| 42| PQCLEAN_NTRUHPS40961229_CLEAN_poly_Z3_to_Zq(g); 80| | 81| | 82| | /* g = 3*g */ 83| 51.6k| for (i = 0; i < NTRU_N; i++) { ------------------ | | 5| 51.6k|#define NTRU_N 1229 ------------------ | Branch (83:17): [True: 51.6k, False: 42] ------------------ 84| 51.6k| g->coeffs[i] = 3 * g->coeffs[i]; 85| 51.6k| } 86| | 87| 42| PQCLEAN_NTRUHPS40961229_CLEAN_poly_Rq_mul(gf, g, f); 88| | 89| 42| PQCLEAN_NTRUHPS40961229_CLEAN_poly_Rq_inv(invgf, gf); 90| | 91| 42| PQCLEAN_NTRUHPS40961229_CLEAN_poly_Rq_mul(tmp, invgf, f); 92| 42| PQCLEAN_NTRUHPS40961229_CLEAN_poly_Sq_mul(invh, tmp, f); 93| 42| PQCLEAN_NTRUHPS40961229_CLEAN_poly_Sq_tobytes(sk + 2 * NTRU_PACK_TRINARY_BYTES, invh); ------------------ | | 26| 42|#define NTRU_PACK_TRINARY_BYTES ((NTRU_PACK_DEG+4)/5) | | ------------------ | | | | 25| 42|#define NTRU_PACK_DEG (NTRU_N-1) | | | | ------------------ | | | | | | 5| 42|#define NTRU_N 1229 | | | | ------------------ | | ------------------ ------------------ 94| | 95| 42| PQCLEAN_NTRUHPS40961229_CLEAN_poly_Rq_mul(tmp, invgf, g); 96| 42| PQCLEAN_NTRUHPS40961229_CLEAN_poly_Rq_mul(h, tmp, g); 97| 42| PQCLEAN_NTRUHPS40961229_CLEAN_poly_Rq_sum_zero_tobytes(pk, h); 98| 42|} PQCLEAN_NTRUHPS40961229_CLEAN_owcpa_enc: 104| 42| const unsigned char *pk) { 105| 42| int i; 106| 42| poly x1, x2; 107| 42| poly *h = &x1, *liftm = &x1; 108| 42| poly *ct = &x2; 109| | 110| 42| PQCLEAN_NTRUHPS40961229_CLEAN_poly_Rq_sum_zero_frombytes(h, pk); 111| | 112| 42| PQCLEAN_NTRUHPS40961229_CLEAN_poly_Rq_mul(ct, r, h); 113| | 114| 42| PQCLEAN_NTRUHPS40961229_CLEAN_poly_lift(liftm, m); 115| 51.6k| for (i = 0; i < NTRU_N; i++) { ------------------ | | 5| 51.6k|#define NTRU_N 1229 ------------------ | Branch (115:17): [True: 51.6k, False: 42] ------------------ 116| 51.6k| ct->coeffs[i] = ct->coeffs[i] + liftm->coeffs[i]; 117| 51.6k| } 118| | 119| 42| PQCLEAN_NTRUHPS40961229_CLEAN_poly_Rq_sum_zero_tobytes(c, ct); 120| 42|} PQCLEAN_NTRUHPS40961229_CLEAN_owcpa_dec: 124| 42| const unsigned char *secretkey) { 125| 42| int i; 126| 42| int fail; 127| 42| poly x1, x2, x3, x4; 128| | 129| 42| poly *c = &x1, *f = &x2, *cf = &x3; 130| 42| poly *mf = &x2, *finv3 = &x3, *m = &x4; 131| 42| poly *liftm = &x2, *invh = &x3, *r = &x4; 132| 42| poly *b = &x1; 133| | 134| 42| PQCLEAN_NTRUHPS40961229_CLEAN_poly_Rq_sum_zero_frombytes(c, ciphertext); 135| 42| PQCLEAN_NTRUHPS40961229_CLEAN_poly_S3_frombytes(f, secretkey); 136| 42| PQCLEAN_NTRUHPS40961229_CLEAN_poly_Z3_to_Zq(f); 137| | 138| 42| PQCLEAN_NTRUHPS40961229_CLEAN_poly_Rq_mul(cf, c, f); 139| 42| PQCLEAN_NTRUHPS40961229_CLEAN_poly_Rq_to_S3(mf, cf); 140| | 141| 42| PQCLEAN_NTRUHPS40961229_CLEAN_poly_S3_frombytes(finv3, secretkey + NTRU_PACK_TRINARY_BYTES); ------------------ | | 26| 42|#define NTRU_PACK_TRINARY_BYTES ((NTRU_PACK_DEG+4)/5) | | ------------------ | | | | 25| 42|#define NTRU_PACK_DEG (NTRU_N-1) | | | | ------------------ | | | | | | 5| 42|#define NTRU_N 1229 | | | | ------------------ | | ------------------ ------------------ 142| 42| PQCLEAN_NTRUHPS40961229_CLEAN_poly_S3_mul(m, mf, finv3); 143| 42| PQCLEAN_NTRUHPS40961229_CLEAN_poly_S3_tobytes(rm + NTRU_PACK_TRINARY_BYTES, m); ------------------ | | 26| 42|#define NTRU_PACK_TRINARY_BYTES ((NTRU_PACK_DEG+4)/5) | | ------------------ | | | | 25| 42|#define NTRU_PACK_DEG (NTRU_N-1) | | | | ------------------ | | | | | | 5| 42|#define NTRU_N 1229 | | | | ------------------ | | ------------------ ------------------ 144| | 145| 42| fail = 0; 146| | 147| | /* Check that the unused bits of the last byte of the ciphertext are zero */ 148| 42| fail |= owcpa_check_ciphertext(ciphertext); 149| | 150| | /* For the IND-CCA2 KEM we must ensure that c = Enc(h, (r,m)). */ 151| | /* We can avoid re-computing r*h + Lift(m) as long as we check that */ 152| | /* r (defined as b/h mod (q, Phi_n)) and m are in the message space. */ 153| | /* (m can take any value in S3 in NTRU_HRSS) */ 154| 42| fail |= owcpa_check_m(m); 155| | 156| | /* b = c - Lift(m) mod (q, x^n - 1) */ 157| 42| PQCLEAN_NTRUHPS40961229_CLEAN_poly_lift(liftm, m); 158| 51.6k| for (i = 0; i < NTRU_N; i++) { ------------------ | | 5| 51.6k|#define NTRU_N 1229 ------------------ | Branch (158:17): [True: 51.6k, False: 42] ------------------ 159| 51.6k| b->coeffs[i] = c->coeffs[i] - liftm->coeffs[i]; 160| 51.6k| } 161| | 162| | /* r = b / h mod (q, Phi_n) */ 163| 42| PQCLEAN_NTRUHPS40961229_CLEAN_poly_Sq_frombytes(invh, secretkey + 2 * NTRU_PACK_TRINARY_BYTES); ------------------ | | 26| 42|#define NTRU_PACK_TRINARY_BYTES ((NTRU_PACK_DEG+4)/5) | | ------------------ | | | | 25| 42|#define NTRU_PACK_DEG (NTRU_N-1) | | | | ------------------ | | | | | | 5| 42|#define NTRU_N 1229 | | | | ------------------ | | ------------------ ------------------ 164| 42| PQCLEAN_NTRUHPS40961229_CLEAN_poly_Sq_mul(r, b, invh); 165| | 166| | /* NOTE: Our definition of r as b/h mod (q, Phi_n) follows Figure 4 of */ 167| | /* [Sch18] https://eprint.iacr.org/2018/1174/20181203:032458. */ 168| | /* This differs from Figure 10 of Saito--Xagawa--Yamakawa */ 169| | /* [SXY17] https://eprint.iacr.org/2017/1005/20180516:055500 */ 170| | /* where r gets a final reduction modulo p. */ 171| | /* We need this change to use Proposition 1 of [Sch18]. */ 172| | 173| | /* Proposition 1 of [Sch18] shows that re-encryption with (r,m) yields c. */ 174| | /* if and only if fail==0 after the following call to owcpa_check_r */ 175| | /* The procedure given in Fig. 8 of [Sch18] can be skipped because we have */ 176| | /* c(1) = 0 due to the use of poly_Rq_sum_zero_{to,from}bytes. */ 177| 42| fail |= owcpa_check_r(r); 178| | 179| 42| PQCLEAN_NTRUHPS40961229_CLEAN_poly_trinary_Zq_to_Z3(r); 180| 42| PQCLEAN_NTRUHPS40961229_CLEAN_poly_S3_tobytes(rm, r); 181| | 182| 42| return fail; 183| 42|} PQCLEAN_NTRUHPS40961229_CLEAN_poly_S3_tobytes: 3| 252|void PQCLEAN_NTRUHPS40961229_CLEAN_poly_S3_tobytes(unsigned char msg[NTRU_PACK_TRINARY_BYTES], const poly *a) { 4| 252| int i; 5| 252| unsigned char c; 6| 252| int j; 7| | 8| 61.9k| for (i = 0; i < NTRU_PACK_DEG / 5; i++) { ------------------ | | 25| 61.9k|#define NTRU_PACK_DEG (NTRU_N-1) | | ------------------ | | | | 5| 61.9k|#define NTRU_N 1229 | | ------------------ ------------------ | Branch (8:17): [True: 61.7k, False: 252] ------------------ 9| 61.7k| c = a->coeffs[5 * i + 4] & 255; 10| 61.7k| c = (3 * c + a->coeffs[5 * i + 3]) & 255; 11| 61.7k| c = (3 * c + a->coeffs[5 * i + 2]) & 255; 12| 61.7k| c = (3 * c + a->coeffs[5 * i + 1]) & 255; 13| 61.7k| c = (3 * c + a->coeffs[5 * i + 0]) & 255; 14| 61.7k| msg[i] = c; 15| 61.7k| } 16| 252| i = NTRU_PACK_DEG / 5; ------------------ | | 25| 252|#define NTRU_PACK_DEG (NTRU_N-1) | | ------------------ | | | | 5| 252|#define NTRU_N 1229 | | ------------------ ------------------ 17| 252| c = 0; 18| 1.00k| for (j = NTRU_PACK_DEG - (5 * i) - 1; j >= 0; j--) { ------------------ | | 25| 252|#define NTRU_PACK_DEG (NTRU_N-1) | | ------------------ | | | | 5| 252|#define NTRU_N 1229 | | ------------------ ------------------ | Branch (18:43): [True: 756, False: 252] ------------------ 19| 756| c = (3 * c + a->coeffs[5 * i + j]) & 255; 20| 756| } 21| 252| msg[i] = c; 22| 252|} PQCLEAN_NTRUHPS40961229_CLEAN_poly_S3_frombytes: 24| 84|void PQCLEAN_NTRUHPS40961229_CLEAN_poly_S3_frombytes(poly *r, const unsigned char msg[NTRU_PACK_TRINARY_BYTES]) { 25| 84| int i; 26| 84| unsigned char c; 27| 84| int j; 28| | 29| 20.6k| for (i = 0; i < NTRU_PACK_DEG / 5; i++) { ------------------ | | 25| 20.6k|#define NTRU_PACK_DEG (NTRU_N-1) | | ------------------ | | | | 5| 20.6k|#define NTRU_N 1229 | | ------------------ ------------------ | Branch (29:17): [True: 20.5k, False: 84] ------------------ 30| 20.5k| c = msg[i]; 31| 20.5k| r->coeffs[5 * i + 0] = c; 32| 20.5k| r->coeffs[5 * i + 1] = c * 171 >> 9; // this is division by 3 33| 20.5k| r->coeffs[5 * i + 2] = c * 57 >> 9; // division by 3^2 34| 20.5k| r->coeffs[5 * i + 3] = c * 19 >> 9; // division by 3^3 35| 20.5k| r->coeffs[5 * i + 4] = c * 203 >> 14; // etc. 36| 20.5k| } 37| 84| i = NTRU_PACK_DEG / 5; ------------------ | | 25| 84|#define NTRU_PACK_DEG (NTRU_N-1) | | ------------------ | | | | 5| 84|#define NTRU_N 1229 | | ------------------ ------------------ 38| 84| c = msg[i]; 39| 336| for (j = 0; (5 * i + j) < NTRU_PACK_DEG; j++) { ------------------ | | 25| 336|#define NTRU_PACK_DEG (NTRU_N-1) | | ------------------ | | | | 5| 336|#define NTRU_N 1229 | | ------------------ ------------------ | Branch (39:17): [True: 252, False: 84] ------------------ 40| 252| r->coeffs[5 * i + j] = c; 41| 252| c = c * 171 >> 9; 42| 252| } 43| 84| r->coeffs[NTRU_N - 1] = 0; ------------------ | | 5| 84|#define NTRU_N 1229 ------------------ 44| 84| PQCLEAN_NTRUHPS40961229_CLEAN_poly_mod_3_Phi_n(r); 45| 84|} PQCLEAN_NTRUHPS40961229_CLEAN_poly_Sq_tobytes: 4| 126|void PQCLEAN_NTRUHPS40961229_CLEAN_poly_Sq_tobytes(unsigned char *r, const poly *a) { 5| 126| int i; 6| | 7| 77.4k| for (i = 0; i < NTRU_PACK_DEG / 2; i++) { ------------------ | | 25| 77.4k|#define NTRU_PACK_DEG (NTRU_N-1) | | ------------------ | | | | 5| 77.4k|#define NTRU_N 1229 | | ------------------ ------------------ | Branch (7:17): [True: 77.3k, False: 126] ------------------ 8| 77.3k| r[3 * i + 0] = (unsigned char) ( MODQ(a->coeffs[2 * i + 0]) & 0xff); ------------------ | | 9| 77.3k|#define MODQ(X) ((X) & (NTRU_Q-1)) | | ------------------ | | | | 13| 77.3k|#define NTRU_Q (1 << NTRU_LOGQ) | | | | ------------------ | | | | | | 6| 77.3k|#define NTRU_LOGQ 12 | | | | ------------------ | | ------------------ ------------------ 9| 77.3k| r[3 * i + 1] = (unsigned char) ((MODQ(a->coeffs[2 * i + 0]) >> 8) | ((MODQ(a->coeffs[2 * i + 1]) & 0x0f) << 4)); ------------------ | | 9| 77.3k|#define MODQ(X) ((X) & (NTRU_Q-1)) | | ------------------ | | | | 13| 77.3k|#define NTRU_Q (1 << NTRU_LOGQ) | | | | ------------------ | | | | | | 6| 77.3k|#define NTRU_LOGQ 12 | | | | ------------------ | | ------------------ ------------------ r[3 * i + 1] = (unsigned char) ((MODQ(a->coeffs[2 * i + 0]) >> 8) | ((MODQ(a->coeffs[2 * i + 1]) & 0x0f) << 4)); ------------------ | | 9| 77.3k|#define MODQ(X) ((X) & (NTRU_Q-1)) | | ------------------ | | | | 13| 77.3k|#define NTRU_Q (1 << NTRU_LOGQ) | | | | ------------------ | | | | | | 6| 77.3k|#define NTRU_LOGQ 12 | | | | ------------------ | | ------------------ ------------------ 10| 77.3k| r[3 * i + 2] = (unsigned char) ((MODQ(a->coeffs[2 * i + 1]) >> 4)); ------------------ | | 9| 77.3k|#define MODQ(X) ((X) & (NTRU_Q-1)) | | ------------------ | | | | 13| 77.3k|#define NTRU_Q (1 << NTRU_LOGQ) | | | | ------------------ | | | | | | 6| 77.3k|#define NTRU_LOGQ 12 | | | | ------------------ | | ------------------ ------------------ 11| 77.3k| } 12| 126|} PQCLEAN_NTRUHPS40961229_CLEAN_poly_Sq_frombytes: 14| 126|void PQCLEAN_NTRUHPS40961229_CLEAN_poly_Sq_frombytes(poly *r, const unsigned char *a) { 15| 126| int i; 16| 77.4k| for (i = 0; i < NTRU_PACK_DEG / 2; i++) { ------------------ | | 25| 77.4k|#define NTRU_PACK_DEG (NTRU_N-1) | | ------------------ | | | | 5| 77.4k|#define NTRU_N 1229 | | ------------------ ------------------ | Branch (16:17): [True: 77.3k, False: 126] ------------------ 17| 77.3k| r->coeffs[2 * i + 0] = (a[3 * i + 0] >> 0) | (((uint16_t)a[3 * i + 1] & 0x0f) << 8); 18| 77.3k| r->coeffs[2 * i + 1] = (a[3 * i + 1] >> 4) | (((uint16_t)a[3 * i + 2] & 0xff) << 4); 19| 77.3k| } 20| 126| r->coeffs[NTRU_N - 1] = 0; ------------------ | | 5| 126|#define NTRU_N 1229 ------------------ 21| 126|} PQCLEAN_NTRUHPS40961229_CLEAN_poly_Rq_sum_zero_tobytes: 23| 84|void PQCLEAN_NTRUHPS40961229_CLEAN_poly_Rq_sum_zero_tobytes(unsigned char *r, const poly *a) { 24| 84| PQCLEAN_NTRUHPS40961229_CLEAN_poly_Sq_tobytes(r, a); 25| 84|} PQCLEAN_NTRUHPS40961229_CLEAN_poly_Rq_sum_zero_frombytes: 27| 84|void PQCLEAN_NTRUHPS40961229_CLEAN_poly_Rq_sum_zero_frombytes(poly *r, const unsigned char *a) { 28| 84| int i; 29| 84| PQCLEAN_NTRUHPS40961229_CLEAN_poly_Sq_frombytes(r, a); 30| | 31| | /* Set r[n-1] so that the sum of coefficients is zero mod q */ 32| 84| r->coeffs[NTRU_N - 1] = 0; ------------------ | | 5| 84|#define NTRU_N 1229 ------------------ 33| 103k| for (i = 0; i < NTRU_PACK_DEG; i++) { ------------------ | | 25| 103k|#define NTRU_PACK_DEG (NTRU_N-1) | | ------------------ | | | | 5| 103k|#define NTRU_N 1229 | | ------------------ ------------------ | Branch (33:17): [True: 103k, False: 84] ------------------ 34| 103k| r->coeffs[NTRU_N - 1] -= r->coeffs[i]; ------------------ | | 5| 103k|#define NTRU_N 1229 ------------------ 35| 103k| } 36| 84|} PQCLEAN_NTRUHPS40961229_CLEAN_poly_Z3_to_Zq: 4| 252|void PQCLEAN_NTRUHPS40961229_CLEAN_poly_Z3_to_Zq(poly *r) { 5| 252| int i; 6| 309k| for (i = 0; i < NTRU_N; i++) { ------------------ | | 5| 309k|#define NTRU_N 1229 ------------------ | Branch (6:17): [True: 309k, False: 252] ------------------ 7| 309k| r->coeffs[i] = r->coeffs[i] | ((-(r->coeffs[i] >> 1)) & (NTRU_Q - 1)); ------------------ | | 13| 309k|#define NTRU_Q (1 << NTRU_LOGQ) | | ------------------ | | | | 6| 309k|#define NTRU_LOGQ 12 | | ------------------ ------------------ 8| 309k| } 9| 252|} PQCLEAN_NTRUHPS40961229_CLEAN_poly_trinary_Zq_to_Z3: 12| 42|void PQCLEAN_NTRUHPS40961229_CLEAN_poly_trinary_Zq_to_Z3(poly *r) { 13| 42| int i; 14| 51.6k| for (i = 0; i < NTRU_N; i++) { ------------------ | | 5| 51.6k|#define NTRU_N 1229 ------------------ | Branch (14:17): [True: 51.6k, False: 42] ------------------ 15| 51.6k| r->coeffs[i] = MODQ(r->coeffs[i]); ------------------ | | 9| 51.6k|#define MODQ(X) ((X) & (NTRU_Q-1)) | | ------------------ | | | | 13| 51.6k|#define NTRU_Q (1 << NTRU_LOGQ) | | | | ------------------ | | | | | | 6| 51.6k|#define NTRU_LOGQ 12 | | | | ------------------ | | ------------------ ------------------ 16| 51.6k| r->coeffs[i] = 3 & (r->coeffs[i] ^ (r->coeffs[i] >> (NTRU_LOGQ - 1))); ------------------ | | 6| 51.6k|#define NTRU_LOGQ 12 ------------------ 17| 51.6k| } 18| 42|} PQCLEAN_NTRUHPS40961229_CLEAN_poly_Sq_mul: 20| 84|void PQCLEAN_NTRUHPS40961229_CLEAN_poly_Sq_mul(poly *r, const poly *a, const poly *b) { 21| 84| PQCLEAN_NTRUHPS40961229_CLEAN_poly_Rq_mul(r, a, b); 22| 84| PQCLEAN_NTRUHPS40961229_CLEAN_poly_mod_q_Phi_n(r); 23| 84|} PQCLEAN_NTRUHPS40961229_CLEAN_poly_S3_mul: 25| 42|void PQCLEAN_NTRUHPS40961229_CLEAN_poly_S3_mul(poly *r, const poly *a, const poly *b) { 26| 42| int i; 27| | 28| | /* Our S3 multiplications do not overflow mod q, */ 29| | /* so we can re-purpose PQCLEAN_NTRUHPS40961229_CLEAN_poly_Rq_mul, as long as we */ 30| | /* follow with an explicit reduction mod q. */ 31| 42| PQCLEAN_NTRUHPS40961229_CLEAN_poly_Rq_mul(r, a, b); 32| 51.6k| for (i = 0; i < NTRU_N; i++) { ------------------ | | 5| 51.6k|#define NTRU_N 1229 ------------------ | Branch (32:17): [True: 51.6k, False: 42] ------------------ 33| 51.6k| r->coeffs[i] = MODQ(r->coeffs[i]); ------------------ | | 9| 51.6k|#define MODQ(X) ((X) & (NTRU_Q-1)) | | ------------------ | | | | 13| 51.6k|#define NTRU_Q (1 << NTRU_LOGQ) | | | | ------------------ | | | | | | 6| 51.6k|#define NTRU_LOGQ 12 | | | | ------------------ | | ------------------ ------------------ 34| 51.6k| } 35| 42| PQCLEAN_NTRUHPS40961229_CLEAN_poly_mod_3_Phi_n(r); 36| 42|} PQCLEAN_NTRUHPS40961229_CLEAN_poly_Rq_inv: 71| 42|void PQCLEAN_NTRUHPS40961229_CLEAN_poly_Rq_inv(poly *r, const poly *a) { 72| 42| poly ai2; 73| 42| PQCLEAN_NTRUHPS40961229_CLEAN_poly_R2_inv(&ai2, a); 74| 42| PQCLEAN_NTRUHPS40961229_CLEAN_poly_R2_inv_to_Rq_inv(r, &ai2, a); 75| 42|} poly.c:PQCLEAN_NTRUHPS40961229_CLEAN_poly_R2_inv_to_Rq_inv: 38| 42|static void PQCLEAN_NTRUHPS40961229_CLEAN_poly_R2_inv_to_Rq_inv(poly *r, const poly *ai, const poly *a) { 39| | 40| 42| int i; 41| 42| poly b, c; 42| 42| poly s; 43| | 44| | // for 0..4 45| | // ai = ai * (2 - a*ai) mod q 46| 51.6k| for (i = 0; i < NTRU_N; i++) { ------------------ | | 5| 51.6k|#define NTRU_N 1229 ------------------ | Branch (46:17): [True: 51.6k, False: 42] ------------------ 47| 51.6k| b.coeffs[i] = -(a->coeffs[i]); 48| 51.6k| } 49| | 50| 51.6k| for (i = 0; i < NTRU_N; i++) { ------------------ | | 5| 51.6k|#define NTRU_N 1229 ------------------ | Branch (50:17): [True: 51.6k, False: 42] ------------------ 51| 51.6k| r->coeffs[i] = ai->coeffs[i]; 52| 51.6k| } 53| | 54| 42| PQCLEAN_NTRUHPS40961229_CLEAN_poly_Rq_mul(&c, r, &b); 55| 42| c.coeffs[0] += 2; // c = 2 - a*ai 56| 42| PQCLEAN_NTRUHPS40961229_CLEAN_poly_Rq_mul(&s, &c, r); // s = ai*c 57| | 58| 42| PQCLEAN_NTRUHPS40961229_CLEAN_poly_Rq_mul(&c, &s, &b); 59| 42| c.coeffs[0] += 2; // c = 2 - a*s 60| 42| PQCLEAN_NTRUHPS40961229_CLEAN_poly_Rq_mul(r, &c, &s); // r = s*c 61| | 62| 42| PQCLEAN_NTRUHPS40961229_CLEAN_poly_Rq_mul(&c, r, &b); 63| 42| c.coeffs[0] += 2; // c = 2 - a*r 64| 42| PQCLEAN_NTRUHPS40961229_CLEAN_poly_Rq_mul(&s, &c, r); // s = r*c 65| | 66| 42| PQCLEAN_NTRUHPS40961229_CLEAN_poly_Rq_mul(&c, &s, &b); 67| 42| c.coeffs[0] += 2; // c = 2 - a*s 68| 42| PQCLEAN_NTRUHPS40961229_CLEAN_poly_Rq_mul(r, &c, &s); // r = s*c 69| 42|} PQCLEAN_NTRUHPS40961229_CLEAN_poly_lift: 3| 84|void PQCLEAN_NTRUHPS40961229_CLEAN_poly_lift(poly *r, const poly *a) { 4| 84| int i; 5| 103k| for (i = 0; i < NTRU_N; i++) { ------------------ | | 5| 103k|#define NTRU_N 1229 ------------------ | Branch (5:17): [True: 103k, False: 84] ------------------ 6| 103k| r->coeffs[i] = a->coeffs[i]; 7| 103k| } 8| 84| PQCLEAN_NTRUHPS40961229_CLEAN_poly_Z3_to_Zq(r); 9| 84|} PQCLEAN_NTRUHPS40961229_CLEAN_poly_mod_3_Phi_n: 18| 168|void PQCLEAN_NTRUHPS40961229_CLEAN_poly_mod_3_Phi_n(poly *r) { 19| 168| int i; 20| 206k| for (i = 0; i < NTRU_N; i++) { ------------------ | | 5| 206k|#define NTRU_N 1229 ------------------ | Branch (20:17): [True: 206k, False: 168] ------------------ 21| 206k| r->coeffs[i] = mod3(r->coeffs[i] + 2 * r->coeffs[NTRU_N - 1]); ------------------ | | 5| 206k|#define NTRU_N 1229 ------------------ 22| 206k| } 23| 168|} PQCLEAN_NTRUHPS40961229_CLEAN_poly_mod_q_Phi_n: 25| 84|void PQCLEAN_NTRUHPS40961229_CLEAN_poly_mod_q_Phi_n(poly *r) { 26| 84| int i; 27| 103k| for (i = 0; i < NTRU_N; i++) { ------------------ | | 5| 103k|#define NTRU_N 1229 ------------------ | Branch (27:17): [True: 103k, False: 84] ------------------ 28| 103k| r->coeffs[i] = r->coeffs[i] - r->coeffs[NTRU_N - 1]; ------------------ | | 5| 103k|#define NTRU_N 1229 ------------------ 29| 103k| } 30| 84|} PQCLEAN_NTRUHPS40961229_CLEAN_poly_Rq_to_S3: 32| 42|void PQCLEAN_NTRUHPS40961229_CLEAN_poly_Rq_to_S3(poly *r, const poly *a) { 33| 42| int i; 34| 42| uint16_t flag; 35| | 36| | /* The coefficients of a are stored as non-negative integers. */ 37| | /* We must translate to representatives in [-q/2, q/2) before */ 38| | /* reduction mod 3. */ 39| 51.6k| for (i = 0; i < NTRU_N; i++) { ------------------ | | 5| 51.6k|#define NTRU_N 1229 ------------------ | Branch (39:17): [True: 51.6k, False: 42] ------------------ 40| | /* Need an explicit reduction mod q here */ 41| 51.6k| r->coeffs[i] = MODQ(a->coeffs[i]); ------------------ | | 9| 51.6k|#define MODQ(X) ((X) & (NTRU_Q-1)) | | ------------------ | | | | 13| 51.6k|#define NTRU_Q (1 << NTRU_LOGQ) | | | | ------------------ | | | | | | 6| 51.6k|#define NTRU_LOGQ 12 | | | | ------------------ | | ------------------ ------------------ 42| | 43| | /* flag = 1 if r[i] >= q/2 else 0 */ 44| 51.6k| flag = r->coeffs[i] >> (NTRU_LOGQ - 1); ------------------ | | 6| 51.6k|#define NTRU_LOGQ 12 ------------------ 45| | 46| | /* Now we will add (-q) mod 3 if r[i] >= q/2 */ 47| | /* Note (-q) mod 3=(-2^k) mod 3=1<<(1-(k&1)) */ 48| 51.6k| r->coeffs[i] += flag << (1 - (NTRU_LOGQ & 1)); ------------------ | | 6| 51.6k|#define NTRU_LOGQ 12 ------------------ 49| 51.6k| } 50| | 51| 42| PQCLEAN_NTRUHPS40961229_CLEAN_poly_mod_3_Phi_n(r); 52| 42|} PQCLEAN_NTRUHPS40961229_CLEAN_poly_R2_inv: 10| 42|void PQCLEAN_NTRUHPS40961229_CLEAN_poly_R2_inv(poly *r, const poly *a) { 11| 42| poly f, g, v, w; 12| 42| size_t i, loop; 13| 42| int16_t delta, sign, swap, t; 14| | 15| 51.6k| for (i = 0; i < NTRU_N; ++i) { ------------------ | | 5| 51.6k|#define NTRU_N 1229 ------------------ | Branch (15:17): [True: 51.6k, False: 42] ------------------ 16| 51.6k| v.coeffs[i] = 0; 17| 51.6k| } 18| 51.6k| for (i = 0; i < NTRU_N; ++i) { ------------------ | | 5| 51.6k|#define NTRU_N 1229 ------------------ | Branch (18:17): [True: 51.6k, False: 42] ------------------ 19| 51.6k| w.coeffs[i] = 0; 20| 51.6k| } 21| 42| w.coeffs[0] = 1; 22| | 23| 51.6k| for (i = 0; i < NTRU_N; ++i) { ------------------ | | 5| 51.6k|#define NTRU_N 1229 ------------------ | Branch (23:17): [True: 51.6k, False: 42] ------------------ 24| 51.6k| f.coeffs[i] = 1; 25| 51.6k| } 26| 51.6k| for (i = 0; i < NTRU_N - 1; ++i) { ------------------ | | 5| 51.6k|#define NTRU_N 1229 ------------------ | Branch (26:17): [True: 51.5k, False: 42] ------------------ 27| 51.5k| g.coeffs[NTRU_N - 2 - i] = (a->coeffs[i] ^ a->coeffs[NTRU_N - 1]) & 1; ------------------ | | 5| 51.5k|#define NTRU_N 1229 ------------------ g.coeffs[NTRU_N - 2 - i] = (a->coeffs[i] ^ a->coeffs[NTRU_N - 1]) & 1; ------------------ | | 5| 51.5k|#define NTRU_N 1229 ------------------ 28| 51.5k| } 29| 42| g.coeffs[NTRU_N - 1] = 0; ------------------ | | 5| 42|#define NTRU_N 1229 ------------------ 30| | 31| 42| delta = 1; 32| | 33| 103k| for (loop = 0; loop < 2 * (NTRU_N - 1) - 1; ++loop) { ------------------ | | 5| 103k|#define NTRU_N 1229 ------------------ | Branch (33:20): [True: 103k, False: 42] ------------------ 34| 126M| for (i = NTRU_N - 1; i > 0; --i) { ------------------ | | 5| 103k|#define NTRU_N 1229 ------------------ | Branch (34:30): [True: 126M, False: 103k] ------------------ 35| 126M| v.coeffs[i] = v.coeffs[i - 1]; 36| 126M| } 37| 103k| v.coeffs[0] = 0; 38| | 39| 103k| sign = g.coeffs[0] & f.coeffs[0]; 40| 103k| swap = both_negative_mask(-delta, -(int16_t) g.coeffs[0]); 41| 103k| delta ^= swap & (delta ^ -delta); 42| 103k| delta += 1; 43| | 44| 126M| for (i = 0; i < NTRU_N; ++i) { ------------------ | | 5| 126M|#define NTRU_N 1229 ------------------ | Branch (44:21): [True: 126M, False: 103k] ------------------ 45| 126M| t = swap & (f.coeffs[i] ^ g.coeffs[i]); 46| 126M| f.coeffs[i] ^= t; 47| 126M| g.coeffs[i] ^= t; 48| 126M| t = swap & (v.coeffs[i] ^ w.coeffs[i]); 49| 126M| v.coeffs[i] ^= t; 50| 126M| w.coeffs[i] ^= t; 51| 126M| } 52| | 53| 126M| for (i = 0; i < NTRU_N; ++i) { ------------------ | | 5| 126M|#define NTRU_N 1229 ------------------ | Branch (53:21): [True: 126M, False: 103k] ------------------ 54| 126M| g.coeffs[i] = g.coeffs[i] ^ (sign & f.coeffs[i]); 55| 126M| } 56| 126M| for (i = 0; i < NTRU_N; ++i) { ------------------ | | 5| 126M|#define NTRU_N 1229 ------------------ | Branch (56:21): [True: 126M, False: 103k] ------------------ 57| 126M| w.coeffs[i] = w.coeffs[i] ^ (sign & v.coeffs[i]); 58| 126M| } 59| 126M| for (i = 0; i < NTRU_N - 1; ++i) { ------------------ | | 5| 126M|#define NTRU_N 1229 ------------------ | Branch (59:21): [True: 126M, False: 103k] ------------------ 60| 126M| g.coeffs[i] = g.coeffs[i + 1]; 61| 126M| } 62| 103k| g.coeffs[NTRU_N - 1] = 0; ------------------ | | 5| 103k|#define NTRU_N 1229 ------------------ 63| 103k| } 64| | 65| 51.6k| for (i = 0; i < NTRU_N - 1; ++i) { ------------------ | | 5| 51.6k|#define NTRU_N 1229 ------------------ | Branch (65:17): [True: 51.5k, False: 42] ------------------ 66| 51.5k| r->coeffs[i] = v.coeffs[NTRU_N - 2 - i]; ------------------ | | 5| 51.5k|#define NTRU_N 1229 ------------------ 67| 51.5k| } 68| 42| r->coeffs[NTRU_N - 1] = 0; ------------------ | | 5| 42|#define NTRU_N 1229 ------------------ 69| 42|} PQCLEAN_NTRUHPS40961229_CLEAN_poly_Rq_mul: 27| 714|void PQCLEAN_NTRUHPS40961229_CLEAN_poly_Rq_mul(poly *r, const poly *a, const poly *b) { 28| 714| size_t i; 29| 714| uint16_t ab[2 * L]; 30| | 31| 878k| for (i = 0; i < NTRU_N; i++) { ------------------ | | 5| 878k|#define NTRU_N 1229 ------------------ | Branch (31:17): [True: 877k, False: 714] ------------------ 32| 877k| ab[i] = a->coeffs[i]; 33| 877k| ab[L + i] = b->coeffs[i]; ------------------ | | 6| 877k|#define L PAD32(NTRU_N) | | ------------------ | | | | 11| 877k|#define PAD32(X) ((((X) + 31)/32)*32) | | ------------------ ------------------ 34| 877k| } 35| 14.2k| for (i = NTRU_N; i < L; i++) { ------------------ | | 5| 714|#define NTRU_N 1229 ------------------ for (i = NTRU_N; i < L; i++) { ------------------ | | 6| 14.2k|#define L PAD32(NTRU_N) | | ------------------ | | | | 11| 14.2k|#define PAD32(X) ((((X) + 31)/32)*32) | | ------------------ ------------------ | Branch (35:22): [True: 13.5k, False: 714] ------------------ 36| 13.5k| ab[i] = 0; 37| 13.5k| ab[L + i] = 0; ------------------ | | 6| 13.5k|#define L PAD32(NTRU_N) | | ------------------ | | | | 11| 13.5k|#define PAD32(X) ((((X) + 31)/32)*32) | | ------------------ ------------------ 38| 13.5k| } 39| | 40| 714| toom4_k2x2_mul(ab, ab, ab + L); ------------------ | | 6| 714|#define L PAD32(NTRU_N) | | ------------------ | | | | 11| 714|#define PAD32(X) ((((X) + 31)/32)*32) | | ------------------ ------------------ 41| | 42| 878k| for (i = 0; i < NTRU_N; i++) { ------------------ | | 5| 878k|#define NTRU_N 1229 ------------------ | Branch (42:17): [True: 877k, False: 714] ------------------ 43| 877k| r->coeffs[i] = ab[i] + ab[NTRU_N + i]; ------------------ | | 5| 877k|#define NTRU_N 1229 ------------------ 44| 877k| } 45| 714|} PQCLEAN_NTRUHPS40961229_CLEAN_poly_S3_inv: 18| 42|void PQCLEAN_NTRUHPS40961229_CLEAN_poly_S3_inv(poly *r, const poly *a) { 19| 42| poly f, g, v, w; 20| 42| size_t i, loop; 21| 42| int16_t delta, sign, swap, t; 22| | 23| 51.6k| for (i = 0; i < NTRU_N; ++i) { ------------------ | | 5| 51.6k|#define NTRU_N 1229 ------------------ | Branch (23:17): [True: 51.6k, False: 42] ------------------ 24| 51.6k| v.coeffs[i] = 0; 25| 51.6k| } 26| 51.6k| for (i = 0; i < NTRU_N; ++i) { ------------------ | | 5| 51.6k|#define NTRU_N 1229 ------------------ | Branch (26:17): [True: 51.6k, False: 42] ------------------ 27| 51.6k| w.coeffs[i] = 0; 28| 51.6k| } 29| 42| w.coeffs[0] = 1; 30| | 31| 51.6k| for (i = 0; i < NTRU_N; ++i) { ------------------ | | 5| 51.6k|#define NTRU_N 1229 ------------------ | Branch (31:17): [True: 51.6k, False: 42] ------------------ 32| 51.6k| f.coeffs[i] = 1; 33| 51.6k| } 34| 51.6k| for (i = 0; i < NTRU_N - 1; ++i) { ------------------ | | 5| 51.6k|#define NTRU_N 1229 ------------------ | Branch (34:17): [True: 51.5k, False: 42] ------------------ 35| 51.5k| g.coeffs[NTRU_N - 2 - i] = mod3((a->coeffs[i] & 3) + 2 * (a->coeffs[NTRU_N - 1] & 3)); ------------------ | | 5| 51.5k|#define NTRU_N 1229 ------------------ g.coeffs[NTRU_N - 2 - i] = mod3((a->coeffs[i] & 3) + 2 * (a->coeffs[NTRU_N - 1] & 3)); ------------------ | | 5| 51.5k|#define NTRU_N 1229 ------------------ 36| 51.5k| } 37| 42| g.coeffs[NTRU_N - 1] = 0; ------------------ | | 5| 42|#define NTRU_N 1229 ------------------ 38| | 39| 42| delta = 1; 40| | 41| 103k| for (loop = 0; loop < 2 * (NTRU_N - 1) - 1; ++loop) { ------------------ | | 5| 103k|#define NTRU_N 1229 ------------------ | Branch (41:20): [True: 103k, False: 42] ------------------ 42| 126M| for (i = NTRU_N - 1; i > 0; --i) { ------------------ | | 5| 103k|#define NTRU_N 1229 ------------------ | Branch (42:30): [True: 126M, False: 103k] ------------------ 43| 126M| v.coeffs[i] = v.coeffs[i - 1]; 44| 126M| } 45| 103k| v.coeffs[0] = 0; 46| | 47| 103k| sign = mod3((uint8_t) (2 * g.coeffs[0] * f.coeffs[0])); 48| 103k| swap = both_negative_mask(-delta, -(int16_t) g.coeffs[0]); 49| 103k| delta ^= swap & (delta ^ -delta); 50| 103k| delta += 1; 51| | 52| 126M| for (i = 0; i < NTRU_N; ++i) { ------------------ | | 5| 126M|#define NTRU_N 1229 ------------------ | Branch (52:21): [True: 126M, False: 103k] ------------------ 53| 126M| t = swap & (f.coeffs[i] ^ g.coeffs[i]); 54| 126M| f.coeffs[i] ^= t; 55| 126M| g.coeffs[i] ^= t; 56| 126M| t = swap & (v.coeffs[i] ^ w.coeffs[i]); 57| 126M| v.coeffs[i] ^= t; 58| 126M| w.coeffs[i] ^= t; 59| 126M| } 60| | 61| 126M| for (i = 0; i < NTRU_N; ++i) { ------------------ | | 5| 126M|#define NTRU_N 1229 ------------------ | Branch (61:21): [True: 126M, False: 103k] ------------------ 62| 126M| g.coeffs[i] = mod3((uint8_t) (g.coeffs[i] + sign * f.coeffs[i])); 63| 126M| } 64| 126M| for (i = 0; i < NTRU_N; ++i) { ------------------ | | 5| 126M|#define NTRU_N 1229 ------------------ | Branch (64:21): [True: 126M, False: 103k] ------------------ 65| 126M| w.coeffs[i] = mod3((uint8_t) (w.coeffs[i] + sign * v.coeffs[i])); 66| 126M| } 67| 126M| for (i = 0; i < NTRU_N - 1; ++i) { ------------------ | | 5| 126M|#define NTRU_N 1229 ------------------ | Branch (67:21): [True: 126M, False: 103k] ------------------ 68| 126M| g.coeffs[i] = g.coeffs[i + 1]; 69| 126M| } 70| 103k| g.coeffs[NTRU_N - 1] = 0; ------------------ | | 5| 103k|#define NTRU_N 1229 ------------------ 71| 103k| } 72| | 73| 42| sign = f.coeffs[0]; 74| 51.6k| for (i = 0; i < NTRU_N - 1; ++i) { ------------------ | | 5| 51.6k|#define NTRU_N 1229 ------------------ | Branch (74:17): [True: 51.5k, False: 42] ------------------ 75| 51.5k| r->coeffs[i] = mod3((uint8_t) (sign * v.coeffs[NTRU_N - 2 - i])); ------------------ | | 5| 51.5k|#define NTRU_N 1229 ------------------ 76| 51.5k| } 77| 42| r->coeffs[NTRU_N - 1] = 0; ------------------ | | 5| 42|#define NTRU_N 1229 ------------------ 78| 42|} PQCLEAN_NTRUHPS40961229_CLEAN_sample_fg: 3| 42|void PQCLEAN_NTRUHPS40961229_CLEAN_sample_fg(poly *f, poly *g, const unsigned char uniformbytes[NTRU_SAMPLE_FG_BYTES]) { 4| | 5| 42| PQCLEAN_NTRUHPS40961229_CLEAN_sample_iid(f, uniformbytes); 6| 42| PQCLEAN_NTRUHPS40961229_CLEAN_sample_fixed_type(g, uniformbytes + NTRU_SAMPLE_IID_BYTES); ------------------ | | 20| 42|#define NTRU_SAMPLE_IID_BYTES (NTRU_N-1) | | ------------------ | | | | 5| 42|#define NTRU_N 1229 | | ------------------ ------------------ 7| 42|} PQCLEAN_NTRUHPS40961229_CLEAN_sample_rm: 9| 42|void PQCLEAN_NTRUHPS40961229_CLEAN_sample_rm(poly *r, poly *m, const unsigned char uniformbytes[NTRU_SAMPLE_RM_BYTES]) { 10| | 11| 42| PQCLEAN_NTRUHPS40961229_CLEAN_sample_iid(r, uniformbytes); 12| 42| PQCLEAN_NTRUHPS40961229_CLEAN_sample_fixed_type(m, uniformbytes + NTRU_SAMPLE_IID_BYTES); ------------------ | | 20| 42|#define NTRU_SAMPLE_IID_BYTES (NTRU_N-1) | | ------------------ | | | | 5| 42|#define NTRU_N 1229 | | ------------------ ------------------ 13| 42|} PQCLEAN_NTRUHPS40961229_CLEAN_sample_fixed_type: 16| 84|void PQCLEAN_NTRUHPS40961229_CLEAN_sample_fixed_type(poly *r, const unsigned char u[NTRU_SAMPLE_FT_BYTES]) { 17| | // Assumes NTRU_SAMPLE_FT_BYTES = ceil(30*(n-1)/8) 18| | 19| 84| int32_t s[NTRU_N - 1]; 20| 84| int i; 21| | 22| | // Use 30 bits of u per word 23| 25.8k| for (i = 0; i < (NTRU_N - 1) / 4; i++) { ------------------ | | 5| 25.8k|#define NTRU_N 1229 ------------------ | Branch (23:17): [True: 25.7k, False: 84] ------------------ 24| 25.7k| s[4 * i + 0] = (u[15 * i + 0] << 2) + (u[15 * i + 1] << 10) + (u[15 * i + 2] << 18) + ((uint32_t) u[15 * i + 3] << 26); 25| 25.7k| s[4 * i + 1] = ((u[15 * i + 3] & 0xc0) >> 4) + (u[15 * i + 4] << 4) + (u[15 * i + 5] << 12) + (u[15 * i + 6] << 20) + ((uint32_t) u[15 * i + 7] << 28); 26| 25.7k| s[4 * i + 2] = ((u[15 * i + 7] & 0xf0) >> 2) + (u[15 * i + 8] << 6) + (u[15 * i + 9] << 14) + (u[15 * i + 10] << 22) + ((uint32_t) u[15 * i + 11] << 30); 27| 25.7k| s[4 * i + 3] = (u[15 * i + 11] & 0xfc) + (u[15 * i + 12] << 8) + (u[15 * i + 13] << 16) + ((uint32_t) u[15 * i + 14] << 24); 28| 25.7k| } 29| | 30| 21.5k| for (i = 0; i < NTRU_WEIGHT / 2; i++) { ------------------ | | 14| 21.5k|#define NTRU_WEIGHT (NTRU_Q/8 - 2) | | ------------------ | | | | 13| 21.5k|#define NTRU_Q (1 << NTRU_LOGQ) | | | | ------------------ | | | | | | 6| 21.5k|#define NTRU_LOGQ 12 | | | | ------------------ | | ------------------ ------------------ | Branch (30:17): [True: 21.4k, False: 84] ------------------ 31| 21.4k| s[i] |= 1; 32| 21.4k| } 33| | 34| 21.5k| for (i = NTRU_WEIGHT / 2; i < NTRU_WEIGHT; i++) { ------------------ | | 14| 84|#define NTRU_WEIGHT (NTRU_Q/8 - 2) | | ------------------ | | | | 13| 84|#define NTRU_Q (1 << NTRU_LOGQ) | | | | ------------------ | | | | | | 6| 84|#define NTRU_LOGQ 12 | | | | ------------------ | | ------------------ ------------------ for (i = NTRU_WEIGHT / 2; i < NTRU_WEIGHT; i++) { ------------------ | | 14| 21.5k|#define NTRU_WEIGHT (NTRU_Q/8 - 2) | | ------------------ | | | | 13| 21.5k|#define NTRU_Q (1 << NTRU_LOGQ) | | | | ------------------ | | | | | | 6| 21.5k|#define NTRU_LOGQ 12 | | | | ------------------ | | ------------------ ------------------ | Branch (34:31): [True: 21.4k, False: 84] ------------------ 35| 21.4k| s[i] |= 2; 36| 21.4k| } 37| | 38| 84| PQCLEAN_NTRUHPS40961229_CLEAN_crypto_sort_int32(s, NTRU_N - 1); ------------------ | | 5| 84|#define NTRU_N 1229 ------------------ 39| | 40| 103k| for (i = 0; i < NTRU_N - 1; i++) { ------------------ | | 5| 103k|#define NTRU_N 1229 ------------------ | Branch (40:17): [True: 103k, False: 84] ------------------ 41| 103k| r->coeffs[i] = ((uint16_t) (s[i] & 3)); 42| 103k| } 43| | 44| 84| r->coeffs[NTRU_N - 1] = 0; ------------------ | | 5| 84|#define NTRU_N 1229 ------------------ 45| 84|} PQCLEAN_NTRUHPS40961229_CLEAN_sample_iid: 18| 84|void PQCLEAN_NTRUHPS40961229_CLEAN_sample_iid(poly *r, const unsigned char uniformbytes[NTRU_SAMPLE_IID_BYTES]) { 19| 84| int i; 20| | /* {0,1,...,255} -> {0,1,2}; Pr[0] = 86/256, Pr[1] = Pr[-1] = 85/256 */ 21| 103k| for (i = 0; i < NTRU_N - 1; i++) { ------------------ | | 5| 103k|#define NTRU_N 1229 ------------------ | Branch (21:17): [True: 103k, False: 84] ------------------ 22| 103k| r->coeffs[i] = mod3(uniformbytes[i]); 23| 103k| } 24| | 25| 84| r->coeffs[NTRU_N - 1] = 0; ------------------ | | 5| 84|#define NTRU_N 1229 ------------------ 26| 84|} PQCLEAN_NTRUHPS4096821_AVX2_cmov: 4| 89|void PQCLEAN_NTRUHPS4096821_AVX2_cmov(unsigned char *r, const unsigned char *x, size_t len, unsigned char b) { 5| 89| size_t i; 6| | 7| 89| b = (~b + 1); 8| 2.93k| for (i = 0; i < len; i++) { ------------------ | Branch (8:17): [True: 2.84k, False: 89] ------------------ 9| 2.84k| r[i] ^= b & (x[i] ^ r[i]); 10| 2.84k| } 11| 89|} PQCLEAN_NTRUHPS4096821_AVX2_crypto_sort_int32: 903| 534|void PQCLEAN_NTRUHPS4096821_AVX2_crypto_sort_int32(int32 *x, size_t n) { 904| 534| size_t q, i, j; 905| | 906| 534| if (n <= 8) { ------------------ | Branch (906:9): [True: 0, False: 534] ------------------ 907| 0| if (n == 8) { ------------------ | Branch (907:13): [True: 0, False: 0] ------------------ 908| 0| int32_MINMAX(&x[0], &x[1]); 909| 0| int32_MINMAX(&x[1], &x[2]); 910| 0| int32_MINMAX(&x[2], &x[3]); 911| 0| int32_MINMAX(&x[3], &x[4]); 912| 0| int32_MINMAX(&x[4], &x[5]); 913| 0| int32_MINMAX(&x[5], &x[6]); 914| 0| int32_MINMAX(&x[6], &x[7]); 915| 0| } 916| 0| if (n >= 7) { ------------------ | Branch (916:13): [True: 0, False: 0] ------------------ 917| 0| int32_MINMAX(&x[0], &x[1]); 918| 0| int32_MINMAX(&x[1], &x[2]); 919| 0| int32_MINMAX(&x[2], &x[3]); 920| 0| int32_MINMAX(&x[3], &x[4]); 921| 0| int32_MINMAX(&x[4], &x[5]); 922| 0| int32_MINMAX(&x[5], &x[6]); 923| 0| } 924| 0| if (n >= 6) { ------------------ | Branch (924:13): [True: 0, False: 0] ------------------ 925| 0| int32_MINMAX(&x[0], &x[1]); 926| 0| int32_MINMAX(&x[1], &x[2]); 927| 0| int32_MINMAX(&x[2], &x[3]); 928| 0| int32_MINMAX(&x[3], &x[4]); 929| 0| int32_MINMAX(&x[4], &x[5]); 930| 0| } 931| 0| if (n >= 5) { ------------------ | Branch (931:13): [True: 0, False: 0] ------------------ 932| 0| int32_MINMAX(&x[0], &x[1]); 933| 0| int32_MINMAX(&x[1], &x[2]); 934| 0| int32_MINMAX(&x[2], &x[3]); 935| 0| int32_MINMAX(&x[3], &x[4]); 936| 0| } 937| 0| if (n >= 4) { ------------------ | Branch (937:13): [True: 0, False: 0] ------------------ 938| 0| int32_MINMAX(&x[0], &x[1]); 939| 0| int32_MINMAX(&x[1], &x[2]); 940| 0| int32_MINMAX(&x[2], &x[3]); 941| 0| } 942| 0| if (n >= 3) { ------------------ | Branch (942:13): [True: 0, False: 0] ------------------ 943| 0| int32_MINMAX(&x[0], &x[1]); 944| 0| int32_MINMAX(&x[1], &x[2]); 945| 0| } 946| 0| if (n >= 2) { ------------------ | Branch (946:13): [True: 0, False: 0] ------------------ 947| 0| int32_MINMAX(&x[0], &x[1]); 948| 0| } 949| 0| return; 950| 0| } 951| | 952| 534| if (!(n & (n - 1))) { ------------------ | Branch (952:9): [True: 0, False: 534] ------------------ 953| 0| int32_sort_2power(x, n, 0); 954| 0| return; 955| 0| } 956| | 957| 534| q = 8; 958| 2.84k| while (q < n - q) { ------------------ | Branch (958:12): [True: 2.31k, False: 534] ------------------ 959| 2.31k| q += q; 960| 2.31k| } 961| | /* n > q >= 8 */ 962| | 963| 534| if (q <= 128) { /* n <= 256 */ ------------------ | Branch (963:9): [True: 178, False: 356] ------------------ 964| 178| int32x8 y[32]; 965| 890| for (i = q >> 3; i < q >> 2; ++i) { ------------------ | Branch (965:26): [True: 712, False: 178] ------------------ 966| 712| y[i] = _mm256_set1_epi32(0x7fffffff); 967| 712| } 968| 9.43k| for (i = 0; i < n; ++i) { ------------------ | Branch (968:21): [True: 9.25k, False: 178] ------------------ 969| 9.25k| ((int32 *) y)[i] = x[i]; 970| 9.25k| } 971| 178| int32_sort_2power((int32 *) y, 2 * q, 0); 972| 9.43k| for (i = 0; i < n; ++i) { ------------------ | Branch (972:21): [True: 9.25k, False: 178] ------------------ 973| 9.25k| x[i] = ((int32 *) y)[i]; 974| 9.25k| } 975| 178| return; 976| 178| } 977| | 978| 356| int32_sort_2power(x, q, 1); 979| 356| PQCLEAN_NTRUHPS4096821_AVX2_crypto_sort_int32(x + q, n - q); 980| | 981| 890| while (q >= 64) { ------------------ | Branch (981:12): [True: 534, False: 356] ------------------ 982| 534| q >>= 2; 983| 534| j = int32_threestages(x, n, q); 984| 534| minmax_vector(x + j, x + j + 4 * q, n - 4 * q - j); 985| 534| if (j + 4 * q <= n) { ------------------ | Branch (985:13): [True: 356, False: 178] ------------------ 986| 4.62k| for (i = j; i < j + q; i += 8) { ------------------ | Branch (986:25): [True: 4.27k, False: 356] ------------------ 987| 4.27k| int32x8 x0 = int32x8_load(&x[i]); ------------------ | | 9| 4.27k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 988| 4.27k| int32x8 x1 = int32x8_load(&x[i + q]); ------------------ | | 9| 4.27k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 989| 4.27k| int32x8 x2 = int32x8_load(&x[i + 2 * q]); ------------------ | | 9| 4.27k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 990| 4.27k| int32x8 x3 = int32x8_load(&x[i + 3 * q]); ------------------ | | 9| 4.27k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 991| 4.27k| int32x8_MINMAX(x0, x2); ------------------ | | 15| 4.27k| do { \ | | 16| 4.27k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 4.27k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 4.27k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 4.27k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 4.27k| (a) = c; \ | | 19| 4.27k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 4.27k] | | ------------------ ------------------ 992| 4.27k| int32x8_MINMAX(x1, x3); ------------------ | | 15| 4.27k| do { \ | | 16| 4.27k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 4.27k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 4.27k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 4.27k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 4.27k| (a) = c; \ | | 19| 4.27k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 4.27k] | | ------------------ ------------------ 993| 4.27k| int32x8_MINMAX(x0, x1); ------------------ | | 15| 4.27k| do { \ | | 16| 4.27k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 4.27k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 4.27k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 4.27k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 4.27k| (a) = c; \ | | 19| 4.27k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 4.27k] | | ------------------ ------------------ 994| 4.27k| int32x8_MINMAX(x2, x3); ------------------ | | 15| 4.27k| do { \ | | 16| 4.27k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 4.27k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 4.27k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 4.27k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 4.27k| (a) = c; \ | | 19| 4.27k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 4.27k] | | ------------------ ------------------ 995| 4.27k| int32x8_store(&x[i], x0); ------------------ | | 10| 4.27k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 996| 4.27k| int32x8_store(&x[i + q], x1); ------------------ | | 10| 4.27k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 997| 4.27k| int32x8_store(&x[i + 2 * q], x2); ------------------ | | 10| 4.27k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 998| 4.27k| int32x8_store(&x[i + 3 * q], x3); ------------------ | | 10| 4.27k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 999| 4.27k| } 1000| 356| j += 4 * q; 1001| 356| } 1002| 534| minmax_vector(x + j, x + j + 2 * q, n - 2 * q - j); 1003| 534| if (j + 2 * q <= n) { ------------------ | Branch (1003:13): [True: 356, False: 178] ------------------ 1004| 3.56k| for (i = j; i < j + q; i += 8) { ------------------ | Branch (1004:25): [True: 3.20k, False: 356] ------------------ 1005| 3.20k| int32x8 x0 = int32x8_load(&x[i]); ------------------ | | 9| 3.20k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 1006| 3.20k| int32x8 x1 = int32x8_load(&x[i + q]); ------------------ | | 9| 3.20k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 1007| 3.20k| int32x8_MINMAX(x0, x1); ------------------ | | 15| 3.20k| do { \ | | 16| 3.20k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 3.20k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 3.20k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 3.20k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 3.20k| (a) = c; \ | | 19| 3.20k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 3.20k] | | ------------------ ------------------ 1008| 3.20k| int32x8_store(&x[i], x0); ------------------ | | 10| 3.20k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 1009| 3.20k| int32x8_store(&x[i + q], x1); ------------------ | | 10| 3.20k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 1010| 3.20k| } 1011| 356| j += 2 * q; 1012| 356| } 1013| 534| minmax_vector(x + j, x + j + q, n - q - j); 1014| 534| q >>= 1; 1015| 534| } 1016| 356| if (q == 32) { ------------------ | Branch (1016:9): [True: 178, False: 178] ------------------ 1017| 178| j = 0; 1018| 890| for (; j + 64 <= n; j += 64) { ------------------ | Branch (1018:16): [True: 712, False: 178] ------------------ 1019| 712| int32x8 x0 = int32x8_load(&x[j]); ------------------ | | 9| 712|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 1020| 712| int32x8 x1 = int32x8_load(&x[j + 8]); ------------------ | | 9| 712|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 1021| 712| int32x8 x2 = int32x8_load(&x[j + 16]); ------------------ | | 9| 712|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 1022| 712| int32x8 x3 = int32x8_load(&x[j + 24]); ------------------ | | 9| 712|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 1023| 712| int32x8 x4 = int32x8_load(&x[j + 32]); ------------------ | | 9| 712|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 1024| 712| int32x8 x5 = int32x8_load(&x[j + 40]); ------------------ | | 9| 712|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 1025| 712| int32x8 x6 = int32x8_load(&x[j + 48]); ------------------ | | 9| 712|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 1026| 712| int32x8 x7 = int32x8_load(&x[j + 56]); ------------------ | | 9| 712|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 1027| 712| int32x8_MINMAX(x0, x4); ------------------ | | 15| 712| do { \ | | 16| 712| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 712|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 712| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 712|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 712| (a) = c; \ | | 19| 712| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 712] | | ------------------ ------------------ 1028| 712| int32x8_MINMAX(x1, x5); ------------------ | | 15| 712| do { \ | | 16| 712| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 712|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 712| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 712|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 712| (a) = c; \ | | 19| 712| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 712] | | ------------------ ------------------ 1029| 712| int32x8_MINMAX(x2, x6); ------------------ | | 15| 712| do { \ | | 16| 712| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 712|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 712| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 712|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 712| (a) = c; \ | | 19| 712| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 712] | | ------------------ ------------------ 1030| 712| int32x8_MINMAX(x3, x7); ------------------ | | 15| 712| do { \ | | 16| 712| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 712|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 712| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 712|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 712| (a) = c; \ | | 19| 712| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 712] | | ------------------ ------------------ 1031| 712| int32x8_MINMAX(x0, x2); ------------------ | | 15| 712| do { \ | | 16| 712| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 712|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 712| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 712|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 712| (a) = c; \ | | 19| 712| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 712] | | ------------------ ------------------ 1032| 712| int32x8_MINMAX(x1, x3); ------------------ | | 15| 712| do { \ | | 16| 712| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 712|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 712| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 712|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 712| (a) = c; \ | | 19| 712| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 712] | | ------------------ ------------------ 1033| 712| int32x8_MINMAX(x4, x6); ------------------ | | 15| 712| do { \ | | 16| 712| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 712|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 712| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 712|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 712| (a) = c; \ | | 19| 712| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 712] | | ------------------ ------------------ 1034| 712| int32x8_MINMAX(x5, x7); ------------------ | | 15| 712| do { \ | | 16| 712| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 712|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 712| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 712|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 712| (a) = c; \ | | 19| 712| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 712] | | ------------------ ------------------ 1035| 712| int32x8_MINMAX(x0, x1); ------------------ | | 15| 712| do { \ | | 16| 712| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 712|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 712| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 712|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 712| (a) = c; \ | | 19| 712| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 712] | | ------------------ ------------------ 1036| 712| int32x8_MINMAX(x2, x3); ------------------ | | 15| 712| do { \ | | 16| 712| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 712|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 712| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 712|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 712| (a) = c; \ | | 19| 712| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 712] | | ------------------ ------------------ 1037| 712| int32x8_MINMAX(x4, x5); ------------------ | | 15| 712| do { \ | | 16| 712| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 712|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 712| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 712|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 712| (a) = c; \ | | 19| 712| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 712] | | ------------------ ------------------ 1038| 712| int32x8_MINMAX(x6, x7); ------------------ | | 15| 712| do { \ | | 16| 712| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 712|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 712| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 712|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 712| (a) = c; \ | | 19| 712| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 712] | | ------------------ ------------------ 1039| 712| int32x8 a0 = _mm256_permute2x128_si256(x0, x1, 0x20); 1040| 712| int32x8 a1 = _mm256_permute2x128_si256(x0, x1, 0x31); 1041| 712| int32x8 a2 = _mm256_permute2x128_si256(x2, x3, 0x20); 1042| 712| int32x8 a3 = _mm256_permute2x128_si256(x2, x3, 0x31); 1043| 712| int32x8 a4 = _mm256_permute2x128_si256(x4, x5, 0x20); 1044| 712| int32x8 a5 = _mm256_permute2x128_si256(x4, x5, 0x31); 1045| 712| int32x8 a6 = _mm256_permute2x128_si256(x6, x7, 0x20); 1046| 712| int32x8 a7 = _mm256_permute2x128_si256(x6, x7, 0x31); 1047| 712| int32x8_MINMAX(a0, a1); ------------------ | | 15| 712| do { \ | | 16| 712| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 712|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 712| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 712|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 712| (a) = c; \ | | 19| 712| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 712] | | ------------------ ------------------ 1048| 712| int32x8_MINMAX(a2, a3); ------------------ | | 15| 712| do { \ | | 16| 712| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 712|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 712| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 712|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 712| (a) = c; \ | | 19| 712| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 712] | | ------------------ ------------------ 1049| 712| int32x8_MINMAX(a4, a5); ------------------ | | 15| 712| do { \ | | 16| 712| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 712|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 712| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 712|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 712| (a) = c; \ | | 19| 712| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 712] | | ------------------ ------------------ 1050| 712| int32x8_MINMAX(a6, a7); ------------------ | | 15| 712| do { \ | | 16| 712| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 712|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 712| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 712|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 712| (a) = c; \ | | 19| 712| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 712] | | ------------------ ------------------ 1051| 712| int32x8 b0 = _mm256_permute2x128_si256(a0, a1, 0x20); 1052| 712| int32x8 b1 = _mm256_permute2x128_si256(a0, a1, 0x31); 1053| 712| int32x8 b2 = _mm256_permute2x128_si256(a2, a3, 0x20); 1054| 712| int32x8 b3 = _mm256_permute2x128_si256(a2, a3, 0x31); 1055| 712| int32x8 b4 = _mm256_permute2x128_si256(a4, a5, 0x20); 1056| 712| int32x8 b5 = _mm256_permute2x128_si256(a4, a5, 0x31); 1057| 712| int32x8 b6 = _mm256_permute2x128_si256(a6, a7, 0x20); 1058| 712| int32x8 b7 = _mm256_permute2x128_si256(a6, a7, 0x31); 1059| 712| int32x8 c0 = _mm256_unpacklo_epi64(b0, b1); 1060| 712| int32x8 c1 = _mm256_unpackhi_epi64(b0, b1); 1061| 712| int32x8 c2 = _mm256_unpacklo_epi64(b2, b3); 1062| 712| int32x8 c3 = _mm256_unpackhi_epi64(b2, b3); 1063| 712| int32x8 c4 = _mm256_unpacklo_epi64(b4, b5); 1064| 712| int32x8 c5 = _mm256_unpackhi_epi64(b4, b5); 1065| 712| int32x8 c6 = _mm256_unpacklo_epi64(b6, b7); 1066| 712| int32x8 c7 = _mm256_unpackhi_epi64(b6, b7); 1067| 712| int32x8_MINMAX(c0, c1); ------------------ | | 15| 712| do { \ | | 16| 712| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 712|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 712| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 712|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 712| (a) = c; \ | | 19| 712| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 712] | | ------------------ ------------------ 1068| 712| int32x8_MINMAX(c2, c3); ------------------ | | 15| 712| do { \ | | 16| 712| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 712|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 712| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 712|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 712| (a) = c; \ | | 19| 712| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 712] | | ------------------ ------------------ 1069| 712| int32x8_MINMAX(c4, c5); ------------------ | | 15| 712| do { \ | | 16| 712| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 712|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 712| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 712|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 712| (a) = c; \ | | 19| 712| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 712] | | ------------------ ------------------ 1070| 712| int32x8_MINMAX(c6, c7); ------------------ | | 15| 712| do { \ | | 16| 712| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 712|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 712| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 712|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 712| (a) = c; \ | | 19| 712| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 712] | | ------------------ ------------------ 1071| 712| int32x8 d0 = _mm256_unpacklo_epi32(c0, c1); 1072| 712| int32x8 d1 = _mm256_unpackhi_epi32(c0, c1); 1073| 712| int32x8 d2 = _mm256_unpacklo_epi32(c2, c3); 1074| 712| int32x8 d3 = _mm256_unpackhi_epi32(c2, c3); 1075| 712| int32x8 d4 = _mm256_unpacklo_epi32(c4, c5); 1076| 712| int32x8 d5 = _mm256_unpackhi_epi32(c4, c5); 1077| 712| int32x8 d6 = _mm256_unpacklo_epi32(c6, c7); 1078| 712| int32x8 d7 = _mm256_unpackhi_epi32(c6, c7); 1079| 712| int32x8 e0 = _mm256_unpacklo_epi64(d0, d1); 1080| 712| int32x8 e1 = _mm256_unpackhi_epi64(d0, d1); 1081| 712| int32x8 e2 = _mm256_unpacklo_epi64(d2, d3); 1082| 712| int32x8 e3 = _mm256_unpackhi_epi64(d2, d3); 1083| 712| int32x8 e4 = _mm256_unpacklo_epi64(d4, d5); 1084| 712| int32x8 e5 = _mm256_unpackhi_epi64(d4, d5); 1085| 712| int32x8 e6 = _mm256_unpacklo_epi64(d6, d7); 1086| 712| int32x8 e7 = _mm256_unpackhi_epi64(d6, d7); 1087| 712| int32x8_MINMAX(e0, e1); ------------------ | | 15| 712| do { \ | | 16| 712| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 712|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 712| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 712|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 712| (a) = c; \ | | 19| 712| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 712] | | ------------------ ------------------ 1088| 712| int32x8_MINMAX(e2, e3); ------------------ | | 15| 712| do { \ | | 16| 712| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 712|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 712| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 712|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 712| (a) = c; \ | | 19| 712| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 712] | | ------------------ ------------------ 1089| 712| int32x8_MINMAX(e4, e5); ------------------ | | 15| 712| do { \ | | 16| 712| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 712|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 712| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 712|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 712| (a) = c; \ | | 19| 712| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 712] | | ------------------ ------------------ 1090| 712| int32x8_MINMAX(e6, e7); ------------------ | | 15| 712| do { \ | | 16| 712| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 712|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 712| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 712|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 712| (a) = c; \ | | 19| 712| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 712] | | ------------------ ------------------ 1091| 712| int32x8 f0 = _mm256_unpacklo_epi32(e0, e1); 1092| 712| int32x8 f1 = _mm256_unpackhi_epi32(e0, e1); 1093| 712| int32x8 f2 = _mm256_unpacklo_epi32(e2, e3); 1094| 712| int32x8 f3 = _mm256_unpackhi_epi32(e2, e3); 1095| 712| int32x8 f4 = _mm256_unpacklo_epi32(e4, e5); 1096| 712| int32x8 f5 = _mm256_unpackhi_epi32(e4, e5); 1097| 712| int32x8 f6 = _mm256_unpacklo_epi32(e6, e7); 1098| 712| int32x8 f7 = _mm256_unpackhi_epi32(e6, e7); 1099| 712| int32x8_store(&x[j], f0); ------------------ | | 10| 712|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 1100| 712| int32x8_store(&x[j + 8], f1); ------------------ | | 10| 712|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 1101| 712| int32x8_store(&x[j + 16], f2); ------------------ | | 10| 712|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 1102| 712| int32x8_store(&x[j + 24], f3); ------------------ | | 10| 712|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 1103| 712| int32x8_store(&x[j + 32], f4); ------------------ | | 10| 712|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 1104| 712| int32x8_store(&x[j + 40], f5); ------------------ | | 10| 712|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 1105| 712| int32x8_store(&x[j + 48], f6); ------------------ | | 10| 712|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 1106| 712| int32x8_store(&x[j + 56], f7); ------------------ | | 10| 712|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 1107| 712| } 1108| 178| minmax_vector(x + j, x + j + 32, n - 32 - j); 1109| 178| goto continue16; 1110| 178| } 1111| 178| if (q == 16) { ------------------ | Branch (1111:9): [True: 0, False: 178] ------------------ 1112| 0| j = 0; 1113| 178|continue16: 1114| 356| for (; j + 32 <= n; j += 32) { ------------------ | Branch (1114:16): [True: 178, False: 178] ------------------ 1115| 178| int32x8 x0 = int32x8_load(&x[j]); ------------------ | | 9| 178|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 1116| 178| int32x8 x1 = int32x8_load(&x[j + 8]); ------------------ | | 9| 178|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 1117| 178| int32x8 x2 = int32x8_load(&x[j + 16]); ------------------ | | 9| 178|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 1118| 178| int32x8 x3 = int32x8_load(&x[j + 24]); ------------------ | | 9| 178|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 1119| 178| int32x8_MINMAX(x0, x2); ------------------ | | 15| 178| do { \ | | 16| 178| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 178|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 178| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 178|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 178| (a) = c; \ | | 19| 178| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 178] | | ------------------ ------------------ 1120| 178| int32x8_MINMAX(x1, x3); ------------------ | | 15| 178| do { \ | | 16| 178| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 178|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 178| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 178|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 178| (a) = c; \ | | 19| 178| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 178] | | ------------------ ------------------ 1121| 178| int32x8_MINMAX(x0, x1); ------------------ | | 15| 178| do { \ | | 16| 178| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 178|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 178| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 178|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 178| (a) = c; \ | | 19| 178| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 178] | | ------------------ ------------------ 1122| 178| int32x8_MINMAX(x2, x3); ------------------ | | 15| 178| do { \ | | 16| 178| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 178|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 178| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 178|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 178| (a) = c; \ | | 19| 178| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 178] | | ------------------ ------------------ 1123| 178| int32x8 a0 = _mm256_permute2x128_si256(x0, x1, 0x20); 1124| 178| int32x8 a1 = _mm256_permute2x128_si256(x0, x1, 0x31); 1125| 178| int32x8 a2 = _mm256_permute2x128_si256(x2, x3, 0x20); 1126| 178| int32x8 a3 = _mm256_permute2x128_si256(x2, x3, 0x31); 1127| 178| int32x8_MINMAX(a0, a1); ------------------ | | 15| 178| do { \ | | 16| 178| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 178|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 178| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 178|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 178| (a) = c; \ | | 19| 178| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 178] | | ------------------ ------------------ 1128| 178| int32x8_MINMAX(a2, a3); ------------------ | | 15| 178| do { \ | | 16| 178| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 178|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 178| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 178|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 178| (a) = c; \ | | 19| 178| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 178] | | ------------------ ------------------ 1129| 178| int32x8 b0 = _mm256_permute2x128_si256(a0, a1, 0x20); 1130| 178| int32x8 b1 = _mm256_permute2x128_si256(a0, a1, 0x31); 1131| 178| int32x8 b2 = _mm256_permute2x128_si256(a2, a3, 0x20); 1132| 178| int32x8 b3 = _mm256_permute2x128_si256(a2, a3, 0x31); 1133| 178| int32x8 c0 = _mm256_unpacklo_epi64(b0, b1); 1134| 178| int32x8 c1 = _mm256_unpackhi_epi64(b0, b1); 1135| 178| int32x8 c2 = _mm256_unpacklo_epi64(b2, b3); 1136| 178| int32x8 c3 = _mm256_unpackhi_epi64(b2, b3); 1137| 178| int32x8_MINMAX(c0, c1); ------------------ | | 15| 178| do { \ | | 16| 178| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 178|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 178| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 178|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 178| (a) = c; \ | | 19| 178| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 178] | | ------------------ ------------------ 1138| 178| int32x8_MINMAX(c2, c3); ------------------ | | 15| 178| do { \ | | 16| 178| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 178|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 178| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 178|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 178| (a) = c; \ | | 19| 178| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 178] | | ------------------ ------------------ 1139| 178| int32x8 d0 = _mm256_unpacklo_epi32(c0, c1); 1140| 178| int32x8 d1 = _mm256_unpackhi_epi32(c0, c1); 1141| 178| int32x8 d2 = _mm256_unpacklo_epi32(c2, c3); 1142| 178| int32x8 d3 = _mm256_unpackhi_epi32(c2, c3); 1143| 178| int32x8 e0 = _mm256_unpacklo_epi64(d0, d1); 1144| 178| int32x8 e1 = _mm256_unpackhi_epi64(d0, d1); 1145| 178| int32x8 e2 = _mm256_unpacklo_epi64(d2, d3); 1146| 178| int32x8 e3 = _mm256_unpackhi_epi64(d2, d3); 1147| 178| int32x8_MINMAX(e0, e1); ------------------ | | 15| 178| do { \ | | 16| 178| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 178|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 178| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 178|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 178| (a) = c; \ | | 19| 178| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 178] | | ------------------ ------------------ 1148| 178| int32x8_MINMAX(e2, e3); ------------------ | | 15| 178| do { \ | | 16| 178| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 178|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 178| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 178|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 178| (a) = c; \ | | 19| 178| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 178] | | ------------------ ------------------ 1149| 178| int32x8 f0 = _mm256_unpacklo_epi32(e0, e1); 1150| 178| int32x8 f1 = _mm256_unpackhi_epi32(e0, e1); 1151| 178| int32x8 f2 = _mm256_unpacklo_epi32(e2, e3); 1152| 178| int32x8 f3 = _mm256_unpackhi_epi32(e2, e3); 1153| 178| int32x8_store(&x[j], f0); ------------------ | | 10| 178|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 1154| 178| int32x8_store(&x[j + 8], f1); ------------------ | | 10| 178|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 1155| 178| int32x8_store(&x[j + 16], f2); ------------------ | | 10| 178|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 1156| 178| int32x8_store(&x[j + 24], f3); ------------------ | | 10| 178|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 1157| 178| } 1158| 178| minmax_vector(x + j, x + j + 16, n - 16 - j); 1159| 178| goto continue8; 1160| 0| } 1161| | /* q == 8 */ 1162| 178| j = 0; 1163| 356|continue8: 1164| 9.61k| for (; j + 16 <= n; j += 16) { ------------------ | Branch (1164:12): [True: 9.25k, False: 356] ------------------ 1165| 9.25k| int32x8 x0 = int32x8_load(&x[j]); ------------------ | | 9| 9.25k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 1166| 9.25k| int32x8 x1 = int32x8_load(&x[j + 8]); ------------------ | | 9| 9.25k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 1167| 9.25k| int32x8_MINMAX(x0, x1); ------------------ | | 15| 9.25k| do { \ | | 16| 9.25k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 9.25k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 9.25k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 9.25k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 9.25k| (a) = c; \ | | 19| 9.25k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 9.25k] | | ------------------ ------------------ 1168| 9.25k| int32x8_store(&x[j], x0); ------------------ | | 10| 9.25k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 1169| 9.25k| int32x8_store(&x[j + 8], x1); ------------------ | | 10| 9.25k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 1170| 9.25k| int32x8 a0 = _mm256_permute2x128_si256(x0, x1, 0x20); /* x0123y0123 */ 1171| 9.25k| int32x8 a1 = _mm256_permute2x128_si256(x0, x1, 0x31); /* x4567y4567 */ 1172| 9.25k| int32x8_MINMAX(a0, a1); ------------------ | | 15| 9.25k| do { \ | | 16| 9.25k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 9.25k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 9.25k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 9.25k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 9.25k| (a) = c; \ | | 19| 9.25k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 9.25k] | | ------------------ ------------------ 1173| 9.25k| int32x8 b0 = _mm256_permute2x128_si256(a0, a1, 0x20); /* x01234567 */ 1174| 9.25k| int32x8 b1 = _mm256_permute2x128_si256(a0, a1, 0x31); /* y01234567 */ 1175| 9.25k| int32x8 c0 = _mm256_unpacklo_epi64(b0, b1); /* x01y01x45y45 */ 1176| 9.25k| int32x8 c1 = _mm256_unpackhi_epi64(b0, b1); /* x23y23x67y67 */ 1177| 9.25k| int32x8_MINMAX(c0, c1); ------------------ | | 15| 9.25k| do { \ | | 16| 9.25k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 9.25k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 9.25k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 9.25k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 9.25k| (a) = c; \ | | 19| 9.25k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 9.25k] | | ------------------ ------------------ 1178| 9.25k| int32x8 d0 = _mm256_unpacklo_epi32(c0, c1); /* x02x13x46x57 */ 1179| 9.25k| int32x8 d1 = _mm256_unpackhi_epi32(c0, c1); /* y02y13y46y57 */ 1180| 9.25k| int32x8 e0 = _mm256_unpacklo_epi64(d0, d1); /* x02y02x46y46 */ 1181| 9.25k| int32x8 e1 = _mm256_unpackhi_epi64(d0, d1); /* x13y13x57y57 */ 1182| 9.25k| int32x8_MINMAX(e0, e1); ------------------ | | 15| 9.25k| do { \ | | 16| 9.25k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 9.25k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 9.25k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 9.25k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 9.25k| (a) = c; \ | | 19| 9.25k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 9.25k] | | ------------------ ------------------ 1183| 9.25k| int32x8 f0 = _mm256_unpacklo_epi32(e0, e1); /* x01234567 */ 1184| 9.25k| int32x8 f1 = _mm256_unpackhi_epi32(e0, e1); /* y01234567 */ 1185| 9.25k| int32x8_store(&x[j], f0); ------------------ | | 10| 9.25k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 1186| 9.25k| int32x8_store(&x[j + 8], f1); ------------------ | | 10| 9.25k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 1187| 9.25k| } 1188| 356| minmax_vector(x + j, x + j + 8, n - 8 - j); 1189| 356| if (j + 8 <= n) { ------------------ | Branch (1189:9): [True: 0, False: 356] ------------------ 1190| 0| int32_MINMAX(&x[j], &x[j + 4]); 1191| 0| int32_MINMAX(&x[j + 1], &x[j + 5]); 1192| 0| int32_MINMAX(&x[j + 2], &x[j + 6]); 1193| 0| int32_MINMAX(&x[j + 3], &x[j + 7]); 1194| 0| int32_MINMAX(&x[j], &x[j + 2]); 1195| 0| int32_MINMAX(&x[j + 1], &x[j + 3]); 1196| 0| int32_MINMAX(&x[j], &x[j + 1]); 1197| 0| int32_MINMAX(&x[j + 2], &x[j + 3]); 1198| 0| int32_MINMAX(&x[j + 4], &x[j + 6]); 1199| 0| int32_MINMAX(&x[j + 5], &x[j + 7]); 1200| 0| int32_MINMAX(&x[j + 4], &x[j + 5]); 1201| 0| int32_MINMAX(&x[j + 6], &x[j + 7]); 1202| 0| j += 8; 1203| 0| } 1204| 356| minmax_vector(x + j, x + j + 4, n - 4 - j); 1205| 356| if (j + 4 <= n) { ------------------ | Branch (1205:9): [True: 356, False: 0] ------------------ 1206| 356| int32_MINMAX(&x[j], &x[j + 2]); 1207| 356| int32_MINMAX(&x[j + 1], &x[j + 3]); 1208| 356| int32_MINMAX(&x[j], &x[j + 1]); 1209| 356| int32_MINMAX(&x[j + 2], &x[j + 3]); 1210| 356| j += 4; 1211| 356| } 1212| 356| if (j + 3 <= n) { ------------------ | Branch (1212:9): [True: 0, False: 356] ------------------ 1213| 0| int32_MINMAX(&x[j], &x[j + 2]); 1214| 0| } 1215| 356| if (j + 2 <= n) { ------------------ | Branch (1215:9): [True: 0, False: 356] ------------------ 1216| 0| int32_MINMAX(&x[j], &x[j + 1]); 1217| 0| } 1218| 356|} PQCLEAN_NTRUHPS4096821_AVX2_crypto_kem_keypair: 10| 89|int PQCLEAN_NTRUHPS4096821_AVX2_crypto_kem_keypair(uint8_t *pk, uint8_t *sk) { 11| 89| uint8_t seed[NTRU_SAMPLE_FG_BYTES]; 12| | 13| 89| randombytes(seed, NTRU_SAMPLE_FG_BYTES); ------------------ | | 8| 89|#define randombytes OQS_randombytes ------------------ randombytes(seed, NTRU_SAMPLE_FG_BYTES); ------------------ | | 22| 89|#define NTRU_SAMPLE_FG_BYTES (NTRU_SAMPLE_IID_BYTES+NTRU_SAMPLE_FT_BYTES) | | ------------------ | | | | 20| 89|#define NTRU_SAMPLE_IID_BYTES (NTRU_N-1) | | | | ------------------ | | | | | | 5| 89|#define NTRU_N 821 | | | | ------------------ | | ------------------ | | #define NTRU_SAMPLE_FG_BYTES (NTRU_SAMPLE_IID_BYTES+NTRU_SAMPLE_FT_BYTES) | | ------------------ | | | | 21| 89|#define NTRU_SAMPLE_FT_BYTES ((30*(NTRU_N-1)+7)/8) | | | | ------------------ | | | | | | 5| 89|#define NTRU_N 821 | | | | ------------------ | | ------------------ ------------------ 14| 89| PQCLEAN_NTRUHPS4096821_AVX2_owcpa_keypair(pk, sk, seed); 15| | 16| 89| randombytes(sk + NTRU_OWCPA_SECRETKEYBYTES, NTRU_PRFKEYBYTES); ------------------ | | 8| 89|#define randombytes OQS_randombytes ------------------ randombytes(sk + NTRU_OWCPA_SECRETKEYBYTES, NTRU_PRFKEYBYTES); ------------------ | | 30| 89|#define NTRU_OWCPA_SECRETKEYBYTES (2*NTRU_PACK_TRINARY_BYTES + NTRU_OWCPA_PUBLICKEYBYTES) | | ------------------ | | | | 26| 89|#define NTRU_PACK_TRINARY_BYTES ((NTRU_PACK_DEG+4)/5) | | | | ------------------ | | | | | | 25| 89|#define NTRU_PACK_DEG (NTRU_N-1) | | | | | | ------------------ | | | | | | | | 5| 89|#define NTRU_N 821 | | | | | | ------------------ | | | | ------------------ | | ------------------ | | #define NTRU_OWCPA_SECRETKEYBYTES (2*NTRU_PACK_TRINARY_BYTES + NTRU_OWCPA_PUBLICKEYBYTES) | | ------------------ | | | | 29| 89|#define NTRU_OWCPA_PUBLICKEYBYTES ((NTRU_LOGQ*NTRU_PACK_DEG+7)/8) | | | | ------------------ | | | | | | 6| 89|#define NTRU_LOGQ 12 | | | | ------------------ | | | | #define NTRU_OWCPA_PUBLICKEYBYTES ((NTRU_LOGQ*NTRU_PACK_DEG+7)/8) | | | | ------------------ | | | | | | 25| 89|#define NTRU_PACK_DEG (NTRU_N-1) | | | | | | ------------------ | | | | | | | | 5| 89|#define NTRU_N 821 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ randombytes(sk + NTRU_OWCPA_SECRETKEYBYTES, NTRU_PRFKEYBYTES); ------------------ | | 17| 89|#define NTRU_PRFKEYBYTES 32 ------------------ 17| | 18| 89| return 0; 19| 89|} PQCLEAN_NTRUHPS4096821_AVX2_crypto_kem_enc: 21| 89|int PQCLEAN_NTRUHPS4096821_AVX2_crypto_kem_enc(uint8_t *c, uint8_t *k, const uint8_t *pk) { 22| 89| poly r, m; 23| 89| uint8_t rm[NTRU_OWCPA_MSGBYTES]; 24| 89| uint8_t rm_seed[NTRU_SAMPLE_RM_BYTES]; 25| | 26| 89| randombytes(rm_seed, NTRU_SAMPLE_RM_BYTES); ------------------ | | 8| 89|#define randombytes OQS_randombytes ------------------ randombytes(rm_seed, NTRU_SAMPLE_RM_BYTES); ------------------ | | 23| 89|#define NTRU_SAMPLE_RM_BYTES (NTRU_SAMPLE_IID_BYTES+NTRU_SAMPLE_FT_BYTES) | | ------------------ | | | | 20| 89|#define NTRU_SAMPLE_IID_BYTES (NTRU_N-1) | | | | ------------------ | | | | | | 5| 89|#define NTRU_N 821 | | | | ------------------ | | ------------------ | | #define NTRU_SAMPLE_RM_BYTES (NTRU_SAMPLE_IID_BYTES+NTRU_SAMPLE_FT_BYTES) | | ------------------ | | | | 21| 89|#define NTRU_SAMPLE_FT_BYTES ((30*(NTRU_N-1)+7)/8) | | | | ------------------ | | | | | | 5| 89|#define NTRU_N 821 | | | | ------------------ | | ------------------ ------------------ 27| | 28| 89| PQCLEAN_NTRUHPS4096821_AVX2_sample_rm(&r, &m, rm_seed); 29| | 30| 89| PQCLEAN_NTRUHPS4096821_AVX2_poly_S3_tobytes(rm, &r); 31| 89| PQCLEAN_NTRUHPS4096821_AVX2_poly_S3_tobytes(rm + NTRU_PACK_TRINARY_BYTES, &m); ------------------ | | 26| 89|#define NTRU_PACK_TRINARY_BYTES ((NTRU_PACK_DEG+4)/5) | | ------------------ | | | | 25| 89|#define NTRU_PACK_DEG (NTRU_N-1) | | | | ------------------ | | | | | | 5| 89|#define NTRU_N 821 | | | | ------------------ | | ------------------ ------------------ 32| 89| sha3_256(k, rm, NTRU_OWCPA_MSGBYTES); ------------------ | | 15| 89|#define sha3_256 OQS_SHA3_sha3_256 ------------------ sha3_256(k, rm, NTRU_OWCPA_MSGBYTES); ------------------ | | 28| 89|#define NTRU_OWCPA_MSGBYTES (2*NTRU_PACK_TRINARY_BYTES) | | ------------------ | | | | 26| 89|#define NTRU_PACK_TRINARY_BYTES ((NTRU_PACK_DEG+4)/5) | | | | ------------------ | | | | | | 25| 89|#define NTRU_PACK_DEG (NTRU_N-1) | | | | | | ------------------ | | | | | | | | 5| 89|#define NTRU_N 821 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 33| | 34| 89| PQCLEAN_NTRUHPS4096821_AVX2_poly_Z3_to_Zq(&r); 35| 89| PQCLEAN_NTRUHPS4096821_AVX2_owcpa_enc(c, &r, &m, pk); 36| | 37| 89| return 0; 38| 89|} PQCLEAN_NTRUHPS4096821_AVX2_crypto_kem_dec: 40| 89|int PQCLEAN_NTRUHPS4096821_AVX2_crypto_kem_dec(uint8_t *k, const uint8_t *c, const uint8_t *sk) { 41| 89| int i, fail; 42| 89| uint8_t rm[NTRU_OWCPA_MSGBYTES]; 43| 89| uint8_t buf[NTRU_PRFKEYBYTES + NTRU_CIPHERTEXTBYTES]; 44| | 45| 89| fail = PQCLEAN_NTRUHPS4096821_AVX2_owcpa_dec(rm, c, sk); 46| | /* If fail = 0 then c = Enc(h, rm). There is no need to re-encapsulate. */ 47| | /* See comment in PQCLEAN_NTRUHPS4096821_AVX2_owcpa_dec for details. */ 48| | 49| 89| sha3_256(k, rm, NTRU_OWCPA_MSGBYTES); ------------------ | | 15| 89|#define sha3_256 OQS_SHA3_sha3_256 ------------------ sha3_256(k, rm, NTRU_OWCPA_MSGBYTES); ------------------ | | 28| 89|#define NTRU_OWCPA_MSGBYTES (2*NTRU_PACK_TRINARY_BYTES) | | ------------------ | | | | 26| 89|#define NTRU_PACK_TRINARY_BYTES ((NTRU_PACK_DEG+4)/5) | | | | ------------------ | | | | | | 25| 89|#define NTRU_PACK_DEG (NTRU_N-1) | | | | | | ------------------ | | | | | | | | 5| 89|#define NTRU_N 821 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 50| | 51| | /* shake(secret PRF key || input ciphertext) */ 52| 2.93k| for (i = 0; i < NTRU_PRFKEYBYTES; i++) { ------------------ | | 17| 2.93k|#define NTRU_PRFKEYBYTES 32 ------------------ | Branch (52:17): [True: 2.84k, False: 89] ------------------ 53| 2.84k| buf[i] = sk[i + NTRU_OWCPA_SECRETKEYBYTES]; ------------------ | | 30| 2.84k|#define NTRU_OWCPA_SECRETKEYBYTES (2*NTRU_PACK_TRINARY_BYTES + NTRU_OWCPA_PUBLICKEYBYTES) | | ------------------ | | | | 26| 2.84k|#define NTRU_PACK_TRINARY_BYTES ((NTRU_PACK_DEG+4)/5) | | | | ------------------ | | | | | | 25| 2.84k|#define NTRU_PACK_DEG (NTRU_N-1) | | | | | | ------------------ | | | | | | | | 5| 2.84k|#define NTRU_N 821 | | | | | | ------------------ | | | | ------------------ | | ------------------ | | #define NTRU_OWCPA_SECRETKEYBYTES (2*NTRU_PACK_TRINARY_BYTES + NTRU_OWCPA_PUBLICKEYBYTES) | | ------------------ | | | | 29| 2.84k|#define NTRU_OWCPA_PUBLICKEYBYTES ((NTRU_LOGQ*NTRU_PACK_DEG+7)/8) | | | | ------------------ | | | | | | 6| 2.84k|#define NTRU_LOGQ 12 | | | | ------------------ | | | | #define NTRU_OWCPA_PUBLICKEYBYTES ((NTRU_LOGQ*NTRU_PACK_DEG+7)/8) | | | | ------------------ | | | | | | 25| 2.84k|#define NTRU_PACK_DEG (NTRU_N-1) | | | | | | ------------------ | | | | | | | | 5| 2.84k|#define NTRU_N 821 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 54| 2.84k| } 55| 109k| for (i = 0; i < NTRU_CIPHERTEXTBYTES; i++) { ------------------ | | 35| 109k|#define NTRU_CIPHERTEXTBYTES (NTRU_OWCPA_BYTES) | | ------------------ | | | | 31| 109k|#define NTRU_OWCPA_BYTES ((NTRU_LOGQ*NTRU_PACK_DEG+7)/8) | | | | ------------------ | | | | | | 6| 109k|#define NTRU_LOGQ 12 | | | | ------------------ | | | | #define NTRU_OWCPA_BYTES ((NTRU_LOGQ*NTRU_PACK_DEG+7)/8) | | | | ------------------ | | | | | | 25| 109k|#define NTRU_PACK_DEG (NTRU_N-1) | | | | | | ------------------ | | | | | | | | 5| 109k|#define NTRU_N 821 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ | Branch (55:17): [True: 109k, False: 89] ------------------ 56| 109k| buf[NTRU_PRFKEYBYTES + i] = c[i]; ------------------ | | 17| 109k|#define NTRU_PRFKEYBYTES 32 ------------------ 57| 109k| } 58| 89| sha3_256(rm, buf, NTRU_PRFKEYBYTES + NTRU_CIPHERTEXTBYTES); ------------------ | | 15| 89|#define sha3_256 OQS_SHA3_sha3_256 ------------------ sha3_256(rm, buf, NTRU_PRFKEYBYTES + NTRU_CIPHERTEXTBYTES); ------------------ | | 17| 89|#define NTRU_PRFKEYBYTES 32 ------------------ sha3_256(rm, buf, NTRU_PRFKEYBYTES + NTRU_CIPHERTEXTBYTES); ------------------ | | 35| 89|#define NTRU_CIPHERTEXTBYTES (NTRU_OWCPA_BYTES) | | ------------------ | | | | 31| 89|#define NTRU_OWCPA_BYTES ((NTRU_LOGQ*NTRU_PACK_DEG+7)/8) | | | | ------------------ | | | | | | 6| 89|#define NTRU_LOGQ 12 | | | | ------------------ | | | | #define NTRU_OWCPA_BYTES ((NTRU_LOGQ*NTRU_PACK_DEG+7)/8) | | | | ------------------ | | | | | | 25| 89|#define NTRU_PACK_DEG (NTRU_N-1) | | | | | | ------------------ | | | | | | | | 5| 89|#define NTRU_N 821 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 59| | 60| 89| PQCLEAN_NTRUHPS4096821_AVX2_cmov(k, rm, NTRU_SHAREDKEYBYTES, (unsigned char) fail); ------------------ | | 18| 89|#define NTRU_SHAREDKEYBYTES 32 ------------------ 61| | 62| 89| return 0; 63| 89|} PQCLEAN_NTRUHPS4096821_AVX2_owcpa_keypair: 62| 89| const unsigned char seed[NTRU_SAMPLE_FG_BYTES]) { 63| 89| int i; 64| | 65| 89| poly x1, x2, x3, x4, x5; 66| | 67| 89| poly *f = &x1, *g = &x2, *invf_mod3 = &x3; 68| 89| poly *gf = &x3, *invgf = &x4, *tmp = &x5; 69| 89| poly *invh = &x3, *h = &x3; 70| | 71| 89| PQCLEAN_NTRUHPS4096821_AVX2_sample_fg(f, g, seed); 72| | 73| 89| PQCLEAN_NTRUHPS4096821_AVX2_poly_S3_inv(invf_mod3, f); 74| 89| PQCLEAN_NTRUHPS4096821_AVX2_poly_S3_tobytes(sk, f); 75| 89| PQCLEAN_NTRUHPS4096821_AVX2_poly_S3_tobytes(sk + NTRU_PACK_TRINARY_BYTES, invf_mod3); ------------------ | | 26| 89|#define NTRU_PACK_TRINARY_BYTES ((NTRU_PACK_DEG+4)/5) | | ------------------ | | | | 25| 89|#define NTRU_PACK_DEG (NTRU_N-1) | | | | ------------------ | | | | | | 5| 89|#define NTRU_N 821 | | | | ------------------ | | ------------------ ------------------ 76| | 77| | /* Lift coeffs of f and g from Z_p to Z_q */ 78| 89| PQCLEAN_NTRUHPS4096821_AVX2_poly_Z3_to_Zq(f); 79| 89| PQCLEAN_NTRUHPS4096821_AVX2_poly_Z3_to_Zq(g); 80| | 81| | 82| | /* g = 3*g */ 83| 73.1k| for (i = 0; i < NTRU_N; i++) { ------------------ | | 5| 73.1k|#define NTRU_N 821 ------------------ | Branch (83:17): [True: 73.0k, False: 89] ------------------ 84| 73.0k| g->coeffs[i] = 3 * g->coeffs[i]; 85| 73.0k| } 86| | 87| 89| PQCLEAN_NTRUHPS4096821_AVX2_poly_Rq_mul(gf, g, f); 88| | 89| 89| PQCLEAN_NTRUHPS4096821_AVX2_poly_Rq_inv(invgf, gf); 90| | 91| 89| PQCLEAN_NTRUHPS4096821_AVX2_poly_Rq_mul(tmp, invgf, f); 92| 89| PQCLEAN_NTRUHPS4096821_AVX2_poly_Sq_mul(invh, tmp, f); 93| 89| PQCLEAN_NTRUHPS4096821_AVX2_poly_Sq_tobytes(sk + 2 * NTRU_PACK_TRINARY_BYTES, invh); ------------------ | | 26| 89|#define NTRU_PACK_TRINARY_BYTES ((NTRU_PACK_DEG+4)/5) | | ------------------ | | | | 25| 89|#define NTRU_PACK_DEG (NTRU_N-1) | | | | ------------------ | | | | | | 5| 89|#define NTRU_N 821 | | | | ------------------ | | ------------------ ------------------ 94| | 95| 89| PQCLEAN_NTRUHPS4096821_AVX2_poly_Rq_mul(tmp, invgf, g); 96| 89| PQCLEAN_NTRUHPS4096821_AVX2_poly_Rq_mul(h, tmp, g); 97| 89| PQCLEAN_NTRUHPS4096821_AVX2_poly_Rq_sum_zero_tobytes(pk, h); 98| 89|} PQCLEAN_NTRUHPS4096821_AVX2_owcpa_enc: 104| 89| const unsigned char *pk) { 105| 89| int i; 106| 89| poly x1, x2; 107| 89| poly *h = &x1, *liftm = &x1; 108| 89| poly *ct = &x2; 109| | 110| 89| PQCLEAN_NTRUHPS4096821_AVX2_poly_Rq_sum_zero_frombytes(h, pk); 111| | 112| 89| PQCLEAN_NTRUHPS4096821_AVX2_poly_Rq_mul(ct, r, h); 113| | 114| 89| PQCLEAN_NTRUHPS4096821_AVX2_poly_lift(liftm, m); 115| 73.1k| for (i = 0; i < NTRU_N; i++) { ------------------ | | 5| 73.1k|#define NTRU_N 821 ------------------ | Branch (115:17): [True: 73.0k, False: 89] ------------------ 116| 73.0k| ct->coeffs[i] = ct->coeffs[i] + liftm->coeffs[i]; 117| 73.0k| } 118| | 119| 89| PQCLEAN_NTRUHPS4096821_AVX2_poly_Rq_sum_zero_tobytes(c, ct); 120| 89|} PQCLEAN_NTRUHPS4096821_AVX2_owcpa_dec: 124| 89| const unsigned char *secretkey) { 125| 89| int i; 126| 89| int fail; 127| 89| poly x1, x2, x3, x4; 128| | 129| 89| poly *c = &x1, *f = &x2, *cf = &x3; 130| 89| poly *mf = &x2, *finv3 = &x3, *m = &x4; 131| 89| poly *liftm = &x2, *invh = &x3, *r = &x4; 132| 89| poly *b = &x1; 133| | 134| 89| PQCLEAN_NTRUHPS4096821_AVX2_poly_Rq_sum_zero_frombytes(c, ciphertext); 135| 89| PQCLEAN_NTRUHPS4096821_AVX2_poly_S3_frombytes(f, secretkey); 136| 89| PQCLEAN_NTRUHPS4096821_AVX2_poly_Z3_to_Zq(f); 137| | 138| 89| PQCLEAN_NTRUHPS4096821_AVX2_poly_Rq_mul(cf, c, f); 139| 89| PQCLEAN_NTRUHPS4096821_AVX2_poly_Rq_to_S3(mf, cf); 140| | 141| 89| PQCLEAN_NTRUHPS4096821_AVX2_poly_S3_frombytes(finv3, secretkey + NTRU_PACK_TRINARY_BYTES); ------------------ | | 26| 89|#define NTRU_PACK_TRINARY_BYTES ((NTRU_PACK_DEG+4)/5) | | ------------------ | | | | 25| 89|#define NTRU_PACK_DEG (NTRU_N-1) | | | | ------------------ | | | | | | 5| 89|#define NTRU_N 821 | | | | ------------------ | | ------------------ ------------------ 142| 89| PQCLEAN_NTRUHPS4096821_AVX2_poly_S3_mul(m, mf, finv3); 143| 89| PQCLEAN_NTRUHPS4096821_AVX2_poly_S3_tobytes(rm + NTRU_PACK_TRINARY_BYTES, m); ------------------ | | 26| 89|#define NTRU_PACK_TRINARY_BYTES ((NTRU_PACK_DEG+4)/5) | | ------------------ | | | | 25| 89|#define NTRU_PACK_DEG (NTRU_N-1) | | | | ------------------ | | | | | | 5| 89|#define NTRU_N 821 | | | | ------------------ | | ------------------ ------------------ 144| | 145| 89| fail = 0; 146| | 147| | /* Check that the unused bits of the last byte of the ciphertext are zero */ 148| 89| fail |= owcpa_check_ciphertext(ciphertext); 149| | 150| | /* For the IND-CCA2 KEM we must ensure that c = Enc(h, (r,m)). */ 151| | /* We can avoid re-computing r*h + Lift(m) as long as we check that */ 152| | /* r (defined as b/h mod (q, Phi_n)) and m are in the message space. */ 153| | /* (m can take any value in S3 in NTRU_HRSS) */ 154| 89| fail |= owcpa_check_m(m); 155| | 156| | /* b = c - Lift(m) mod (q, x^n - 1) */ 157| 89| PQCLEAN_NTRUHPS4096821_AVX2_poly_lift(liftm, m); 158| 73.1k| for (i = 0; i < NTRU_N; i++) { ------------------ | | 5| 73.1k|#define NTRU_N 821 ------------------ | Branch (158:17): [True: 73.0k, False: 89] ------------------ 159| 73.0k| b->coeffs[i] = c->coeffs[i] - liftm->coeffs[i]; 160| 73.0k| } 161| | 162| | /* r = b / h mod (q, Phi_n) */ 163| 89| PQCLEAN_NTRUHPS4096821_AVX2_poly_Sq_frombytes(invh, secretkey + 2 * NTRU_PACK_TRINARY_BYTES); ------------------ | | 26| 89|#define NTRU_PACK_TRINARY_BYTES ((NTRU_PACK_DEG+4)/5) | | ------------------ | | | | 25| 89|#define NTRU_PACK_DEG (NTRU_N-1) | | | | ------------------ | | | | | | 5| 89|#define NTRU_N 821 | | | | ------------------ | | ------------------ ------------------ 164| 89| PQCLEAN_NTRUHPS4096821_AVX2_poly_Sq_mul(r, b, invh); 165| | 166| | /* NOTE: Our definition of r as b/h mod (q, Phi_n) follows Figure 4 of */ 167| | /* [Sch18] https://eprint.iacr.org/2018/1174/20181203:032458. */ 168| | /* This differs from Figure 10 of Saito--Xagawa--Yamakawa */ 169| | /* [SXY17] https://eprint.iacr.org/2017/1005/20180516:055500 */ 170| | /* where r gets a final reduction modulo p. */ 171| | /* We need this change to use Proposition 1 of [Sch18]. */ 172| | 173| | /* Proposition 1 of [Sch18] shows that re-encryption with (r,m) yields c. */ 174| | /* if and only if fail==0 after the following call to owcpa_check_r */ 175| | /* The procedure given in Fig. 8 of [Sch18] can be skipped because we have */ 176| | /* c(1) = 0 due to the use of poly_Rq_sum_zero_{to,from}bytes. */ 177| 89| fail |= owcpa_check_r(r); 178| | 179| 89| PQCLEAN_NTRUHPS4096821_AVX2_poly_trinary_Zq_to_Z3(r); 180| 89| PQCLEAN_NTRUHPS4096821_AVX2_poly_S3_tobytes(rm, r); 181| | 182| 89| return fail; 183| 89|} PQCLEAN_NTRUHPS4096821_AVX2_poly_S3_tobytes: 3| 534|void PQCLEAN_NTRUHPS4096821_AVX2_poly_S3_tobytes(unsigned char msg[NTRU_PACK_TRINARY_BYTES], const poly *a) { 4| 534| int i; 5| 534| unsigned char c; 6| | 7| 88.1k| for (i = 0; i < NTRU_PACK_DEG / 5; i++) { ------------------ | | 25| 88.1k|#define NTRU_PACK_DEG (NTRU_N-1) | | ------------------ | | | | 5| 88.1k|#define NTRU_N 821 | | ------------------ ------------------ | Branch (7:17): [True: 87.5k, False: 534] ------------------ 8| 87.5k| c = a->coeffs[5 * i + 4] & 255; 9| 87.5k| c = (3 * c + a->coeffs[5 * i + 3]) & 255; 10| 87.5k| c = (3 * c + a->coeffs[5 * i + 2]) & 255; 11| 87.5k| c = (3 * c + a->coeffs[5 * i + 1]) & 255; 12| 87.5k| c = (3 * c + a->coeffs[5 * i + 0]) & 255; 13| 87.5k| msg[i] = c; 14| 87.5k| } 15| 534|} PQCLEAN_NTRUHPS4096821_AVX2_poly_S3_frombytes: 17| 178|void PQCLEAN_NTRUHPS4096821_AVX2_poly_S3_frombytes(poly *r, const unsigned char msg[NTRU_PACK_TRINARY_BYTES]) { 18| 178| int i; 19| 178| unsigned char c; 20| | 21| 29.3k| for (i = 0; i < NTRU_PACK_DEG / 5; i++) { ------------------ | | 25| 29.3k|#define NTRU_PACK_DEG (NTRU_N-1) | | ------------------ | | | | 5| 29.3k|#define NTRU_N 821 | | ------------------ ------------------ | Branch (21:17): [True: 29.1k, False: 178] ------------------ 22| 29.1k| c = msg[i]; 23| 29.1k| r->coeffs[5 * i + 0] = c; 24| 29.1k| r->coeffs[5 * i + 1] = c * 171 >> 9; // this is division by 3 25| 29.1k| r->coeffs[5 * i + 2] = c * 57 >> 9; // division by 3^2 26| 29.1k| r->coeffs[5 * i + 3] = c * 19 >> 9; // division by 3^3 27| 29.1k| r->coeffs[5 * i + 4] = c * 203 >> 14; // etc. 28| 29.1k| } 29| 178| r->coeffs[NTRU_N - 1] = 0; ------------------ | | 5| 178|#define NTRU_N 821 ------------------ 30| 178| PQCLEAN_NTRUHPS4096821_AVX2_poly_mod_3_Phi_n(r); 31| 178|} PQCLEAN_NTRUHPS4096821_AVX2_poly_Sq_tobytes: 4| 267|void PQCLEAN_NTRUHPS4096821_AVX2_poly_Sq_tobytes(unsigned char *r, const poly *a) { 5| 267| int i; 6| | 7| 109k| for (i = 0; i < NTRU_PACK_DEG / 2; i++) { ------------------ | | 25| 109k|#define NTRU_PACK_DEG (NTRU_N-1) | | ------------------ | | | | 5| 109k|#define NTRU_N 821 | | ------------------ ------------------ | Branch (7:17): [True: 109k, False: 267] ------------------ 8| 109k| r[3 * i + 0] = (unsigned char) ( MODQ(a->coeffs[2 * i + 0]) & 0xff); ------------------ | | 9| 109k|#define MODQ(X) ((X) & (NTRU_Q-1)) | | ------------------ | | | | 13| 109k|#define NTRU_Q (1 << NTRU_LOGQ) | | | | ------------------ | | | | | | 6| 109k|#define NTRU_LOGQ 12 | | | | ------------------ | | ------------------ ------------------ 9| 109k| r[3 * i + 1] = (unsigned char) ((MODQ(a->coeffs[2 * i + 0]) >> 8) | ((MODQ(a->coeffs[2 * i + 1]) & 0x0f) << 4)); ------------------ | | 9| 109k|#define MODQ(X) ((X) & (NTRU_Q-1)) | | ------------------ | | | | 13| 109k|#define NTRU_Q (1 << NTRU_LOGQ) | | | | ------------------ | | | | | | 6| 109k|#define NTRU_LOGQ 12 | | | | ------------------ | | ------------------ ------------------ r[3 * i + 1] = (unsigned char) ((MODQ(a->coeffs[2 * i + 0]) >> 8) | ((MODQ(a->coeffs[2 * i + 1]) & 0x0f) << 4)); ------------------ | | 9| 109k|#define MODQ(X) ((X) & (NTRU_Q-1)) | | ------------------ | | | | 13| 109k|#define NTRU_Q (1 << NTRU_LOGQ) | | | | ------------------ | | | | | | 6| 109k|#define NTRU_LOGQ 12 | | | | ------------------ | | ------------------ ------------------ 10| 109k| r[3 * i + 2] = (unsigned char) ((MODQ(a->coeffs[2 * i + 1]) >> 4)); ------------------ | | 9| 109k|#define MODQ(X) ((X) & (NTRU_Q-1)) | | ------------------ | | | | 13| 109k|#define NTRU_Q (1 << NTRU_LOGQ) | | | | ------------------ | | | | | | 6| 109k|#define NTRU_LOGQ 12 | | | | ------------------ | | ------------------ ------------------ 11| 109k| } 12| 267|} PQCLEAN_NTRUHPS4096821_AVX2_poly_Sq_frombytes: 14| 267|void PQCLEAN_NTRUHPS4096821_AVX2_poly_Sq_frombytes(poly *r, const unsigned char *a) { 15| 267| int i; 16| 109k| for (i = 0; i < NTRU_PACK_DEG / 2; i++) { ------------------ | | 25| 109k|#define NTRU_PACK_DEG (NTRU_N-1) | | ------------------ | | | | 5| 109k|#define NTRU_N 821 | | ------------------ ------------------ | Branch (16:17): [True: 109k, False: 267] ------------------ 17| 109k| r->coeffs[2 * i + 0] = (a[3 * i + 0] >> 0) | (((uint16_t)a[3 * i + 1] & 0x0f) << 8); 18| 109k| r->coeffs[2 * i + 1] = (a[3 * i + 1] >> 4) | (((uint16_t)a[3 * i + 2] & 0xff) << 4); 19| 109k| } 20| 267| r->coeffs[NTRU_N - 1] = 0; ------------------ | | 5| 267|#define NTRU_N 821 ------------------ 21| 267|} PQCLEAN_NTRUHPS4096821_AVX2_poly_Rq_sum_zero_tobytes: 23| 178|void PQCLEAN_NTRUHPS4096821_AVX2_poly_Rq_sum_zero_tobytes(unsigned char *r, const poly *a) { 24| 178| PQCLEAN_NTRUHPS4096821_AVX2_poly_Sq_tobytes(r, a); 25| 178|} PQCLEAN_NTRUHPS4096821_AVX2_poly_Rq_sum_zero_frombytes: 27| 178|void PQCLEAN_NTRUHPS4096821_AVX2_poly_Rq_sum_zero_frombytes(poly *r, const unsigned char *a) { 28| 178| int i; 29| 178| PQCLEAN_NTRUHPS4096821_AVX2_poly_Sq_frombytes(r, a); 30| | 31| | /* Set r[n-1] so that the sum of coefficients is zero mod q */ 32| 178| r->coeffs[NTRU_N - 1] = 0; ------------------ | | 5| 178|#define NTRU_N 821 ------------------ 33| 146k| for (i = 0; i < NTRU_PACK_DEG; i++) { ------------------ | | 25| 146k|#define NTRU_PACK_DEG (NTRU_N-1) | | ------------------ | | | | 5| 146k|#define NTRU_N 821 | | ------------------ ------------------ | Branch (33:17): [True: 145k, False: 178] ------------------ 34| 145k| r->coeffs[NTRU_N - 1] -= r->coeffs[i]; ------------------ | | 5| 145k|#define NTRU_N 821 ------------------ 35| 145k| } 36| 178|} PQCLEAN_NTRUHPS4096821_AVX2_poly_Z3_to_Zq: 4| 534|void PQCLEAN_NTRUHPS4096821_AVX2_poly_Z3_to_Zq(poly *r) { 5| 534| int i; 6| 438k| for (i = 0; i < NTRU_N; i++) { ------------------ | | 5| 438k|#define NTRU_N 821 ------------------ | Branch (6:17): [True: 438k, False: 534] ------------------ 7| 438k| r->coeffs[i] = r->coeffs[i] | ((-(r->coeffs[i] >> 1)) & (NTRU_Q - 1)); ------------------ | | 13| 438k|#define NTRU_Q (1 << NTRU_LOGQ) | | ------------------ | | | | 6| 438k|#define NTRU_LOGQ 12 | | ------------------ ------------------ 8| 438k| } 9| 534|} PQCLEAN_NTRUHPS4096821_AVX2_poly_trinary_Zq_to_Z3: 12| 89|void PQCLEAN_NTRUHPS4096821_AVX2_poly_trinary_Zq_to_Z3(poly *r) { 13| 89| int i; 14| 73.1k| for (i = 0; i < NTRU_N; i++) { ------------------ | | 5| 73.1k|#define NTRU_N 821 ------------------ | Branch (14:17): [True: 73.0k, False: 89] ------------------ 15| 73.0k| r->coeffs[i] = MODQ(r->coeffs[i]); ------------------ | | 9| 73.0k|#define MODQ(X) ((X) & (NTRU_Q-1)) | | ------------------ | | | | 13| 73.0k|#define NTRU_Q (1 << NTRU_LOGQ) | | | | ------------------ | | | | | | 6| 73.0k|#define NTRU_LOGQ 12 | | | | ------------------ | | ------------------ ------------------ 16| 73.0k| r->coeffs[i] = 3 & (r->coeffs[i] ^ (r->coeffs[i] >> (NTRU_LOGQ - 1))); ------------------ | | 6| 73.0k|#define NTRU_LOGQ 12 ------------------ 17| 73.0k| } 18| 89|} PQCLEAN_NTRUHPS4096821_AVX2_poly_Sq_mul: 20| 178|void PQCLEAN_NTRUHPS4096821_AVX2_poly_Sq_mul(poly *r, const poly *a, const poly *b) { 21| 178| PQCLEAN_NTRUHPS4096821_AVX2_poly_Rq_mul(r, a, b); 22| 178| PQCLEAN_NTRUHPS4096821_AVX2_poly_mod_q_Phi_n(r); 23| 178|} PQCLEAN_NTRUHPS4096821_AVX2_poly_S3_mul: 25| 89|void PQCLEAN_NTRUHPS4096821_AVX2_poly_S3_mul(poly *r, const poly *a, const poly *b) { 26| 89| int i; 27| | 28| | /* Our S3 multiplications do not overflow mod q, */ 29| | /* so we can re-purpose PQCLEAN_NTRUHPS4096821_AVX2_poly_Rq_mul, as long as we */ 30| | /* follow with an explicit reduction mod q. */ 31| 89| PQCLEAN_NTRUHPS4096821_AVX2_poly_Rq_mul(r, a, b); 32| 73.1k| for (i = 0; i < NTRU_N; i++) { ------------------ | | 5| 73.1k|#define NTRU_N 821 ------------------ | Branch (32:17): [True: 73.0k, False: 89] ------------------ 33| 73.0k| r->coeffs[i] = MODQ(r->coeffs[i]); ------------------ | | 9| 73.0k|#define MODQ(X) ((X) & (NTRU_Q-1)) | | ------------------ | | | | 13| 73.0k|#define NTRU_Q (1 << NTRU_LOGQ) | | | | ------------------ | | | | | | 6| 73.0k|#define NTRU_LOGQ 12 | | | | ------------------ | | ------------------ ------------------ 34| 73.0k| } 35| 89| PQCLEAN_NTRUHPS4096821_AVX2_poly_mod_3_Phi_n(r); 36| 89|} PQCLEAN_NTRUHPS4096821_AVX2_poly_Rq_inv: 71| 89|void PQCLEAN_NTRUHPS4096821_AVX2_poly_Rq_inv(poly *r, const poly *a) { 72| 89| poly ai2; 73| 89| PQCLEAN_NTRUHPS4096821_AVX2_poly_R2_inv(&ai2, a); 74| 89| PQCLEAN_NTRUHPS4096821_AVX2_poly_R2_inv_to_Rq_inv(r, &ai2, a); 75| 89|} poly.c:PQCLEAN_NTRUHPS4096821_AVX2_poly_R2_inv_to_Rq_inv: 38| 89|static void PQCLEAN_NTRUHPS4096821_AVX2_poly_R2_inv_to_Rq_inv(poly *r, const poly *ai, const poly *a) { 39| | 40| 89| int i; 41| 89| poly b, c; 42| 89| poly s; 43| | 44| | // for 0..4 45| | // ai = ai * (2 - a*ai) mod q 46| 73.1k| for (i = 0; i < NTRU_N; i++) { ------------------ | | 5| 73.1k|#define NTRU_N 821 ------------------ | Branch (46:17): [True: 73.0k, False: 89] ------------------ 47| 73.0k| b.coeffs[i] = -(a->coeffs[i]); 48| 73.0k| } 49| | 50| 73.1k| for (i = 0; i < NTRU_N; i++) { ------------------ | | 5| 73.1k|#define NTRU_N 821 ------------------ | Branch (50:17): [True: 73.0k, False: 89] ------------------ 51| 73.0k| r->coeffs[i] = ai->coeffs[i]; 52| 73.0k| } 53| | 54| 89| PQCLEAN_NTRUHPS4096821_AVX2_poly_Rq_mul(&c, r, &b); 55| 89| c.coeffs[0] += 2; // c = 2 - a*ai 56| 89| PQCLEAN_NTRUHPS4096821_AVX2_poly_Rq_mul(&s, &c, r); // s = ai*c 57| | 58| 89| PQCLEAN_NTRUHPS4096821_AVX2_poly_Rq_mul(&c, &s, &b); 59| 89| c.coeffs[0] += 2; // c = 2 - a*s 60| 89| PQCLEAN_NTRUHPS4096821_AVX2_poly_Rq_mul(r, &c, &s); // r = s*c 61| | 62| 89| PQCLEAN_NTRUHPS4096821_AVX2_poly_Rq_mul(&c, r, &b); 63| 89| c.coeffs[0] += 2; // c = 2 - a*r 64| 89| PQCLEAN_NTRUHPS4096821_AVX2_poly_Rq_mul(&s, &c, r); // s = r*c 65| | 66| 89| PQCLEAN_NTRUHPS4096821_AVX2_poly_Rq_mul(&c, &s, &b); 67| 89| c.coeffs[0] += 2; // c = 2 - a*s 68| 89| PQCLEAN_NTRUHPS4096821_AVX2_poly_Rq_mul(r, &c, &s); // r = s*c 69| 89|} PQCLEAN_NTRUHPS4096821_AVX2_poly_lift: 3| 178|void PQCLEAN_NTRUHPS4096821_AVX2_poly_lift(poly *r, const poly *a) { 4| 178| int i; 5| 146k| for (i = 0; i < NTRU_N; i++) { ------------------ | | 5| 146k|#define NTRU_N 821 ------------------ | Branch (5:17): [True: 146k, False: 178] ------------------ 6| 146k| r->coeffs[i] = a->coeffs[i]; 7| 146k| } 8| 178| PQCLEAN_NTRUHPS4096821_AVX2_poly_Z3_to_Zq(r); 9| 178|} PQCLEAN_NTRUHPS4096821_AVX2_poly_R2_tobytes: 6| 89|void PQCLEAN_NTRUHPS4096821_AVX2_poly_R2_tobytes(unsigned char *out, const poly *a) { 7| 89| int i, j, k; 8| 1.51k| for (i = 0; i < 16; i++) { ------------------ | Branch (8:17): [True: 1.42k, False: 89] ------------------ 9| 12.8k| for (k = 0; k < 8; k++) { ------------------ | Branch (9:21): [True: 11.3k, False: 1.42k] ------------------ 10| 11.3k| out[i * 8 + k] = 0; 11| 102k| for (j = 0; j < 8; j++) { ------------------ | Branch (11:25): [True: 91.1k, False: 11.3k] ------------------ 12| 91.1k| if ((i * 8 + k) * 8 + j < NTRU_N) { ------------------ | | 5| 91.1k|#define NTRU_N 821 ------------------ | Branch (12:21): [True: 73.0k, False: 18.0k] ------------------ 13| 73.0k| out[i * 8 + k] |= (a->coeffs[(i * 8 + k) * 8 + j] & 1) << j; 14| 73.0k| } 15| 91.1k| } 16| 11.3k| } 17| 1.42k| } 18| 89|} PQCLEAN_NTRUHPS4096821_AVX2_poly_R2_frombytes: 20| 89|void PQCLEAN_NTRUHPS4096821_AVX2_poly_R2_frombytes(poly *a, const unsigned char *in) { 21| 89| int i, j, k; 22| 1.51k| for (i = 0; i < 16; i++) { ------------------ | Branch (22:17): [True: 1.42k, False: 89] ------------------ 23| 12.8k| for (k = 0; k < 8; k++) { ------------------ | Branch (23:21): [True: 11.3k, False: 1.42k] ------------------ 24| 102k| for (j = 0; j < 8; j++) { ------------------ | Branch (24:25): [True: 91.1k, False: 11.3k] ------------------ 25| 91.1k| if ((i * 8 + k) * 8 + j < NTRU_N) { ------------------ | | 5| 91.1k|#define NTRU_N 821 ------------------ | Branch (25:21): [True: 73.0k, False: 18.0k] ------------------ 26| 73.0k| a->coeffs[(i * 8 + k) * 8 + j] = (in[i * 8 + k] >> j) & 1; 27| 73.0k| } 28| 91.1k| } 29| 11.3k| } 30| 1.42k| } 31| 89|} PQCLEAN_NTRUHPS4096821_AVX2_poly_R2_inv: 48| 89|void PQCLEAN_NTRUHPS4096821_AVX2_poly_R2_inv(poly *r, const poly *a) { 49| 89| union { 50| 89| unsigned char s[128]; 51| 89| __m256i s_x32[4]; 52| 89| } squares[13]; 53| 89|#define s(x) squares[(x)].s 54| | 55| | // This relies on the following addition chain: 56| | // 1, 2, 3, 6, 12, 24, 48, 51, 102, 204, 408, 816, 819 57| | 58| 89| PQCLEAN_NTRUHPS4096821_AVX2_poly_R2_tobytes(s(0), a); // TODO alignment ------------------ | | 53| 89|#define s(x) squares[(x)].s ------------------ 59| | 60| 89| PQCLEAN_NTRUHPS4096821_AVX2_square_1_821(s(1), s(0)); ------------------ | | 53| 89|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS4096821_AVX2_square_1_821(s(1), s(0)); ------------------ | | 53| 89|#define s(x) squares[(x)].s ------------------ 61| 89| _poly_R2_mul(s(1), s(1), s(0)); ------------------ | | 53| 89|#define s(x) squares[(x)].s ------------------ _poly_R2_mul(s(1), s(1), s(0)); ------------------ | | 53| 89|#define s(x) squares[(x)].s ------------------ _poly_R2_mul(s(1), s(1), s(0)); ------------------ | | 53| 89|#define s(x) squares[(x)].s ------------------ 62| 89| PQCLEAN_NTRUHPS4096821_AVX2_square_1_821(s(2), s(1)); ------------------ | | 53| 89|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS4096821_AVX2_square_1_821(s(2), s(1)); ------------------ | | 53| 89|#define s(x) squares[(x)].s ------------------ 63| 89| _poly_R2_mul(s(2), s(2), s(0)); ------------------ | | 53| 89|#define s(x) squares[(x)].s ------------------ _poly_R2_mul(s(2), s(2), s(0)); ------------------ | | 53| 89|#define s(x) squares[(x)].s ------------------ _poly_R2_mul(s(2), s(2), s(0)); ------------------ | | 53| 89|#define s(x) squares[(x)].s ------------------ 64| 89| PQCLEAN_NTRUHPS4096821_AVX2_square_3_821(s(3), s(2)); ------------------ | | 53| 89|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS4096821_AVX2_square_3_821(s(3), s(2)); ------------------ | | 53| 89|#define s(x) squares[(x)].s ------------------ 65| 89| _poly_R2_mul(s(3), s(3), s(2)); ------------------ | | 53| 89|#define s(x) squares[(x)].s ------------------ _poly_R2_mul(s(3), s(3), s(2)); ------------------ | | 53| 89|#define s(x) squares[(x)].s ------------------ _poly_R2_mul(s(3), s(3), s(2)); ------------------ | | 53| 89|#define s(x) squares[(x)].s ------------------ 66| 89| PQCLEAN_NTRUHPS4096821_AVX2_square_6_821(s(4), s(3)); ------------------ | | 53| 89|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS4096821_AVX2_square_6_821(s(4), s(3)); ------------------ | | 53| 89|#define s(x) squares[(x)].s ------------------ 67| 89| _poly_R2_mul(s(4), s(4), s(3)); ------------------ | | 53| 89|#define s(x) squares[(x)].s ------------------ _poly_R2_mul(s(4), s(4), s(3)); ------------------ | | 53| 89|#define s(x) squares[(x)].s ------------------ _poly_R2_mul(s(4), s(4), s(3)); ------------------ | | 53| 89|#define s(x) squares[(x)].s ------------------ 68| 89| PQCLEAN_NTRUHPS4096821_AVX2_square_12_821(s(5), s(4)); ------------------ | | 53| 89|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS4096821_AVX2_square_12_821(s(5), s(4)); ------------------ | | 53| 89|#define s(x) squares[(x)].s ------------------ 69| 89| _poly_R2_mul(s(5), s(5), s(4)); ------------------ | | 53| 89|#define s(x) squares[(x)].s ------------------ _poly_R2_mul(s(5), s(5), s(4)); ------------------ | | 53| 89|#define s(x) squares[(x)].s ------------------ _poly_R2_mul(s(5), s(5), s(4)); ------------------ | | 53| 89|#define s(x) squares[(x)].s ------------------ 70| 89| PQCLEAN_NTRUHPS4096821_AVX2_square_24_821(s(6), s(5)); ------------------ | | 53| 89|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS4096821_AVX2_square_24_821(s(6), s(5)); ------------------ | | 53| 89|#define s(x) squares[(x)].s ------------------ 71| 89| _poly_R2_mul(s(6), s(6), s(5)); ------------------ | | 53| 89|#define s(x) squares[(x)].s ------------------ _poly_R2_mul(s(6), s(6), s(5)); ------------------ | | 53| 89|#define s(x) squares[(x)].s ------------------ _poly_R2_mul(s(6), s(6), s(5)); ------------------ | | 53| 89|#define s(x) squares[(x)].s ------------------ 72| 89| PQCLEAN_NTRUHPS4096821_AVX2_square_3_821(s(7), s(6)); ------------------ | | 53| 89|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS4096821_AVX2_square_3_821(s(7), s(6)); ------------------ | | 53| 89|#define s(x) squares[(x)].s ------------------ 73| 89| _poly_R2_mul(s(7), s(7), s(2)); ------------------ | | 53| 89|#define s(x) squares[(x)].s ------------------ _poly_R2_mul(s(7), s(7), s(2)); ------------------ | | 53| 89|#define s(x) squares[(x)].s ------------------ _poly_R2_mul(s(7), s(7), s(2)); ------------------ | | 53| 89|#define s(x) squares[(x)].s ------------------ 74| 89| PQCLEAN_NTRUHPS4096821_AVX2_square_51_821(s(8), s(7)); ------------------ | | 53| 89|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS4096821_AVX2_square_51_821(s(8), s(7)); ------------------ | | 53| 89|#define s(x) squares[(x)].s ------------------ 75| 89| _poly_R2_mul(s(8), s(8), s(7)); ------------------ | | 53| 89|#define s(x) squares[(x)].s ------------------ _poly_R2_mul(s(8), s(8), s(7)); ------------------ | | 53| 89|#define s(x) squares[(x)].s ------------------ _poly_R2_mul(s(8), s(8), s(7)); ------------------ | | 53| 89|#define s(x) squares[(x)].s ------------------ 76| 89| PQCLEAN_NTRUHPS4096821_AVX2_square_102_821(s(9), s(8)); ------------------ | | 53| 89|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS4096821_AVX2_square_102_821(s(9), s(8)); ------------------ | | 53| 89|#define s(x) squares[(x)].s ------------------ 77| 89| _poly_R2_mul(s(9), s(9), s(8)); ------------------ | | 53| 89|#define s(x) squares[(x)].s ------------------ _poly_R2_mul(s(9), s(9), s(8)); ------------------ | | 53| 89|#define s(x) squares[(x)].s ------------------ _poly_R2_mul(s(9), s(9), s(8)); ------------------ | | 53| 89|#define s(x) squares[(x)].s ------------------ 78| 89| PQCLEAN_NTRUHPS4096821_AVX2_square_204_821(s(10), s(9)); ------------------ | | 53| 89|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS4096821_AVX2_square_204_821(s(10), s(9)); ------------------ | | 53| 89|#define s(x) squares[(x)].s ------------------ 79| 89| _poly_R2_mul(s(10), s(10), s(9)); ------------------ | | 53| 89|#define s(x) squares[(x)].s ------------------ _poly_R2_mul(s(10), s(10), s(9)); ------------------ | | 53| 89|#define s(x) squares[(x)].s ------------------ _poly_R2_mul(s(10), s(10), s(9)); ------------------ | | 53| 89|#define s(x) squares[(x)].s ------------------ 80| 89| PQCLEAN_NTRUHPS4096821_AVX2_square_408_821(s(11), s(10)); ------------------ | | 53| 89|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS4096821_AVX2_square_408_821(s(11), s(10)); ------------------ | | 53| 89|#define s(x) squares[(x)].s ------------------ 81| 89| _poly_R2_mul(s(11), s(11), s(10)); ------------------ | | 53| 89|#define s(x) squares[(x)].s ------------------ _poly_R2_mul(s(11), s(11), s(10)); ------------------ | | 53| 89|#define s(x) squares[(x)].s ------------------ _poly_R2_mul(s(11), s(11), s(10)); ------------------ | | 53| 89|#define s(x) squares[(x)].s ------------------ 82| 89| PQCLEAN_NTRUHPS4096821_AVX2_square_3_821(s(12), s(11)); ------------------ | | 53| 89|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS4096821_AVX2_square_3_821(s(12), s(11)); ------------------ | | 53| 89|#define s(x) squares[(x)].s ------------------ 83| 89| _poly_R2_mul(s(12), s(12), s(2)); ------------------ | | 53| 89|#define s(x) squares[(x)].s ------------------ _poly_R2_mul(s(12), s(12), s(2)); ------------------ | | 53| 89|#define s(x) squares[(x)].s ------------------ _poly_R2_mul(s(12), s(12), s(2)); ------------------ | | 53| 89|#define s(x) squares[(x)].s ------------------ 84| 89| PQCLEAN_NTRUHPS4096821_AVX2_square_1_821(s(0), s(12)); ------------------ | | 53| 89|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS4096821_AVX2_square_1_821(s(0), s(12)); ------------------ | | 53| 89|#define s(x) squares[(x)].s ------------------ 85| | 86| | 87| 89| PQCLEAN_NTRUHPS4096821_AVX2_poly_R2_frombytes(r, s(0)); ------------------ | | 53| 89|#define s(x) squares[(x)].s ------------------ 88| 89|#undef s 89| 89|} poly_r2_inv.c:_poly_R2_mul: 34| 1.06k|static void _poly_R2_mul(unsigned char r[128], unsigned char a[128], unsigned char b[128]) { 35| | // TODO: Try to avoid copying input 36| 1.06k| int i; 37| 1.06k| union { 38| 1.06k| unsigned char b[128]; 39| 1.06k| __m256i b_x32[4]; 40| 1.06k| } rt; 41| | 42| 1.06k| PQCLEAN_NTRUHPS4096821_AVX2_poly_R2_mul(rt.b, a, b); 43| 137k| for (i = 0; i < 128; i++) { ------------------ | Branch (43:17): [True: 136k, False: 1.06k] ------------------ 44| 136k| r[i] = rt.b[i]; 45| 136k| } 46| 1.06k|} PQCLEAN_NTRUHPS4096821_AVX2_poly_S3_inv: 661| 89|void PQCLEAN_NTRUHPS4096821_AVX2_poly_S3_inv(poly *r_out, const poly *a) { 662| 89| const unsigned char *in = (void *) a; 663| 89| unsigned char *out = (void *) r_out; 664| | 665| 89| small input[ppad]; 666| 89| small output[ppad]; 667| 89| int i; 668| | 669| | /* XXX: obviously input/output format should be packed into bytes */ 670| | 671| 73.0k| for (i = 0; i < p; ++i) { ------------------ | | 7| 73.0k|#define p 820 ------------------ | Branch (671:17): [True: 72.9k, False: 89] ------------------ 672| 72.9k| small x = in[2 * i] & 3; /* 0 1 2 3 */ 673| 72.9k| x += 1; /* 0 1 2 3 4 5 6, offset by 1 */ 674| 72.9k| x &= (x - 3) >> 5; /* 0 1 2, offset by 1 */ 675| 72.9k| input[i] = x - 1; 676| 72.9k| } 677| | /* XXX: merge with vec256_init */ 678| | 679| 89| __poly_S3_inv((unsigned char *)output, (unsigned char *)input); 680| | 681| 73.0k| for (i = 0; i < p; ++i) { ------------------ | | 7| 73.0k|#define p 820 ------------------ | Branch (681:17): [True: 72.9k, False: 89] ------------------ 682| 72.9k| out[2 * i] = (3 & output[i]) ^ ((3 & output[i]) >> 1); 683| 72.9k| out[2 * i + 1] = 0; 684| 72.9k| } 685| 89|} poly_s3_inv.c:vec256_divx_4: 302| 155k|static inline void vec256_divx_4(vec256 *f) { 303| 155k| vec256 f0 = f[0]; 304| 155k| vec256 f1 = f[1]; 305| 155k| vec256 f2 = f[2]; 306| 155k| vec256 f3 = f[3]; 307| | 308| 155k| unsigned long long low0 = _mm_cvtsi128_si64(_mm256_castsi256_si128(f0)); 309| 155k| unsigned long long low1 = _mm_cvtsi128_si64(_mm256_castsi256_si128(f1)); 310| 155k| unsigned long long low2 = _mm_cvtsi128_si64(_mm256_castsi256_si128(f2)); 311| 155k| unsigned long long low3 = _mm_cvtsi128_si64(_mm256_castsi256_si128(f3)); 312| | 313| 155k| low0 = (low0 >> 1) | (low1 << 63); 314| 155k| low1 = (low1 >> 1) | (low2 << 63); 315| 155k| low2 = (low2 >> 1) | (low3 << 63); 316| 155k| low3 = low3 >> 1; 317| | 318| 155k| f0 = _mm256_blend_epi32(f0, _mm256_set_epi64x(0, 0, 0, low0), 0x3); 319| 155k| f1 = _mm256_blend_epi32(f1, _mm256_set_epi64x(0, 0, 0, low1), 0x3); 320| 155k| f2 = _mm256_blend_epi32(f2, _mm256_set_epi64x(0, 0, 0, low2), 0x3); 321| 155k| f3 = _mm256_blend_epi32(f3, _mm256_set_epi64x(0, 0, 0, low3), 0x3); 322| | 323| 155k| f[0] = _mm256_permute4x64_epi64(f0, 0x39); 324| 155k| f[1] = _mm256_permute4x64_epi64(f1, 0x39); 325| 155k| f[2] = _mm256_permute4x64_epi64(f2, 0x39); 326| | f[3] = _mm256_permute4x64_epi64(f3, 0x39); 327| 155k|} poly_s3_inv.c:vec256_timesx_4: 380| 155k|static inline void vec256_timesx_4(vec256 *f) { 381| 155k| vec256 f0 = _mm256_permute4x64_epi64(f[0], 0x93); 382| 155k| vec256 f1 = _mm256_permute4x64_epi64(f[1], 0x93); 383| 155k| vec256 f2 = _mm256_permute4x64_epi64(f[2], 0x93); 384| 155k| vec256 f3 = _mm256_permute4x64_epi64(f[3], 0x93); 385| | 386| 155k| unsigned long long low0 = _mm_cvtsi128_si64(_mm256_castsi256_si128(f0)); 387| 155k| unsigned long long low1 = _mm_cvtsi128_si64(_mm256_castsi256_si128(f1)); 388| 155k| unsigned long long low2 = _mm_cvtsi128_si64(_mm256_castsi256_si128(f2)); 389| 155k| unsigned long long low3 = _mm_cvtsi128_si64(_mm256_castsi256_si128(f3)); 390| | 391| 155k| low3 = (low3 << 1) | (low2 >> 63); 392| 155k| low2 = (low2 << 1) | (low1 >> 63); 393| 155k| low1 = (low1 << 1) | (low0 >> 63); 394| 155k| low0 = low0 << 1; 395| | 396| 155k| f0 = _mm256_blend_epi32(f0, _mm256_set_epi64x(0, 0, 0, low0), 0x3); 397| 155k| f1 = _mm256_blend_epi32(f1, _mm256_set_epi64x(0, 0, 0, low1), 0x3); 398| 155k| f2 = _mm256_blend_epi32(f2, _mm256_set_epi64x(0, 0, 0, low2), 0x3); 399| 155k| f3 = _mm256_blend_epi32(f3, _mm256_set_epi64x(0, 0, 0, low3), 0x3); 400| | 401| 155k| f[0] = f0; 402| 155k| f[1] = f1; 403| 155k| f[2] = f2; 404| 155k| f[3] = f3; 405| 155k|} PQCLEAN_NTRUHPS4096821_AVX2_sample_fg: 3| 89|void PQCLEAN_NTRUHPS4096821_AVX2_sample_fg(poly *f, poly *g, const unsigned char uniformbytes[NTRU_SAMPLE_FG_BYTES]) { 4| | 5| 89| PQCLEAN_NTRUHPS4096821_AVX2_sample_iid(f, uniformbytes); 6| 89| PQCLEAN_NTRUHPS4096821_AVX2_sample_fixed_type(g, uniformbytes + NTRU_SAMPLE_IID_BYTES); ------------------ | | 20| 89|#define NTRU_SAMPLE_IID_BYTES (NTRU_N-1) | | ------------------ | | | | 5| 89|#define NTRU_N 821 | | ------------------ ------------------ 7| 89|} PQCLEAN_NTRUHPS4096821_AVX2_sample_rm: 9| 89|void PQCLEAN_NTRUHPS4096821_AVX2_sample_rm(poly *r, poly *m, const unsigned char uniformbytes[NTRU_SAMPLE_RM_BYTES]) { 10| | 11| 89| PQCLEAN_NTRUHPS4096821_AVX2_sample_iid(r, uniformbytes); 12| 89| PQCLEAN_NTRUHPS4096821_AVX2_sample_fixed_type(m, uniformbytes + NTRU_SAMPLE_IID_BYTES); ------------------ | | 20| 89|#define NTRU_SAMPLE_IID_BYTES (NTRU_N-1) | | ------------------ | | | | 5| 89|#define NTRU_N 821 | | ------------------ ------------------ 13| 89|} PQCLEAN_NTRUHPS4096821_AVX2_sample_fixed_type: 16| 178|void PQCLEAN_NTRUHPS4096821_AVX2_sample_fixed_type(poly *r, const unsigned char u[NTRU_SAMPLE_FT_BYTES]) { 17| | // Assumes NTRU_SAMPLE_FT_BYTES = ceil(30*(n-1)/8) 18| | 19| 178| int32_t s[NTRU_N - 1]; 20| 178| int i; 21| | 22| | // Use 30 bits of u per word 23| 36.6k| for (i = 0; i < (NTRU_N - 1) / 4; i++) { ------------------ | | 5| 36.6k|#define NTRU_N 821 ------------------ | Branch (23:17): [True: 36.4k, False: 178] ------------------ 24| 36.4k| s[4 * i + 0] = (u[15 * i + 0] << 2) + (u[15 * i + 1] << 10) + (u[15 * i + 2] << 18) + ((uint32_t) u[15 * i + 3] << 26); 25| 36.4k| s[4 * i + 1] = ((u[15 * i + 3] & 0xc0) >> 4) + (u[15 * i + 4] << 4) + (u[15 * i + 5] << 12) + (u[15 * i + 6] << 20) + ((uint32_t) u[15 * i + 7] << 28); 26| 36.4k| s[4 * i + 2] = ((u[15 * i + 7] & 0xf0) >> 2) + (u[15 * i + 8] << 6) + (u[15 * i + 9] << 14) + (u[15 * i + 10] << 22) + ((uint32_t) u[15 * i + 11] << 30); 27| 36.4k| s[4 * i + 3] = (u[15 * i + 11] & 0xfc) + (u[15 * i + 12] << 8) + (u[15 * i + 13] << 16) + ((uint32_t) u[15 * i + 14] << 24); 28| 36.4k| } 29| | 30| 45.5k| for (i = 0; i < NTRU_WEIGHT / 2; i++) { ------------------ | | 14| 45.5k|#define NTRU_WEIGHT (NTRU_Q/8 - 2) | | ------------------ | | | | 13| 45.5k|#define NTRU_Q (1 << NTRU_LOGQ) | | | | ------------------ | | | | | | 6| 45.5k|#define NTRU_LOGQ 12 | | | | ------------------ | | ------------------ ------------------ | Branch (30:17): [True: 45.3k, False: 178] ------------------ 31| 45.3k| s[i] |= 1; 32| 45.3k| } 33| | 34| 45.5k| for (i = NTRU_WEIGHT / 2; i < NTRU_WEIGHT; i++) { ------------------ | | 14| 178|#define NTRU_WEIGHT (NTRU_Q/8 - 2) | | ------------------ | | | | 13| 178|#define NTRU_Q (1 << NTRU_LOGQ) | | | | ------------------ | | | | | | 6| 178|#define NTRU_LOGQ 12 | | | | ------------------ | | ------------------ ------------------ for (i = NTRU_WEIGHT / 2; i < NTRU_WEIGHT; i++) { ------------------ | | 14| 45.5k|#define NTRU_WEIGHT (NTRU_Q/8 - 2) | | ------------------ | | | | 13| 45.5k|#define NTRU_Q (1 << NTRU_LOGQ) | | | | ------------------ | | | | | | 6| 45.5k|#define NTRU_LOGQ 12 | | | | ------------------ | | ------------------ ------------------ | Branch (34:31): [True: 45.3k, False: 178] ------------------ 35| 45.3k| s[i] |= 2; 36| 45.3k| } 37| | 38| 178| PQCLEAN_NTRUHPS4096821_AVX2_crypto_sort_int32(s, NTRU_N - 1); ------------------ | | 5| 178|#define NTRU_N 821 ------------------ 39| | 40| 146k| for (i = 0; i < NTRU_N - 1; i++) { ------------------ | | 5| 146k|#define NTRU_N 821 ------------------ | Branch (40:17): [True: 145k, False: 178] ------------------ 41| 145k| r->coeffs[i] = ((uint16_t) (s[i] & 3)); 42| 145k| } 43| | 44| 178| r->coeffs[NTRU_N - 1] = 0; ------------------ | | 5| 178|#define NTRU_N 821 ------------------ 45| 178|} PQCLEAN_NTRUHPS4096821_AVX2_sample_iid: 7| 178|void PQCLEAN_NTRUHPS4096821_AVX2_sample_iid(poly *r, const unsigned char uniformbytes[NTRU_SAMPLE_IID_BYTES]) { 8| 178| int i; 9| 178| union { /* align to 32 byte boundary for vmovdqa */ 10| 178| unsigned char b[PAD32(NTRU_SAMPLE_IID_BYTES)]; 11| 178| __m256i b_x32[PAD32(NTRU_SAMPLE_IID_BYTES) / 32]; 12| 178| } buffer; 13| | 14| 146k| for (i = 0; i < NTRU_SAMPLE_IID_BYTES; i++) { ------------------ | | 20| 146k|#define NTRU_SAMPLE_IID_BYTES (NTRU_N-1) | | ------------------ | | | | 5| 146k|#define NTRU_N 821 | | ------------------ ------------------ | Branch (14:17): [True: 145k, False: 178] ------------------ 15| 145k| buffer.b[i] = uniformbytes[i]; 16| 145k| } 17| 2.31k| for (i = NTRU_SAMPLE_IID_BYTES; i < PAD32(NTRU_SAMPLE_IID_BYTES); i++) { ------------------ | | 20| 178|#define NTRU_SAMPLE_IID_BYTES (NTRU_N-1) | | ------------------ | | | | 5| 178|#define NTRU_N 821 | | ------------------ ------------------ for (i = NTRU_SAMPLE_IID_BYTES; i < PAD32(NTRU_SAMPLE_IID_BYTES); i++) { ------------------ | | 11| 2.31k|#define PAD32(X) ((((X) + 31)/32)*32) ------------------ | Branch (17:37): [True: 2.13k, False: 178] ------------------ 18| 2.13k| buffer.b[i] = 0; 19| 2.13k| } 20| 178| PQCLEAN_NTRUHPS4096821_AVX2_vec32_sample_iid(r, buffer.b); 21| 178|} PQCLEAN_NTRUHRSS1373_CLEAN_cmov: 4| 3|void PQCLEAN_NTRUHRSS1373_CLEAN_cmov(unsigned char *r, const unsigned char *x, size_t len, unsigned char b) { 5| 3| size_t i; 6| | 7| 3| b = (~b + 1); 8| 99| for (i = 0; i < len; i++) { ------------------ | Branch (8:17): [True: 96, False: 3] ------------------ 9| 96| r[i] ^= b & (x[i] ^ r[i]); 10| 96| } 11| 3|} PQCLEAN_NTRUHRSS1373_CLEAN_crypto_kem_keypair: 10| 3|int PQCLEAN_NTRUHRSS1373_CLEAN_crypto_kem_keypair(uint8_t *pk, uint8_t *sk) { 11| 3| uint8_t seed[NTRU_SAMPLE_FG_BYTES]; 12| | 13| 3| randombytes(seed, NTRU_SAMPLE_FG_BYTES); ------------------ | | 8| 3|#define randombytes OQS_randombytes ------------------ randombytes(seed, NTRU_SAMPLE_FG_BYTES); ------------------ | | 20| 3|#define NTRU_SAMPLE_FG_BYTES (2*NTRU_SAMPLE_IID_BYTES) | | ------------------ | | | | 19| 3|#define NTRU_SAMPLE_IID_BYTES (NTRU_N-1) | | | | ------------------ | | | | | | 5| 3|#define NTRU_N 1373 | | | | ------------------ | | ------------------ ------------------ 14| 3| PQCLEAN_NTRUHRSS1373_CLEAN_owcpa_keypair(pk, sk, seed); 15| | 16| 3| randombytes(sk + NTRU_OWCPA_SECRETKEYBYTES, NTRU_PRFKEYBYTES); ------------------ | | 8| 3|#define randombytes OQS_randombytes ------------------ randombytes(sk + NTRU_OWCPA_SECRETKEYBYTES, NTRU_PRFKEYBYTES); ------------------ | | 28| 3|#define NTRU_OWCPA_SECRETKEYBYTES (2*NTRU_PACK_TRINARY_BYTES + NTRU_OWCPA_PUBLICKEYBYTES) | | ------------------ | | | | 24| 3|#define NTRU_PACK_TRINARY_BYTES ((NTRU_PACK_DEG+4)/5) | | | | ------------------ | | | | | | 23| 3|#define NTRU_PACK_DEG (NTRU_N-1) | | | | | | ------------------ | | | | | | | | 5| 3|#define NTRU_N 1373 | | | | | | ------------------ | | | | ------------------ | | ------------------ | | #define NTRU_OWCPA_SECRETKEYBYTES (2*NTRU_PACK_TRINARY_BYTES + NTRU_OWCPA_PUBLICKEYBYTES) | | ------------------ | | | | 27| 3|#define NTRU_OWCPA_PUBLICKEYBYTES ((NTRU_LOGQ*NTRU_PACK_DEG+7)/8) | | | | ------------------ | | | | | | 6| 3|#define NTRU_LOGQ 14 | | | | ------------------ | | | | #define NTRU_OWCPA_PUBLICKEYBYTES ((NTRU_LOGQ*NTRU_PACK_DEG+7)/8) | | | | ------------------ | | | | | | 23| 3|#define NTRU_PACK_DEG (NTRU_N-1) | | | | | | ------------------ | | | | | | | | 5| 3|#define NTRU_N 1373 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ randombytes(sk + NTRU_OWCPA_SECRETKEYBYTES, NTRU_PRFKEYBYTES); ------------------ | | 16| 3|#define NTRU_PRFKEYBYTES 32 ------------------ 17| | 18| 3| return 0; 19| 3|} PQCLEAN_NTRUHRSS1373_CLEAN_crypto_kem_enc: 21| 3|int PQCLEAN_NTRUHRSS1373_CLEAN_crypto_kem_enc(uint8_t *c, uint8_t *k, const uint8_t *pk) { 22| 3| poly r, m; 23| 3| uint8_t rm[NTRU_OWCPA_MSGBYTES]; 24| 3| uint8_t rm_seed[NTRU_SAMPLE_RM_BYTES]; 25| | 26| 3| randombytes(rm_seed, NTRU_SAMPLE_RM_BYTES); ------------------ | | 8| 3|#define randombytes OQS_randombytes ------------------ randombytes(rm_seed, NTRU_SAMPLE_RM_BYTES); ------------------ | | 21| 3|#define NTRU_SAMPLE_RM_BYTES (2*NTRU_SAMPLE_IID_BYTES) | | ------------------ | | | | 19| 3|#define NTRU_SAMPLE_IID_BYTES (NTRU_N-1) | | | | ------------------ | | | | | | 5| 3|#define NTRU_N 1373 | | | | ------------------ | | ------------------ ------------------ 27| | 28| 3| PQCLEAN_NTRUHRSS1373_CLEAN_sample_rm(&r, &m, rm_seed); 29| | 30| 3| PQCLEAN_NTRUHRSS1373_CLEAN_poly_S3_tobytes(rm, &r); 31| 3| PQCLEAN_NTRUHRSS1373_CLEAN_poly_S3_tobytes(rm + NTRU_PACK_TRINARY_BYTES, &m); ------------------ | | 24| 3|#define NTRU_PACK_TRINARY_BYTES ((NTRU_PACK_DEG+4)/5) | | ------------------ | | | | 23| 3|#define NTRU_PACK_DEG (NTRU_N-1) | | | | ------------------ | | | | | | 5| 3|#define NTRU_N 1373 | | | | ------------------ | | ------------------ ------------------ 32| 3| sha3_256(k, rm, NTRU_OWCPA_MSGBYTES); ------------------ | | 15| 3|#define sha3_256 OQS_SHA3_sha3_256 ------------------ sha3_256(k, rm, NTRU_OWCPA_MSGBYTES); ------------------ | | 26| 3|#define NTRU_OWCPA_MSGBYTES (2*NTRU_PACK_TRINARY_BYTES) | | ------------------ | | | | 24| 3|#define NTRU_PACK_TRINARY_BYTES ((NTRU_PACK_DEG+4)/5) | | | | ------------------ | | | | | | 23| 3|#define NTRU_PACK_DEG (NTRU_N-1) | | | | | | ------------------ | | | | | | | | 5| 3|#define NTRU_N 1373 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 33| | 34| 3| PQCLEAN_NTRUHRSS1373_CLEAN_poly_Z3_to_Zq(&r); 35| 3| PQCLEAN_NTRUHRSS1373_CLEAN_owcpa_enc(c, &r, &m, pk); 36| | 37| 3| return 0; 38| 3|} PQCLEAN_NTRUHRSS1373_CLEAN_crypto_kem_dec: 40| 3|int PQCLEAN_NTRUHRSS1373_CLEAN_crypto_kem_dec(uint8_t *k, const uint8_t *c, const uint8_t *sk) { 41| 3| int i, fail; 42| 3| uint8_t rm[NTRU_OWCPA_MSGBYTES]; 43| 3| uint8_t buf[NTRU_PRFKEYBYTES + NTRU_CIPHERTEXTBYTES]; 44| | 45| 3| fail = PQCLEAN_NTRUHRSS1373_CLEAN_owcpa_dec(rm, c, sk); 46| | /* If fail = 0 then c = Enc(h, rm). There is no need to re-encapsulate. */ 47| | /* See comment in PQCLEAN_NTRUHRSS1373_CLEAN_owcpa_dec for details. */ 48| | 49| 3| sha3_256(k, rm, NTRU_OWCPA_MSGBYTES); ------------------ | | 15| 3|#define sha3_256 OQS_SHA3_sha3_256 ------------------ sha3_256(k, rm, NTRU_OWCPA_MSGBYTES); ------------------ | | 26| 3|#define NTRU_OWCPA_MSGBYTES (2*NTRU_PACK_TRINARY_BYTES) | | ------------------ | | | | 24| 3|#define NTRU_PACK_TRINARY_BYTES ((NTRU_PACK_DEG+4)/5) | | | | ------------------ | | | | | | 23| 3|#define NTRU_PACK_DEG (NTRU_N-1) | | | | | | ------------------ | | | | | | | | 5| 3|#define NTRU_N 1373 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 50| | 51| | /* shake(secret PRF key || input ciphertext) */ 52| 99| for (i = 0; i < NTRU_PRFKEYBYTES; i++) { ------------------ | | 16| 99|#define NTRU_PRFKEYBYTES 32 ------------------ | Branch (52:17): [True: 96, False: 3] ------------------ 53| 96| buf[i] = sk[i + NTRU_OWCPA_SECRETKEYBYTES]; ------------------ | | 28| 96|#define NTRU_OWCPA_SECRETKEYBYTES (2*NTRU_PACK_TRINARY_BYTES + NTRU_OWCPA_PUBLICKEYBYTES) | | ------------------ | | | | 24| 96|#define NTRU_PACK_TRINARY_BYTES ((NTRU_PACK_DEG+4)/5) | | | | ------------------ | | | | | | 23| 96|#define NTRU_PACK_DEG (NTRU_N-1) | | | | | | ------------------ | | | | | | | | 5| 96|#define NTRU_N 1373 | | | | | | ------------------ | | | | ------------------ | | ------------------ | | #define NTRU_OWCPA_SECRETKEYBYTES (2*NTRU_PACK_TRINARY_BYTES + NTRU_OWCPA_PUBLICKEYBYTES) | | ------------------ | | | | 27| 96|#define NTRU_OWCPA_PUBLICKEYBYTES ((NTRU_LOGQ*NTRU_PACK_DEG+7)/8) | | | | ------------------ | | | | | | 6| 96|#define NTRU_LOGQ 14 | | | | ------------------ | | | | #define NTRU_OWCPA_PUBLICKEYBYTES ((NTRU_LOGQ*NTRU_PACK_DEG+7)/8) | | | | ------------------ | | | | | | 23| 96|#define NTRU_PACK_DEG (NTRU_N-1) | | | | | | ------------------ | | | | | | | | 5| 96|#define NTRU_N 1373 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 54| 96| } 55| 7.20k| for (i = 0; i < NTRU_CIPHERTEXTBYTES; i++) { ------------------ | | 33| 7.20k|#define NTRU_CIPHERTEXTBYTES (NTRU_OWCPA_BYTES) | | ------------------ | | | | 29| 7.20k|#define NTRU_OWCPA_BYTES ((NTRU_LOGQ*NTRU_PACK_DEG+7)/8) | | | | ------------------ | | | | | | 6| 7.20k|#define NTRU_LOGQ 14 | | | | ------------------ | | | | #define NTRU_OWCPA_BYTES ((NTRU_LOGQ*NTRU_PACK_DEG+7)/8) | | | | ------------------ | | | | | | 23| 7.20k|#define NTRU_PACK_DEG (NTRU_N-1) | | | | | | ------------------ | | | | | | | | 5| 7.20k|#define NTRU_N 1373 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ | Branch (55:17): [True: 7.20k, False: 3] ------------------ 56| 7.20k| buf[NTRU_PRFKEYBYTES + i] = c[i]; ------------------ | | 16| 7.20k|#define NTRU_PRFKEYBYTES 32 ------------------ 57| 7.20k| } 58| 3| sha3_256(rm, buf, NTRU_PRFKEYBYTES + NTRU_CIPHERTEXTBYTES); ------------------ | | 15| 3|#define sha3_256 OQS_SHA3_sha3_256 ------------------ sha3_256(rm, buf, NTRU_PRFKEYBYTES + NTRU_CIPHERTEXTBYTES); ------------------ | | 16| 3|#define NTRU_PRFKEYBYTES 32 ------------------ sha3_256(rm, buf, NTRU_PRFKEYBYTES + NTRU_CIPHERTEXTBYTES); ------------------ | | 33| 3|#define NTRU_CIPHERTEXTBYTES (NTRU_OWCPA_BYTES) | | ------------------ | | | | 29| 3|#define NTRU_OWCPA_BYTES ((NTRU_LOGQ*NTRU_PACK_DEG+7)/8) | | | | ------------------ | | | | | | 6| 3|#define NTRU_LOGQ 14 | | | | ------------------ | | | | #define NTRU_OWCPA_BYTES ((NTRU_LOGQ*NTRU_PACK_DEG+7)/8) | | | | ------------------ | | | | | | 23| 3|#define NTRU_PACK_DEG (NTRU_N-1) | | | | | | ------------------ | | | | | | | | 5| 3|#define NTRU_N 1373 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 59| | 60| 3| PQCLEAN_NTRUHRSS1373_CLEAN_cmov(k, rm, NTRU_SHAREDKEYBYTES, (unsigned char) fail); ------------------ | | 17| 3|#define NTRU_SHAREDKEYBYTES 32 ------------------ 61| | 62| 3| return 0; 63| 3|} PQCLEAN_NTRUHRSS1373_CLEAN_owcpa_keypair: 41| 3| const unsigned char seed[NTRU_SAMPLE_FG_BYTES]) { 42| 3| int i; 43| | 44| 3| poly x1, x2, x3, x4, x5; 45| | 46| 3| poly *f = &x1, *g = &x2, *invf_mod3 = &x3; 47| 3| poly *gf = &x3, *invgf = &x4, *tmp = &x5; 48| 3| poly *invh = &x3, *h = &x3; 49| | 50| 3| PQCLEAN_NTRUHRSS1373_CLEAN_sample_fg(f, g, seed); 51| | 52| 3| PQCLEAN_NTRUHRSS1373_CLEAN_poly_S3_inv(invf_mod3, f); 53| 3| PQCLEAN_NTRUHRSS1373_CLEAN_poly_S3_tobytes(sk, f); 54| 3| PQCLEAN_NTRUHRSS1373_CLEAN_poly_S3_tobytes(sk + NTRU_PACK_TRINARY_BYTES, invf_mod3); ------------------ | | 24| 3|#define NTRU_PACK_TRINARY_BYTES ((NTRU_PACK_DEG+4)/5) | | ------------------ | | | | 23| 3|#define NTRU_PACK_DEG (NTRU_N-1) | | | | ------------------ | | | | | | 5| 3|#define NTRU_N 1373 | | | | ------------------ | | ------------------ ------------------ 55| | 56| | /* Lift coeffs of f and g from Z_p to Z_q */ 57| 3| PQCLEAN_NTRUHRSS1373_CLEAN_poly_Z3_to_Zq(f); 58| 3| PQCLEAN_NTRUHRSS1373_CLEAN_poly_Z3_to_Zq(g); 59| | 60| | /* g = 3*(x-1)*g */ 61| 4.11k| for (i = NTRU_N - 1; i > 0; i--) { ------------------ | | 5| 3|#define NTRU_N 1373 ------------------ | Branch (61:26): [True: 4.11k, False: 3] ------------------ 62| 4.11k| g->coeffs[i] = 3 * (g->coeffs[i - 1] - g->coeffs[i]); 63| 4.11k| } 64| 3| g->coeffs[0] = -(3 * g->coeffs[0]); 65| | 66| | 67| 3| PQCLEAN_NTRUHRSS1373_CLEAN_poly_Rq_mul(gf, g, f); 68| | 69| 3| PQCLEAN_NTRUHRSS1373_CLEAN_poly_Rq_inv(invgf, gf); 70| | 71| 3| PQCLEAN_NTRUHRSS1373_CLEAN_poly_Rq_mul(tmp, invgf, f); 72| 3| PQCLEAN_NTRUHRSS1373_CLEAN_poly_Sq_mul(invh, tmp, f); 73| 3| PQCLEAN_NTRUHRSS1373_CLEAN_poly_Sq_tobytes(sk + 2 * NTRU_PACK_TRINARY_BYTES, invh); ------------------ | | 24| 3|#define NTRU_PACK_TRINARY_BYTES ((NTRU_PACK_DEG+4)/5) | | ------------------ | | | | 23| 3|#define NTRU_PACK_DEG (NTRU_N-1) | | | | ------------------ | | | | | | 5| 3|#define NTRU_N 1373 | | | | ------------------ | | ------------------ ------------------ 74| | 75| 3| PQCLEAN_NTRUHRSS1373_CLEAN_poly_Rq_mul(tmp, invgf, g); 76| 3| PQCLEAN_NTRUHRSS1373_CLEAN_poly_Rq_mul(h, tmp, g); 77| 3| PQCLEAN_NTRUHRSS1373_CLEAN_poly_Rq_sum_zero_tobytes(pk, h); 78| 3|} PQCLEAN_NTRUHRSS1373_CLEAN_owcpa_enc: 84| 3| const unsigned char *pk) { 85| 3| int i; 86| 3| poly x1, x2; 87| 3| poly *h = &x1, *liftm = &x1; 88| 3| poly *ct = &x2; 89| | 90| 3| PQCLEAN_NTRUHRSS1373_CLEAN_poly_Rq_sum_zero_frombytes(h, pk); 91| | 92| 3| PQCLEAN_NTRUHRSS1373_CLEAN_poly_Rq_mul(ct, r, h); 93| | 94| 3| PQCLEAN_NTRUHRSS1373_CLEAN_poly_lift(liftm, m); 95| 4.12k| for (i = 0; i < NTRU_N; i++) { ------------------ | | 5| 4.12k|#define NTRU_N 1373 ------------------ | Branch (95:17): [True: 4.11k, False: 3] ------------------ 96| 4.11k| ct->coeffs[i] = ct->coeffs[i] + liftm->coeffs[i]; 97| 4.11k| } 98| | 99| 3| PQCLEAN_NTRUHRSS1373_CLEAN_poly_Rq_sum_zero_tobytes(c, ct); 100| 3|} PQCLEAN_NTRUHRSS1373_CLEAN_owcpa_dec: 104| 3| const unsigned char *secretkey) { 105| 3| int i; 106| 3| int fail; 107| 3| poly x1, x2, x3, x4; 108| | 109| 3| poly *c = &x1, *f = &x2, *cf = &x3; 110| 3| poly *mf = &x2, *finv3 = &x3, *m = &x4; 111| 3| poly *liftm = &x2, *invh = &x3, *r = &x4; 112| 3| poly *b = &x1; 113| | 114| 3| PQCLEAN_NTRUHRSS1373_CLEAN_poly_Rq_sum_zero_frombytes(c, ciphertext); 115| 3| PQCLEAN_NTRUHRSS1373_CLEAN_poly_S3_frombytes(f, secretkey); 116| 3| PQCLEAN_NTRUHRSS1373_CLEAN_poly_Z3_to_Zq(f); 117| | 118| 3| PQCLEAN_NTRUHRSS1373_CLEAN_poly_Rq_mul(cf, c, f); 119| 3| PQCLEAN_NTRUHRSS1373_CLEAN_poly_Rq_to_S3(mf, cf); 120| | 121| 3| PQCLEAN_NTRUHRSS1373_CLEAN_poly_S3_frombytes(finv3, secretkey + NTRU_PACK_TRINARY_BYTES); ------------------ | | 24| 3|#define NTRU_PACK_TRINARY_BYTES ((NTRU_PACK_DEG+4)/5) | | ------------------ | | | | 23| 3|#define NTRU_PACK_DEG (NTRU_N-1) | | | | ------------------ | | | | | | 5| 3|#define NTRU_N 1373 | | | | ------------------ | | ------------------ ------------------ 122| 3| PQCLEAN_NTRUHRSS1373_CLEAN_poly_S3_mul(m, mf, finv3); 123| 3| PQCLEAN_NTRUHRSS1373_CLEAN_poly_S3_tobytes(rm + NTRU_PACK_TRINARY_BYTES, m); ------------------ | | 24| 3|#define NTRU_PACK_TRINARY_BYTES ((NTRU_PACK_DEG+4)/5) | | ------------------ | | | | 23| 3|#define NTRU_PACK_DEG (NTRU_N-1) | | | | ------------------ | | | | | | 5| 3|#define NTRU_N 1373 | | | | ------------------ | | ------------------ ------------------ 124| | 125| 3| fail = 0; 126| | 127| | /* Check that the unused bits of the last byte of the ciphertext are zero */ 128| 3| fail |= owcpa_check_ciphertext(ciphertext); 129| | 130| | /* For the IND-CCA2 KEM we must ensure that c = Enc(h, (r,m)). */ 131| | /* We can avoid re-computing r*h + Lift(m) as long as we check that */ 132| | /* r (defined as b/h mod (q, Phi_n)) and m are in the message space. */ 133| | /* (m can take any value in S3 in NTRU_HRSS) */ 134| | 135| | /* b = c - Lift(m) mod (q, x^n - 1) */ 136| 3| PQCLEAN_NTRUHRSS1373_CLEAN_poly_lift(liftm, m); 137| 4.12k| for (i = 0; i < NTRU_N; i++) { ------------------ | | 5| 4.12k|#define NTRU_N 1373 ------------------ | Branch (137:17): [True: 4.11k, False: 3] ------------------ 138| 4.11k| b->coeffs[i] = c->coeffs[i] - liftm->coeffs[i]; 139| 4.11k| } 140| | 141| | /* r = b / h mod (q, Phi_n) */ 142| 3| PQCLEAN_NTRUHRSS1373_CLEAN_poly_Sq_frombytes(invh, secretkey + 2 * NTRU_PACK_TRINARY_BYTES); ------------------ | | 24| 3|#define NTRU_PACK_TRINARY_BYTES ((NTRU_PACK_DEG+4)/5) | | ------------------ | | | | 23| 3|#define NTRU_PACK_DEG (NTRU_N-1) | | | | ------------------ | | | | | | 5| 3|#define NTRU_N 1373 | | | | ------------------ | | ------------------ ------------------ 143| 3| PQCLEAN_NTRUHRSS1373_CLEAN_poly_Sq_mul(r, b, invh); 144| | 145| | /* NOTE: Our definition of r as b/h mod (q, Phi_n) follows Figure 4 of */ 146| | /* [Sch18] https://eprint.iacr.org/2018/1174/20181203:032458. */ 147| | /* This differs from Figure 10 of Saito--Xagawa--Yamakawa */ 148| | /* [SXY17] https://eprint.iacr.org/2017/1005/20180516:055500 */ 149| | /* where r gets a final reduction modulo p. */ 150| | /* We need this change to use Proposition 1 of [Sch18]. */ 151| | 152| | /* Proposition 1 of [Sch18] shows that re-encryption with (r,m) yields c. */ 153| | /* if and only if fail==0 after the following call to owcpa_check_r */ 154| | /* The procedure given in Fig. 8 of [Sch18] can be skipped because we have */ 155| | /* c(1) = 0 due to the use of poly_Rq_sum_zero_{to,from}bytes. */ 156| 3| fail |= owcpa_check_r(r); 157| | 158| 3| PQCLEAN_NTRUHRSS1373_CLEAN_poly_trinary_Zq_to_Z3(r); 159| 3| PQCLEAN_NTRUHRSS1373_CLEAN_poly_S3_tobytes(rm, r); 160| | 161| 3| return fail; 162| 3|} PQCLEAN_NTRUHRSS1373_CLEAN_poly_S3_tobytes: 3| 18|void PQCLEAN_NTRUHRSS1373_CLEAN_poly_S3_tobytes(unsigned char msg[NTRU_PACK_TRINARY_BYTES], const poly *a) { 4| 18| int i; 5| 18| unsigned char c; 6| 18| int j; 7| | 8| 4.95k| for (i = 0; i < NTRU_PACK_DEG / 5; i++) { ------------------ | | 23| 4.95k|#define NTRU_PACK_DEG (NTRU_N-1) | | ------------------ | | | | 5| 4.95k|#define NTRU_N 1373 | | ------------------ ------------------ | Branch (8:17): [True: 4.93k, False: 18] ------------------ 9| 4.93k| c = a->coeffs[5 * i + 4] & 255; 10| 4.93k| c = (3 * c + a->coeffs[5 * i + 3]) & 255; 11| 4.93k| c = (3 * c + a->coeffs[5 * i + 2]) & 255; 12| 4.93k| c = (3 * c + a->coeffs[5 * i + 1]) & 255; 13| 4.93k| c = (3 * c + a->coeffs[5 * i + 0]) & 255; 14| 4.93k| msg[i] = c; 15| 4.93k| } 16| 18| i = NTRU_PACK_DEG / 5; ------------------ | | 23| 18|#define NTRU_PACK_DEG (NTRU_N-1) | | ------------------ | | | | 5| 18|#define NTRU_N 1373 | | ------------------ ------------------ 17| 18| c = 0; 18| 54| for (j = NTRU_PACK_DEG - (5 * i) - 1; j >= 0; j--) { ------------------ | | 23| 18|#define NTRU_PACK_DEG (NTRU_N-1) | | ------------------ | | | | 5| 18|#define NTRU_N 1373 | | ------------------ ------------------ | Branch (18:43): [True: 36, False: 18] ------------------ 19| 36| c = (3 * c + a->coeffs[5 * i + j]) & 255; 20| 36| } 21| 18| msg[i] = c; 22| 18|} PQCLEAN_NTRUHRSS1373_CLEAN_poly_S3_frombytes: 24| 6|void PQCLEAN_NTRUHRSS1373_CLEAN_poly_S3_frombytes(poly *r, const unsigned char msg[NTRU_PACK_TRINARY_BYTES]) { 25| 6| int i; 26| 6| unsigned char c; 27| 6| int j; 28| | 29| 1.65k| for (i = 0; i < NTRU_PACK_DEG / 5; i++) { ------------------ | | 23| 1.65k|#define NTRU_PACK_DEG (NTRU_N-1) | | ------------------ | | | | 5| 1.65k|#define NTRU_N 1373 | | ------------------ ------------------ | Branch (29:17): [True: 1.64k, False: 6] ------------------ 30| 1.64k| c = msg[i]; 31| 1.64k| r->coeffs[5 * i + 0] = c; 32| 1.64k| r->coeffs[5 * i + 1] = c * 171 >> 9; // this is division by 3 33| 1.64k| r->coeffs[5 * i + 2] = c * 57 >> 9; // division by 3^2 34| 1.64k| r->coeffs[5 * i + 3] = c * 19 >> 9; // division by 3^3 35| 1.64k| r->coeffs[5 * i + 4] = c * 203 >> 14; // etc. 36| 1.64k| } 37| 6| i = NTRU_PACK_DEG / 5; ------------------ | | 23| 6|#define NTRU_PACK_DEG (NTRU_N-1) | | ------------------ | | | | 5| 6|#define NTRU_N 1373 | | ------------------ ------------------ 38| 6| c = msg[i]; 39| 18| for (j = 0; (5 * i + j) < NTRU_PACK_DEG; j++) { ------------------ | | 23| 18|#define NTRU_PACK_DEG (NTRU_N-1) | | ------------------ | | | | 5| 18|#define NTRU_N 1373 | | ------------------ ------------------ | Branch (39:17): [True: 12, False: 6] ------------------ 40| 12| r->coeffs[5 * i + j] = c; 41| 12| c = c * 171 >> 9; 42| 12| } 43| 6| r->coeffs[NTRU_N - 1] = 0; ------------------ | | 5| 6|#define NTRU_N 1373 ------------------ 44| 6| PQCLEAN_NTRUHRSS1373_CLEAN_poly_mod_3_Phi_n(r); 45| 6|} PQCLEAN_NTRUHRSS1373_CLEAN_poly_Sq_tobytes: 4| 9|void PQCLEAN_NTRUHRSS1373_CLEAN_poly_Sq_tobytes(unsigned char *r, const poly *a) { 5| 9| int i, j; 6| 9| uint16_t t[4]; 7| | 8| 3.09k| for (i = 0; i < NTRU_PACK_DEG / 4; i++) { ------------------ | | 23| 3.09k|#define NTRU_PACK_DEG (NTRU_N-1) | | ------------------ | | | | 5| 3.09k|#define NTRU_N 1373 | | ------------------ ------------------ | Branch (8:17): [True: 3.08k, False: 9] ------------------ 9| 15.4k| for (j = 0; j < 4; j++) { ------------------ | Branch (9:21): [True: 12.3k, False: 3.08k] ------------------ 10| 12.3k| t[j] = MODQ(a->coeffs[4 * i + j]); ------------------ | | 9| 12.3k|#define MODQ(X) ((X) & (NTRU_Q-1)) | | ------------------ | | | | 13| 12.3k|#define NTRU_Q (1 << NTRU_LOGQ) | | | | ------------------ | | | | | | 6| 12.3k|#define NTRU_LOGQ 14 | | | | ------------------ | | ------------------ ------------------ 11| 12.3k| } 12| | 13| | // t0 t1 t2 t3 14| | // r0 8 15| | // r1 6 | 2 16| | // r2 8 17| | // r3 4 | 4 18| | // r4 8 19| | // r5 2 | 6 20| | // r6 8 21| 3.08k| r[7 * i + 0] = (unsigned char) ( t[0] & 0xff ); 22| 3.08k| r[7 * i + 1] = (unsigned char) ((t[0] >> 8) | ((t[1] & 0x03) << 6)); 23| 3.08k| r[7 * i + 2] = (unsigned char) ((t[1] >> 2) & 0xff); 24| 3.08k| r[7 * i + 3] = (unsigned char) ((t[1] >> 10) | ((t[2] & 0x0f) << 4)); 25| 3.08k| r[7 * i + 4] = (unsigned char) ((t[2] >> 4) & 0xff); 26| 3.08k| r[7 * i + 5] = (unsigned char) ((t[2] >> 12) | ((t[3] & 0x3f) << 2)); 27| 3.08k| r[7 * i + 6] = (unsigned char) ( t[3] >> 6); 28| 3.08k| } 29| | 30| | // i=NTRU_PACK_DEG/4; 31| 9| if (NTRU_PACK_DEG % 4 == 2) { ------------------ | | 23| 9|#define NTRU_PACK_DEG (NTRU_N-1) | | ------------------ | | | | 5| 9|#define NTRU_N 1373 | | ------------------ ------------------ | Branch (31:9): [Folded, False: 9] ------------------ 32| 0| t[0] = MODQ(a->coeffs[NTRU_PACK_DEG - 2]); ------------------ | | 9| 0|#define MODQ(X) ((X) & (NTRU_Q-1)) | | ------------------ | | | | 13| 0|#define NTRU_Q (1 << NTRU_LOGQ) | | | | ------------------ | | | | | | 6| 0|#define NTRU_LOGQ 14 | | | | ------------------ | | ------------------ ------------------ 33| 0| t[1] = MODQ(a->coeffs[NTRU_PACK_DEG - 1]); ------------------ | | 9| 0|#define MODQ(X) ((X) & (NTRU_Q-1)) | | ------------------ | | | | 13| 0|#define NTRU_Q (1 << NTRU_LOGQ) | | | | ------------------ | | | | | | 6| 0|#define NTRU_LOGQ 14 | | | | ------------------ | | ------------------ ------------------ 34| 0| r[7 * i + 0] = (unsigned char) ( t[0] & 0xff ); 35| 0| r[7 * i + 1] = (unsigned char) ((t[0] >> 8) | ((t[1] & 0x03) << 6)); 36| 0| r[7 * i + 2] = (unsigned char) ((t[1] >> 2) & 0xff); 37| 0| r[7 * i + 3] = (unsigned char) ( t[1] >> 10 ); 38| 0| } 39| 9|} PQCLEAN_NTRUHRSS1373_CLEAN_poly_Sq_frombytes: 41| 9|void PQCLEAN_NTRUHRSS1373_CLEAN_poly_Sq_frombytes(poly *r, const unsigned char *a) { 42| 9| int i; 43| 3.09k| for (i = 0; i < NTRU_PACK_DEG / 4; i++) { ------------------ | | 23| 3.09k|#define NTRU_PACK_DEG (NTRU_N-1) | | ------------------ | | | | 5| 3.09k|#define NTRU_N 1373 | | ------------------ ------------------ | Branch (43:17): [True: 3.08k, False: 9] ------------------ 44| 3.08k| r->coeffs[4 * i + 0] = a[7 * i + 0] | (((uint16_t)a[7 * i + 1] & 0x3f) << 8); 45| 3.08k| r->coeffs[4 * i + 1] = (a[7 * i + 1] >> 6) | (((uint16_t)a[7 * i + 2] ) << 2) | (((uint16_t)a[7 * i + 3] & 0x0f) << 10); 46| 3.08k| r->coeffs[4 * i + 2] = (a[7 * i + 3] >> 4) | (((uint16_t)a[7 * i + 4] & 0xff) << 4) | (((uint16_t)a[7 * i + 5] & 0x03) << 12); 47| 3.08k| r->coeffs[4 * i + 3] = (a[7 * i + 5] >> 2) | (((uint16_t)a[7 * i + 6] ) << 6); 48| 3.08k| } 49| | 50| | // i=NTRU_PACK_DEG/4; 51| 9| if (NTRU_PACK_DEG % 4 == 2) { ------------------ | | 23| 9|#define NTRU_PACK_DEG (NTRU_N-1) | | ------------------ | | | | 5| 9|#define NTRU_N 1373 | | ------------------ ------------------ | Branch (51:9): [Folded, False: 9] ------------------ 52| 0| r->coeffs[4 * i + 0] = a[7 * i + 0] | (((uint16_t)a[7 * i + 1] & 0x3f) << 8); 53| 0| r->coeffs[4 * i + 1] = (a[7 * i + 1] >> 6) | (((uint16_t)a[7 * i + 2] ) << 2) | (((uint16_t)a[7 * i + 3] & 0x0f) << 10); 54| 0| } 55| 9| r->coeffs[NTRU_N - 1] = 0; ------------------ | | 5| 9|#define NTRU_N 1373 ------------------ 56| 9|} PQCLEAN_NTRUHRSS1373_CLEAN_poly_Rq_sum_zero_tobytes: 58| 6|void PQCLEAN_NTRUHRSS1373_CLEAN_poly_Rq_sum_zero_tobytes(unsigned char *r, const poly *a) { 59| 6| PQCLEAN_NTRUHRSS1373_CLEAN_poly_Sq_tobytes(r, a); 60| 6|} PQCLEAN_NTRUHRSS1373_CLEAN_poly_Rq_sum_zero_frombytes: 62| 6|void PQCLEAN_NTRUHRSS1373_CLEAN_poly_Rq_sum_zero_frombytes(poly *r, const unsigned char *a) { 63| 6| int i; 64| 6| PQCLEAN_NTRUHRSS1373_CLEAN_poly_Sq_frombytes(r, a); 65| | 66| | /* Set r[n-1] so that the sum of coefficients is zero mod q */ 67| 6| r->coeffs[NTRU_N - 1] = 0; ------------------ | | 5| 6|#define NTRU_N 1373 ------------------ 68| 8.23k| for (i = 0; i < NTRU_PACK_DEG; i++) { ------------------ | | 23| 8.23k|#define NTRU_PACK_DEG (NTRU_N-1) | | ------------------ | | | | 5| 8.23k|#define NTRU_N 1373 | | ------------------ ------------------ | Branch (68:17): [True: 8.23k, False: 6] ------------------ 69| 8.23k| r->coeffs[NTRU_N - 1] -= r->coeffs[i]; ------------------ | | 5| 8.23k|#define NTRU_N 1373 ------------------ 70| 8.23k| } 71| 6|} PQCLEAN_NTRUHRSS1373_CLEAN_poly_Z3_to_Zq: 4| 18|void PQCLEAN_NTRUHRSS1373_CLEAN_poly_Z3_to_Zq(poly *r) { 5| 18| int i; 6| 24.7k| for (i = 0; i < NTRU_N; i++) { ------------------ | | 5| 24.7k|#define NTRU_N 1373 ------------------ | Branch (6:17): [True: 24.7k, False: 18] ------------------ 7| 24.7k| r->coeffs[i] = r->coeffs[i] | ((-(r->coeffs[i] >> 1)) & (NTRU_Q - 1)); ------------------ | | 13| 24.7k|#define NTRU_Q (1 << NTRU_LOGQ) | | ------------------ | | | | 6| 24.7k|#define NTRU_LOGQ 14 | | ------------------ ------------------ 8| 24.7k| } 9| 18|} PQCLEAN_NTRUHRSS1373_CLEAN_poly_trinary_Zq_to_Z3: 12| 3|void PQCLEAN_NTRUHRSS1373_CLEAN_poly_trinary_Zq_to_Z3(poly *r) { 13| 3| int i; 14| 4.12k| for (i = 0; i < NTRU_N; i++) { ------------------ | | 5| 4.12k|#define NTRU_N 1373 ------------------ | Branch (14:17): [True: 4.11k, False: 3] ------------------ 15| 4.11k| r->coeffs[i] = MODQ(r->coeffs[i]); ------------------ | | 9| 4.11k|#define MODQ(X) ((X) & (NTRU_Q-1)) | | ------------------ | | | | 13| 4.11k|#define NTRU_Q (1 << NTRU_LOGQ) | | | | ------------------ | | | | | | 6| 4.11k|#define NTRU_LOGQ 14 | | | | ------------------ | | ------------------ ------------------ 16| 4.11k| r->coeffs[i] = 3 & (r->coeffs[i] ^ (r->coeffs[i] >> (NTRU_LOGQ - 1))); ------------------ | | 6| 4.11k|#define NTRU_LOGQ 14 ------------------ 17| 4.11k| } 18| 3|} PQCLEAN_NTRUHRSS1373_CLEAN_poly_Sq_mul: 20| 6|void PQCLEAN_NTRUHRSS1373_CLEAN_poly_Sq_mul(poly *r, const poly *a, const poly *b) { 21| 6| PQCLEAN_NTRUHRSS1373_CLEAN_poly_Rq_mul(r, a, b); 22| 6| PQCLEAN_NTRUHRSS1373_CLEAN_poly_mod_q_Phi_n(r); 23| 6|} PQCLEAN_NTRUHRSS1373_CLEAN_poly_S3_mul: 25| 3|void PQCLEAN_NTRUHRSS1373_CLEAN_poly_S3_mul(poly *r, const poly *a, const poly *b) { 26| 3| int i; 27| | 28| | /* Our S3 multiplications do not overflow mod q, */ 29| | /* so we can re-purpose PQCLEAN_NTRUHRSS1373_CLEAN_poly_Rq_mul, as long as we */ 30| | /* follow with an explicit reduction mod q. */ 31| 3| PQCLEAN_NTRUHRSS1373_CLEAN_poly_Rq_mul(r, a, b); 32| 4.12k| for (i = 0; i < NTRU_N; i++) { ------------------ | | 5| 4.12k|#define NTRU_N 1373 ------------------ | Branch (32:17): [True: 4.11k, False: 3] ------------------ 33| 4.11k| r->coeffs[i] = MODQ(r->coeffs[i]); ------------------ | | 9| 4.11k|#define MODQ(X) ((X) & (NTRU_Q-1)) | | ------------------ | | | | 13| 4.11k|#define NTRU_Q (1 << NTRU_LOGQ) | | | | ------------------ | | | | | | 6| 4.11k|#define NTRU_LOGQ 14 | | | | ------------------ | | ------------------ ------------------ 34| 4.11k| } 35| 3| PQCLEAN_NTRUHRSS1373_CLEAN_poly_mod_3_Phi_n(r); 36| 3|} PQCLEAN_NTRUHRSS1373_CLEAN_poly_Rq_inv: 71| 3|void PQCLEAN_NTRUHRSS1373_CLEAN_poly_Rq_inv(poly *r, const poly *a) { 72| 3| poly ai2; 73| 3| PQCLEAN_NTRUHRSS1373_CLEAN_poly_R2_inv(&ai2, a); 74| 3| PQCLEAN_NTRUHRSS1373_CLEAN_poly_R2_inv_to_Rq_inv(r, &ai2, a); 75| 3|} poly.c:PQCLEAN_NTRUHRSS1373_CLEAN_poly_R2_inv_to_Rq_inv: 38| 3|static void PQCLEAN_NTRUHRSS1373_CLEAN_poly_R2_inv_to_Rq_inv(poly *r, const poly *ai, const poly *a) { 39| | 40| 3| int i; 41| 3| poly b, c; 42| 3| poly s; 43| | 44| | // for 0..4 45| | // ai = ai * (2 - a*ai) mod q 46| 4.12k| for (i = 0; i < NTRU_N; i++) { ------------------ | | 5| 4.12k|#define NTRU_N 1373 ------------------ | Branch (46:17): [True: 4.11k, False: 3] ------------------ 47| 4.11k| b.coeffs[i] = -(a->coeffs[i]); 48| 4.11k| } 49| | 50| 4.12k| for (i = 0; i < NTRU_N; i++) { ------------------ | | 5| 4.12k|#define NTRU_N 1373 ------------------ | Branch (50:17): [True: 4.11k, False: 3] ------------------ 51| 4.11k| r->coeffs[i] = ai->coeffs[i]; 52| 4.11k| } 53| | 54| 3| PQCLEAN_NTRUHRSS1373_CLEAN_poly_Rq_mul(&c, r, &b); 55| 3| c.coeffs[0] += 2; // c = 2 - a*ai 56| 3| PQCLEAN_NTRUHRSS1373_CLEAN_poly_Rq_mul(&s, &c, r); // s = ai*c 57| | 58| 3| PQCLEAN_NTRUHRSS1373_CLEAN_poly_Rq_mul(&c, &s, &b); 59| 3| c.coeffs[0] += 2; // c = 2 - a*s 60| 3| PQCLEAN_NTRUHRSS1373_CLEAN_poly_Rq_mul(r, &c, &s); // r = s*c 61| | 62| 3| PQCLEAN_NTRUHRSS1373_CLEAN_poly_Rq_mul(&c, r, &b); 63| 3| c.coeffs[0] += 2; // c = 2 - a*r 64| 3| PQCLEAN_NTRUHRSS1373_CLEAN_poly_Rq_mul(&s, &c, r); // s = r*c 65| | 66| 3| PQCLEAN_NTRUHRSS1373_CLEAN_poly_Rq_mul(&c, &s, &b); 67| 3| c.coeffs[0] += 2; // c = 2 - a*s 68| 3| PQCLEAN_NTRUHRSS1373_CLEAN_poly_Rq_mul(r, &c, &s); // r = s*c 69| 3|} PQCLEAN_NTRUHRSS1373_CLEAN_poly_lift: 4| 6|void PQCLEAN_NTRUHRSS1373_CLEAN_poly_lift(poly *r, const poly *a) { 5| | /* NOTE: Assumes input is in {0,1,2}^N */ 6| | /* Produces output in [0,Q-1]^N */ 7| 6| int i; 8| 6| poly b; 9| 6| uint16_t t, zj; 10| | 11| | /* Define z by = delta_{i,0} mod 3: */ 12| | /* t = -1/N mod p = -N mod 3 */ 13| | /* z[0] = 2 - t mod 3 */ 14| | /* z[1] = 0 mod 3 */ 15| | /* z[j] = z[j-1] + t mod 3 */ 16| | /* We'll compute b = a/(x-1) mod (3, Phi) using */ 17| | /* b[0] = , b[1] = , b[2] = */ 18| | /* b[i] = b[i-3] - (a[i] + a[i-1] + a[i-2]) */ 19| 6| t = 3 - (NTRU_N % 3); ------------------ | | 5| 6|#define NTRU_N 1373 ------------------ 20| 6| b.coeffs[0] = a->coeffs[0] * (2 - t) + a->coeffs[1] * 0 + a->coeffs[2] * t; 21| 6| b.coeffs[1] = a->coeffs[1] * (2 - t) + a->coeffs[2] * 0; 22| 6| b.coeffs[2] = a->coeffs[2] * (2 - t); 23| | 24| 6| zj = 0; /* z[1] */ 25| 8.22k| for (i = 3; i < NTRU_N; i++) { ------------------ | | 5| 8.22k|#define NTRU_N 1373 ------------------ | Branch (25:17): [True: 8.22k, False: 6] ------------------ 26| 8.22k| b.coeffs[0] += a->coeffs[i] * (zj + 2 * t); 27| 8.22k| b.coeffs[1] += a->coeffs[i] * (zj + t); 28| 8.22k| b.coeffs[2] += a->coeffs[i] * zj; 29| 8.22k| zj = (zj + t) % 3; 30| 8.22k| } 31| 6| b.coeffs[1] += a->coeffs[0] * (zj + t); 32| 6| b.coeffs[2] += a->coeffs[0] * zj; 33| 6| b.coeffs[2] += a->coeffs[1] * (zj + t); 34| | 35| 6| b.coeffs[0] = b.coeffs[0]; 36| 6| b.coeffs[1] = b.coeffs[1]; 37| 6| b.coeffs[2] = b.coeffs[2]; 38| 8.22k| for (i = 3; i < NTRU_N; i++) { ------------------ | | 5| 8.22k|#define NTRU_N 1373 ------------------ | Branch (38:17): [True: 8.22k, False: 6] ------------------ 39| 8.22k| b.coeffs[i] = b.coeffs[i - 3] + 2 * (a->coeffs[i] + a->coeffs[i - 1] + a->coeffs[i - 2]); 40| 8.22k| } 41| | 42| | /* Finish reduction mod Phi by subtracting Phi * b[N-1] */ 43| 6| PQCLEAN_NTRUHRSS1373_CLEAN_poly_mod_3_Phi_n(&b); 44| | 45| | /* Switch from {0,1,2} to {0,1,q-1} coefficient representation */ 46| 6| PQCLEAN_NTRUHRSS1373_CLEAN_poly_Z3_to_Zq(&b); 47| | 48| | /* Multiply by (x-1) */ 49| 6| r->coeffs[0] = -(b.coeffs[0]); 50| 8.23k| for (i = 0; i < NTRU_N - 1; i++) { ------------------ | | 5| 8.23k|#define NTRU_N 1373 ------------------ | Branch (50:17): [True: 8.23k, False: 6] ------------------ 51| 8.23k| r->coeffs[i + 1] = b.coeffs[i] - b.coeffs[i + 1]; 52| 8.23k| } 53| 6|} PQCLEAN_NTRUHRSS1373_CLEAN_poly_mod_3_Phi_n: 18| 18|void PQCLEAN_NTRUHRSS1373_CLEAN_poly_mod_3_Phi_n(poly *r) { 19| 18| int i; 20| 24.7k| for (i = 0; i < NTRU_N; i++) { ------------------ | | 5| 24.7k|#define NTRU_N 1373 ------------------ | Branch (20:17): [True: 24.7k, False: 18] ------------------ 21| 24.7k| r->coeffs[i] = mod3(r->coeffs[i] + 2 * r->coeffs[NTRU_N - 1]); ------------------ | | 5| 24.7k|#define NTRU_N 1373 ------------------ 22| 24.7k| } 23| 18|} PQCLEAN_NTRUHRSS1373_CLEAN_poly_mod_q_Phi_n: 25| 6|void PQCLEAN_NTRUHRSS1373_CLEAN_poly_mod_q_Phi_n(poly *r) { 26| 6| int i; 27| 8.24k| for (i = 0; i < NTRU_N; i++) { ------------------ | | 5| 8.24k|#define NTRU_N 1373 ------------------ | Branch (27:17): [True: 8.23k, False: 6] ------------------ 28| 8.23k| r->coeffs[i] = r->coeffs[i] - r->coeffs[NTRU_N - 1]; ------------------ | | 5| 8.23k|#define NTRU_N 1373 ------------------ 29| 8.23k| } 30| 6|} PQCLEAN_NTRUHRSS1373_CLEAN_poly_Rq_to_S3: 32| 3|void PQCLEAN_NTRUHRSS1373_CLEAN_poly_Rq_to_S3(poly *r, const poly *a) { 33| 3| int i; 34| 3| uint16_t flag; 35| | 36| | /* The coefficients of a are stored as non-negative integers. */ 37| | /* We must translate to representatives in [-q/2, q/2) before */ 38| | /* reduction mod 3. */ 39| 4.12k| for (i = 0; i < NTRU_N; i++) { ------------------ | | 5| 4.12k|#define NTRU_N 1373 ------------------ | Branch (39:17): [True: 4.11k, False: 3] ------------------ 40| | /* Need an explicit reduction mod q here */ 41| 4.11k| r->coeffs[i] = MODQ(a->coeffs[i]); ------------------ | | 9| 4.11k|#define MODQ(X) ((X) & (NTRU_Q-1)) | | ------------------ | | | | 13| 4.11k|#define NTRU_Q (1 << NTRU_LOGQ) | | | | ------------------ | | | | | | 6| 4.11k|#define NTRU_LOGQ 14 | | | | ------------------ | | ------------------ ------------------ 42| | 43| | /* flag = 1 if r[i] >= q/2 else 0 */ 44| 4.11k| flag = r->coeffs[i] >> (NTRU_LOGQ - 1); ------------------ | | 6| 4.11k|#define NTRU_LOGQ 14 ------------------ 45| | 46| | /* Now we will add (-q) mod 3 if r[i] >= q/2 */ 47| | /* Note (-q) mod 3=(-2^k) mod 3=1<<(1-(k&1)) */ 48| 4.11k| r->coeffs[i] += flag << (1 - (NTRU_LOGQ & 1)); ------------------ | | 6| 4.11k|#define NTRU_LOGQ 14 ------------------ 49| 4.11k| } 50| | 51| 3| PQCLEAN_NTRUHRSS1373_CLEAN_poly_mod_3_Phi_n(r); 52| 3|} PQCLEAN_NTRUHRSS1373_CLEAN_poly_R2_inv: 10| 3|void PQCLEAN_NTRUHRSS1373_CLEAN_poly_R2_inv(poly *r, const poly *a) { 11| 3| poly f, g, v, w; 12| 3| size_t i, loop; 13| 3| int16_t delta, sign, swap, t; 14| | 15| 4.12k| for (i = 0; i < NTRU_N; ++i) { ------------------ | | 5| 4.12k|#define NTRU_N 1373 ------------------ | Branch (15:17): [True: 4.11k, False: 3] ------------------ 16| 4.11k| v.coeffs[i] = 0; 17| 4.11k| } 18| 4.12k| for (i = 0; i < NTRU_N; ++i) { ------------------ | | 5| 4.12k|#define NTRU_N 1373 ------------------ | Branch (18:17): [True: 4.11k, False: 3] ------------------ 19| 4.11k| w.coeffs[i] = 0; 20| 4.11k| } 21| 3| w.coeffs[0] = 1; 22| | 23| 4.12k| for (i = 0; i < NTRU_N; ++i) { ------------------ | | 5| 4.12k|#define NTRU_N 1373 ------------------ | Branch (23:17): [True: 4.11k, False: 3] ------------------ 24| 4.11k| f.coeffs[i] = 1; 25| 4.11k| } 26| 4.11k| for (i = 0; i < NTRU_N - 1; ++i) { ------------------ | | 5| 4.11k|#define NTRU_N 1373 ------------------ | Branch (26:17): [True: 4.11k, False: 3] ------------------ 27| 4.11k| g.coeffs[NTRU_N - 2 - i] = (a->coeffs[i] ^ a->coeffs[NTRU_N - 1]) & 1; ------------------ | | 5| 4.11k|#define NTRU_N 1373 ------------------ g.coeffs[NTRU_N - 2 - i] = (a->coeffs[i] ^ a->coeffs[NTRU_N - 1]) & 1; ------------------ | | 5| 4.11k|#define NTRU_N 1373 ------------------ 28| 4.11k| } 29| 3| g.coeffs[NTRU_N - 1] = 0; ------------------ | | 5| 3|#define NTRU_N 1373 ------------------ 30| | 31| 3| delta = 1; 32| | 33| 8.23k| for (loop = 0; loop < 2 * (NTRU_N - 1) - 1; ++loop) { ------------------ | | 5| 8.23k|#define NTRU_N 1373 ------------------ | Branch (33:20): [True: 8.22k, False: 3] ------------------ 34| 11.2M| for (i = NTRU_N - 1; i > 0; --i) { ------------------ | | 5| 8.22k|#define NTRU_N 1373 ------------------ | Branch (34:30): [True: 11.2M, False: 8.22k] ------------------ 35| 11.2M| v.coeffs[i] = v.coeffs[i - 1]; 36| 11.2M| } 37| 8.22k| v.coeffs[0] = 0; 38| | 39| 8.22k| sign = g.coeffs[0] & f.coeffs[0]; 40| 8.22k| swap = both_negative_mask(-delta, -(int16_t) g.coeffs[0]); 41| 8.22k| delta ^= swap & (delta ^ -delta); 42| 8.22k| delta += 1; 43| | 44| 11.3M| for (i = 0; i < NTRU_N; ++i) { ------------------ | | 5| 11.3M|#define NTRU_N 1373 ------------------ | Branch (44:21): [True: 11.2M, False: 8.22k] ------------------ 45| 11.2M| t = swap & (f.coeffs[i] ^ g.coeffs[i]); 46| 11.2M| f.coeffs[i] ^= t; 47| 11.2M| g.coeffs[i] ^= t; 48| 11.2M| t = swap & (v.coeffs[i] ^ w.coeffs[i]); 49| 11.2M| v.coeffs[i] ^= t; 50| 11.2M| w.coeffs[i] ^= t; 51| 11.2M| } 52| | 53| 11.3M| for (i = 0; i < NTRU_N; ++i) { ------------------ | | 5| 11.3M|#define NTRU_N 1373 ------------------ | Branch (53:21): [True: 11.2M, False: 8.22k] ------------------ 54| 11.2M| g.coeffs[i] = g.coeffs[i] ^ (sign & f.coeffs[i]); 55| 11.2M| } 56| 11.3M| for (i = 0; i < NTRU_N; ++i) { ------------------ | | 5| 11.3M|#define NTRU_N 1373 ------------------ | Branch (56:21): [True: 11.2M, False: 8.22k] ------------------ 57| 11.2M| w.coeffs[i] = w.coeffs[i] ^ (sign & v.coeffs[i]); 58| 11.2M| } 59| 11.2M| for (i = 0; i < NTRU_N - 1; ++i) { ------------------ | | 5| 11.2M|#define NTRU_N 1373 ------------------ | Branch (59:21): [True: 11.2M, False: 8.22k] ------------------ 60| 11.2M| g.coeffs[i] = g.coeffs[i + 1]; 61| 11.2M| } 62| 8.22k| g.coeffs[NTRU_N - 1] = 0; ------------------ | | 5| 8.22k|#define NTRU_N 1373 ------------------ 63| 8.22k| } 64| | 65| 4.11k| for (i = 0; i < NTRU_N - 1; ++i) { ------------------ | | 5| 4.11k|#define NTRU_N 1373 ------------------ | Branch (65:17): [True: 4.11k, False: 3] ------------------ 66| 4.11k| r->coeffs[i] = v.coeffs[NTRU_N - 2 - i]; ------------------ | | 5| 4.11k|#define NTRU_N 1373 ------------------ 67| 4.11k| } 68| 3| r->coeffs[NTRU_N - 1] = 0; ------------------ | | 5| 3|#define NTRU_N 1373 ------------------ 69| 3|} PQCLEAN_NTRUHRSS1373_CLEAN_poly_Rq_mul: 29| 51|void PQCLEAN_NTRUHRSS1373_CLEAN_poly_Rq_mul(poly *r, const poly *a, const poly *b) { 30| 51| size_t i; 31| 51| uint16_t ab[2 * L]; 32| | 33| 70.0k| for (i = 0; i < NTRU_N; i++) { ------------------ | | 5| 70.0k|#define NTRU_N 1373 ------------------ | Branch (33:17): [True: 70.0k, False: 51] ------------------ 34| 70.0k| ab[i] = a->coeffs[i]; 35| 70.0k| ab[L + i] = b->coeffs[i]; ------------------ | | 6| 70.0k|#define L PAD32(NTRU_N) | | ------------------ | | | | 11| 70.0k|#define PAD32(X) ((((X) + 31)/32)*32) | | ------------------ ------------------ 36| 70.0k| } 37| 204| for (i = NTRU_N; i < L; i++) { ------------------ | | 5| 51|#define NTRU_N 1373 ------------------ for (i = NTRU_N; i < L; i++) { ------------------ | | 6| 204|#define L PAD32(NTRU_N) | | ------------------ | | | | 11| 204|#define PAD32(X) ((((X) + 31)/32)*32) | | ------------------ ------------------ | Branch (37:22): [True: 153, False: 51] ------------------ 38| 153| ab[i] = 0; 39| 153| ab[L + i] = 0; ------------------ | | 6| 153|#define L PAD32(NTRU_N) | | ------------------ | | | | 11| 153|#define PAD32(X) ((((X) + 31)/32)*32) | | ------------------ ------------------ 40| 153| } 41| | 42| 51| k2x4_mul(ab, ab, ab + L); ------------------ | | 6| 51|#define L PAD32(NTRU_N) | | ------------------ | | | | 11| 51|#define PAD32(X) ((((X) + 31)/32)*32) | | ------------------ ------------------ 43| | 44| 70.0k| for (i = 0; i < NTRU_N; i++) { ------------------ | | 5| 70.0k|#define NTRU_N 1373 ------------------ | Branch (44:17): [True: 70.0k, False: 51] ------------------ 45| 70.0k| r->coeffs[i] = ab[i] + ab[NTRU_N + i]; ------------------ | | 5| 70.0k|#define NTRU_N 1373 ------------------ 46| 70.0k| } 47| 51|} poly_rq_mul.c:k2x4_mul: 49| 51|static void k2x4_mul(uint16_t ab[2 * L], const uint16_t a[L], const uint16_t b[L]) { 50| 51| uint16_t tmpA[9 * K]; 51| 51| uint16_t tmpB[9 * K]; 52| 51| uint16_t eC[81 * 2 * K]; 53| | 54| 51| k2x4_eval_00(tmpA, a); 55| 51| k2x4_eval_00(tmpB, b); 56| 51| k2x4_basemul(eC + 0 * 9 * 2 * K, tmpA, tmpB); ------------------ | | 8| 51|#define K (L/16) | | ------------------ | | | | 6| 51|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 51|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 57| | 58| 51| k2x4_eval_0inf(tmpA, a); 59| 51| k2x4_eval_0inf(tmpB, b); 60| 51| k2x4_basemul(eC + 1 * 9 * 2 * K, tmpA, tmpB); ------------------ | | 8| 51|#define K (L/16) | | ------------------ | | | | 6| 51|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 51|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 61| | 62| 51| k2x4_eval_inf0(tmpA, a); 63| 51| k2x4_eval_inf0(tmpB, b); 64| 51| k2x4_basemul(eC + 2 * 9 * 2 * K, tmpA, tmpB); ------------------ | | 8| 51|#define K (L/16) | | ------------------ | | | | 6| 51|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 51|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 65| | 66| 51| k2x4_eval_infinf(tmpA, a); 67| 51| k2x4_eval_infinf(tmpB, b); 68| 51| k2x4_basemul(eC + 3 * 9 * 2 * K, tmpA, tmpB); ------------------ | | 8| 51|#define K (L/16) | | ------------------ | | | | 6| 51|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 51|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 69| | 70| 51| k2x4_eval_01(tmpA, a); 71| 51| k2x4_eval_01(tmpB, b); 72| 51| k2x4_basemul(eC + 4 * 9 * 2 * K, tmpA, tmpB); ------------------ | | 8| 51|#define K (L/16) | | ------------------ | | | | 6| 51|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 51|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 73| | 74| 51| k2x4_eval_1inf(tmpA, a); 75| 51| k2x4_eval_1inf(tmpB, b); 76| 51| k2x4_basemul(eC + 5 * 9 * 2 * K, tmpA, tmpB); ------------------ | | 8| 51|#define K (L/16) | | ------------------ | | | | 6| 51|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 51|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 77| | 78| 51| k2x4_eval_10(tmpA, a); 79| 51| k2x4_eval_10(tmpB, b); 80| 51| k2x4_basemul(eC + 6 * 9 * 2 * K, tmpA, tmpB); ------------------ | | 8| 51|#define K (L/16) | | ------------------ | | | | 6| 51|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 51|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 81| | 82| 51| k2x4_eval_inf1(tmpA, a); 83| 51| k2x4_eval_inf1(tmpB, b); 84| 51| k2x4_basemul(eC + 7 * 9 * 2 * K, tmpA, tmpB); ------------------ | | 8| 51|#define K (L/16) | | ------------------ | | | | 6| 51|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 51|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 85| | 86| 51| k2x4_eval_11(tmpA, a); 87| 51| k2x4_eval_11(tmpB, b); 88| 51| k2x4_basemul(eC + 8 * 9 * 2 * K, tmpA, tmpB); ------------------ | | 8| 51|#define K (L/16) | | ------------------ | | | | 6| 51|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 51|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 89| | 90| 51| k2x4_interpolate(ab, eC); 91| 51|} poly_rq_mul.c:k2x4_eval_00: 93| 102|static void k2x4_eval_00(uint16_t r[9 * K], const uint16_t a[L]) { 94| 35.1k| for (size_t i = 0; i < M; i++) { ------------------ | | 7| 35.1k|#define M (L/4) | | ------------------ | | | | 6| 35.1k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 35.1k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ | Branch (94:24): [True: 35.0k, False: 102] ------------------ 95| 35.0k| r[i] = a[i]; 96| 35.0k| } 97| 102| k2x2_eval(r); 98| 102|} poly_rq_mul.c:k2x4_basemul: 181| 459|static void k2x4_basemul(uint16_t r[18 * K], const uint16_t a[9 * K], const uint16_t b[9 * K]) { 182| 459| schoolbook_KxK(r + 0 * 2 * K, a + 0 * K, b + 0 * K); ------------------ | | 8| 459|#define K (L/16) | | ------------------ | | | | 6| 459|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 459|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ schoolbook_KxK(r + 0 * 2 * K, a + 0 * K, b + 0 * K); ------------------ | | 8| 459|#define K (L/16) | | ------------------ | | | | 6| 459|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 459|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ schoolbook_KxK(r + 0 * 2 * K, a + 0 * K, b + 0 * K); ------------------ | | 8| 459|#define K (L/16) | | ------------------ | | | | 6| 459|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 459|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 183| 459| schoolbook_KxK(r + 1 * 2 * K, a + 1 * K, b + 1 * K); ------------------ | | 8| 459|#define K (L/16) | | ------------------ | | | | 6| 459|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 459|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ schoolbook_KxK(r + 1 * 2 * K, a + 1 * K, b + 1 * K); ------------------ | | 8| 459|#define K (L/16) | | ------------------ | | | | 6| 459|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 459|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ schoolbook_KxK(r + 1 * 2 * K, a + 1 * K, b + 1 * K); ------------------ | | 8| 459|#define K (L/16) | | ------------------ | | | | 6| 459|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 459|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 184| 459| schoolbook_KxK(r + 2 * 2 * K, a + 2 * K, b + 2 * K); ------------------ | | 8| 459|#define K (L/16) | | ------------------ | | | | 6| 459|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 459|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ schoolbook_KxK(r + 2 * 2 * K, a + 2 * K, b + 2 * K); ------------------ | | 8| 459|#define K (L/16) | | ------------------ | | | | 6| 459|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 459|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ schoolbook_KxK(r + 2 * 2 * K, a + 2 * K, b + 2 * K); ------------------ | | 8| 459|#define K (L/16) | | ------------------ | | | | 6| 459|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 459|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 185| 459| schoolbook_KxK(r + 3 * 2 * K, a + 3 * K, b + 3 * K); ------------------ | | 8| 459|#define K (L/16) | | ------------------ | | | | 6| 459|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 459|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ schoolbook_KxK(r + 3 * 2 * K, a + 3 * K, b + 3 * K); ------------------ | | 8| 459|#define K (L/16) | | ------------------ | | | | 6| 459|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 459|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ schoolbook_KxK(r + 3 * 2 * K, a + 3 * K, b + 3 * K); ------------------ | | 8| 459|#define K (L/16) | | ------------------ | | | | 6| 459|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 459|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 186| 459| schoolbook_KxK(r + 4 * 2 * K, a + 4 * K, b + 4 * K); ------------------ | | 8| 459|#define K (L/16) | | ------------------ | | | | 6| 459|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 459|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ schoolbook_KxK(r + 4 * 2 * K, a + 4 * K, b + 4 * K); ------------------ | | 8| 459|#define K (L/16) | | ------------------ | | | | 6| 459|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 459|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ schoolbook_KxK(r + 4 * 2 * K, a + 4 * K, b + 4 * K); ------------------ | | 8| 459|#define K (L/16) | | ------------------ | | | | 6| 459|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 459|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 187| 459| schoolbook_KxK(r + 5 * 2 * K, a + 5 * K, b + 5 * K); ------------------ | | 8| 459|#define K (L/16) | | ------------------ | | | | 6| 459|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 459|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ schoolbook_KxK(r + 5 * 2 * K, a + 5 * K, b + 5 * K); ------------------ | | 8| 459|#define K (L/16) | | ------------------ | | | | 6| 459|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 459|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ schoolbook_KxK(r + 5 * 2 * K, a + 5 * K, b + 5 * K); ------------------ | | 8| 459|#define K (L/16) | | ------------------ | | | | 6| 459|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 459|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 188| 459| schoolbook_KxK(r + 6 * 2 * K, a + 6 * K, b + 6 * K); ------------------ | | 8| 459|#define K (L/16) | | ------------------ | | | | 6| 459|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 459|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ schoolbook_KxK(r + 6 * 2 * K, a + 6 * K, b + 6 * K); ------------------ | | 8| 459|#define K (L/16) | | ------------------ | | | | 6| 459|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 459|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ schoolbook_KxK(r + 6 * 2 * K, a + 6 * K, b + 6 * K); ------------------ | | 8| 459|#define K (L/16) | | ------------------ | | | | 6| 459|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 459|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 189| 459| schoolbook_KxK(r + 7 * 2 * K, a + 7 * K, b + 7 * K); ------------------ | | 8| 459|#define K (L/16) | | ------------------ | | | | 6| 459|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 459|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ schoolbook_KxK(r + 7 * 2 * K, a + 7 * K, b + 7 * K); ------------------ | | 8| 459|#define K (L/16) | | ------------------ | | | | 6| 459|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 459|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ schoolbook_KxK(r + 7 * 2 * K, a + 7 * K, b + 7 * K); ------------------ | | 8| 459|#define K (L/16) | | ------------------ | | | | 6| 459|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 459|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 190| 459| schoolbook_KxK(r + 8 * 2 * K, a + 8 * K, b + 8 * K); ------------------ | | 8| 459|#define K (L/16) | | ------------------ | | | | 6| 459|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 459|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ schoolbook_KxK(r + 8 * 2 * K, a + 8 * K, b + 8 * K); ------------------ | | 8| 459|#define K (L/16) | | ------------------ | | | | 6| 459|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 459|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ schoolbook_KxK(r + 8 * 2 * K, a + 8 * K, b + 8 * K); ------------------ | | 8| 459|#define K (L/16) | | ------------------ | | | | 6| 459|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 459|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 191| 459|} poly_rq_mul.c:k2x4_eval_0inf: 108| 102|static void k2x4_eval_0inf(uint16_t r[9 * K], const uint16_t a[L]) { 109| 35.1k| for (size_t i = 0; i < M; i++) { ------------------ | | 7| 35.1k|#define M (L/4) | | ------------------ | | | | 6| 35.1k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 35.1k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ | Branch (109:24): [True: 35.0k, False: 102] ------------------ 110| 35.0k| r[i] = a[1 * M + i]; ------------------ | | 7| 35.0k|#define M (L/4) | | ------------------ | | | | 6| 35.0k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 35.0k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 111| 35.0k| } 112| 102| k2x2_eval(r); 113| 102|} poly_rq_mul.c:k2x4_eval_inf0: 141| 102|static void k2x4_eval_inf0(uint16_t r[9 * K], const uint16_t a[L]) { 142| 35.1k| for (size_t i = 0; i < M; i++) { ------------------ | | 7| 35.1k|#define M (L/4) | | ------------------ | | | | 6| 35.1k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 35.1k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ | Branch (142:24): [True: 35.0k, False: 102] ------------------ 143| 35.0k| r[i] = a[2 * M + i]; ------------------ | | 7| 35.0k|#define M (L/4) | | ------------------ | | | | 6| 35.0k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 35.0k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 144| 35.0k| } 145| 102| k2x2_eval(r); 146| 102|} poly_rq_mul.c:k2x4_eval_infinf: 156| 102|static void k2x4_eval_infinf(uint16_t r[9 * K], const uint16_t a[L]) { 157| 35.1k| for (size_t i = 0; i < M; i++) { ------------------ | | 7| 35.1k|#define M (L/4) | | ------------------ | | | | 6| 35.1k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 35.1k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ | Branch (157:24): [True: 35.0k, False: 102] ------------------ 158| 35.0k| r[i] = a[3 * M + i]; ------------------ | | 7| 35.0k|#define M (L/4) | | ------------------ | | | | 6| 35.0k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 35.0k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 159| 35.0k| } 160| 102| k2x2_eval(r); 161| 102|} poly_rq_mul.c:k2x4_eval_01: 100| 102|static void k2x4_eval_01(uint16_t r[9 * K], const uint16_t a[L]) { 101| 35.1k| for (size_t i = 0; i < M; i++) { ------------------ | | 7| 35.1k|#define M (L/4) | | ------------------ | | | | 6| 35.1k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 35.1k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ | Branch (101:24): [True: 35.0k, False: 102] ------------------ 102| 35.0k| r[i] = a[0 * M + i]; ------------------ | | 7| 35.0k|#define M (L/4) | | ------------------ | | | | 6| 35.0k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 35.0k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 103| 35.0k| r[i] += a[1 * M + i]; ------------------ | | 7| 35.0k|#define M (L/4) | | ------------------ | | | | 6| 35.0k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 35.0k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 104| 35.0k| } 105| 102| k2x2_eval(r); 106| 102|} poly_rq_mul.c:k2x4_eval_1inf: 133| 102|static void k2x4_eval_1inf(uint16_t r[9 * K], const uint16_t a[L]) { 134| 35.1k| for (size_t i = 0; i < M; i++) { ------------------ | | 7| 35.1k|#define M (L/4) | | ------------------ | | | | 6| 35.1k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 35.1k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ | Branch (134:24): [True: 35.0k, False: 102] ------------------ 135| 35.0k| r[i] = a[1 * M + i]; ------------------ | | 7| 35.0k|#define M (L/4) | | ------------------ | | | | 6| 35.0k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 35.0k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 136| 35.0k| r[i] += a[3 * M + i]; ------------------ | | 7| 35.0k|#define M (L/4) | | ------------------ | | | | 6| 35.0k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 35.0k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 137| 35.0k| } 138| 102| k2x2_eval(r); 139| 102|} poly_rq_mul.c:k2x4_eval_10: 115| 102|static void k2x4_eval_10(uint16_t r[9 * K], const uint16_t a[L]) { 116| 35.1k| for (size_t i = 0; i < M; i++) { ------------------ | | 7| 35.1k|#define M (L/4) | | ------------------ | | | | 6| 35.1k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 35.1k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ | Branch (116:24): [True: 35.0k, False: 102] ------------------ 117| 35.0k| r[i] = a[0 * M + i]; ------------------ | | 7| 35.0k|#define M (L/4) | | ------------------ | | | | 6| 35.0k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 35.0k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 118| 35.0k| r[i] += a[2 * M + i]; ------------------ | | 7| 35.0k|#define M (L/4) | | ------------------ | | | | 6| 35.0k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 35.0k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 119| 35.0k| } 120| 102| k2x2_eval(r); 121| 102|} poly_rq_mul.c:k2x4_eval_inf1: 148| 102|static void k2x4_eval_inf1(uint16_t r[9 * K], const uint16_t a[L]) { 149| 35.1k| for (size_t i = 0; i < M; i++) { ------------------ | | 7| 35.1k|#define M (L/4) | | ------------------ | | | | 6| 35.1k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 35.1k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ | Branch (149:24): [True: 35.0k, False: 102] ------------------ 150| 35.0k| r[i] = a[2 * M + i]; ------------------ | | 7| 35.0k|#define M (L/4) | | ------------------ | | | | 6| 35.0k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 35.0k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 151| 35.0k| r[i] += a[3 * M + i]; ------------------ | | 7| 35.0k|#define M (L/4) | | ------------------ | | | | 6| 35.0k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 35.0k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 152| 35.0k| } 153| 102| k2x2_eval(r); 154| 102|} poly_rq_mul.c:k2x4_eval_11: 123| 102|static void k2x4_eval_11(uint16_t r[9 * K], const uint16_t a[L]) { 124| 35.1k| for (size_t i = 0; i < M; i++) { ------------------ | | 7| 35.1k|#define M (L/4) | | ------------------ | | | | 6| 35.1k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 35.1k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ | Branch (124:24): [True: 35.0k, False: 102] ------------------ 125| 35.0k| r[i] = a[0 * M + i]; ------------------ | | 7| 35.0k|#define M (L/4) | | ------------------ | | | | 6| 35.0k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 35.0k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 126| 35.0k| r[i] += a[1 * M + i]; ------------------ | | 7| 35.0k|#define M (L/4) | | ------------------ | | | | 6| 35.0k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 35.0k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 127| 35.0k| r[i] += a[2 * M + i]; ------------------ | | 7| 35.0k|#define M (L/4) | | ------------------ | | | | 6| 35.0k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 35.0k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 128| 35.0k| r[i] += a[3 * M + i]; ------------------ | | 7| 35.0k|#define M (L/4) | | ------------------ | | | | 6| 35.0k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 35.0k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 129| 35.0k| } 130| 102| k2x2_eval(r); 131| 102|} poly_rq_mul.c:k2x4_interpolate: 207| 51|static void k2x4_interpolate(uint16_t r[2 * L], const uint16_t a[81 * 2 * K]) { 208| 51| size_t i; 209| | 210| 51| uint16_t tmp[4 * M]; 211| | 212| 51| uint16_t P1[2 * M]; 213| 51| uint16_t P2[2 * M]; 214| 51| uint16_t P3[2 * M]; 215| | 216| 51| k2x2_interpolate(P1, a + 0 * 9 * 2 * K); ------------------ | | 8| 51|#define K (L/16) | | ------------------ | | | | 6| 51|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 51|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 217| 51| k2x2_interpolate(P2, a + 1 * 9 * 2 * K); ------------------ | | 8| 51|#define K (L/16) | | ------------------ | | | | 6| 51|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 51|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 218| 51| k2x2_interpolate(P3, a + 4 * 9 * 2 * K); ------------------ | | 8| 51|#define K (L/16) | | ------------------ | | | | 6| 51|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 51|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 219| 35.1k| for (i = 0; i < 2 * M; i++) { ------------------ | | 7| 35.1k|#define M (L/4) | | ------------------ | | | | 6| 35.1k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 35.1k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ | Branch (219:17): [True: 35.0k, False: 51] ------------------ 220| 35.0k| r[0 * M + i] = P1[i]; ------------------ | | 7| 35.0k|#define M (L/4) | | ------------------ | | | | 6| 35.0k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 35.0k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 221| 35.0k| r[2 * M + i] = P2[i]; ------------------ | | 7| 35.0k|#define M (L/4) | | ------------------ | | | | 6| 35.0k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 35.0k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 222| 35.0k| } 223| | 224| 35.1k| for (i = 0; i < 2 * M; i++) { ------------------ | | 7| 35.1k|#define M (L/4) | | ------------------ | | | | 6| 35.1k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 35.1k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ | Branch (224:17): [True: 35.0k, False: 51] ------------------ 225| 35.0k| r[1 * M + i] += P3[i] - P1[i] - P2[i]; ------------------ | | 7| 35.0k|#define M (L/4) | | ------------------ | | | | 6| 35.0k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 35.0k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 226| 35.0k| } 227| | 228| 51| k2x2_interpolate(P1, a + 2 * 9 * 2 * K); ------------------ | | 8| 51|#define K (L/16) | | ------------------ | | | | 6| 51|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 51|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 229| 51| k2x2_interpolate(P2, a + 3 * 9 * 2 * K); ------------------ | | 8| 51|#define K (L/16) | | ------------------ | | | | 6| 51|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 51|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 230| 51| k2x2_interpolate(P3, a + 7 * 9 * 2 * K); ------------------ | | 8| 51|#define K (L/16) | | ------------------ | | | | 6| 51|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 51|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 231| 35.1k| for (i = 0; i < 2 * M; i++) { ------------------ | | 7| 35.1k|#define M (L/4) | | ------------------ | | | | 6| 35.1k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 35.1k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ | Branch (231:17): [True: 35.0k, False: 51] ------------------ 232| 35.0k| r[4 * M + i] = P1[i]; ------------------ | | 7| 35.0k|#define M (L/4) | | ------------------ | | | | 6| 35.0k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 35.0k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 233| 35.0k| r[6 * M + i] = P2[i]; ------------------ | | 7| 35.0k|#define M (L/4) | | ------------------ | | | | 6| 35.0k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 35.0k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 234| 35.0k| } 235| | 236| 35.1k| for (i = 0; i < 2 * M; i++) { ------------------ | | 7| 35.1k|#define M (L/4) | | ------------------ | | | | 6| 35.1k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 35.1k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ | Branch (236:17): [True: 35.0k, False: 51] ------------------ 237| 35.0k| r[5 * M + i] += P3[i] - P1[i] - P2[i]; ------------------ | | 7| 35.0k|#define M (L/4) | | ------------------ | | | | 6| 35.0k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 35.0k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 238| 35.0k| } 239| | 240| 51| k2x2_interpolate(P1, a + 6 * 9 * 2 * K); ------------------ | | 8| 51|#define K (L/16) | | ------------------ | | | | 6| 51|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 51|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 241| 51| k2x2_interpolate(P2, a + 5 * 9 * 2 * K); ------------------ | | 8| 51|#define K (L/16) | | ------------------ | | | | 6| 51|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 51|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 242| 51| k2x2_interpolate(P3, a + 8 * 9 * 2 * K); ------------------ | | 8| 51|#define K (L/16) | | ------------------ | | | | 6| 51|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 51|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 243| 35.1k| for (i = 0; i < 2 * M; i++) { ------------------ | | 7| 35.1k|#define M (L/4) | | ------------------ | | | | 6| 35.1k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 35.1k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ | Branch (243:17): [True: 35.0k, False: 51] ------------------ 244| 35.0k| tmp[0 * M + i] = P1[i]; ------------------ | | 7| 35.0k|#define M (L/4) | | ------------------ | | | | 6| 35.0k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 35.0k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 245| 35.0k| tmp[2 * M + i] = P2[i]; ------------------ | | 7| 35.0k|#define M (L/4) | | ------------------ | | | | 6| 35.0k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 35.0k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 246| 35.0k| } 247| | 248| 35.1k| for (i = 0; i < 2 * M; i++) { ------------------ | | 7| 35.1k|#define M (L/4) | | ------------------ | | | | 6| 35.1k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 35.1k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ | Branch (248:17): [True: 35.0k, False: 51] ------------------ 249| 35.0k| tmp[1 * M + i] += P3[i] - P1[i] - P2[i]; ------------------ | | 7| 35.0k|#define M (L/4) | | ------------------ | | | | 6| 35.0k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 35.0k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 250| 35.0k| } 251| | 252| 70.2k| for (i = 0; i < 4 * M; i++) { ------------------ | | 7| 70.2k|#define M (L/4) | | ------------------ | | | | 6| 70.2k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 70.2k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ | Branch (252:17): [True: 70.1k, False: 51] ------------------ 253| 70.1k| tmp[0 * M + i] = tmp[0 * M + i] - r[0 * M + i] - r[4 * M + i]; ------------------ | | 7| 70.1k|#define M (L/4) | | ------------------ | | | | 6| 70.1k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 70.1k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ tmp[0 * M + i] = tmp[0 * M + i] - r[0 * M + i] - r[4 * M + i]; ------------------ | | 7| 70.1k|#define M (L/4) | | ------------------ | | | | 6| 70.1k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 70.1k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ tmp[0 * M + i] = tmp[0 * M + i] - r[0 * M + i] - r[4 * M + i]; ------------------ | | 7| 70.1k|#define M (L/4) | | ------------------ | | | | 6| 70.1k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 70.1k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ tmp[0 * M + i] = tmp[0 * M + i] - r[0 * M + i] - r[4 * M + i]; ------------------ | | 7| 70.1k|#define M (L/4) | | ------------------ | | | | 6| 70.1k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 70.1k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 254| 70.1k| } 255| | 256| 70.2k| for (i = 0; i < 4 * M; i++) { ------------------ | | 7| 70.2k|#define M (L/4) | | ------------------ | | | | 6| 70.2k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 70.2k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ | Branch (256:17): [True: 70.1k, False: 51] ------------------ 257| 70.1k| r[2 * M + i] += tmp[0 * M + i]; ------------------ | | 7| 70.1k|#define M (L/4) | | ------------------ | | | | 6| 70.1k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 70.1k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ r[2 * M + i] += tmp[0 * M + i]; ------------------ | | 7| 70.1k|#define M (L/4) | | ------------------ | | | | 6| 70.1k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 70.1k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 258| 70.1k| } 259| 51|} PQCLEAN_NTRUHRSS1373_CLEAN_poly_S3_inv: 18| 3|void PQCLEAN_NTRUHRSS1373_CLEAN_poly_S3_inv(poly *r, const poly *a) { 19| 3| poly f, g, v, w; 20| 3| size_t i, loop; 21| 3| int16_t delta, sign, swap, t; 22| | 23| 4.12k| for (i = 0; i < NTRU_N; ++i) { ------------------ | | 5| 4.12k|#define NTRU_N 1373 ------------------ | Branch (23:17): [True: 4.11k, False: 3] ------------------ 24| 4.11k| v.coeffs[i] = 0; 25| 4.11k| } 26| 4.12k| for (i = 0; i < NTRU_N; ++i) { ------------------ | | 5| 4.12k|#define NTRU_N 1373 ------------------ | Branch (26:17): [True: 4.11k, False: 3] ------------------ 27| 4.11k| w.coeffs[i] = 0; 28| 4.11k| } 29| 3| w.coeffs[0] = 1; 30| | 31| 4.12k| for (i = 0; i < NTRU_N; ++i) { ------------------ | | 5| 4.12k|#define NTRU_N 1373 ------------------ | Branch (31:17): [True: 4.11k, False: 3] ------------------ 32| 4.11k| f.coeffs[i] = 1; 33| 4.11k| } 34| 4.11k| for (i = 0; i < NTRU_N - 1; ++i) { ------------------ | | 5| 4.11k|#define NTRU_N 1373 ------------------ | Branch (34:17): [True: 4.11k, False: 3] ------------------ 35| 4.11k| g.coeffs[NTRU_N - 2 - i] = mod3((a->coeffs[i] & 3) + 2 * (a->coeffs[NTRU_N - 1] & 3)); ------------------ | | 5| 4.11k|#define NTRU_N 1373 ------------------ g.coeffs[NTRU_N - 2 - i] = mod3((a->coeffs[i] & 3) + 2 * (a->coeffs[NTRU_N - 1] & 3)); ------------------ | | 5| 4.11k|#define NTRU_N 1373 ------------------ 36| 4.11k| } 37| 3| g.coeffs[NTRU_N - 1] = 0; ------------------ | | 5| 3|#define NTRU_N 1373 ------------------ 38| | 39| 3| delta = 1; 40| | 41| 8.23k| for (loop = 0; loop < 2 * (NTRU_N - 1) - 1; ++loop) { ------------------ | | 5| 8.23k|#define NTRU_N 1373 ------------------ | Branch (41:20): [True: 8.22k, False: 3] ------------------ 42| 11.2M| for (i = NTRU_N - 1; i > 0; --i) { ------------------ | | 5| 8.22k|#define NTRU_N 1373 ------------------ | Branch (42:30): [True: 11.2M, False: 8.22k] ------------------ 43| 11.2M| v.coeffs[i] = v.coeffs[i - 1]; 44| 11.2M| } 45| 8.22k| v.coeffs[0] = 0; 46| | 47| 8.22k| sign = mod3((uint8_t) (2 * g.coeffs[0] * f.coeffs[0])); 48| 8.22k| swap = both_negative_mask(-delta, -(int16_t) g.coeffs[0]); 49| 8.22k| delta ^= swap & (delta ^ -delta); 50| 8.22k| delta += 1; 51| | 52| 11.3M| for (i = 0; i < NTRU_N; ++i) { ------------------ | | 5| 11.3M|#define NTRU_N 1373 ------------------ | Branch (52:21): [True: 11.2M, False: 8.22k] ------------------ 53| 11.2M| t = swap & (f.coeffs[i] ^ g.coeffs[i]); 54| 11.2M| f.coeffs[i] ^= t; 55| 11.2M| g.coeffs[i] ^= t; 56| 11.2M| t = swap & (v.coeffs[i] ^ w.coeffs[i]); 57| 11.2M| v.coeffs[i] ^= t; 58| 11.2M| w.coeffs[i] ^= t; 59| 11.2M| } 60| | 61| 11.3M| for (i = 0; i < NTRU_N; ++i) { ------------------ | | 5| 11.3M|#define NTRU_N 1373 ------------------ | Branch (61:21): [True: 11.2M, False: 8.22k] ------------------ 62| 11.2M| g.coeffs[i] = mod3((uint8_t) (g.coeffs[i] + sign * f.coeffs[i])); 63| 11.2M| } 64| 11.3M| for (i = 0; i < NTRU_N; ++i) { ------------------ | | 5| 11.3M|#define NTRU_N 1373 ------------------ | Branch (64:21): [True: 11.2M, False: 8.22k] ------------------ 65| 11.2M| w.coeffs[i] = mod3((uint8_t) (w.coeffs[i] + sign * v.coeffs[i])); 66| 11.2M| } 67| 11.2M| for (i = 0; i < NTRU_N - 1; ++i) { ------------------ | | 5| 11.2M|#define NTRU_N 1373 ------------------ | Branch (67:21): [True: 11.2M, False: 8.22k] ------------------ 68| 11.2M| g.coeffs[i] = g.coeffs[i + 1]; 69| 11.2M| } 70| 8.22k| g.coeffs[NTRU_N - 1] = 0; ------------------ | | 5| 8.22k|#define NTRU_N 1373 ------------------ 71| 8.22k| } 72| | 73| 3| sign = f.coeffs[0]; 74| 4.11k| for (i = 0; i < NTRU_N - 1; ++i) { ------------------ | | 5| 4.11k|#define NTRU_N 1373 ------------------ | Branch (74:17): [True: 4.11k, False: 3] ------------------ 75| 4.11k| r->coeffs[i] = mod3((uint8_t) (sign * v.coeffs[NTRU_N - 2 - i])); ------------------ | | 5| 4.11k|#define NTRU_N 1373 ------------------ 76| 4.11k| } 77| 3| r->coeffs[NTRU_N - 1] = 0; ------------------ | | 5| 3|#define NTRU_N 1373 ------------------ 78| 3|} PQCLEAN_NTRUHRSS1373_CLEAN_sample_fg: 3| 3|void PQCLEAN_NTRUHRSS1373_CLEAN_sample_fg(poly *f, poly *g, const unsigned char uniformbytes[NTRU_SAMPLE_FG_BYTES]) { 4| 3| PQCLEAN_NTRUHRSS1373_CLEAN_sample_iid_plus(f, uniformbytes); 5| 3| PQCLEAN_NTRUHRSS1373_CLEAN_sample_iid_plus(g, uniformbytes + NTRU_SAMPLE_IID_BYTES); ------------------ | | 19| 3|#define NTRU_SAMPLE_IID_BYTES (NTRU_N-1) | | ------------------ | | | | 5| 3|#define NTRU_N 1373 | | ------------------ ------------------ 6| | 7| 3|} PQCLEAN_NTRUHRSS1373_CLEAN_sample_rm: 9| 3|void PQCLEAN_NTRUHRSS1373_CLEAN_sample_rm(poly *r, poly *m, const unsigned char uniformbytes[NTRU_SAMPLE_RM_BYTES]) { 10| 3| PQCLEAN_NTRUHRSS1373_CLEAN_sample_iid(r, uniformbytes); 11| 3| PQCLEAN_NTRUHRSS1373_CLEAN_sample_iid(m, uniformbytes + NTRU_SAMPLE_IID_BYTES); ------------------ | | 19| 3|#define NTRU_SAMPLE_IID_BYTES (NTRU_N-1) | | ------------------ | | | | 5| 3|#define NTRU_N 1373 | | ------------------ ------------------ 12| | 13| 3|} PQCLEAN_NTRUHRSS1373_CLEAN_sample_iid_plus: 15| 6|void PQCLEAN_NTRUHRSS1373_CLEAN_sample_iid_plus(poly *r, const unsigned char uniformbytes[NTRU_SAMPLE_IID_BYTES]) { 16| | /* Sample r using PQCLEAN_NTRUHRSS1373_CLEAN_sample_iid then conditionally flip */ 17| | /* signs of even index coefficients so that >= 0. */ 18| | 19| 6| int i; 20| 6| uint16_t s = 0; 21| | 22| 6| PQCLEAN_NTRUHRSS1373_CLEAN_sample_iid(r, uniformbytes); 23| | 24| | /* Map {0,1,2} -> {0, 1, 2^16 - 1} */ 25| 8.23k| for (i = 0; i < NTRU_N - 1; i++) { ------------------ | | 5| 8.23k|#define NTRU_N 1373 ------------------ | Branch (25:17): [True: 8.23k, False: 6] ------------------ 26| 8.23k| r->coeffs[i] = r->coeffs[i] | (-(r->coeffs[i] >> 1)); 27| 8.23k| } 28| | 29| | /* s = . (r[n-1] = 0) */ 30| 8.23k| for (i = 0; i < NTRU_N - 1; i++) { ------------------ | | 5| 8.23k|#define NTRU_N 1373 ------------------ | Branch (30:17): [True: 8.23k, False: 6] ------------------ 31| 8.23k| s += (uint16_t)((uint32_t)r->coeffs[i + 1] * (uint32_t)r->coeffs[i]); 32| 8.23k| } 33| | 34| | /* Extract sign of s (sign(0) = 1) */ 35| 6| s = 1 | (-(s >> 15)); 36| | 37| 4.12k| for (i = 0; i < NTRU_N; i += 2) { ------------------ | | 5| 4.12k|#define NTRU_N 1373 ------------------ | Branch (37:17): [True: 4.12k, False: 6] ------------------ 38| 4.12k| r->coeffs[i] = (uint16_t)((uint32_t)s * (uint32_t)r->coeffs[i]); 39| 4.12k| } 40| | 41| | /* Map {0,1,2^16-1} -> {0, 1, 2} */ 42| 8.24k| for (i = 0; i < NTRU_N; i++) { ------------------ | | 5| 8.24k|#define NTRU_N 1373 ------------------ | Branch (42:17): [True: 8.23k, False: 6] ------------------ 43| 8.23k| r->coeffs[i] = 3 & (r->coeffs[i] ^ (r->coeffs[i] >> 15)); 44| 8.23k| } 45| 6|} PQCLEAN_NTRUHRSS1373_CLEAN_sample_iid: 18| 12|void PQCLEAN_NTRUHRSS1373_CLEAN_sample_iid(poly *r, const unsigned char uniformbytes[NTRU_SAMPLE_IID_BYTES]) { 19| 12| int i; 20| | /* {0,1,...,255} -> {0,1,2}; Pr[0] = 86/256, Pr[1] = Pr[-1] = 85/256 */ 21| 16.4k| for (i = 0; i < NTRU_N - 1; i++) { ------------------ | | 5| 16.4k|#define NTRU_N 1373 ------------------ | Branch (21:17): [True: 16.4k, False: 12] ------------------ 22| 16.4k| r->coeffs[i] = mod3(uniformbytes[i]); 23| 16.4k| } 24| | 25| 12| r->coeffs[NTRU_N - 1] = 0; ------------------ | | 5| 12|#define NTRU_N 1373 ------------------ 26| 12|} PQCLEAN_NTRUHRSS701_AVX2_cmov: 4| 6|void PQCLEAN_NTRUHRSS701_AVX2_cmov(unsigned char *r, const unsigned char *x, size_t len, unsigned char b) { 5| 6| size_t i; 6| | 7| 6| b = (~b + 1); 8| 198| for (i = 0; i < len; i++) { ------------------ | Branch (8:17): [True: 192, False: 6] ------------------ 9| 192| r[i] ^= b & (x[i] ^ r[i]); 10| 192| } 11| 6|} PQCLEAN_NTRUHRSS701_AVX2_crypto_kem_keypair: 10| 6|int PQCLEAN_NTRUHRSS701_AVX2_crypto_kem_keypair(uint8_t *pk, uint8_t *sk) { 11| 6| uint8_t seed[NTRU_SAMPLE_FG_BYTES]; 12| | 13| 6| randombytes(seed, NTRU_SAMPLE_FG_BYTES); ------------------ | | 8| 6|#define randombytes OQS_randombytes ------------------ randombytes(seed, NTRU_SAMPLE_FG_BYTES); ------------------ | | 20| 6|#define NTRU_SAMPLE_FG_BYTES (2*NTRU_SAMPLE_IID_BYTES) | | ------------------ | | | | 19| 6|#define NTRU_SAMPLE_IID_BYTES (NTRU_N-1) | | | | ------------------ | | | | | | 5| 6|#define NTRU_N 701 | | | | ------------------ | | ------------------ ------------------ 14| 6| PQCLEAN_NTRUHRSS701_AVX2_owcpa_keypair(pk, sk, seed); 15| | 16| 6| randombytes(sk + NTRU_OWCPA_SECRETKEYBYTES, NTRU_PRFKEYBYTES); ------------------ | | 8| 6|#define randombytes OQS_randombytes ------------------ randombytes(sk + NTRU_OWCPA_SECRETKEYBYTES, NTRU_PRFKEYBYTES); ------------------ | | 28| 6|#define NTRU_OWCPA_SECRETKEYBYTES (2*NTRU_PACK_TRINARY_BYTES + NTRU_OWCPA_PUBLICKEYBYTES) | | ------------------ | | | | 24| 6|#define NTRU_PACK_TRINARY_BYTES ((NTRU_PACK_DEG+4)/5) | | | | ------------------ | | | | | | 23| 6|#define NTRU_PACK_DEG (NTRU_N-1) | | | | | | ------------------ | | | | | | | | 5| 6|#define NTRU_N 701 | | | | | | ------------------ | | | | ------------------ | | ------------------ | | #define NTRU_OWCPA_SECRETKEYBYTES (2*NTRU_PACK_TRINARY_BYTES + NTRU_OWCPA_PUBLICKEYBYTES) | | ------------------ | | | | 27| 6|#define NTRU_OWCPA_PUBLICKEYBYTES ((NTRU_LOGQ*NTRU_PACK_DEG+7)/8) | | | | ------------------ | | | | | | 6| 6|#define NTRU_LOGQ 13 | | | | ------------------ | | | | #define NTRU_OWCPA_PUBLICKEYBYTES ((NTRU_LOGQ*NTRU_PACK_DEG+7)/8) | | | | ------------------ | | | | | | 23| 6|#define NTRU_PACK_DEG (NTRU_N-1) | | | | | | ------------------ | | | | | | | | 5| 6|#define NTRU_N 701 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ randombytes(sk + NTRU_OWCPA_SECRETKEYBYTES, NTRU_PRFKEYBYTES); ------------------ | | 16| 6|#define NTRU_PRFKEYBYTES 32 ------------------ 17| | 18| 6| return 0; 19| 6|} PQCLEAN_NTRUHRSS701_AVX2_crypto_kem_enc: 21| 6|int PQCLEAN_NTRUHRSS701_AVX2_crypto_kem_enc(uint8_t *c, uint8_t *k, const uint8_t *pk) { 22| 6| poly r, m; 23| 6| uint8_t rm[NTRU_OWCPA_MSGBYTES]; 24| 6| uint8_t rm_seed[NTRU_SAMPLE_RM_BYTES]; 25| | 26| 6| randombytes(rm_seed, NTRU_SAMPLE_RM_BYTES); ------------------ | | 8| 6|#define randombytes OQS_randombytes ------------------ randombytes(rm_seed, NTRU_SAMPLE_RM_BYTES); ------------------ | | 21| 6|#define NTRU_SAMPLE_RM_BYTES (2*NTRU_SAMPLE_IID_BYTES) | | ------------------ | | | | 19| 6|#define NTRU_SAMPLE_IID_BYTES (NTRU_N-1) | | | | ------------------ | | | | | | 5| 6|#define NTRU_N 701 | | | | ------------------ | | ------------------ ------------------ 27| | 28| 6| PQCLEAN_NTRUHRSS701_AVX2_sample_rm(&r, &m, rm_seed); 29| | 30| 6| PQCLEAN_NTRUHRSS701_AVX2_poly_S3_tobytes(rm, &r); 31| 6| PQCLEAN_NTRUHRSS701_AVX2_poly_S3_tobytes(rm + NTRU_PACK_TRINARY_BYTES, &m); ------------------ | | 24| 6|#define NTRU_PACK_TRINARY_BYTES ((NTRU_PACK_DEG+4)/5) | | ------------------ | | | | 23| 6|#define NTRU_PACK_DEG (NTRU_N-1) | | | | ------------------ | | | | | | 5| 6|#define NTRU_N 701 | | | | ------------------ | | ------------------ ------------------ 32| 6| sha3_256(k, rm, NTRU_OWCPA_MSGBYTES); ------------------ | | 15| 6|#define sha3_256 OQS_SHA3_sha3_256 ------------------ sha3_256(k, rm, NTRU_OWCPA_MSGBYTES); ------------------ | | 26| 6|#define NTRU_OWCPA_MSGBYTES (2*NTRU_PACK_TRINARY_BYTES) | | ------------------ | | | | 24| 6|#define NTRU_PACK_TRINARY_BYTES ((NTRU_PACK_DEG+4)/5) | | | | ------------------ | | | | | | 23| 6|#define NTRU_PACK_DEG (NTRU_N-1) | | | | | | ------------------ | | | | | | | | 5| 6|#define NTRU_N 701 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 33| | 34| 6| PQCLEAN_NTRUHRSS701_AVX2_poly_Z3_to_Zq(&r); 35| 6| PQCLEAN_NTRUHRSS701_AVX2_owcpa_enc(c, &r, &m, pk); 36| | 37| 6| return 0; 38| 6|} PQCLEAN_NTRUHRSS701_AVX2_crypto_kem_dec: 40| 6|int PQCLEAN_NTRUHRSS701_AVX2_crypto_kem_dec(uint8_t *k, const uint8_t *c, const uint8_t *sk) { 41| 6| int i, fail; 42| 6| uint8_t rm[NTRU_OWCPA_MSGBYTES]; 43| 6| uint8_t buf[NTRU_PRFKEYBYTES + NTRU_CIPHERTEXTBYTES]; 44| | 45| 6| fail = PQCLEAN_NTRUHRSS701_AVX2_owcpa_dec(rm, c, sk); 46| | /* If fail = 0 then c = Enc(h, rm). There is no need to re-encapsulate. */ 47| | /* See comment in PQCLEAN_NTRUHRSS701_AVX2_owcpa_dec for details. */ 48| | 49| 6| sha3_256(k, rm, NTRU_OWCPA_MSGBYTES); ------------------ | | 15| 6|#define sha3_256 OQS_SHA3_sha3_256 ------------------ sha3_256(k, rm, NTRU_OWCPA_MSGBYTES); ------------------ | | 26| 6|#define NTRU_OWCPA_MSGBYTES (2*NTRU_PACK_TRINARY_BYTES) | | ------------------ | | | | 24| 6|#define NTRU_PACK_TRINARY_BYTES ((NTRU_PACK_DEG+4)/5) | | | | ------------------ | | | | | | 23| 6|#define NTRU_PACK_DEG (NTRU_N-1) | | | | | | ------------------ | | | | | | | | 5| 6|#define NTRU_N 701 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 50| | 51| | /* shake(secret PRF key || input ciphertext) */ 52| 198| for (i = 0; i < NTRU_PRFKEYBYTES; i++) { ------------------ | | 16| 198|#define NTRU_PRFKEYBYTES 32 ------------------ | Branch (52:17): [True: 192, False: 6] ------------------ 53| 192| buf[i] = sk[i + NTRU_OWCPA_SECRETKEYBYTES]; ------------------ | | 28| 192|#define NTRU_OWCPA_SECRETKEYBYTES (2*NTRU_PACK_TRINARY_BYTES + NTRU_OWCPA_PUBLICKEYBYTES) | | ------------------ | | | | 24| 192|#define NTRU_PACK_TRINARY_BYTES ((NTRU_PACK_DEG+4)/5) | | | | ------------------ | | | | | | 23| 192|#define NTRU_PACK_DEG (NTRU_N-1) | | | | | | ------------------ | | | | | | | | 5| 192|#define NTRU_N 701 | | | | | | ------------------ | | | | ------------------ | | ------------------ | | #define NTRU_OWCPA_SECRETKEYBYTES (2*NTRU_PACK_TRINARY_BYTES + NTRU_OWCPA_PUBLICKEYBYTES) | | ------------------ | | | | 27| 192|#define NTRU_OWCPA_PUBLICKEYBYTES ((NTRU_LOGQ*NTRU_PACK_DEG+7)/8) | | | | ------------------ | | | | | | 6| 192|#define NTRU_LOGQ 13 | | | | ------------------ | | | | #define NTRU_OWCPA_PUBLICKEYBYTES ((NTRU_LOGQ*NTRU_PACK_DEG+7)/8) | | | | ------------------ | | | | | | 23| 192|#define NTRU_PACK_DEG (NTRU_N-1) | | | | | | ------------------ | | | | | | | | 5| 192|#define NTRU_N 701 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 54| 192| } 55| 6.83k| for (i = 0; i < NTRU_CIPHERTEXTBYTES; i++) { ------------------ | | 33| 6.83k|#define NTRU_CIPHERTEXTBYTES (NTRU_OWCPA_BYTES) | | ------------------ | | | | 29| 6.83k|#define NTRU_OWCPA_BYTES ((NTRU_LOGQ*NTRU_PACK_DEG+7)/8) | | | | ------------------ | | | | | | 6| 6.83k|#define NTRU_LOGQ 13 | | | | ------------------ | | | | #define NTRU_OWCPA_BYTES ((NTRU_LOGQ*NTRU_PACK_DEG+7)/8) | | | | ------------------ | | | | | | 23| 6.83k|#define NTRU_PACK_DEG (NTRU_N-1) | | | | | | ------------------ | | | | | | | | 5| 6.83k|#define NTRU_N 701 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ | Branch (55:17): [True: 6.82k, False: 6] ------------------ 56| 6.82k| buf[NTRU_PRFKEYBYTES + i] = c[i]; ------------------ | | 16| 6.82k|#define NTRU_PRFKEYBYTES 32 ------------------ 57| 6.82k| } 58| 6| sha3_256(rm, buf, NTRU_PRFKEYBYTES + NTRU_CIPHERTEXTBYTES); ------------------ | | 15| 6|#define sha3_256 OQS_SHA3_sha3_256 ------------------ sha3_256(rm, buf, NTRU_PRFKEYBYTES + NTRU_CIPHERTEXTBYTES); ------------------ | | 16| 6|#define NTRU_PRFKEYBYTES 32 ------------------ sha3_256(rm, buf, NTRU_PRFKEYBYTES + NTRU_CIPHERTEXTBYTES); ------------------ | | 33| 6|#define NTRU_CIPHERTEXTBYTES (NTRU_OWCPA_BYTES) | | ------------------ | | | | 29| 6|#define NTRU_OWCPA_BYTES ((NTRU_LOGQ*NTRU_PACK_DEG+7)/8) | | | | ------------------ | | | | | | 6| 6|#define NTRU_LOGQ 13 | | | | ------------------ | | | | #define NTRU_OWCPA_BYTES ((NTRU_LOGQ*NTRU_PACK_DEG+7)/8) | | | | ------------------ | | | | | | 23| 6|#define NTRU_PACK_DEG (NTRU_N-1) | | | | | | ------------------ | | | | | | | | 5| 6|#define NTRU_N 701 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 59| | 60| 6| PQCLEAN_NTRUHRSS701_AVX2_cmov(k, rm, NTRU_SHAREDKEYBYTES, (unsigned char) fail); ------------------ | | 17| 6|#define NTRU_SHAREDKEYBYTES 32 ------------------ 61| | 62| 6| return 0; 63| 6|} PQCLEAN_NTRUHRSS701_AVX2_owcpa_keypair: 41| 6| const unsigned char seed[NTRU_SAMPLE_FG_BYTES]) { 42| 6| int i; 43| | 44| 6| poly x1, x2, x3, x4, x5; 45| | 46| 6| poly *f = &x1, *g = &x2, *invf_mod3 = &x3; 47| 6| poly *gf = &x3, *invgf = &x4, *tmp = &x5; 48| 6| poly *invh = &x3, *h = &x3; 49| | 50| 6| PQCLEAN_NTRUHRSS701_AVX2_sample_fg(f, g, seed); 51| | 52| 6| PQCLEAN_NTRUHRSS701_AVX2_poly_S3_inv(invf_mod3, f); 53| 6| PQCLEAN_NTRUHRSS701_AVX2_poly_S3_tobytes(sk, f); 54| 6| PQCLEAN_NTRUHRSS701_AVX2_poly_S3_tobytes(sk + NTRU_PACK_TRINARY_BYTES, invf_mod3); ------------------ | | 24| 6|#define NTRU_PACK_TRINARY_BYTES ((NTRU_PACK_DEG+4)/5) | | ------------------ | | | | 23| 6|#define NTRU_PACK_DEG (NTRU_N-1) | | | | ------------------ | | | | | | 5| 6|#define NTRU_N 701 | | | | ------------------ | | ------------------ ------------------ 55| | 56| | /* Lift coeffs of f and g from Z_p to Z_q */ 57| 6| PQCLEAN_NTRUHRSS701_AVX2_poly_Z3_to_Zq(f); 58| 6| PQCLEAN_NTRUHRSS701_AVX2_poly_Z3_to_Zq(g); 59| | 60| | /* g = 3*(x-1)*g */ 61| 4.20k| for (i = NTRU_N - 1; i > 0; i--) { ------------------ | | 5| 6|#define NTRU_N 701 ------------------ | Branch (61:26): [True: 4.20k, False: 6] ------------------ 62| 4.20k| g->coeffs[i] = 3 * (g->coeffs[i - 1] - g->coeffs[i]); 63| 4.20k| } 64| 6| g->coeffs[0] = -(3 * g->coeffs[0]); 65| | 66| | 67| 6| PQCLEAN_NTRUHRSS701_AVX2_poly_Rq_mul(gf, g, f); 68| | 69| 6| PQCLEAN_NTRUHRSS701_AVX2_poly_Rq_inv(invgf, gf); 70| | 71| 6| PQCLEAN_NTRUHRSS701_AVX2_poly_Rq_mul(tmp, invgf, f); 72| 6| PQCLEAN_NTRUHRSS701_AVX2_poly_Sq_mul(invh, tmp, f); 73| 6| PQCLEAN_NTRUHRSS701_AVX2_poly_Sq_tobytes(sk + 2 * NTRU_PACK_TRINARY_BYTES, invh); ------------------ | | 24| 6|#define NTRU_PACK_TRINARY_BYTES ((NTRU_PACK_DEG+4)/5) | | ------------------ | | | | 23| 6|#define NTRU_PACK_DEG (NTRU_N-1) | | | | ------------------ | | | | | | 5| 6|#define NTRU_N 701 | | | | ------------------ | | ------------------ ------------------ 74| | 75| 6| PQCLEAN_NTRUHRSS701_AVX2_poly_Rq_mul(tmp, invgf, g); 76| 6| PQCLEAN_NTRUHRSS701_AVX2_poly_Rq_mul(h, tmp, g); 77| 6| PQCLEAN_NTRUHRSS701_AVX2_poly_Rq_sum_zero_tobytes(pk, h); 78| 6|} PQCLEAN_NTRUHRSS701_AVX2_owcpa_enc: 84| 6| const unsigned char *pk) { 85| 6| int i; 86| 6| poly x1, x2; 87| 6| poly *h = &x1, *liftm = &x1; 88| 6| poly *ct = &x2; 89| | 90| 6| PQCLEAN_NTRUHRSS701_AVX2_poly_Rq_sum_zero_frombytes(h, pk); 91| | 92| 6| PQCLEAN_NTRUHRSS701_AVX2_poly_Rq_mul(ct, r, h); 93| | 94| 6| PQCLEAN_NTRUHRSS701_AVX2_poly_lift(liftm, m); 95| 4.21k| for (i = 0; i < NTRU_N; i++) { ------------------ | | 5| 4.21k|#define NTRU_N 701 ------------------ | Branch (95:17): [True: 4.20k, False: 6] ------------------ 96| 4.20k| ct->coeffs[i] = ct->coeffs[i] + liftm->coeffs[i]; 97| 4.20k| } 98| | 99| 6| PQCLEAN_NTRUHRSS701_AVX2_poly_Rq_sum_zero_tobytes(c, ct); 100| 6|} PQCLEAN_NTRUHRSS701_AVX2_owcpa_dec: 104| 6| const unsigned char *secretkey) { 105| 6| int i; 106| 6| int fail; 107| 6| poly x1, x2, x3, x4; 108| | 109| 6| poly *c = &x1, *f = &x2, *cf = &x3; 110| 6| poly *mf = &x2, *finv3 = &x3, *m = &x4; 111| 6| poly *liftm = &x2, *invh = &x3, *r = &x4; 112| 6| poly *b = &x1; 113| | 114| 6| PQCLEAN_NTRUHRSS701_AVX2_poly_Rq_sum_zero_frombytes(c, ciphertext); 115| 6| PQCLEAN_NTRUHRSS701_AVX2_poly_S3_frombytes(f, secretkey); 116| 6| PQCLEAN_NTRUHRSS701_AVX2_poly_Z3_to_Zq(f); 117| | 118| 6| PQCLEAN_NTRUHRSS701_AVX2_poly_Rq_mul(cf, c, f); 119| 6| PQCLEAN_NTRUHRSS701_AVX2_poly_Rq_to_S3(mf, cf); 120| | 121| 6| PQCLEAN_NTRUHRSS701_AVX2_poly_S3_frombytes(finv3, secretkey + NTRU_PACK_TRINARY_BYTES); ------------------ | | 24| 6|#define NTRU_PACK_TRINARY_BYTES ((NTRU_PACK_DEG+4)/5) | | ------------------ | | | | 23| 6|#define NTRU_PACK_DEG (NTRU_N-1) | | | | ------------------ | | | | | | 5| 6|#define NTRU_N 701 | | | | ------------------ | | ------------------ ------------------ 122| 6| PQCLEAN_NTRUHRSS701_AVX2_poly_S3_mul(m, mf, finv3); 123| 6| PQCLEAN_NTRUHRSS701_AVX2_poly_S3_tobytes(rm + NTRU_PACK_TRINARY_BYTES, m); ------------------ | | 24| 6|#define NTRU_PACK_TRINARY_BYTES ((NTRU_PACK_DEG+4)/5) | | ------------------ | | | | 23| 6|#define NTRU_PACK_DEG (NTRU_N-1) | | | | ------------------ | | | | | | 5| 6|#define NTRU_N 701 | | | | ------------------ | | ------------------ ------------------ 124| | 125| 6| fail = 0; 126| | 127| | /* Check that the unused bits of the last byte of the ciphertext are zero */ 128| 6| fail |= owcpa_check_ciphertext(ciphertext); 129| | 130| | /* For the IND-CCA2 KEM we must ensure that c = Enc(h, (r,m)). */ 131| | /* We can avoid re-computing r*h + Lift(m) as long as we check that */ 132| | /* r (defined as b/h mod (q, Phi_n)) and m are in the message space. */ 133| | /* (m can take any value in S3 in NTRU_HRSS) */ 134| | 135| | /* b = c - Lift(m) mod (q, x^n - 1) */ 136| 6| PQCLEAN_NTRUHRSS701_AVX2_poly_lift(liftm, m); 137| 4.21k| for (i = 0; i < NTRU_N; i++) { ------------------ | | 5| 4.21k|#define NTRU_N 701 ------------------ | Branch (137:17): [True: 4.20k, False: 6] ------------------ 138| 4.20k| b->coeffs[i] = c->coeffs[i] - liftm->coeffs[i]; 139| 4.20k| } 140| | 141| | /* r = b / h mod (q, Phi_n) */ 142| 6| PQCLEAN_NTRUHRSS701_AVX2_poly_Sq_frombytes(invh, secretkey + 2 * NTRU_PACK_TRINARY_BYTES); ------------------ | | 24| 6|#define NTRU_PACK_TRINARY_BYTES ((NTRU_PACK_DEG+4)/5) | | ------------------ | | | | 23| 6|#define NTRU_PACK_DEG (NTRU_N-1) | | | | ------------------ | | | | | | 5| 6|#define NTRU_N 701 | | | | ------------------ | | ------------------ ------------------ 143| 6| PQCLEAN_NTRUHRSS701_AVX2_poly_Sq_mul(r, b, invh); 144| | 145| | /* NOTE: Our definition of r as b/h mod (q, Phi_n) follows Figure 4 of */ 146| | /* [Sch18] https://eprint.iacr.org/2018/1174/20181203:032458. */ 147| | /* This differs from Figure 10 of Saito--Xagawa--Yamakawa */ 148| | /* [SXY17] https://eprint.iacr.org/2017/1005/20180516:055500 */ 149| | /* where r gets a final reduction modulo p. */ 150| | /* We need this change to use Proposition 1 of [Sch18]. */ 151| | 152| | /* Proposition 1 of [Sch18] shows that re-encryption with (r,m) yields c. */ 153| | /* if and only if fail==0 after the following call to owcpa_check_r */ 154| | /* The procedure given in Fig. 8 of [Sch18] can be skipped because we have */ 155| | /* c(1) = 0 due to the use of poly_Rq_sum_zero_{to,from}bytes. */ 156| 6| fail |= owcpa_check_r(r); 157| | 158| 6| PQCLEAN_NTRUHRSS701_AVX2_poly_trinary_Zq_to_Z3(r); 159| 6| PQCLEAN_NTRUHRSS701_AVX2_poly_S3_tobytes(rm, r); 160| | 161| 6| return fail; 162| 6|} PQCLEAN_NTRUHRSS701_AVX2_poly_S3_tobytes: 3| 36|void PQCLEAN_NTRUHRSS701_AVX2_poly_S3_tobytes(unsigned char msg[NTRU_PACK_TRINARY_BYTES], const poly *a) { 4| 36| int i; 5| 36| unsigned char c; 6| | 7| 5.07k| for (i = 0; i < NTRU_PACK_DEG / 5; i++) { ------------------ | | 23| 5.07k|#define NTRU_PACK_DEG (NTRU_N-1) | | ------------------ | | | | 5| 5.07k|#define NTRU_N 701 | | ------------------ ------------------ | Branch (7:17): [True: 5.04k, False: 36] ------------------ 8| 5.04k| c = a->coeffs[5 * i + 4] & 255; 9| 5.04k| c = (3 * c + a->coeffs[5 * i + 3]) & 255; 10| 5.04k| c = (3 * c + a->coeffs[5 * i + 2]) & 255; 11| 5.04k| c = (3 * c + a->coeffs[5 * i + 1]) & 255; 12| 5.04k| c = (3 * c + a->coeffs[5 * i + 0]) & 255; 13| 5.04k| msg[i] = c; 14| 5.04k| } 15| 36|} PQCLEAN_NTRUHRSS701_AVX2_poly_S3_frombytes: 17| 12|void PQCLEAN_NTRUHRSS701_AVX2_poly_S3_frombytes(poly *r, const unsigned char msg[NTRU_PACK_TRINARY_BYTES]) { 18| 12| int i; 19| 12| unsigned char c; 20| | 21| 1.69k| for (i = 0; i < NTRU_PACK_DEG / 5; i++) { ------------------ | | 23| 1.69k|#define NTRU_PACK_DEG (NTRU_N-1) | | ------------------ | | | | 5| 1.69k|#define NTRU_N 701 | | ------------------ ------------------ | Branch (21:17): [True: 1.68k, False: 12] ------------------ 22| 1.68k| c = msg[i]; 23| 1.68k| r->coeffs[5 * i + 0] = c; 24| 1.68k| r->coeffs[5 * i + 1] = c * 171 >> 9; // this is division by 3 25| 1.68k| r->coeffs[5 * i + 2] = c * 57 >> 9; // division by 3^2 26| 1.68k| r->coeffs[5 * i + 3] = c * 19 >> 9; // division by 3^3 27| 1.68k| r->coeffs[5 * i + 4] = c * 203 >> 14; // etc. 28| 1.68k| } 29| 12| r->coeffs[NTRU_N - 1] = 0; ------------------ | | 5| 12|#define NTRU_N 701 ------------------ 30| 12| PQCLEAN_NTRUHRSS701_AVX2_poly_mod_3_Phi_n(r); 31| 12|} PQCLEAN_NTRUHRSS701_AVX2_poly_Sq_tobytes: 4| 18|void PQCLEAN_NTRUHRSS701_AVX2_poly_Sq_tobytes(unsigned char *r, const poly *a) { 5| 18| int i, j; 6| 18| uint16_t t[8]; 7| | 8| 1.58k| for (i = 0; i < NTRU_PACK_DEG / 8; i++) { ------------------ | | 23| 1.58k|#define NTRU_PACK_DEG (NTRU_N-1) | | ------------------ | | | | 5| 1.58k|#define NTRU_N 701 | | ------------------ ------------------ | Branch (8:17): [True: 1.56k, False: 18] ------------------ 9| 14.0k| for (j = 0; j < 8; j++) { ------------------ | Branch (9:21): [True: 12.5k, False: 1.56k] ------------------ 10| 12.5k| t[j] = MODQ(a->coeffs[8 * i + j]); ------------------ | | 9| 12.5k|#define MODQ(X) ((X) & (NTRU_Q-1)) | | ------------------ | | | | 13| 12.5k|#define NTRU_Q (1 << NTRU_LOGQ) | | | | ------------------ | | | | | | 6| 12.5k|#define NTRU_LOGQ 13 | | | | ------------------ | | ------------------ ------------------ 11| 12.5k| } 12| | 13| 1.56k| r[13 * i + 0] = (unsigned char) ( t[0] & 0xff); 14| 1.56k| r[13 * i + 1] = (unsigned char) ((t[0] >> 8) | ((t[1] & 0x07) << 5)); 15| 1.56k| r[13 * i + 2] = (unsigned char) ((t[1] >> 3) & 0xff); 16| 1.56k| r[13 * i + 3] = (unsigned char) ((t[1] >> 11) | ((t[2] & 0x3f) << 2)); 17| 1.56k| r[13 * i + 4] = (unsigned char) ((t[2] >> 6) | ((t[3] & 0x01) << 7)); 18| 1.56k| r[13 * i + 5] = (unsigned char) ((t[3] >> 1) & 0xff); 19| 1.56k| r[13 * i + 6] = (unsigned char) ((t[3] >> 9) | ((t[4] & 0x0f) << 4)); 20| 1.56k| r[13 * i + 7] = (unsigned char) ((t[4] >> 4) & 0xff); 21| 1.56k| r[13 * i + 8] = (unsigned char) ((t[4] >> 12) | ((t[5] & 0x7f) << 1)); 22| 1.56k| r[13 * i + 9] = (unsigned char) ((t[5] >> 7) | ((t[6] & 0x03) << 6)); 23| 1.56k| r[13 * i + 10] = (unsigned char) ((t[6] >> 2) & 0xff); 24| 1.56k| r[13 * i + 11] = (unsigned char) ((t[6] >> 10) | ((t[7] & 0x1f) << 3)); 25| 1.56k| r[13 * i + 12] = (unsigned char) ((t[7] >> 5)); 26| 1.56k| } 27| | 28| 90| for (j = 0; j < NTRU_PACK_DEG - 8 * i; j++) { ------------------ | | 23| 90|#define NTRU_PACK_DEG (NTRU_N-1) | | ------------------ | | | | 5| 90|#define NTRU_N 701 | | ------------------ ------------------ | Branch (28:17): [True: 72, False: 18] ------------------ 29| 72| t[j] = MODQ(a->coeffs[8 * i + j]); ------------------ | | 9| 72|#define MODQ(X) ((X) & (NTRU_Q-1)) | | ------------------ | | | | 13| 72|#define NTRU_Q (1 << NTRU_LOGQ) | | | | ------------------ | | | | | | 6| 72|#define NTRU_LOGQ 13 | | | | ------------------ | | ------------------ ------------------ 30| 72| } 31| 90| for (; j < 8; j++) { ------------------ | Branch (31:12): [True: 72, False: 18] ------------------ 32| 72| t[j] = 0; 33| 72| } 34| | 35| 18| switch (NTRU_PACK_DEG - 8 * (NTRU_PACK_DEG / 8)) { ------------------ | | 23| 18|#define NTRU_PACK_DEG (NTRU_N-1) | | ------------------ | | | | 5| 18|#define NTRU_N 701 | | ------------------ ------------------ switch (NTRU_PACK_DEG - 8 * (NTRU_PACK_DEG / 8)) { ------------------ | | 23| 18|#define NTRU_PACK_DEG (NTRU_N-1) | | ------------------ | | | | 5| 18|#define NTRU_N 701 | | ------------------ ------------------ | Branch (35:13): [True: 18, Folded] ------------------ 36| | // cases 0 and 6 are impossible since 2 generates (Z/n)* and 37| | // p mod 8 in {1, 7} implies that 2 is a quadratic residue. 38| 18| case 4: ------------------ | Branch (38:5): [True: 18, False: 0] ------------------ 39| 18| r[13 * i + 0] = (unsigned char) ( t[0] & 0xff); 40| 18| r[13 * i + 1] = (unsigned char) (t[0] >> 8) | ((t[1] & 0x07) << 5); 41| 18| r[13 * i + 2] = (unsigned char) (t[1] >> 3) & 0xff; 42| 18| r[13 * i + 3] = (unsigned char) (t[1] >> 11) | ((t[2] & 0x3f) << 2); 43| 18| r[13 * i + 4] = (unsigned char) (t[2] >> 6) | ((t[3] & 0x01) << 7); 44| 18| r[13 * i + 5] = (unsigned char) (t[3] >> 1) & 0xff; 45| 18| r[13 * i + 6] = (unsigned char) (t[3] >> 9) | ((t[4] & 0x0f) << 4); 46| 18| break; 47| 0| case 2: ------------------ | Branch (47:5): [True: 0, False: 18] ------------------ 48| 0| r[13 * i + 0] = (unsigned char) ( t[0] & 0xff); 49| 0| r[13 * i + 1] = (unsigned char) (t[0] >> 8) | ((t[1] & 0x07) << 5); 50| 0| r[13 * i + 2] = (unsigned char) (t[1] >> 3) & 0xff; 51| 0| r[13 * i + 3] = (unsigned char) (t[1] >> 11) | ((t[2] & 0x3f) << 2); 52| 0| break; 53| 18| } 54| 18|} PQCLEAN_NTRUHRSS701_AVX2_poly_Sq_frombytes: 56| 18|void PQCLEAN_NTRUHRSS701_AVX2_poly_Sq_frombytes(poly *r, const unsigned char *a) { 57| 18| int i; 58| 1.58k| for (i = 0; i < NTRU_PACK_DEG / 8; i++) { ------------------ | | 23| 1.58k|#define NTRU_PACK_DEG (NTRU_N-1) | | ------------------ | | | | 5| 1.58k|#define NTRU_N 701 | | ------------------ ------------------ | Branch (58:17): [True: 1.56k, False: 18] ------------------ 59| 1.56k| r->coeffs[8 * i + 0] = a[13 * i + 0] | (((uint16_t)a[13 * i + 1] & 0x1f) << 8); 60| 1.56k| r->coeffs[8 * i + 1] = (a[13 * i + 1] >> 5) | (((uint16_t)a[13 * i + 2] ) << 3) | (((uint16_t)a[13 * i + 3] & 0x03) << 11); 61| 1.56k| r->coeffs[8 * i + 2] = (a[13 * i + 3] >> 2) | (((uint16_t)a[13 * i + 4] & 0x7f) << 6); 62| 1.56k| r->coeffs[8 * i + 3] = (a[13 * i + 4] >> 7) | (((uint16_t)a[13 * i + 5] ) << 1) | (((uint16_t)a[13 * i + 6] & 0x0f) << 9); 63| 1.56k| r->coeffs[8 * i + 4] = (a[13 * i + 6] >> 4) | (((uint16_t)a[13 * i + 7] ) << 4) | (((uint16_t)a[13 * i + 8] & 0x01) << 12); 64| 1.56k| r->coeffs[8 * i + 5] = (a[13 * i + 8] >> 1) | (((uint16_t)a[13 * i + 9] & 0x3f) << 7); 65| 1.56k| r->coeffs[8 * i + 6] = (a[13 * i + 9] >> 6) | (((uint16_t)a[13 * i + 10] ) << 2) | (((uint16_t)a[13 * i + 11] & 0x07) << 10); 66| 1.56k| r->coeffs[8 * i + 7] = (a[13 * i + 11] >> 3) | (((uint16_t)a[13 * i + 12] ) << 5); 67| 1.56k| } 68| 18| switch (NTRU_PACK_DEG & 0x07) { ------------------ | | 23| 18|#define NTRU_PACK_DEG (NTRU_N-1) | | ------------------ | | | | 5| 18|#define NTRU_N 701 | | ------------------ ------------------ | Branch (68:13): [True: 18, Folded] ------------------ 69| | // cases 0 and 6 are impossible since 2 generates (Z/n)* and 70| | // p mod 8 in {1, 7} implies that 2 is a quadratic residue. 71| 18| case 4: ------------------ | Branch (71:5): [True: 18, False: 0] ------------------ 72| 18| r->coeffs[8 * i + 0] = a[13 * i + 0] | (((uint16_t)a[13 * i + 1] & 0x1f) << 8); 73| 18| r->coeffs[8 * i + 1] = (a[13 * i + 1] >> 5) | (((uint16_t)a[13 * i + 2] ) << 3) | (((uint16_t)a[13 * i + 3] & 0x03) << 11); 74| 18| r->coeffs[8 * i + 2] = (a[13 * i + 3] >> 2) | (((uint16_t)a[13 * i + 4] & 0x7f) << 6); 75| 18| r->coeffs[8 * i + 3] = (a[13 * i + 4] >> 7) | (((uint16_t)a[13 * i + 5] ) << 1) | (((uint16_t)a[13 * i + 6] & 0x0f) << 9); 76| 18| break; 77| 0| case 2: ------------------ | Branch (77:5): [True: 0, False: 18] ------------------ 78| 0| r->coeffs[8 * i + 0] = a[13 * i + 0] | (((uint16_t)a[13 * i + 1] & 0x1f) << 8); 79| 0| r->coeffs[8 * i + 1] = (a[13 * i + 1] >> 5) | (((uint16_t)a[13 * i + 2] ) << 3) | (((uint16_t)a[13 * i + 3] & 0x03) << 11); 80| 0| break; 81| 18| } 82| 18| r->coeffs[NTRU_N - 1] = 0; ------------------ | | 5| 18|#define NTRU_N 701 ------------------ 83| 18|} PQCLEAN_NTRUHRSS701_AVX2_poly_Rq_sum_zero_tobytes: 85| 12|void PQCLEAN_NTRUHRSS701_AVX2_poly_Rq_sum_zero_tobytes(unsigned char *r, const poly *a) { 86| 12| PQCLEAN_NTRUHRSS701_AVX2_poly_Sq_tobytes(r, a); 87| 12|} PQCLEAN_NTRUHRSS701_AVX2_poly_Rq_sum_zero_frombytes: 89| 12|void PQCLEAN_NTRUHRSS701_AVX2_poly_Rq_sum_zero_frombytes(poly *r, const unsigned char *a) { 90| 12| int i; 91| 12| PQCLEAN_NTRUHRSS701_AVX2_poly_Sq_frombytes(r, a); 92| | 93| | /* Set r[n-1] so that the sum of coefficients is zero mod q */ 94| 12| r->coeffs[NTRU_N - 1] = 0; ------------------ | | 5| 12|#define NTRU_N 701 ------------------ 95| 8.41k| for (i = 0; i < NTRU_PACK_DEG; i++) { ------------------ | | 23| 8.41k|#define NTRU_PACK_DEG (NTRU_N-1) | | ------------------ | | | | 5| 8.41k|#define NTRU_N 701 | | ------------------ ------------------ | Branch (95:17): [True: 8.40k, False: 12] ------------------ 96| 8.40k| r->coeffs[NTRU_N - 1] -= r->coeffs[i]; ------------------ | | 5| 8.40k|#define NTRU_N 701 ------------------ 97| 8.40k| } 98| 12|} PQCLEAN_NTRUHRSS701_AVX2_poly_Z3_to_Zq: 4| 24|void PQCLEAN_NTRUHRSS701_AVX2_poly_Z3_to_Zq(poly *r) { 5| 24| int i; 6| 16.8k| for (i = 0; i < NTRU_N; i++) { ------------------ | | 5| 16.8k|#define NTRU_N 701 ------------------ | Branch (6:17): [True: 16.8k, False: 24] ------------------ 7| 16.8k| r->coeffs[i] = r->coeffs[i] | ((-(r->coeffs[i] >> 1)) & (NTRU_Q - 1)); ------------------ | | 13| 16.8k|#define NTRU_Q (1 << NTRU_LOGQ) | | ------------------ | | | | 6| 16.8k|#define NTRU_LOGQ 13 | | ------------------ ------------------ 8| 16.8k| } 9| 24|} PQCLEAN_NTRUHRSS701_AVX2_poly_trinary_Zq_to_Z3: 12| 6|void PQCLEAN_NTRUHRSS701_AVX2_poly_trinary_Zq_to_Z3(poly *r) { 13| 6| int i; 14| 4.21k| for (i = 0; i < NTRU_N; i++) { ------------------ | | 5| 4.21k|#define NTRU_N 701 ------------------ | Branch (14:17): [True: 4.20k, False: 6] ------------------ 15| 4.20k| r->coeffs[i] = MODQ(r->coeffs[i]); ------------------ | | 9| 4.20k|#define MODQ(X) ((X) & (NTRU_Q-1)) | | ------------------ | | | | 13| 4.20k|#define NTRU_Q (1 << NTRU_LOGQ) | | | | ------------------ | | | | | | 6| 4.20k|#define NTRU_LOGQ 13 | | | | ------------------ | | ------------------ ------------------ 16| 4.20k| r->coeffs[i] = 3 & (r->coeffs[i] ^ (r->coeffs[i] >> (NTRU_LOGQ - 1))); ------------------ | | 6| 4.20k|#define NTRU_LOGQ 13 ------------------ 17| 4.20k| } 18| 6|} PQCLEAN_NTRUHRSS701_AVX2_poly_Sq_mul: 20| 12|void PQCLEAN_NTRUHRSS701_AVX2_poly_Sq_mul(poly *r, const poly *a, const poly *b) { 21| 12| PQCLEAN_NTRUHRSS701_AVX2_poly_Rq_mul(r, a, b); 22| 12| PQCLEAN_NTRUHRSS701_AVX2_poly_mod_q_Phi_n(r); 23| 12|} PQCLEAN_NTRUHRSS701_AVX2_poly_S3_mul: 25| 6|void PQCLEAN_NTRUHRSS701_AVX2_poly_S3_mul(poly *r, const poly *a, const poly *b) { 26| 6| int i; 27| | 28| | /* Our S3 multiplications do not overflow mod q, */ 29| | /* so we can re-purpose PQCLEAN_NTRUHRSS701_AVX2_poly_Rq_mul, as long as we */ 30| | /* follow with an explicit reduction mod q. */ 31| 6| PQCLEAN_NTRUHRSS701_AVX2_poly_Rq_mul(r, a, b); 32| 4.21k| for (i = 0; i < NTRU_N; i++) { ------------------ | | 5| 4.21k|#define NTRU_N 701 ------------------ | Branch (32:17): [True: 4.20k, False: 6] ------------------ 33| 4.20k| r->coeffs[i] = MODQ(r->coeffs[i]); ------------------ | | 9| 4.20k|#define MODQ(X) ((X) & (NTRU_Q-1)) | | ------------------ | | | | 13| 4.20k|#define NTRU_Q (1 << NTRU_LOGQ) | | | | ------------------ | | | | | | 6| 4.20k|#define NTRU_LOGQ 13 | | | | ------------------ | | ------------------ ------------------ 34| 4.20k| } 35| 6| PQCLEAN_NTRUHRSS701_AVX2_poly_mod_3_Phi_n(r); 36| 6|} PQCLEAN_NTRUHRSS701_AVX2_poly_Rq_inv: 71| 6|void PQCLEAN_NTRUHRSS701_AVX2_poly_Rq_inv(poly *r, const poly *a) { 72| 6| poly ai2; 73| 6| PQCLEAN_NTRUHRSS701_AVX2_poly_R2_inv(&ai2, a); 74| 6| PQCLEAN_NTRUHRSS701_AVX2_poly_R2_inv_to_Rq_inv(r, &ai2, a); 75| 6|} poly.c:PQCLEAN_NTRUHRSS701_AVX2_poly_R2_inv_to_Rq_inv: 38| 6|static void PQCLEAN_NTRUHRSS701_AVX2_poly_R2_inv_to_Rq_inv(poly *r, const poly *ai, const poly *a) { 39| | 40| 6| int i; 41| 6| poly b, c; 42| 6| poly s; 43| | 44| | // for 0..4 45| | // ai = ai * (2 - a*ai) mod q 46| 4.21k| for (i = 0; i < NTRU_N; i++) { ------------------ | | 5| 4.21k|#define NTRU_N 701 ------------------ | Branch (46:17): [True: 4.20k, False: 6] ------------------ 47| 4.20k| b.coeffs[i] = -(a->coeffs[i]); 48| 4.20k| } 49| | 50| 4.21k| for (i = 0; i < NTRU_N; i++) { ------------------ | | 5| 4.21k|#define NTRU_N 701 ------------------ | Branch (50:17): [True: 4.20k, False: 6] ------------------ 51| 4.20k| r->coeffs[i] = ai->coeffs[i]; 52| 4.20k| } 53| | 54| 6| PQCLEAN_NTRUHRSS701_AVX2_poly_Rq_mul(&c, r, &b); 55| 6| c.coeffs[0] += 2; // c = 2 - a*ai 56| 6| PQCLEAN_NTRUHRSS701_AVX2_poly_Rq_mul(&s, &c, r); // s = ai*c 57| | 58| 6| PQCLEAN_NTRUHRSS701_AVX2_poly_Rq_mul(&c, &s, &b); 59| 6| c.coeffs[0] += 2; // c = 2 - a*s 60| 6| PQCLEAN_NTRUHRSS701_AVX2_poly_Rq_mul(r, &c, &s); // r = s*c 61| | 62| 6| PQCLEAN_NTRUHRSS701_AVX2_poly_Rq_mul(&c, r, &b); 63| 6| c.coeffs[0] += 2; // c = 2 - a*r 64| 6| PQCLEAN_NTRUHRSS701_AVX2_poly_Rq_mul(&s, &c, r); // s = r*c 65| | 66| 6| PQCLEAN_NTRUHRSS701_AVX2_poly_Rq_mul(&c, &s, &b); 67| 6| c.coeffs[0] += 2; // c = 2 - a*s 68| 6| PQCLEAN_NTRUHRSS701_AVX2_poly_Rq_mul(r, &c, &s); // r = s*c 69| 6|} PQCLEAN_NTRUHRSS701_AVX2_poly_R2_tobytes: 6| 6|void PQCLEAN_NTRUHRSS701_AVX2_poly_R2_tobytes(unsigned char *out, const poly *a) { 7| 6| int i, j, k; 8| 78| for (i = 0; i < 12; i++) { ------------------ | Branch (8:17): [True: 72, False: 6] ------------------ 9| 648| for (k = 0; k < 8; k++) { ------------------ | Branch (9:21): [True: 576, False: 72] ------------------ 10| 576| out[i * 8 + k] = 0; 11| 5.18k| for (j = 0; j < 8; j++) { ------------------ | Branch (11:25): [True: 4.60k, False: 576] ------------------ 12| 4.60k| if ((i * 8 + k) * 8 + j < NTRU_N) { ------------------ | | 5| 4.60k|#define NTRU_N 701 ------------------ | Branch (12:21): [True: 4.20k, False: 402] ------------------ 13| 4.20k| out[i * 8 + k] |= (a->coeffs[(i * 8 + k) * 8 + j] & 1) << j; 14| 4.20k| } 15| 4.60k| } 16| 576| } 17| 72| } 18| 6|} PQCLEAN_NTRUHRSS701_AVX2_poly_R2_frombytes: 20| 6|void PQCLEAN_NTRUHRSS701_AVX2_poly_R2_frombytes(poly *a, const unsigned char *in) { 21| 6| int i, j, k; 22| 78| for (i = 0; i < 12; i++) { ------------------ | Branch (22:17): [True: 72, False: 6] ------------------ 23| 648| for (k = 0; k < 8; k++) { ------------------ | Branch (23:21): [True: 576, False: 72] ------------------ 24| 5.18k| for (j = 0; j < 8; j++) { ------------------ | Branch (24:25): [True: 4.60k, False: 576] ------------------ 25| 4.60k| if ((i * 8 + k) * 8 + j < NTRU_N) { ------------------ | | 5| 4.60k|#define NTRU_N 701 ------------------ | Branch (25:21): [True: 4.20k, False: 402] ------------------ 26| 4.20k| a->coeffs[(i * 8 + k) * 8 + j] = (in[i * 8 + k] >> j) & 1; 27| 4.20k| } 28| 4.60k| } 29| 576| } 30| 72| } 31| 6|} PQCLEAN_NTRUHRSS701_AVX2_poly_R2_inv: 33| 6|void PQCLEAN_NTRUHRSS701_AVX2_poly_R2_inv(poly *r, const poly *a) { 34| 6| union { 35| 6| unsigned char s[96]; 36| 6| __m256i s_x32[3]; 37| 6| } squares[13]; 38| 6|#define s(x) squares[(x)].s 39| | 40| | // This relies on the following addition chain: 41| | // 1, 2, 3, 6, 12, 15, 27, 42, 84, 168, 336, 672, 699 42| | 43| 6| PQCLEAN_NTRUHRSS701_AVX2_poly_R2_tobytes(s(0), a); // TODO alignment ------------------ | | 38| 6|#define s(x) squares[(x)].s ------------------ 44| | 45| 6| PQCLEAN_NTRUHRSS701_AVX2_square_1_701(s(1), s(0)); ------------------ | | 38| 6|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHRSS701_AVX2_square_1_701(s(1), s(0)); ------------------ | | 38| 6|#define s(x) squares[(x)].s ------------------ 46| 6| PQCLEAN_NTRUHRSS701_AVX2_poly_R2_mul(s(1), s(1), s(0)); ------------------ | | 38| 6|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHRSS701_AVX2_poly_R2_mul(s(1), s(1), s(0)); ------------------ | | 38| 6|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHRSS701_AVX2_poly_R2_mul(s(1), s(1), s(0)); ------------------ | | 38| 6|#define s(x) squares[(x)].s ------------------ 47| 6| PQCLEAN_NTRUHRSS701_AVX2_square_1_701(s(2), s(1)); ------------------ | | 38| 6|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHRSS701_AVX2_square_1_701(s(2), s(1)); ------------------ | | 38| 6|#define s(x) squares[(x)].s ------------------ 48| 6| PQCLEAN_NTRUHRSS701_AVX2_poly_R2_mul(s(2), s(2), s(0)); ------------------ | | 38| 6|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHRSS701_AVX2_poly_R2_mul(s(2), s(2), s(0)); ------------------ | | 38| 6|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHRSS701_AVX2_poly_R2_mul(s(2), s(2), s(0)); ------------------ | | 38| 6|#define s(x) squares[(x)].s ------------------ 49| 6| PQCLEAN_NTRUHRSS701_AVX2_square_3_701(s(3), s(2)); ------------------ | | 38| 6|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHRSS701_AVX2_square_3_701(s(3), s(2)); ------------------ | | 38| 6|#define s(x) squares[(x)].s ------------------ 50| 6| PQCLEAN_NTRUHRSS701_AVX2_poly_R2_mul(s(3), s(3), s(2)); ------------------ | | 38| 6|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHRSS701_AVX2_poly_R2_mul(s(3), s(3), s(2)); ------------------ | | 38| 6|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHRSS701_AVX2_poly_R2_mul(s(3), s(3), s(2)); ------------------ | | 38| 6|#define s(x) squares[(x)].s ------------------ 51| 6| PQCLEAN_NTRUHRSS701_AVX2_square_6_701(s(4), s(3)); ------------------ | | 38| 6|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHRSS701_AVX2_square_6_701(s(4), s(3)); ------------------ | | 38| 6|#define s(x) squares[(x)].s ------------------ 52| 6| PQCLEAN_NTRUHRSS701_AVX2_poly_R2_mul(s(4), s(4), s(3)); ------------------ | | 38| 6|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHRSS701_AVX2_poly_R2_mul(s(4), s(4), s(3)); ------------------ | | 38| 6|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHRSS701_AVX2_poly_R2_mul(s(4), s(4), s(3)); ------------------ | | 38| 6|#define s(x) squares[(x)].s ------------------ 53| 6| PQCLEAN_NTRUHRSS701_AVX2_square_3_701(s(5), s(4)); ------------------ | | 38| 6|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHRSS701_AVX2_square_3_701(s(5), s(4)); ------------------ | | 38| 6|#define s(x) squares[(x)].s ------------------ 54| 6| PQCLEAN_NTRUHRSS701_AVX2_poly_R2_mul(s(5), s(5), s(2)); ------------------ | | 38| 6|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHRSS701_AVX2_poly_R2_mul(s(5), s(5), s(2)); ------------------ | | 38| 6|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHRSS701_AVX2_poly_R2_mul(s(5), s(5), s(2)); ------------------ | | 38| 6|#define s(x) squares[(x)].s ------------------ 55| 6| PQCLEAN_NTRUHRSS701_AVX2_square_12_701(s(6), s(5)); ------------------ | | 38| 6|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHRSS701_AVX2_square_12_701(s(6), s(5)); ------------------ | | 38| 6|#define s(x) squares[(x)].s ------------------ 56| 6| PQCLEAN_NTRUHRSS701_AVX2_poly_R2_mul(s(6), s(6), s(4)); ------------------ | | 38| 6|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHRSS701_AVX2_poly_R2_mul(s(6), s(6), s(4)); ------------------ | | 38| 6|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHRSS701_AVX2_poly_R2_mul(s(6), s(6), s(4)); ------------------ | | 38| 6|#define s(x) squares[(x)].s ------------------ 57| 6| PQCLEAN_NTRUHRSS701_AVX2_square_15_701(s(7), s(6)); ------------------ | | 38| 6|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHRSS701_AVX2_square_15_701(s(7), s(6)); ------------------ | | 38| 6|#define s(x) squares[(x)].s ------------------ 58| 6| PQCLEAN_NTRUHRSS701_AVX2_poly_R2_mul(s(7), s(7), s(5)); ------------------ | | 38| 6|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHRSS701_AVX2_poly_R2_mul(s(7), s(7), s(5)); ------------------ | | 38| 6|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHRSS701_AVX2_poly_R2_mul(s(7), s(7), s(5)); ------------------ | | 38| 6|#define s(x) squares[(x)].s ------------------ 59| 6| PQCLEAN_NTRUHRSS701_AVX2_square_42_701(s(8), s(7)); ------------------ | | 38| 6|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHRSS701_AVX2_square_42_701(s(8), s(7)); ------------------ | | 38| 6|#define s(x) squares[(x)].s ------------------ 60| 6| PQCLEAN_NTRUHRSS701_AVX2_poly_R2_mul(s(8), s(8), s(7)); ------------------ | | 38| 6|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHRSS701_AVX2_poly_R2_mul(s(8), s(8), s(7)); ------------------ | | 38| 6|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHRSS701_AVX2_poly_R2_mul(s(8), s(8), s(7)); ------------------ | | 38| 6|#define s(x) squares[(x)].s ------------------ 61| 6| PQCLEAN_NTRUHRSS701_AVX2_square_84_701(s(9), s(8)); ------------------ | | 38| 6|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHRSS701_AVX2_square_84_701(s(9), s(8)); ------------------ | | 38| 6|#define s(x) squares[(x)].s ------------------ 62| 6| PQCLEAN_NTRUHRSS701_AVX2_poly_R2_mul(s(9), s(9), s(8)); ------------------ | | 38| 6|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHRSS701_AVX2_poly_R2_mul(s(9), s(9), s(8)); ------------------ | | 38| 6|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHRSS701_AVX2_poly_R2_mul(s(9), s(9), s(8)); ------------------ | | 38| 6|#define s(x) squares[(x)].s ------------------ 63| 6| PQCLEAN_NTRUHRSS701_AVX2_square_168_701(s(10), s(9)); ------------------ | | 38| 6|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHRSS701_AVX2_square_168_701(s(10), s(9)); ------------------ | | 38| 6|#define s(x) squares[(x)].s ------------------ 64| 6| PQCLEAN_NTRUHRSS701_AVX2_poly_R2_mul(s(10), s(10), s(9)); ------------------ | | 38| 6|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHRSS701_AVX2_poly_R2_mul(s(10), s(10), s(9)); ------------------ | | 38| 6|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHRSS701_AVX2_poly_R2_mul(s(10), s(10), s(9)); ------------------ | | 38| 6|#define s(x) squares[(x)].s ------------------ 65| 6| PQCLEAN_NTRUHRSS701_AVX2_square_336_701(s(11), s(10)); ------------------ | | 38| 6|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHRSS701_AVX2_square_336_701(s(11), s(10)); ------------------ | | 38| 6|#define s(x) squares[(x)].s ------------------ 66| 6| PQCLEAN_NTRUHRSS701_AVX2_poly_R2_mul(s(11), s(11), s(10)); ------------------ | | 38| 6|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHRSS701_AVX2_poly_R2_mul(s(11), s(11), s(10)); ------------------ | | 38| 6|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHRSS701_AVX2_poly_R2_mul(s(11), s(11), s(10)); ------------------ | | 38| 6|#define s(x) squares[(x)].s ------------------ 67| 6| PQCLEAN_NTRUHRSS701_AVX2_square_27_701(s(12), s(11)); ------------------ | | 38| 6|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHRSS701_AVX2_square_27_701(s(12), s(11)); ------------------ | | 38| 6|#define s(x) squares[(x)].s ------------------ 68| 6| PQCLEAN_NTRUHRSS701_AVX2_poly_R2_mul(s(12), s(12), s(6)); ------------------ | | 38| 6|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHRSS701_AVX2_poly_R2_mul(s(12), s(12), s(6)); ------------------ | | 38| 6|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHRSS701_AVX2_poly_R2_mul(s(12), s(12), s(6)); ------------------ | | 38| 6|#define s(x) squares[(x)].s ------------------ 69| 6| PQCLEAN_NTRUHRSS701_AVX2_square_1_701(s(0), s(12)); ------------------ | | 38| 6|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHRSS701_AVX2_square_1_701(s(0), s(12)); ------------------ | | 38| 6|#define s(x) squares[(x)].s ------------------ 70| | 71| 6| PQCLEAN_NTRUHRSS701_AVX2_poly_R2_frombytes(r, s(0)); ------------------ | | 38| 6|#define s(x) squares[(x)].s ------------------ 72| 6|#undef s 73| 6|} PQCLEAN_NTRUHRSS701_AVX2_poly_S3_inv: 545| 6|void PQCLEAN_NTRUHRSS701_AVX2_poly_S3_inv(poly *r_out, const poly *a) { 546| 6| const unsigned char *in = (void *) a; 547| 6| unsigned char *out = (void *) r_out; 548| | 549| 6| small input[ppad]; 550| 6| small output[ppad]; 551| 6| int i; 552| | 553| | /* XXX: obviously input/output format should be packed into bytes */ 554| | 555| 4.20k| for (i = 0; i < p; ++i) { ------------------ | | 7| 4.20k|#define p 700 ------------------ | Branch (555:17): [True: 4.20k, False: 6] ------------------ 556| 4.20k| small x = in[2 * i] & 3; /* 0 1 2 3 */ 557| 4.20k| x += 1; /* 0 1 2 3 4 5 6, offset by 1 */ 558| 4.20k| x &= (x - 3) >> 5; /* 0 1 2, offset by 1 */ 559| 4.20k| input[i] = x - 1; 560| 4.20k| } 561| | /* XXX: merge with vec256_init */ 562| | 563| 6| __poly_S3_inv((unsigned char *)output, (unsigned char *)input); 564| | 565| 4.20k| for (i = 0; i < p; ++i) { ------------------ | | 7| 4.20k|#define p 700 ------------------ | Branch (565:17): [True: 4.20k, False: 6] ------------------ 566| 4.20k| out[2 * i] = (3 & output[i]) ^ ((3 & output[i]) >> 1); 567| 4.20k| out[2 * i + 1] = 0; 568| 4.20k| } 569| 6|} PQCLEAN_NTRUHRSS701_AVX2_sample_fg: 3| 6|void PQCLEAN_NTRUHRSS701_AVX2_sample_fg(poly *f, poly *g, const unsigned char uniformbytes[NTRU_SAMPLE_FG_BYTES]) { 4| 6| PQCLEAN_NTRUHRSS701_AVX2_sample_iid_plus(f, uniformbytes); 5| 6| PQCLEAN_NTRUHRSS701_AVX2_sample_iid_plus(g, uniformbytes + NTRU_SAMPLE_IID_BYTES); ------------------ | | 19| 6|#define NTRU_SAMPLE_IID_BYTES (NTRU_N-1) | | ------------------ | | | | 5| 6|#define NTRU_N 701 | | ------------------ ------------------ 6| | 7| 6|} PQCLEAN_NTRUHRSS701_AVX2_sample_rm: 9| 6|void PQCLEAN_NTRUHRSS701_AVX2_sample_rm(poly *r, poly *m, const unsigned char uniformbytes[NTRU_SAMPLE_RM_BYTES]) { 10| 6| PQCLEAN_NTRUHRSS701_AVX2_sample_iid(r, uniformbytes); 11| 6| PQCLEAN_NTRUHRSS701_AVX2_sample_iid(m, uniformbytes + NTRU_SAMPLE_IID_BYTES); ------------------ | | 19| 6|#define NTRU_SAMPLE_IID_BYTES (NTRU_N-1) | | ------------------ | | | | 5| 6|#define NTRU_N 701 | | ------------------ ------------------ 12| | 13| 6|} PQCLEAN_NTRUHRSS701_AVX2_sample_iid_plus: 15| 12|void PQCLEAN_NTRUHRSS701_AVX2_sample_iid_plus(poly *r, const unsigned char uniformbytes[NTRU_SAMPLE_IID_BYTES]) { 16| | /* Sample r using PQCLEAN_NTRUHRSS701_AVX2_sample_iid then conditionally flip */ 17| | /* signs of even index coefficients so that >= 0. */ 18| | 19| 12| int i; 20| 12| uint16_t s = 0; 21| | 22| 12| PQCLEAN_NTRUHRSS701_AVX2_sample_iid(r, uniformbytes); 23| | 24| | /* Map {0,1,2} -> {0, 1, 2^16 - 1} */ 25| 8.41k| for (i = 0; i < NTRU_N - 1; i++) { ------------------ | | 5| 8.41k|#define NTRU_N 701 ------------------ | Branch (25:17): [True: 8.40k, False: 12] ------------------ 26| 8.40k| r->coeffs[i] = r->coeffs[i] | (-(r->coeffs[i] >> 1)); 27| 8.40k| } 28| | 29| | /* s = . (r[n-1] = 0) */ 30| 8.41k| for (i = 0; i < NTRU_N - 1; i++) { ------------------ | | 5| 8.41k|#define NTRU_N 701 ------------------ | Branch (30:17): [True: 8.40k, False: 12] ------------------ 31| 8.40k| s += (uint16_t)((uint32_t)r->coeffs[i + 1] * (uint32_t)r->coeffs[i]); 32| 8.40k| } 33| | 34| | /* Extract sign of s (sign(0) = 1) */ 35| 12| s = 1 | (-(s >> 15)); 36| | 37| 4.22k| for (i = 0; i < NTRU_N; i += 2) { ------------------ | | 5| 4.22k|#define NTRU_N 701 ------------------ | Branch (37:17): [True: 4.21k, False: 12] ------------------ 38| 4.21k| r->coeffs[i] = (uint16_t)((uint32_t)s * (uint32_t)r->coeffs[i]); 39| 4.21k| } 40| | 41| | /* Map {0,1,2^16-1} -> {0, 1, 2} */ 42| 8.42k| for (i = 0; i < NTRU_N; i++) { ------------------ | | 5| 8.42k|#define NTRU_N 701 ------------------ | Branch (42:17): [True: 8.41k, False: 12] ------------------ 43| 8.41k| r->coeffs[i] = 3 & (r->coeffs[i] ^ (r->coeffs[i] >> 15)); 44| 8.41k| } 45| 12|} PQCLEAN_NTRUHRSS701_AVX2_sample_iid: 7| 24|void PQCLEAN_NTRUHRSS701_AVX2_sample_iid(poly *r, const unsigned char uniformbytes[NTRU_SAMPLE_IID_BYTES]) { 8| 24| int i; 9| 24| union { /* align to 32 byte boundary for vmovdqa */ 10| 24| unsigned char b[PAD32(NTRU_SAMPLE_IID_BYTES)]; 11| 24| __m256i b_x32[PAD32(NTRU_SAMPLE_IID_BYTES) / 32]; 12| 24| } buffer; 13| | 14| 16.8k| for (i = 0; i < NTRU_SAMPLE_IID_BYTES; i++) { ------------------ | | 19| 16.8k|#define NTRU_SAMPLE_IID_BYTES (NTRU_N-1) | | ------------------ | | | | 5| 16.8k|#define NTRU_N 701 | | ------------------ ------------------ | Branch (14:17): [True: 16.8k, False: 24] ------------------ 15| 16.8k| buffer.b[i] = uniformbytes[i]; 16| 16.8k| } 17| 120| for (i = NTRU_SAMPLE_IID_BYTES; i < PAD32(NTRU_SAMPLE_IID_BYTES); i++) { ------------------ | | 19| 24|#define NTRU_SAMPLE_IID_BYTES (NTRU_N-1) | | ------------------ | | | | 5| 24|#define NTRU_N 701 | | ------------------ ------------------ for (i = NTRU_SAMPLE_IID_BYTES; i < PAD32(NTRU_SAMPLE_IID_BYTES); i++) { ------------------ | | 11| 120|#define PAD32(X) ((((X) + 31)/32)*32) ------------------ | Branch (17:37): [True: 96, False: 24] ------------------ 18| 96| buffer.b[i] = 0; 19| 96| } 20| 24| PQCLEAN_NTRUHRSS701_AVX2_vec32_sample_iid(r, buffer.b); 21| 24|} OQS_KEM_ntruprime_sntrup761_new: 9| 10|OQS_KEM *OQS_KEM_ntruprime_sntrup761_new(void) { 10| | 11| 10| OQS_KEM *kem = OQS_MEM_calloc(1, sizeof(OQS_KEM)); 12| 10| if (kem == NULL) { ------------------ | Branch (12:6): [True: 0, False: 10] ------------------ 13| 0| return NULL; 14| 0| } 15| 10| kem->method_name = OQS_KEM_alg_ntruprime_sntrup761; ------------------ | | 93| 10|#define OQS_KEM_alg_ntruprime_sntrup761 "sntrup761" ------------------ 16| 10| kem->alg_version = "v1.9.2026.01.20 via https://github.com/openssh/openssh-portable/blob/master/sntrup761.c"; 17| | 18| 10| kem->claimed_nist_level = 2; 19| 10| kem->ind_cca = true; 20| | 21| 10| kem->length_public_key = OQS_KEM_ntruprime_sntrup761_length_public_key; ------------------ | | 9| 10|#define OQS_KEM_ntruprime_sntrup761_length_public_key 1158 ------------------ 22| 10| kem->length_secret_key = OQS_KEM_ntruprime_sntrup761_length_secret_key; ------------------ | | 10| 10|#define OQS_KEM_ntruprime_sntrup761_length_secret_key 1763 ------------------ 23| 10| kem->length_ciphertext = OQS_KEM_ntruprime_sntrup761_length_ciphertext; ------------------ | | 11| 10|#define OQS_KEM_ntruprime_sntrup761_length_ciphertext 1039 ------------------ 24| 10| kem->length_shared_secret = OQS_KEM_ntruprime_sntrup761_length_shared_secret; ------------------ | | 12| 10|#define OQS_KEM_ntruprime_sntrup761_length_shared_secret 32 ------------------ 25| 10| kem->length_keypair_seed = OQS_KEM_ntruprime_sntrup761_length_keypair_seed; ------------------ | | 13| 10|#define OQS_KEM_ntruprime_sntrup761_length_keypair_seed 0 ------------------ 26| 10| kem->length_encaps_seed = OQS_KEM_ntruprime_sntrup761_length_encaps_seed; ------------------ | | 14| 10|#define OQS_KEM_ntruprime_sntrup761_length_encaps_seed 0 ------------------ 27| | 28| 10| kem->keypair = OQS_KEM_ntruprime_sntrup761_keypair; 29| 10| kem->keypair_derand = OQS_KEM_ntruprime_sntrup761_keypair_derand; 30| 10| kem->encaps = OQS_KEM_ntruprime_sntrup761_encaps; 31| 10| kem->encaps_derand = OQS_KEM_ntruprime_sntrup761_encaps_derand; 32| 10| kem->decaps = OQS_KEM_ntruprime_sntrup761_decaps; 33| | 34| 10| return kem; 35| 10|} OQS_KEM_ntruprime_sntrup761_keypair: 48| 10|OQS_API OQS_STATUS OQS_KEM_ntruprime_sntrup761_keypair(uint8_t *public_key, uint8_t *secret_key) { 49| 10| return (OQS_STATUS) OPENSSH_SNTRUP761_crypto_kem_keypair(public_key, secret_key); 50| 10|} OQS_KEM_ntruprime_sntrup761_encaps: 60| 10|OQS_API OQS_STATUS OQS_KEM_ntruprime_sntrup761_encaps(uint8_t *ciphertext, uint8_t *shared_secret, const uint8_t *public_key) { 61| 10| return (OQS_STATUS) OPENSSH_SNTRUP761_crypto_kem_enc(ciphertext, shared_secret, public_key); 62| 10|} OQS_KEM_ntruprime_sntrup761_decaps: 64| 10|OQS_API OQS_STATUS OQS_KEM_ntruprime_sntrup761_decaps(uint8_t *shared_secret, const uint8_t *ciphertext, const uint8_t *secret_key) { 65| 10| return (OQS_STATUS) OPENSSH_SNTRUP761_crypto_kem_dec(shared_secret, ciphertext, secret_key); 66| 10|} OPENSSH_SNTRUP761_crypto_kem_keypair: 2103| 10|int crypto_kem_sntrup761_keypair(unsigned char *pk, unsigned char *sk) { 2104| 10| int i; 2105| 10| ZKeyGen(pk, sk); 2106| 10| sk += SecretKeys_bytes; ------------------ | | 1703| 10|#define SecretKeys_bytes (2 * Small_bytes) | | ------------------ | | | | 1701| 10|#define Small_bytes ((p + 3) / 4) | | | | ------------------ | | | | | | 1694| 10|#define p 761 | | | | ------------------ | | ------------------ ------------------ 2107| 11.5k| for (i = 0; i < crypto_kem_sntrup761_PUBLICKEYBYTES; ++i) *sk++ = pk[i]; ------------------ | | 4| 11.5k|#define crypto_kem_sntrup761_PUBLICKEYBYTES 1158 ------------------ | Branch (2107:15): [True: 11.5k, False: 10] ------------------ 2108| 10| randombytes(sk, Small_bytes); ------------------ | | 10| 10|#define randombytes(buf,len) OQS_randombytes((uint8_t *)(buf),(len)) ------------------ 2109| 10| Hash_prefix(sk + Small_bytes, 4, pk, crypto_kem_sntrup761_PUBLICKEYBYTES); ------------------ | | 1701| 10|#define Small_bytes ((p + 3) / 4) | | ------------------ | | | | 1694| 10|#define p 761 | | ------------------ ------------------ Hash_prefix(sk + Small_bytes, 4, pk, crypto_kem_sntrup761_PUBLICKEYBYTES); ------------------ | | 4| 10|#define crypto_kem_sntrup761_PUBLICKEYBYTES 1158 ------------------ 2110| 10| return 0; 2111| 10|} OPENSSH_SNTRUP761_crypto_kem_enc: 2119| 10|int crypto_kem_sntrup761_enc(unsigned char *c, unsigned char *k, const unsigned char *pk) { 2120| 10| Inputs r; 2121| 10| unsigned char r_enc[Small_bytes], cache[Hash_bytes]; 2122| 10| Hash_prefix(cache, 4, pk, crypto_kem_sntrup761_PUBLICKEYBYTES); ------------------ | | 4| 10|#define crypto_kem_sntrup761_PUBLICKEYBYTES 1158 ------------------ 2123| 10| Short_random(r); 2124| 10| Hide(c, r_enc, r, pk, cache); 2125| 10| HashSession(k, 1, r_enc, c); 2126| 10| return 0; 2127| 10|} OPENSSH_SNTRUP761_crypto_kem_dec: 2136| 10|int crypto_kem_sntrup761_dec(unsigned char *k, const unsigned char *c, const unsigned char *sk) { 2137| 10| const unsigned char *pk = sk + SecretKeys_bytes; ------------------ | | 1703| 10|#define SecretKeys_bytes (2 * Small_bytes) | | ------------------ | | | | 1701| 10|#define Small_bytes ((p + 3) / 4) | | | | ------------------ | | | | | | 1694| 10|#define p 761 | | | | ------------------ | | ------------------ ------------------ 2138| 10| const unsigned char *rho = pk + crypto_kem_sntrup761_PUBLICKEYBYTES; ------------------ | | 4| 10|#define crypto_kem_sntrup761_PUBLICKEYBYTES 1158 ------------------ 2139| 10| const unsigned char *cache = rho + Small_bytes; ------------------ | | 1701| 10|#define Small_bytes ((p + 3) / 4) | | ------------------ | | | | 1694| 10|#define p 761 | | ------------------ ------------------ 2140| 10| Inputs r; 2141| 10| unsigned char r_enc[Small_bytes], cnew[crypto_kem_sntrup761_CIPHERTEXTBYTES]; 2142| 10| int mask, i; 2143| 10| ZDecrypt(r, c, sk); 2144| 10| Hide(cnew, r_enc, r, pk, cache); 2145| 10| mask = Ciphertexts_diff_mask(c, cnew); 2146| 1.92k| for (i = 0; i < Small_bytes; ++i) r_enc[i] ^= mask & (r_enc[i] ^ rho[i]); ------------------ | | 1701| 1.92k|#define Small_bytes ((p + 3) / 4) | | ------------------ | | | | 1694| 1.92k|#define p 761 | | ------------------ ------------------ | Branch (2146:15): [True: 1.91k, False: 10] ------------------ 2147| 10| HashSession(k, 1 + mask, r_enc, c); 2148| 10| return 0; 2149| 10|} sntrup761.c:ZKeyGen: 2062| 10|static void ZKeyGen(unsigned char *pk, unsigned char *sk) { 2063| 10| Fq h[p]; 2064| 10| small f[p], v[p]; 2065| 10| KeyGen(h, f, v); 2066| 10| Rq_encode(pk, h); 2067| 10| Small_encode(sk, f); 2068| 10| Small_encode(sk + Small_bytes, v); ------------------ | | 1701| 10|#define Small_bytes ((p + 3) / 4) | | ------------------ | | | | 1694| 10|#define p 761 | | ------------------ ------------------ 2069| 10|} sntrup761.c:KeyGen: 1977| 10|static void KeyGen(Fq *h, small *f, small *ginv) { 1978| 10| small g[p]; 1979| 10| Fq finv[p]; 1980| 10| for (;;) { 1981| 10| int result; 1982| 10| Small_random(g); 1983| 10| result = R3_recip(ginv, g); 1984| 10| crypto_declassify(&result, sizeof result); ------------------ | | 18| 10|#define crypto_declassify(x, y) do {} while (0) | | ------------------ | | | Branch (18:46): [Folded, False: 10] | | ------------------ ------------------ 1985| 10| if (result == 0) break; ------------------ | Branch (1985:9): [True: 10, False: 0] ------------------ 1986| 10| } 1987| 10| Short_random(f); 1988| 10| Rq_recip3(finv, f); 1989| 10| Rq_mult_small(h, finv, g); 1990| 10|} sntrup761.c:Small_random: 1970| 10|static void Small_random(small *out) { 1971| 10| int i; 1972| 10| uint32_t L[p]; 1973| 10| randombytes(L, sizeof(L)); ------------------ | | 10| 10|#define randombytes(buf,len) OQS_randombytes((uint8_t *)(buf),(len)) ------------------ 1974| 7.62k| for (i = 0; i < p; ++i) out[i] = (((L[i] & 0x3fffffff) * 3) >> 30) - 1; ------------------ | | 1694| 7.62k|#define p 761 ------------------ | Branch (1974:15): [True: 7.61k, False: 10] ------------------ 1975| 10| explicit_bzero(L, sizeof(L)); ------------------ | | 14| 10|#define explicit_bzero OQS_MEM_cleanse ------------------ 1976| 10|} sntrup761.c:R3_recip: 1840| 10|static int R3_recip(small *out, const small *in) { 1841| 10| small f[p + 1], g[p + 1], v[p + 1], r[p + 1]; 1842| 10| int sign, swap, t, i, loop, delta = 1; 1843| 7.63k| for (i = 0; i < p + 1; ++i) v[i] = 0; ------------------ | | 1694| 7.63k|#define p 761 ------------------ | Branch (1843:15): [True: 7.62k, False: 10] ------------------ 1844| 7.63k| for (i = 0; i < p + 1; ++i) r[i] = 0; ------------------ | | 1694| 7.63k|#define p 761 ------------------ | Branch (1844:15): [True: 7.62k, False: 10] ------------------ 1845| 10| r[0] = 1; 1846| 7.62k| for (i = 0; i < p; ++i) f[i] = 0; ------------------ | | 1694| 7.62k|#define p 761 ------------------ | Branch (1846:15): [True: 7.61k, False: 10] ------------------ 1847| 10| f[0] = 1; 1848| 10| f[p - 1] = f[p] = -1; ------------------ | | 1694| 10|#define p 761 ------------------ f[p - 1] = f[p] = -1; ------------------ | | 1694| 10|#define p 761 ------------------ 1849| 7.62k| for (i = 0; i < p; ++i) g[p - 1 - i] = in[i]; ------------------ | | 1694| 7.62k|#define p 761 ------------------ for (i = 0; i < p; ++i) g[p - 1 - i] = in[i]; ------------------ | | 1694| 7.61k|#define p 761 ------------------ | Branch (1849:15): [True: 7.61k, False: 10] ------------------ 1850| 10| g[p] = 0; ------------------ | | 1694| 10|#define p 761 ------------------ 1851| 15.2k| for (loop = 0; loop < 2 * p - 1; ++loop) { ------------------ | | 1694| 15.2k|#define p 761 ------------------ | Branch (1851:18): [True: 15.2k, False: 10] ------------------ 1852| 11.5M| for (i = p; i > 0; --i) v[i] = v[i - 1]; ------------------ | | 1694| 15.2k|#define p 761 ------------------ | Branch (1852:17): [True: 11.5M, False: 15.2k] ------------------ 1853| 15.2k| v[0] = 0; 1854| 15.2k| sign = -g[0] * f[0]; 1855| 15.2k| swap = crypto_int16_negative_mask(-delta) & crypto_int16_nonzero_mask(g[0]); 1856| 15.2k| delta ^= swap & (delta ^ -delta); 1857| 15.2k| delta += 1; 1858| 11.6M| for (i = 0; i < p + 1; ++i) { ------------------ | | 1694| 11.6M|#define p 761 ------------------ | Branch (1858:17): [True: 11.5M, False: 15.2k] ------------------ 1859| 11.5M| t = swap & (f[i] ^ g[i]); 1860| 11.5M| f[i] ^= t; 1861| 11.5M| g[i] ^= t; 1862| 11.5M| t = swap & (v[i] ^ r[i]); 1863| 11.5M| v[i] ^= t; 1864| 11.5M| r[i] ^= t; 1865| 11.5M| } 1866| 11.6M| for (i = 0; i < p + 1; ++i) g[i] = F3_freeze(g[i] + sign * f[i]); ------------------ | | 1694| 11.6M|#define p 761 ------------------ | Branch (1866:17): [True: 11.5M, False: 15.2k] ------------------ 1867| 11.6M| for (i = 0; i < p + 1; ++i) r[i] = F3_freeze(r[i] + sign * v[i]); ------------------ | | 1694| 11.6M|#define p 761 ------------------ | Branch (1867:17): [True: 11.5M, False: 15.2k] ------------------ 1868| 11.5M| for (i = 0; i < p; ++i) g[i] = g[i + 1]; ------------------ | | 1694| 11.5M|#define p 761 ------------------ | Branch (1868:17): [True: 11.5M, False: 15.2k] ------------------ 1869| 15.2k| g[p] = 0; ------------------ | | 1694| 15.2k|#define p 761 ------------------ 1870| 15.2k| } 1871| 10| sign = f[0]; 1872| 7.62k| for (i = 0; i < p; ++i) out[i] = sign * v[p - 1 - i]; ------------------ | | 1694| 7.62k|#define p 761 ------------------ for (i = 0; i < p; ++i) out[i] = sign * v[p - 1 - i]; ------------------ | | 1694| 7.61k|#define p 761 ------------------ | Branch (1872:15): [True: 7.61k, False: 10] ------------------ 1873| 10| return crypto_int16_nonzero_mask(delta); 1874| 10|} sntrup761.c:crypto_int16_negative_mask: 62| 30.4k|crypto_int16 crypto_int16_negative_mask(crypto_int16 crypto_int16_x) { 63| 30.4k|#if defined(__GNUC__) && defined(__x86_64__) 64| 30.4k| __asm__ ("sarw $15,%0" : "+r"(crypto_int16_x) : : "cc"); 65| 30.4k| return crypto_int16_x; 66| |#elif defined(__GNUC__) && defined(__aarch64__) 67| | crypto_int16 crypto_int16_y; 68| | __asm__ ("sbfx %w0,%w1,15,1" : "=r"(crypto_int16_y) : "r"(crypto_int16_x) : ); 69| | return crypto_int16_y; 70| |#else 71| | crypto_int16_x >>= 16-6; 72| | crypto_int16_x ^= crypto_int16_optblocker; 73| | crypto_int16_x >>= 5; 74| | return crypto_int16_x; 75| |#endif 76| 30.4k|} sntrup761.c:crypto_int16_nonzero_mask: 220| 30.4k|crypto_int16 crypto_int16_nonzero_mask(crypto_int16 crypto_int16_x) { 221| 30.4k|#if defined(__GNUC__) && defined(__x86_64__) 222| 30.4k| crypto_int16 crypto_int16_q,crypto_int16_z; ------------------ | | 39| 30.4k|#define crypto_int16 int16_t ------------------ 223| 30.4k| __asm__ ("xorw %0,%0\n movw $-1,%1\n testw %2,%2\n cmovnew %1,%0" : "=&r"(crypto_int16_z), "=&r"(crypto_int16_q) : "r"(crypto_int16_x) : "cc"); 224| 30.4k| return crypto_int16_z; 225| |#elif defined(__GNUC__) && defined(__aarch64__) 226| | crypto_int16 crypto_int16_z; 227| | __asm__ ("tst %w1,65535\n csetm %w0,ne" : "=r"(crypto_int16_z) : "r"(crypto_int16_x) : "cc"); 228| | return crypto_int16_z; 229| |#else 230| | crypto_int16_x |= -crypto_int16_x; 231| | return crypto_int16_negative_mask(crypto_int16_x); 232| |#endif 233| 30.4k|} sntrup761.c:F3_freeze: 1706| 23.2M|static small F3_freeze(int16_t x) { return x - 3 * ((10923 * x + 16384) >> 15); } sntrup761.c:Rq_recip3: 1902| 10|static int Rq_recip3(Fq *out, const small *in) { 1903| 10| Fq f[p + 1], g[p + 1], v[p + 1], r[p + 1], scale; 1904| 10| int swap, t, i, loop, delta = 1; 1905| 10| int32_t f0, g0; 1906| 7.63k| for (i = 0; i < p + 1; ++i) v[i] = 0; ------------------ | | 1694| 7.63k|#define p 761 ------------------ | Branch (1906:15): [True: 7.62k, False: 10] ------------------ 1907| 7.63k| for (i = 0; i < p + 1; ++i) r[i] = 0; ------------------ | | 1694| 7.63k|#define p 761 ------------------ | Branch (1907:15): [True: 7.62k, False: 10] ------------------ 1908| 10| r[0] = Fq_recip(3); 1909| 7.62k| for (i = 0; i < p; ++i) f[i] = 0; ------------------ | | 1694| 7.62k|#define p 761 ------------------ | Branch (1909:15): [True: 7.61k, False: 10] ------------------ 1910| 10| f[0] = 1; 1911| 10| f[p - 1] = f[p] = -1; ------------------ | | 1694| 10|#define p 761 ------------------ f[p - 1] = f[p] = -1; ------------------ | | 1694| 10|#define p 761 ------------------ 1912| 7.62k| for (i = 0; i < p; ++i) g[p - 1 - i] = in[i]; ------------------ | | 1694| 7.62k|#define p 761 ------------------ for (i = 0; i < p; ++i) g[p - 1 - i] = in[i]; ------------------ | | 1694| 7.61k|#define p 761 ------------------ | Branch (1912:15): [True: 7.61k, False: 10] ------------------ 1913| 10| g[p] = 0; ------------------ | | 1694| 10|#define p 761 ------------------ 1914| 15.2k| for (loop = 0; loop < 2 * p - 1; ++loop) { ------------------ | | 1694| 15.2k|#define p 761 ------------------ | Branch (1914:18): [True: 15.2k, False: 10] ------------------ 1915| 11.5M| for (i = p; i > 0; --i) v[i] = v[i - 1]; ------------------ | | 1694| 15.2k|#define p 761 ------------------ | Branch (1915:17): [True: 11.5M, False: 15.2k] ------------------ 1916| 15.2k| v[0] = 0; 1917| 15.2k| swap = crypto_int16_negative_mask(-delta) & crypto_int16_nonzero_mask(g[0]); 1918| 15.2k| delta ^= swap & (delta ^ -delta); 1919| 15.2k| delta += 1; 1920| 11.6M| for (i = 0; i < p + 1; ++i) { ------------------ | | 1694| 11.6M|#define p 761 ------------------ | Branch (1920:17): [True: 11.5M, False: 15.2k] ------------------ 1921| 11.5M| t = swap & (f[i] ^ g[i]); 1922| 11.5M| f[i] ^= t; 1923| 11.5M| g[i] ^= t; 1924| 11.5M| t = swap & (v[i] ^ r[i]); 1925| 11.5M| v[i] ^= t; 1926| 11.5M| r[i] ^= t; 1927| 11.5M| } 1928| 15.2k| f0 = f[0]; 1929| 15.2k| g0 = g[0]; 1930| 11.6M| for (i = 0; i < p + 1; ++i) g[i] = Fq_freeze(f0 * g[i] - g0 * f[i]); ------------------ | | 1694| 11.6M|#define p 761 ------------------ | Branch (1930:17): [True: 11.5M, False: 15.2k] ------------------ 1931| 11.6M| for (i = 0; i < p + 1; ++i) r[i] = Fq_freeze(f0 * r[i] - g0 * v[i]); ------------------ | | 1694| 11.6M|#define p 761 ------------------ | Branch (1931:17): [True: 11.5M, False: 15.2k] ------------------ 1932| 11.5M| for (i = 0; i < p; ++i) g[i] = g[i + 1]; ------------------ | | 1694| 11.5M|#define p 761 ------------------ | Branch (1932:17): [True: 11.5M, False: 15.2k] ------------------ 1933| 15.2k| g[p] = 0; ------------------ | | 1694| 15.2k|#define p 761 ------------------ 1934| 15.2k| } 1935| 10| scale = Fq_recip(f[0]); 1936| 7.62k| for (i = 0; i < p; ++i) out[i] = Fq_freeze(scale * (int32_t)v[p - 1 - i]); ------------------ | | 1694| 7.62k|#define p 761 ------------------ for (i = 0; i < p; ++i) out[i] = Fq_freeze(scale * (int32_t)v[p - 1 - i]); ------------------ | | 1694| 7.61k|#define p 761 ------------------ | Branch (1936:15): [True: 7.61k, False: 10] ------------------ 1937| 10| return crypto_int16_nonzero_mask(delta); 1938| 10|} sntrup761.c:Fq_recip: 1892| 20|static Fq Fq_recip(Fq a1) { 1893| 20| int i = 1; 1894| 20| Fq ai = a1; 1895| 91.7k| while (i < q - 2) { ------------------ | | 1695| 91.7k|#define q 4591 ------------------ | Branch (1895:10): [True: 91.7k, False: 20] ------------------ 1896| 91.7k| ai = Fq_freeze(a1 * (int32_t)ai); 1897| 91.7k| i += 1; 1898| 91.7k| } 1899| 20| return ai; 1900| 20|} sntrup761.c:Fq_freeze: 1708| 23.3M|static Fq Fq_freeze(int32_t x) { 1709| 23.3M| const int32_t q16 = (0x10000 + q / 2) / q; ------------------ | | 1695| 23.3M|#define q 4591 ------------------ const int32_t q16 = (0x10000 + q / 2) / q; ------------------ | | 1695| 23.3M|#define q 4591 ------------------ 1710| 23.3M| const int32_t q20 = (0x100000 + q / 2) / q; ------------------ | | 1695| 23.3M|#define q 4591 ------------------ const int32_t q20 = (0x100000 + q / 2) / q; ------------------ | | 1695| 23.3M|#define q 4591 ------------------ 1711| 23.3M| const int32_t q28 = (0x10000000 + q / 2) / q; ------------------ | | 1695| 23.3M|#define q 4591 ------------------ const int32_t q28 = (0x10000000 + q / 2) / q; ------------------ | | 1695| 23.3M|#define q 4591 ------------------ 1712| 23.3M| x -= q * ((q16 * x) >> 16); ------------------ | | 1695| 23.3M|#define q 4591 ------------------ 1713| 23.3M| x -= q * ((q20 * x) >> 20); ------------------ | | 1695| 23.3M|#define q 4591 ------------------ 1714| 23.3M| return x - q * ((q28 * x + 0x8000000) >> 28); ------------------ | | 1695| 23.3M|#define q 4591 ------------------ 1715| 23.3M|} sntrup761.c:Rq_mult_small: 1876| 40|static void Rq_mult_small(Fq *h, const Fq *f, const small *g) { 1877| 40| int32_t fg[p + p - 1]; 1878| 40| int i, j; 1879| 60.8k| for (i = 0; i < p + p - 1; ++i) fg[i] = 0; ------------------ | | 1694| 60.8k|#define p 761 ------------------ for (i = 0; i < p + p - 1; ++i) fg[i] = 0; ------------------ | | 1694| 60.8k|#define p 761 ------------------ | Branch (1879:15): [True: 60.8k, False: 40] ------------------ 1880| 30.4k| for (i = 0; i < p; ++i) ------------------ | | 1694| 30.4k|#define p 761 ------------------ | Branch (1880:15): [True: 30.4k, False: 40] ------------------ 1881| 23.1M| for (j = 0; j < p; ++j) fg[i + j] += f[i] * (int32_t)g[j]; ------------------ | | 1694| 23.1M|#define p 761 ------------------ | Branch (1881:17): [True: 23.1M, False: 30.4k] ------------------ 1882| 30.4k| for (i = p; i < p + p - 1; ++i) fg[i - p] += fg[i]; ------------------ | | 1694| 40|#define p 761 ------------------ for (i = p; i < p + p - 1; ++i) fg[i - p] += fg[i]; ------------------ | | 1694| 30.4k|#define p 761 ------------------ for (i = p; i < p + p - 1; ++i) fg[i - p] += fg[i]; ------------------ | | 1694| 30.4k|#define p 761 ------------------ for (i = p; i < p + p - 1; ++i) fg[i - p] += fg[i]; ------------------ | | 1694| 30.4k|#define p 761 ------------------ | Branch (1882:15): [True: 30.4k, False: 40] ------------------ 1883| 30.4k| for (i = p; i < p + p - 1; ++i) fg[i - p + 1] += fg[i]; ------------------ | | 1694| 40|#define p 761 ------------------ for (i = p; i < p + p - 1; ++i) fg[i - p + 1] += fg[i]; ------------------ | | 1694| 30.4k|#define p 761 ------------------ for (i = p; i < p + p - 1; ++i) fg[i - p + 1] += fg[i]; ------------------ | | 1694| 30.4k|#define p 761 ------------------ for (i = p; i < p + p - 1; ++i) fg[i - p + 1] += fg[i]; ------------------ | | 1694| 30.4k|#define p 761 ------------------ | Branch (1883:15): [True: 30.4k, False: 40] ------------------ 1884| 30.4k| for (i = 0; i < p; ++i) h[i] = Fq_freeze(fg[i]); ------------------ | | 1694| 30.4k|#define p 761 ------------------ | Branch (1884:15): [True: 30.4k, False: 40] ------------------ 1885| 40|} sntrup761.c:Rq_encode: 2030| 10|static void Rq_encode(unsigned char *s, const Fq *r) { 2031| 10| uint16_t R[p], M[p]; 2032| 10| int i; 2033| 7.62k| for (i = 0; i < p; ++i) R[i] = r[i] + q12; ------------------ | | 1694| 7.62k|#define p 761 ------------------ for (i = 0; i < p; ++i) R[i] = r[i] + q12; ------------------ | | 1697| 7.61k|#define q12 ((q - 1) / 2) | | ------------------ | | | | 1695| 7.61k|#define q 4591 | | ------------------ ------------------ | Branch (2033:15): [True: 7.61k, False: 10] ------------------ 2034| 7.62k| for (i = 0; i < p; ++i) M[i] = q; ------------------ | | 1694| 7.62k|#define p 761 ------------------ for (i = 0; i < p; ++i) M[i] = q; ------------------ | | 1695| 7.61k|#define q 4591 ------------------ | Branch (2034:15): [True: 7.61k, False: 10] ------------------ 2035| 10| Encode(s, R, M, p); ------------------ | | 1694| 10|#define p 761 ------------------ 2036| 10|} sntrup761.c:Encode: 1746| 330|static void Encode(unsigned char *out, const uint16_t *R, const uint16_t *M, long long len) { 1747| 330| if (len == 1) { ------------------ | Branch (1747:7): [True: 30, False: 300] ------------------ 1748| 30| uint16_t r = R[0], m = M[0]; 1749| 90| while (m > 1) { ------------------ | Branch (1749:12): [True: 60, False: 30] ------------------ 1750| 60| *out++ = r; 1751| 60| r >>= 8; 1752| 60| m = (m + 255) >> 8; 1753| 60| } 1754| 30| } 1755| 330| if (len > 1) { ------------------ | Branch (1755:7): [True: 300, False: 30] ------------------ 1756| 300| uint16_t *R2 = (uint16_t *)alloca(sizeof(uint16_t) * ((len + 1) / 2)), *M2 = (uint16_t *)alloca(sizeof(uint16_t) * ((len + 1) / 2)); 1757| 300| long long i; 1758| 23.1k| for (i = 0; i < len - 1; i += 2) { ------------------ | Branch (1758:17): [True: 22.8k, False: 300] ------------------ 1759| 22.8k| uint32_t m0 = M[i]; 1760| 22.8k| uint32_t r = R[i] + R[i + 1] * m0; 1761| 22.8k| uint32_t m = M[i + 1] * m0; 1762| 54.4k| while (m >= 16384) { ------------------ | Branch (1762:14): [True: 31.6k, False: 22.8k] ------------------ 1763| 31.6k| *out++ = r; 1764| 31.6k| r >>= 8; 1765| 31.6k| m = (m + 255) >> 8; 1766| 31.6k| } 1767| 22.8k| R2[i / 2] = r; 1768| 22.8k| M2[i / 2] = m; 1769| 22.8k| } 1770| 300| if (i < len) { ------------------ | Branch (1770:9): [True: 120, False: 180] ------------------ 1771| 120| R2[i / 2] = R[i]; 1772| 120| M2[i / 2] = M[i]; 1773| 120| } 1774| 300| Encode(out, R2, M2, (len + 1) / 2); 1775| 300| } 1776| 330|} sntrup761.c:Small_encode: 2011| 40|static void Small_encode(unsigned char *s, const small *f) { 2012| 40| int i, j; 2013| 7.64k| for (i = 0; i < p / 4; ++i) { ------------------ | | 1694| 7.64k|#define p 761 ------------------ | Branch (2013:15): [True: 7.60k, False: 40] ------------------ 2014| 7.60k| small x = 0; 2015| 38.0k| for (j = 0;j < 4;++j) x += (*f++ + 1) << (2 * j); ------------------ | Branch (2015:16): [True: 30.4k, False: 7.60k] ------------------ 2016| 7.60k| *s++ = x; 2017| 7.60k| } 2018| 40| *s = *f++ + 1; 2019| 40|} sntrup761.c:Hash_prefix: 1954| 100|static void Hash_prefix(unsigned char *out, int b, const unsigned char *in, int inlen) { 1955| 100| unsigned char *x = (unsigned char *)alloca(inlen + 1), h[64]; 1956| 100| int i; 1957| 100| x[0] = b; 1958| 53.6k| for (i = 0; i < inlen; ++i) x[i + 1] = in[i]; ------------------ | Branch (1958:15): [True: 53.5k, False: 100] ------------------ 1959| 100| crypto_hash_sha512(h, x, inlen + 1); ------------------ | | 9| 100|#define crypto_hash_sha512 OQS_SHA2_sha512 ------------------ 1960| 3.30k| for (i = 0; i < 32; ++i) out[i] = h[i]; ------------------ | Branch (1960:15): [True: 3.20k, False: 100] ------------------ 1961| 100|} sntrup761.c:Short_random: 1964| 20|static void Short_random(small *out) { 1965| 20| uint32_t L[p]; 1966| 20| randombytes(L, sizeof(L)); ------------------ | | 10| 20|#define randombytes(buf,len) OQS_randombytes((uint8_t *)(buf),(len)) ------------------ 1967| 20| Short_fromlist(out, L); 1968| 20| explicit_bzero(L, sizeof(L)); ------------------ | | 14| 20|#define explicit_bzero OQS_MEM_cleanse ------------------ 1969| 20|} sntrup761.c:Short_fromlist: 1945| 20|static void Short_fromlist(small *out, const uint32_t *in) { 1946| 20| uint32_t L[p]; 1947| 20| int i; 1948| 5.74k| for (i = 0; i < w; ++i) L[i] = in[i] & (uint32_t)-2; ------------------ | | 1696| 5.74k|#define w 286 ------------------ | Branch (1948:15): [True: 5.72k, False: 20] ------------------ 1949| 9.52k| for (i = w; i < p; ++i) L[i] = (in[i] & (uint32_t)-3) | 1; ------------------ | | 1696| 20|#define w 286 ------------------ for (i = w; i < p; ++i) L[i] = (in[i] & (uint32_t)-3) | 1; ------------------ | | 1694| 9.52k|#define p 761 ------------------ | Branch (1949:15): [True: 9.50k, False: 20] ------------------ 1950| 20| crypto_sort_uint32(L, p); ------------------ | | 1694| 20|#define p 761 ------------------ 1951| 15.2k| for (i = 0; i < p; ++i) out[i] = (L[i] & 3) - 1; ------------------ | | 1694| 15.2k|#define p 761 ------------------ | Branch (1951:15): [True: 15.2k, False: 20] ------------------ 1952| 20|} sntrup761.c:crypto_sort_uint32: 1683| 20|{ 1684| 20| crypto_uint32 *x = array; ------------------ | | 6| 20|#define crypto_uint32 uint32_t ------------------ 1685| 20| long long j; 1686| 15.2k| for (j = 0;j < n;++j) x[j] ^= 0x80000000; ------------------ | Branch (1686:14): [True: 15.2k, False: 20] ------------------ 1687| 20| crypto_sort_int32(array,n); 1688| 15.2k| for (j = 0;j < n;++j) x[j] ^= 0x80000000; ------------------ | Branch (1688:14): [True: 15.2k, False: 20] ------------------ 1689| 20|} sntrup761.c:crypto_sort_int32: 1620| 20|{ 1621| 20| long long top,p,q,r,i,j; 1622| 20| int32 *x = array; ------------------ | | 24| 20|#define int32 crypto_int32 | | ------------------ | | | | 562| 20|#define crypto_int32 int32_t | | ------------------ ------------------ 1623| | 1624| 20| if (n < 2) return; ------------------ | Branch (1624:7): [True: 0, False: 20] ------------------ 1625| 20| top = 1; 1626| 200| while (top < n - top) top += top; ------------------ | Branch (1626:10): [True: 180, False: 20] ------------------ 1627| | 1628| 220| for (p = top;p >= 1;p >>= 1) { ------------------ | Branch (1628:16): [True: 200, False: 20] ------------------ 1629| 200| i = 0; 1630| 15.2k| while (i + 2 * p <= n) { ------------------ | Branch (1630:12): [True: 15.0k, False: 200] ------------------ 1631| 76.4k| for (j = i;j < i + p;++j) ------------------ | Branch (1631:18): [True: 61.3k, False: 15.0k] ------------------ 1632| 61.3k| int32_MINMAX(x[j],x[j+p]); ------------------ | | 1617| 61.3k|#define int32_MINMAX(a,b) crypto_int32_minmax(&a,&b) ------------------ 1633| 15.0k| i += 2 * p; 1634| 15.0k| } 1635| 9.44k| for (j = i;j < n - p;++j) ------------------ | Branch (1635:16): [True: 9.24k, False: 200] ------------------ 1636| 9.24k| int32_MINMAX(x[j],x[j+p]); ------------------ | | 1617| 9.24k|#define int32_MINMAX(a,b) crypto_int32_minmax(&a,&b) ------------------ 1637| | 1638| 200| i = 0; 1639| 200| j = 0; 1640| 1.10k| for (q = top;q > p;q >>= 1) { ------------------ | Branch (1640:18): [True: 900, False: 200] ------------------ 1641| 900| if (j != i) for (;;) { ------------------ | Branch (1641:11): [True: 260, False: 640] ------------------ 1642| 500| if (j == n - q) goto done; ------------------ | Branch (1642:13): [True: 0, False: 500] ------------------ 1643| 500| int32 a = x[j + p]; ------------------ | | 24| 500|#define int32 crypto_int32 | | ------------------ | | | | 562| 500|#define crypto_int32 int32_t | | ------------------ ------------------ 1644| 2.32k| for (r = q;r > p;r >>= 1) ------------------ | Branch (1644:20): [True: 1.82k, False: 500] ------------------ 1645| 1.82k| int32_MINMAX(a,x[j + r]); ------------------ | | 1617| 2.32k|#define int32_MINMAX(a,b) crypto_int32_minmax(&a,&b) ------------------ 1646| 500| x[j + p] = a; 1647| 500| ++j; 1648| 500| if (j == i + p) { ------------------ | Branch (1648:13): [True: 260, False: 240] ------------------ 1649| 260| i += 2 * p; 1650| 260| break; 1651| 260| } 1652| 500| } 1653| 15.6k| while (i + p <= n - q) { ------------------ | Branch (1653:14): [True: 14.7k, False: 900] ------------------ 1654| 70.1k| for (j = i;j < i + p;++j) { ------------------ | Branch (1654:20): [True: 55.3k, False: 14.7k] ------------------ 1655| 55.3k| int32 a = x[j + p]; ------------------ | | 24| 55.3k|#define int32 crypto_int32 | | ------------------ | | | | 562| 55.3k|#define crypto_int32 int32_t | | ------------------ ------------------ 1656| 311k| for (r = q;r > p;r >>= 1) ------------------ | Branch (1656:22): [True: 256k, False: 55.3k] ------------------ 1657| 256k| int32_MINMAX(a,x[j+r]); ------------------ | | 1617| 256k|#define int32_MINMAX(a,b) crypto_int32_minmax(&a,&b) ------------------ 1658| 55.3k| x[j + p] = a; 1659| 55.3k| } 1660| 14.7k| i += 2 * p; 1661| 14.7k| } 1662| | /* now i + p > n - q */ 1663| 900| j = i; 1664| 6.18k| while (j < n - q) { ------------------ | Branch (1664:14): [True: 5.28k, False: 900] ------------------ 1665| 5.28k| int32 a = x[j + p]; ------------------ | | 24| 5.28k|#define int32 crypto_int32 | | ------------------ | | | | 562| 5.28k|#define crypto_int32 int32_t | | ------------------ ------------------ 1666| 11.5k| for (r = q;r > p;r >>= 1) ------------------ | Branch (1666:20): [True: 6.26k, False: 5.28k] ------------------ 1667| 6.26k| int32_MINMAX(a,x[j+r]); ------------------ | | 1617| 6.26k|#define int32_MINMAX(a,b) crypto_int32_minmax(&a,&b) ------------------ 1668| 5.28k| x[j + p] = a; 1669| 5.28k| ++j; 1670| 5.28k| } 1671| | 1672| 900| done: ; 1673| 900| } 1674| 200| } 1675| 20|} sntrup761.c:crypto_int32_minmax: 949| 335k|void crypto_int32_minmax(crypto_int32 *crypto_int32_p,crypto_int32 *crypto_int32_q) { 950| 335k| crypto_int32 crypto_int32_x = *crypto_int32_p; ------------------ | | 562| 335k|#define crypto_int32 int32_t ------------------ 951| 335k| crypto_int32 crypto_int32_y = *crypto_int32_q; ------------------ | | 562| 335k|#define crypto_int32 int32_t ------------------ 952| 335k|#if defined(__GNUC__) && defined(__x86_64__) 953| 335k| crypto_int32 crypto_int32_z; ------------------ | | 562| 335k|#define crypto_int32 int32_t ------------------ 954| 335k| __asm__ ("cmpl %2,%1\n movl %1,%0\n cmovgl %2,%1\n cmovgl %0,%2" : "=&r"(crypto_int32_z), "+&r"(crypto_int32_x), "+r"(crypto_int32_y) : : "cc"); 955| 335k| *crypto_int32_p = crypto_int32_x; 956| 335k| *crypto_int32_q = crypto_int32_y; 957| |#elif defined(__GNUC__) && defined(__aarch64__) 958| | crypto_int32 crypto_int32_r, crypto_int32_s; 959| | __asm__ ("cmp %w2,%w3\n csel %w0,%w2,%w3,lt\n csel %w1,%w3,%w2,lt" : "=&r"(crypto_int32_r), "=r"(crypto_int32_s) : "r"(crypto_int32_x), "r"(crypto_int32_y) : "cc"); 960| | *crypto_int32_p = crypto_int32_r; 961| | *crypto_int32_q = crypto_int32_s; 962| |#else 963| | crypto_int64 crypto_int32_r = (crypto_int64)crypto_int32_y ^ (crypto_int64)crypto_int32_x; 964| | crypto_int64 crypto_int32_z = (crypto_int64)crypto_int32_y - (crypto_int64)crypto_int32_x; 965| | crypto_int32_z ^= crypto_int32_r & (crypto_int32_z ^ crypto_int32_y); 966| | crypto_int32_z = crypto_int32_negative_mask(crypto_int32_z); 967| | crypto_int32_z &= crypto_int32_r; 968| | crypto_int32_x ^= crypto_int32_z; 969| | crypto_int32_y ^= crypto_int32_z; 970| | *crypto_int32_p = crypto_int32_x; 971| | *crypto_int32_q = crypto_int32_y; 972| |#endif 973| 335k|} sntrup761.c:Hide: 2113| 20|static void Hide(unsigned char *c, unsigned char *r_enc, const Inputs r, const unsigned char *pk, const unsigned char *cache) { 2114| 20| Small_encode(r_enc, r); 2115| 20| ZEncrypt(c, r, pk); 2116| 20| HashConfirm(c + crypto_kem_sntrup761_CIPHERTEXTBYTES - Confirm_bytes, r_enc, cache); ------------------ | | 6| 20|#define crypto_kem_sntrup761_CIPHERTEXTBYTES 1039 ------------------ HashConfirm(c + crypto_kem_sntrup761_CIPHERTEXTBYTES - Confirm_bytes, r_enc, cache); ------------------ | | 1704| 20|#define Confirm_bytes 32 ------------------ 2117| 20|} sntrup761.c:ZEncrypt: 2071| 20|static void ZEncrypt(unsigned char *C, const Inputs r, const unsigned char *pk) { 2072| 20| Fq h[p], c[p]; 2073| 20| Rq_decode(h, pk); 2074| 20| Encrypt(c, r, h); 2075| 20| Rounded_encode(C, c); 2076| 20|} sntrup761.c:Rq_decode: 2038| 20|static void Rq_decode(Fq *r, const unsigned char *s) { 2039| 20| uint16_t R[p], M[p]; 2040| 20| int i; 2041| 15.2k| for (i = 0; i < p; ++i) M[i] = q; ------------------ | | 1694| 15.2k|#define p 761 ------------------ for (i = 0; i < p; ++i) M[i] = q; ------------------ | | 1695| 15.2k|#define q 4591 ------------------ | Branch (2041:15): [True: 15.2k, False: 20] ------------------ 2042| 20| Decode(R, s, M, p); ------------------ | | 1694| 20|#define p 761 ------------------ 2043| 15.2k| for (i = 0; i < p; ++i) r[i] = ((Fq)R[i]) - q12; ------------------ | | 1694| 15.2k|#define p 761 ------------------ for (i = 0; i < p; ++i) r[i] = ((Fq)R[i]) - q12; ------------------ | | 1697| 15.2k|#define q12 ((q - 1) / 2) | | ------------------ | | | | 1695| 15.2k|#define q 4591 | | ------------------ ------------------ | Branch (2043:15): [True: 15.2k, False: 20] ------------------ 2044| 20|} sntrup761.c:Decode: 1778| 330|static void Decode(uint16_t *out, const unsigned char *S, const uint16_t *M, long long len) { 1779| 330| if (len == 1) { ------------------ | Branch (1779:7): [True: 30, False: 300] ------------------ 1780| 30| if (M[0] == 1) ------------------ | Branch (1780:9): [True: 0, False: 30] ------------------ 1781| 0| *out = 0; 1782| 30| else if (M[0] <= 256) ------------------ | Branch (1782:14): [True: 0, False: 30] ------------------ 1783| 0| *out = uint32_mod_uint14(S[0], M[0]); 1784| 30| else 1785| 30| *out = uint32_mod_uint14(S[0] + (((uint16_t)S[1]) << 8), M[0]); 1786| 30| } 1787| 330| if (len > 1) { ------------------ | Branch (1787:7): [True: 300, False: 30] ------------------ 1788| 300| uint16_t *R2 = (uint16_t *)alloca(sizeof(uint16_t) * ((len + 1) / 2)), *M2 = (uint16_t *)alloca(sizeof(uint16_t) * ((len + 1) / 2)), *bottomr = (uint16_t *)alloca(sizeof(uint16_t) * (len / 2)); 1789| 300| uint32_t *bottomt = (uint32_t *)alloca(sizeof(uint32_t) * (len / 2)); 1790| 300| long long i; 1791| 23.1k| for (i = 0; i < len - 1; i += 2) { ------------------ | Branch (1791:17): [True: 22.8k, False: 300] ------------------ 1792| 22.8k| uint32_t m = M[i] * (uint32_t)M[i + 1]; 1793| 22.8k| if (m > 256 * 16383) { ------------------ | Branch (1793:11): [True: 10.3k, False: 12.4k] ------------------ 1794| 10.3k| bottomt[i / 2] = 256 * 256; 1795| 10.3k| bottomr[i / 2] = S[0] + 256 * S[1]; 1796| 10.3k| S += 2; 1797| 10.3k| M2[i / 2] = (((m + 255) >> 8) + 255) >> 8; 1798| 12.4k| } else if (m >= 16384) { ------------------ | Branch (1798:18): [True: 12.4k, False: 0] ------------------ 1799| 12.4k| bottomt[i / 2] = 256; 1800| 12.4k| bottomr[i / 2] = S[0]; 1801| 12.4k| S += 1; 1802| 12.4k| M2[i / 2] = (m + 255) >> 8; 1803| 12.4k| } else { 1804| 0| bottomt[i / 2] = 1; 1805| 0| bottomr[i / 2] = 0; 1806| 0| M2[i / 2] = m; 1807| 0| } 1808| 22.8k| } 1809| 300| if (i < len) M2[i / 2] = M[i]; ------------------ | Branch (1809:9): [True: 120, False: 180] ------------------ 1810| 300| Decode(R2, S, M2, (len + 1) / 2); 1811| 23.1k| for (i = 0; i < len - 1; i += 2) { ------------------ | Branch (1811:17): [True: 22.8k, False: 300] ------------------ 1812| 22.8k| uint32_t r1, r = bottomr[i / 2]; 1813| 22.8k| uint16_t r0; 1814| 22.8k| r += bottomt[i / 2] * R2[i / 2]; 1815| 22.8k| uint32_divmod_uint14(&r1, &r0, r, M[i]); 1816| 22.8k| r1 = uint32_mod_uint14(r1, M[i + 1]); 1817| 22.8k| *out++ = r0; 1818| 22.8k| *out++ = r1; 1819| 22.8k| } 1820| 300| if (i < len) *out++ = R2[i / 2]; ------------------ | Branch (1820:9): [True: 120, False: 180] ------------------ 1821| 300| } 1822| 330|} sntrup761.c:uint32_mod_uint14: 1739| 22.8k|static uint16_t uint32_mod_uint14(uint32_t x, uint16_t m) { 1740| 22.8k| uint32_t Q; 1741| 22.8k| uint16_t r; 1742| 22.8k| uint32_divmod_uint14(&Q, &r, x, m); 1743| 22.8k| return r; 1744| 22.8k|} sntrup761.c:uint32_divmod_uint14: 1723| 45.6k|static void uint32_divmod_uint14(uint32_t *Q, uint16_t *r, uint32_t x, uint16_t m) { 1724| 45.6k| uint32_t qpart, mask, v = 0x80000000 / m; 1725| 45.6k| qpart = (x * (uint64_t)v) >> 31; 1726| 45.6k| x -= qpart * m; 1727| 45.6k| *Q = qpart; 1728| 45.6k| qpart = (x * (uint64_t)v) >> 31; 1729| 45.6k| x -= qpart * m; 1730| 45.6k| *Q += qpart; 1731| 45.6k| x -= m; 1732| 45.6k| *Q += 1; 1733| 45.6k| mask = crypto_int32_negative_mask(x); 1734| 45.6k| x += mask & (uint32_t)m; 1735| 45.6k| *Q += mask; 1736| 45.6k| *r = x; 1737| 45.6k|} sntrup761.c:crypto_int32_negative_mask: 589| 45.6k|crypto_int32 crypto_int32_negative_mask(crypto_int32 crypto_int32_x) { 590| 45.6k|#if defined(__GNUC__) && defined(__x86_64__) 591| 45.6k| __asm__ ("sarl $31,%0" : "+r"(crypto_int32_x) : : "cc"); 592| 45.6k| return crypto_int32_x; 593| |#elif defined(__GNUC__) && defined(__aarch64__) 594| | crypto_int32 crypto_int32_y; 595| | __asm__ ("asr %w0,%w1,31" : "=r"(crypto_int32_y) : "r"(crypto_int32_x) : ); 596| | return crypto_int32_y; 597| |#else 598| | crypto_int32_x >>= 32-6; 599| | crypto_int32_x ^= crypto_int32_optblocker; 600| | crypto_int32_x >>= 5; 601| | return crypto_int32_x; 602| |#endif 603| 45.6k|} sntrup761.c:Encrypt: 1992| 20|static void Encrypt(Fq *c, const small *r, const Fq *h) { 1993| 20| Fq hr[p]; 1994| 20| Rq_mult_small(hr, h, r); 1995| 20| Round(c, hr); 1996| 20|} sntrup761.c:Round: 1940| 20|static void Round(Fq *out, const Fq *a) { 1941| 20| int i; 1942| 15.2k| for (i = 0; i < p; ++i) out[i] = a[i] - F3_freeze(a[i]); ------------------ | | 1694| 15.2k|#define p 761 ------------------ | Branch (1942:15): [True: 15.2k, False: 20] ------------------ 1943| 20|} sntrup761.c:Rounded_encode: 2046| 20|static void Rounded_encode(unsigned char *s, const Fq *r) { 2047| 20| uint16_t R[p], M[p]; 2048| 20| int i; 2049| 15.2k| for (i = 0; i < p; ++i) R[i] = ((r[i] + q12) * 10923) >> 15; ------------------ | | 1694| 15.2k|#define p 761 ------------------ for (i = 0; i < p; ++i) R[i] = ((r[i] + q12) * 10923) >> 15; ------------------ | | 1697| 15.2k|#define q12 ((q - 1) / 2) | | ------------------ | | | | 1695| 15.2k|#define q 4591 | | ------------------ ------------------ | Branch (2049:15): [True: 15.2k, False: 20] ------------------ 2050| 15.2k| for (i = 0; i < p; ++i) M[i] = (q + 2) / 3; ------------------ | | 1694| 15.2k|#define p 761 ------------------ for (i = 0; i < p; ++i) M[i] = (q + 2) / 3; ------------------ | | 1695| 15.2k|#define q 4591 ------------------ | Branch (2050:15): [True: 15.2k, False: 20] ------------------ 2051| 20| Encode(s, R, M, p); ------------------ | | 1694| 20|#define p 761 ------------------ 2052| 20|} sntrup761.c:HashConfirm: 2087| 20|static void HashConfirm(unsigned char *h, const unsigned char *r, const unsigned char *cache) { 2088| 20| unsigned char x[Hash_bytes * 2]; 2089| 20| int i; 2090| 20| Hash_prefix(x, 3, r, Small_bytes); ------------------ | | 1701| 20|#define Small_bytes ((p + 3) / 4) | | ------------------ | | | | 1694| 20|#define p 761 | | ------------------ ------------------ 2091| 660| for (i = 0; i < Hash_bytes; ++i) x[Hash_bytes + i] = cache[i]; ------------------ | | 1700| 660|#define Hash_bytes 32 ------------------ for (i = 0; i < Hash_bytes; ++i) x[Hash_bytes + i] = cache[i]; ------------------ | | 1700| 640|#define Hash_bytes 32 ------------------ | Branch (2091:15): [True: 640, False: 20] ------------------ 2092| 20| Hash_prefix(h, 2, x, sizeof x); 2093| 20|} sntrup761.c:HashSession: 2095| 20|static void HashSession(unsigned char *k, int b, const unsigned char *y, const unsigned char *z) { 2096| 20| unsigned char x[Hash_bytes + crypto_kem_sntrup761_CIPHERTEXTBYTES]; 2097| 20| int i; 2098| 20| Hash_prefix(x, 3, y, Small_bytes); ------------------ | | 1701| 20|#define Small_bytes ((p + 3) / 4) | | ------------------ | | | | 1694| 20|#define p 761 | | ------------------ ------------------ 2099| 20.8k| for (i = 0; i < crypto_kem_sntrup761_CIPHERTEXTBYTES; ++i) x[Hash_bytes + i] = z[i]; ------------------ | | 6| 20.8k|#define crypto_kem_sntrup761_CIPHERTEXTBYTES 1039 ------------------ for (i = 0; i < crypto_kem_sntrup761_CIPHERTEXTBYTES; ++i) x[Hash_bytes + i] = z[i]; ------------------ | | 1700| 20.7k|#define Hash_bytes 32 ------------------ | Branch (2099:15): [True: 20.7k, False: 20] ------------------ 2100| 20| Hash_prefix(k, b, x, sizeof x); 2101| 20|} sntrup761.c:ZDecrypt: 2078| 10|static void ZDecrypt(Inputs r, const unsigned char *C, const unsigned char *sk) { 2079| 10| small f[p], v[p]; 2080| 10| Fq c[p]; 2081| 10| Small_decode(f, sk); 2082| 10| Small_decode(v, sk + Small_bytes); ------------------ | | 1701| 10|#define Small_bytes ((p + 3) / 4) | | ------------------ | | | | 1694| 10|#define p 761 | | ------------------ ------------------ 2083| 10| Rounded_decode(c, C); 2084| 10| Decrypt(r, c, f, v); 2085| 10|} sntrup761.c:Small_decode: 2021| 20|static void Small_decode(small *f, const unsigned char *s) { 2022| 20| int i, j; 2023| 3.82k| for (i = 0; i < p / 4; ++i) { ------------------ | | 1694| 3.82k|#define p 761 ------------------ | Branch (2023:15): [True: 3.80k, False: 20] ------------------ 2024| 3.80k| unsigned char x = *s++; 2025| 19.0k| for (j = 0;j < 4;++j) *f++ = ((small)((x >> (2 * j)) & 3)) - 1; ------------------ | Branch (2025:16): [True: 15.2k, False: 3.80k] ------------------ 2026| 3.80k| } 2027| 20| *f++ = ((small)(*s & 3)) - 1; 2028| 20|} sntrup761.c:Rounded_decode: 2054| 10|static void Rounded_decode(Fq *r, const unsigned char *s) { 2055| 10| uint16_t R[p], M[p]; 2056| 10| int i; 2057| 7.62k| for (i = 0; i < p; ++i) M[i] = (q + 2) / 3; ------------------ | | 1694| 7.62k|#define p 761 ------------------ for (i = 0; i < p; ++i) M[i] = (q + 2) / 3; ------------------ | | 1695| 7.61k|#define q 4591 ------------------ | Branch (2057:15): [True: 7.61k, False: 10] ------------------ 2058| 10| Decode(R, s, M, p); ------------------ | | 1694| 10|#define p 761 ------------------ 2059| 7.62k| for (i = 0; i < p; ++i) r[i] = R[i] * 3 - q12; ------------------ | | 1694| 7.62k|#define p 761 ------------------ for (i = 0; i < p; ++i) r[i] = R[i] * 3 - q12; ------------------ | | 1697| 7.61k|#define q12 ((q - 1) / 2) | | ------------------ | | | | 1695| 7.61k|#define q 4591 | | ------------------ ------------------ | Branch (2059:15): [True: 7.61k, False: 10] ------------------ 2060| 10|} sntrup761.c:Decrypt: 1998| 10|static void Decrypt(small *r, const Fq *c, const small *f, const small *ginv) { 1999| 10| Fq cf[p], cf3[p]; 2000| 10| small e[p], ev[p]; 2001| 10| int mask, i; 2002| 10| Rq_mult_small(cf, c, f); 2003| 10| Rq_mult3(cf3, cf); 2004| 10| R3_fromRq(e, cf3); 2005| 10| R3_mult(ev, e, ginv); 2006| 10| mask = Weightw_mask(ev); 2007| 2.87k| for (i = 0; i < w; ++i) r[i] = ((ev[i] ^ 1) & ~mask) ^ 1; ------------------ | | 1696| 2.87k|#define w 286 ------------------ | Branch (2007:15): [True: 2.86k, False: 10] ------------------ 2008| 4.76k| for (i = w; i < p; ++i) r[i] = ev[i] & ~mask; ------------------ | | 1696| 10|#define w 286 ------------------ for (i = w; i < p; ++i) r[i] = ev[i] & ~mask; ------------------ | | 1694| 4.76k|#define p 761 ------------------ | Branch (2008:15): [True: 4.75k, False: 10] ------------------ 2009| 10|} sntrup761.c:Rq_mult3: 1887| 10|static void Rq_mult3(Fq *h, const Fq *f) { 1888| 10| int i; 1889| 7.62k| for (i = 0; i < p; ++i) h[i] = Fq_freeze(3 * f[i]); ------------------ | | 1694| 7.62k|#define p 761 ------------------ | Branch (1889:15): [True: 7.61k, False: 10] ------------------ 1890| 10|} sntrup761.c:R3_fromRq: 1824| 10|static void R3_fromRq(small *out, const Fq *r) { 1825| 10| int i; 1826| 7.62k| for (i = 0; i < p; ++i) out[i] = F3_freeze(r[i]); ------------------ | | 1694| 7.62k|#define p 761 ------------------ | Branch (1826:15): [True: 7.61k, False: 10] ------------------ 1827| 10|} sntrup761.c:R3_mult: 1829| 10|static void R3_mult(small *h, const small *f, const small *g) { 1830| 10| int16_t fg[p + p - 1]; 1831| 10| int i, j; 1832| 15.2k| for (i = 0; i < p + p - 1; ++i) fg[i] = 0; ------------------ | | 1694| 15.2k|#define p 761 ------------------ for (i = 0; i < p + p - 1; ++i) fg[i] = 0; ------------------ | | 1694| 15.2k|#define p 761 ------------------ | Branch (1832:15): [True: 15.2k, False: 10] ------------------ 1833| 7.62k| for (i = 0; i < p; ++i) ------------------ | | 1694| 7.62k|#define p 761 ------------------ | Branch (1833:15): [True: 7.61k, False: 10] ------------------ 1834| 5.79M| for (j = 0; j < p; ++j) fg[i + j] += f[i] * (int16_t)g[j]; ------------------ | | 1694| 5.79M|#define p 761 ------------------ | Branch (1834:17): [True: 5.79M, False: 7.61k] ------------------ 1835| 7.61k| for (i = p; i < p + p - 1; ++i) fg[i - p] += fg[i]; ------------------ | | 1694| 10|#define p 761 ------------------ for (i = p; i < p + p - 1; ++i) fg[i - p] += fg[i]; ------------------ | | 1694| 7.61k|#define p 761 ------------------ for (i = p; i < p + p - 1; ++i) fg[i - p] += fg[i]; ------------------ | | 1694| 7.61k|#define p 761 ------------------ for (i = p; i < p + p - 1; ++i) fg[i - p] += fg[i]; ------------------ | | 1694| 7.60k|#define p 761 ------------------ | Branch (1835:15): [True: 7.60k, False: 10] ------------------ 1836| 7.61k| for (i = p; i < p + p - 1; ++i) fg[i - p + 1] += fg[i]; ------------------ | | 1694| 10|#define p 761 ------------------ for (i = p; i < p + p - 1; ++i) fg[i - p + 1] += fg[i]; ------------------ | | 1694| 7.61k|#define p 761 ------------------ for (i = p; i < p + p - 1; ++i) fg[i - p + 1] += fg[i]; ------------------ | | 1694| 7.61k|#define p 761 ------------------ for (i = p; i < p + p - 1; ++i) fg[i - p + 1] += fg[i]; ------------------ | | 1694| 7.60k|#define p 761 ------------------ | Branch (1836:15): [True: 7.60k, False: 10] ------------------ 1837| 7.62k| for (i = 0; i < p; ++i) h[i] = F3_freeze(fg[i]); ------------------ | | 1694| 7.62k|#define p 761 ------------------ | Branch (1837:15): [True: 7.61k, False: 10] ------------------ 1838| 10|} sntrup761.c:Weightw_mask: 1717| 10|static int Weightw_mask(small *r) { 1718| 10| int i, weight = 0; 1719| 7.62k| for (i = 0; i < p; ++i) weight += crypto_int64_bottombit_01(r[i]); ------------------ | | 1694| 7.62k|#define p 761 ------------------ | Branch (1719:15): [True: 7.61k, False: 10] ------------------ 1720| 10| return crypto_int16_nonzero_mask(weight - w); ------------------ | | 1696| 10|#define w 286 ------------------ 1721| 10|} sntrup761.c:crypto_int64_bottombit_01: 1193| 7.62k|crypto_int64 crypto_int64_bottombit_01(crypto_int64 crypto_int64_x) { 1194| 7.62k|#if defined(__GNUC__) && defined(__x86_64__) 1195| 7.62k| __asm__ ("andq $1,%0" : "+r"(crypto_int64_x) : : "cc"); 1196| 7.62k| return crypto_int64_x; 1197| |#elif defined(__GNUC__) && defined(__aarch64__) 1198| | crypto_int64 crypto_int64_y; 1199| | __asm__ ("ubfx %0,%1,0,1" : "=r"(crypto_int64_y) : "r"(crypto_int64_x) : ); 1200| | return crypto_int64_y; 1201| |#else 1202| | crypto_int64_x &= 1 ^ crypto_int64_optblocker; 1203| | return crypto_int64_x; 1204| |#endif 1205| 7.62k|} sntrup761.c:Ciphertexts_diff_mask: 2129| 10|static int Ciphertexts_diff_mask(const unsigned char *c, const unsigned char *c2) { 2130| 10| uint16_t differentbits = 0; 2131| 10| int len = crypto_kem_sntrup761_CIPHERTEXTBYTES; ------------------ | | 6| 10|#define crypto_kem_sntrup761_CIPHERTEXTBYTES 1039 ------------------ 2132| 10.4k| while (len-- > 0) differentbits |= (*c++) ^ (*c2++); ------------------ | Branch (2132:10): [True: 10.3k, False: 10] ------------------ 2133| 10| return (crypto_int64_bitmod_01((differentbits - 1),8)) - 1; 2134| 10|} sntrup761.c:crypto_int64_bitmod_01: 1272| 10|crypto_int64 crypto_int64_bitmod_01(crypto_int64 crypto_int64_x,crypto_int64 crypto_int64_s) { 1273| 10| crypto_int64_x = crypto_int64_shrmod(crypto_int64_x,crypto_int64_s); 1274| 10| return crypto_int64_bottombit_01(crypto_int64_x); 1275| 10|} sntrup761.c:crypto_int64_shrmod: 1250| 10|crypto_int64 crypto_int64_shrmod(crypto_int64 crypto_int64_x,crypto_int64 crypto_int64_s) { 1251| 10|#if defined(__GNUC__) && defined(__x86_64__) 1252| 10| __asm__ ("sarq %%cl,%0" : "+r"(crypto_int64_x) : "c"(crypto_int64_s) : "cc"); 1253| |#elif defined(__GNUC__) && defined(__aarch64__) 1254| | __asm__ ("asr %0,%0,%1" : "+r"(crypto_int64_x) : "r"(crypto_int64_s) : ); 1255| |#else 1256| | int crypto_int64_k, crypto_int64_l; 1257| | for (crypto_int64_l = 0,crypto_int64_k = 1;crypto_int64_k < 64;++crypto_int64_l,crypto_int64_k *= 2) 1258| | crypto_int64_x ^= (crypto_int64_x ^ (crypto_int64_x >> crypto_int64_k)) & crypto_int64_bitinrangepublicpos_mask(crypto_int64_s,crypto_int64_l); 1259| |#endif 1260| 10| return crypto_int64_x; 1261| 10|} min: 18| 1.87k|size_t min(size_t a, size_t b) { 19| 1.87k| return a < b ? a : b; ------------------ | Branch (19:9): [True: 1.84k, False: 32] ------------------ 20| 1.87k|} fuzz_rand: 36| 8.44k|void fuzz_rand(uint8_t *random_array, size_t bytes_to_read) { 37| 4.37M| for (size_t i = 0; i < bytes_to_read; i++) { ------------------ | Branch (37:21): [True: 4.36M, False: 8.44k] ------------------ 38| 4.36M| random_array[i] = (uint8_t)rand(); 39| 4.36M| } 40| 8.44k|} init_fuzz_context: 42| 1.87k|fuzz_ctx_t init_fuzz_context(const uint8_t *data, size_t data_len) { 43| | 44| 1.87k| fuzz_ctx_t ctx = {{0, 0}, NULL, 0}; 45| 1.87k| if (data_len > sizeof(fuzz_init_ctx_t)) { ------------------ | Branch (45:6): [True: 1.87k, False: 5] ------------------ 46| 1.87k| memcpy(&ctx.init, data, sizeof(fuzz_init_ctx_t)); 47| 1.87k| ctx.data = data + sizeof(fuzz_init_ctx_t); 48| 1.87k| ctx.data_len = data_len - sizeof(fuzz_init_ctx_t); 49| | 50| 1.87k| ctx.init.algorithm_index %= OQS_KEM_algs_length; ------------------ | | 122| 1.87k|#define OQS_KEM_algs_length 41 ------------------ 51| 1.87k| } else { 52| 5| ctx.data = data; 53| 5| ctx.data_len = data_len; 54| 5| } 55| | 56| 1.87k| srand(ctx.init.random_seed); 57| 1.87k| OQS_randombytes_custom_algorithm(&fuzz_rand); 58| | 59| 1.87k| return ctx; 60| 1.87k|} cleanup_heap: 134| 1.87k| uint8_t *ciphertext, OQS_KEM *kem) { 135| 1.87k| if (kem != NULL) { ------------------ | Branch (135:6): [True: 1.87k, False: 0] ------------------ 136| 1.87k| OQS_MEM_secure_free(secret_key, kem->length_secret_key); 137| 1.87k| OQS_MEM_secure_free(shared_secret_e, kem->length_shared_secret); 138| 1.87k| OQS_MEM_secure_free(shared_secret_d, kem->length_shared_secret); 139| 1.87k| } 140| 1.87k| OQS_MEM_insecure_free(public_key); 141| 1.87k| OQS_MEM_insecure_free(ciphertext); 142| 1.87k| OQS_KEM_free(kem); 143| 1.87k|} LLVMFuzzerTestOneInput: 145| 1.87k|int LLVMFuzzerTestOneInput(const char *data, size_t size) { 146| 1.87k| OQS_init(); 147| 1.87k| if (OQS_ERROR == fuzz_kem((const uint8_t *)data, size)) { ------------------ | Branch (147:6): [True: 0, False: 1.87k] ------------------ 148| | // If we get an error prune testcase from corpus. 149| 0| return -1; 150| 0| } 151| 1.87k| OQS_destroy(); 152| 1.87k| return 0; 153| 1.87k|} fuzz_test_kem.c:fuzz_kem: 68| 1.87k|static OQS_STATUS fuzz_kem(const uint8_t *data, size_t data_len) { 69| 1.87k| OQS_KEM *kem = NULL; 70| 1.87k| uint8_t *public_key = NULL; 71| 1.87k| uint8_t *secret_key = NULL; 72| 1.87k| uint8_t *ciphertext = NULL; 73| 1.87k| uint8_t *shared_secret_e = NULL; 74| 1.87k| uint8_t *shared_secret_d = NULL; 75| | 76| 1.87k| fuzz_ctx_t ctx = init_fuzz_context(data, data_len); 77| 1.87k| const char *algorithm = OQS_KEM_alg_identifier(ctx.init.algorithm_index); 78| 1.87k| kem = OQS_KEM_new(algorithm); 79| 1.87k| if (kem == NULL) { ------------------ | Branch (79:6): [True: 0, False: 1.87k] ------------------ 80| 0| printf("%s was not enabled at compile-time.\n", algorithm); 81| 0| return OQS_ERROR; 82| 0| } 83| | 84| 1.87k| public_key = OQS_MEM_malloc(kem->length_public_key); 85| 1.87k| secret_key = OQS_MEM_malloc(kem->length_secret_key); 86| 1.87k| ciphertext = OQS_MEM_malloc(kem->length_ciphertext); 87| 1.87k| shared_secret_e = OQS_MEM_malloc(kem->length_shared_secret); 88| 1.87k| shared_secret_d = OQS_MEM_malloc(kem->length_shared_secret); 89| | 90| 1.87k| if ((public_key == NULL) || (secret_key == NULL) || (ciphertext == NULL) || ------------------ | Branch (90:6): [True: 0, False: 1.87k] | Branch (90:30): [True: 0, False: 1.87k] | Branch (90:54): [True: 0, False: 1.87k] ------------------ 91| 1.87k| (shared_secret_e == NULL) || (shared_secret_d == NULL)) { ------------------ | Branch (91:10): [True: 0, False: 1.87k] | Branch (91:39): [True: 0, False: 1.87k] ------------------ 92| 0| fprintf(stderr, "ERROR: OQS_MEM_malloc failed!\n"); 93| 0| cleanup_heap(secret_key, shared_secret_e, shared_secret_d, public_key, 94| 0| ciphertext, kem); 95| | 96| 0| return OQS_ERROR; 97| 0| } 98| | 99| 1.87k| memcpy(shared_secret_e, ctx.data, min(ctx.data_len, kem->length_shared_secret)); 100| 1.87k| OQS_STATUS rc = OQS_KEM_keypair(kem, public_key, secret_key); 101| 1.87k| if (rc != OQS_SUCCESS) { ------------------ | Branch (101:6): [True: 0, False: 1.87k] ------------------ 102| 0| fprintf(stderr, "ERROR: OQS_KEM_keypair failed!\n"); 103| 0| cleanup_heap(secret_key, shared_secret_e, shared_secret_d, public_key, 104| 0| ciphertext, kem); 105| | 106| 0| return rc; 107| 0| } 108| 1.87k| rc = OQS_KEM_encaps(kem, ciphertext, shared_secret_e, public_key); 109| 1.87k| if (rc != OQS_SUCCESS) { ------------------ | Branch (109:6): [True: 0, False: 1.87k] ------------------ 110| 0| fprintf(stderr, "ERROR: OQS_KEM_encaps failed!\n"); 111| 0| cleanup_heap(secret_key, shared_secret_e, shared_secret_d, public_key, 112| 0| ciphertext, kem); 113| | 114| 0| return rc; 115| 0| } 116| 1.87k| rc = OQS_KEM_decaps(kem, shared_secret_d, ciphertext, secret_key); 117| 1.87k| if (rc != OQS_SUCCESS) { ------------------ | Branch (117:6): [True: 0, False: 1.87k] ------------------ 118| 0| fprintf(stderr, "ERROR: OQS_KEM_decaps failed! with algorithm index %u\n", ctx.init.algorithm_index); 119| 0| cleanup_heap(secret_key, shared_secret_e, shared_secret_d, public_key, 120| 0| ciphertext, kem); 121| | 122| 0| return rc; 123| 0| } 124| 1.87k| assert(memcmp(shared_secret_d, shared_secret_e, kem->length_shared_secret) == 0); 125| | 126| 1.87k| cleanup_heap(secret_key, shared_secret_e, shared_secret_d, public_key, 127| 1.87k| ciphertext, kem); 128| | 129| 1.87k| return OQS_SUCCESS; // success 130| 1.87k|}